dfireballz

Run a full 11-phase forensic investigation across all MCP servers — disk, memory, Windows artifacts, malware, network, OSINT, threat intel, timeline, and reporting.

Run a 6-phase forensic investigation — evidence intake, artifact collection, network analysis, threat intel, timeline reconstruction, and reporting.

Run a 7-phase incident response — triage, containment assessment, evidence collection, attack chain reconstruction, threat intel, impact assessment, and reporting.

Analyze a malware sample — static analysis with Ghidra/Radare2/Capa, YARA scanning, string extraction, and VirusTotal/MalwareBazaar lookup.

Analyze a memory dump — process analysis, network connections, persistence mechanisms, malware detection with Volatility3, and reporting.

Analyze network traffic — PCAP triage, protocol analysis, anomaly detection, IoC extraction, stream reconstruction, and reporting.

Investigate a domain — DNS/subdomain enumeration, infrastructure analysis, threat assessment, web presence mapping, and reporting.

Investigate a person via OSINT — username/email enumeration with Maigret/Sherlock/Holehe, infrastructure analysis, threat intel correlation, and digital footprint mapping.

Investigate a phishing campaign — email header analysis, URL/domain investigation, attachment analysis, credential harvesting checks, and threat intel.

Investigate a ransomware incident — triage, artifact analysis, attack chain reconstruction, malware analysis, network forensics, and reporting.