| name | forensic-triage |
| description | Perform forensic triage on a host or artifacts — collect and analyze disk, memory, and log evidence with proper handling, then build an incident timeline. Use to investigate a compromised system or scope an incident. Preserve evidence integrity. |
Goal
A defensible analysis of the available evidence that answers what happened, when, and
how far it spread — with a timeline and chain of custody intact.
Evidence sources & artifacts
- Memory — running/hidden processes, network connections, injected code,
credentials, command lines (capture early — most volatile).
- Disk — filesystem timeline, prefetch/shimcache/amcache (Windows), bash history/
systemd/cron (Linux), browser/registry artifacts, deleted-file recovery.
- Persistence — services, scheduled tasks, run keys, startup, WMI, webshells.
- Logs — auth/security, EDR, process creation, PowerShell, web/proxy, DNS,
firewall/netflow; central SIEM.
- Network — connections, beaconing patterns, DNS, captured traffic.
Steps
- Preserve first — respect order of volatility (see
incident-response
reference); work on copies; hash and log every item (chain of custody).
- Triage — quick wins: suspicious processes, persistence, recent logons, new
accounts, anomalous network. Identify the foothold.
- Build a timeline — normalize timestamps (UTC), correlate across sources into a
single chronology of attacker actions.
- Scope — pivot on IOCs/accounts/hosts to find lateral movement and the full
set of affected systems; estimate dwell time.
- Map to ATT&CK — tag observed techniques for clarity and detection follow-up.
Output
A triage report: evidence collected (with hashes) · key artifacts · timeline · scope/
dwell time · ATT&CK techniques · IOCs (hand to ioc-development). Use
security-reporting; visualize the timeline/attack path with security-diagramming.
Notes
Preserve before you analyze — and capture memory early, it's gone on reboot. A
correct, source-correlated timeline in UTC is the backbone of the investigation.
Maintain chain of custody if the findings might be used in legal/HR proceedings.
