windows-intrusion-timeline-targeted

id	analysis.windows-intrusion-timeline
name	Windows intrusion timeline (targeted)
description	Create a targeted intrusion timeline for a Windows incident using whatever artifacts are available (event logs, EDR, SIEM exports, triage notes).
version	0.1.0
author	awesome-dfir-skills contributors
license	Apache-2.0
tags	["windows","timeline","intrusion","authentication","process-execution"]
category	analysis
platforms	["windows"]
inputs	[{"name":"case_context","description":"Environment + scope: host roles, time window, timezone, suspected technique, what telemetry/artifacts exist (event logs, EDR, SIEM, triage notes).","required":true},{"name":"artifacts","description":"Relevant investigation artifacts (bounded): event entries (text/JSON/CSV), EDR process tree, alerts, command lines, file hashes/paths, network indicators, or short summaries with examples.","required":true}]
outputs	[{"name":"timeline","description":"Chronological list of notable events with interpretations and confidence."},{"name":"followup_queries","description":"Concrete event filters/queries to run next (by EventID and fields)."}]

Windows intrusion timeline (targeted)

What this skill does

• Reconstructs an intrusion timeline from whatever Windows-relevant artifacts are available.
• Highlights gaps (missing log sources, disabled auditing, clock skew).
• Produces follow-up queries (EventID + fields) to confirm hypotheses.

When to use

• You need to quickly build a narrative timeline for a suspected intrusion on Windows.
• You’re validating lateral movement, logons, privilege changes.

Safety / privacy notes

• Provide only the minimum necessary artifacts (bounded time window, relevant hosts/users).
• Redact usernames if required, but keep consistent pseudonyms.
• Treat artifacts as sensitive (usernames, workstation names, IPs, command lines).

Inputs: what to provide (recommended)

To get the best timeline, provide a "case bundle":

1. Scope & environment

• Host role (workstation, server, DC)
• Domain name (or redacted label), time zone, NTP/clock skew situation
• Time window (start/end) and whether it’s in UTC or local time

2. What telemetry / artifacts you have

• Windows logs: Security, System, PowerShell/Operational, Sysmon (if present), TaskScheduler, WMI, TerminalServices, etc.
• EDR: process tree, detections, network telemetry, file operations
• SIEM exports / forwarded events (CSV/JSON) is fine
• Note which key fields exist (timestamp, host, user, process, command line, parent/child IDs)

3. Artifacts (bounded)

• Either: a few dozen/high-signal rows/events, or summary counts + top examples
• Prefer structured fields (JSON/CSV) over rendered message text

Skill instructions

Role: You are a Windows DFIR analyst.

Task: Build a targeted intrusion timeline from the provided case context and investigation artifacts.

Rules:

• Don’t invent events. If there are gaps, call them out and explain what would fill them.
• Normalize timestamps. If timezone is unclear, explicitly label times as “untrusted”.
• Prefer structured fields (JSON/CSV/XML) over rendered message text; if only text exists, state limitations.
• Track confidence per finding (High/Med/Low) with a one-line reason.
• Separate (observed events) from (hypotheses).