メニュー
Load when you need to determine which forensic tool to use for a specific Windows artifact type. Maps artifact categories to exact MCP tools and Bash commands using the Practical Windows Forensics taxonomy.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/kismatkunwar89/SAVVYDFIR-MCP --skill artifact-routingコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
REQUIRED when the user says "start investigation", "investigate", "analyze case", "Read case-templates/manifest.json", references a manifest.json, or provides a SAVVYDFIR-MCP case_id. Defines the 5-phase DFIR methodology from evidence mounting through report generation, with mandatory tools, decision points, and quality gates that the report coverage gate enforces.
Load when you have an initial finding and need to determine what to investigate next. Defines universal pivot chains from each artifact type to related evidence, enabling systematic investigation expansion.
Load when running sigma_scan(), interpreting anomaly results, or mapping findings to MITRE ATT&CK techniques. Covers all 5 universal detectors, severity levels, and pivot patterns from each detection type.
SOC 職業分類に基づく
SKILL.md を表示中
| name | artifact-routing |
| description | Load when you need to determine which forensic tool to use for a specific Windows artifact type. Maps artifact categories to exact MCP tools and Bash commands using the Practical Windows Forensics taxonomy. |
| allowed-tools | ["Bash"] |
| Artifact | MCP Tool | What It Proves |
|---|---|---|
| Prefetch (.pf) | extract_prefetch() | Binary executed, first/last 8 run times |
| Amcache.hve | get_amcache() | Binary existed + SHA-1 hash (survives deletion) |
| ShimCache | run_analysis() on AppCompatCache CSV | Binary existed on disk (not necessarily executed) |
| BAM/DAM | run_analysis() on registry export | Binary executed by specific user (Win10+) |
| UserAssist | run_analysis() on registry export | GUI program execution with count + timestamp |
| Artifact | MCP Tool | What It Proves |
|---|---|---|
| $MFT | extract_mft_timeline() | All files that ever existed, SI vs FN timestamps |
| Deleted files | list_deleted_files() | Files removed during/after attack |
| $UsnJrnl | run_analysis() on MFTECmd $J output | File creation/deletion/rename journal |
| $LogFile | N/A (manual parsing) | NTFS transaction log |
| Artifact | MCP Tool | What It Proves |
|---|---|---|
| Run/RunOnce | extract_registry_run_keys() | Auto-start binaries |
| Services | summarize_evtx(channel="System") → Event 7045 | New service installation |
| Scheduled Tasks | summarize_evtx(channel="Security") → Event 4698 | Scheduled task creation |
| WMI | Manual: strings on OBJECTS.DATA | WMI event subscriptions |
| Startup Folder | list_deleted_files() + extract_mft_timeline() | LNK files in Startup |
| Artifact | MCP Tool | What It Proves |
|---|---|---|
| Active connections | scan_network() | C2 beacons, lateral movement, data exfil |
| DNS cache | run_analysis() on DNS cache export | Resolved domains |
| Browser history | run_analysis() on SQLite export | URLs visited |
| SRUM | run_analysis() on SRUM CSV | Network usage per application |
| Artifact | MCP Tool | What It Proves |
|---|---|---|
| Process list | list_processes() | Running processes from PEB linked list |
| Hidden processes | scan_processes() | DKOM-hidden processes via pool tag scan |
| Code injection | detect_injection() | PAGE_EXECUTE_READWRITE VAD regions |
| DLL list | list_dlls() | Loaded DLLs per process |
| Credentials | Manual: vol3 windows.hashdump | SAM hashes, LSA secrets |
| Artifact | MCP Tool | What It Proves |
|---|---|---|
| Event 4624 Type 3 | summarize_evtx(channel="Security") | Network logon from remote host |
| Event 4648 | summarize_evtx(channel="Security") | Explicit credential logon |
| Event 5140/5145 | summarize_evtx(channel="Security") | Network share access |
| PSExec | extract_prefetch() + Event 7045 | Remote execution via PsExec |
| WMI | Event 4688 with wmiprvse.exe parent | Remote WMI execution |
| Check | MCP Tool | What It Detects |
|---|---|---|
| All 10 checks (6 core + 4 extended) | compare_disk_and_memory() | Fileless, cleanup, injection, C2, persistence, timestomping + USN-journal validation, ShimCache-vs-Amcache clearing, EID 1102 log clearing, SRUM exfiltration |
| Universal anomalies | sigma_scan() | Process masquerade, orphans, suspicious persistence, high-value events |