メニュー
Load when you need exact command syntax for SIFT Workstation tools. Covers Volatility 3, Sleuth Kit, EZ Tools, Plaso, YARA, and Regripper with actual invocation examples and output parsing guidance.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/kismatkunwar89/SAVVYDFIR-MCP --skill tools-referenceコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Load when you need to determine which forensic tool to use for a specific Windows artifact type. Maps artifact categories to exact MCP tools and Bash commands using the Practical Windows Forensics taxonomy.
REQUIRED when the user says "start investigation", "investigate", "analyze case", "Read case-templates/manifest.json", references a manifest.json, or provides a SAVVYDFIR-MCP case_id. Defines the 5-phase DFIR methodology from evidence mounting through report generation, with mandatory tools, decision points, and quality gates that the report coverage gate enforces.
Load when you have an initial finding and need to determine what to investigate next. Defines universal pivot chains from each artifact type to related evidence, enabling systematic investigation expansion.
SOC 職業分類に基づく
SKILL.md を表示中
| name | tools-reference |
| description | Load when you need exact command syntax for SIFT Workstation tools. Covers Volatility 3, Sleuth Kit, EZ Tools, Plaso, YARA, and Regripper with actual invocation examples and output parsing guidance. |
| allowed-tools | ["Bash"] |
MEM=/evidence/memory/extracted/dump.raw
# Process analysis
vol3 -f $MEM windows.pslist # Running processes (EPROCESS list walk)
vol3 -f $MEM windows.psscan # All processes (pool tag scan - finds hidden)
vol3 -f $MEM windows.pstree # Process tree with parent-child
vol3 -f $MEM windows.cmdline # Command lines per process
# Network
vol3 -f $MEM windows.netscan # Active + recently closed connections
vol3 -f $MEM windows.netstat # Current connections
# Injection detection
vol3 -f $MEM windows.malfind # All suspicious VAD regions
vol3 -f $MEM windows.malfind --pid PID # Specific process
vol3 -f $MEM windows.vadinfo --pid PID # Full VAD details
# DLLs and handles
vol3 -f $MEM windows.dlllist --pid PID # Loaded DLLs
vol3 -f $MEM windows.handles --pid PID # Open handles
# Credentials
vol3 -f $MEM windows.hashdump # SAM database hashes
vol3 -f $MEM windows.lsadump # LSA secrets
# YARA in memory
vol3 -f $MEM yarascan.YaraScan --yara-file /path/to/rules.yar
vol3 -f $MEM yarascan.YaraScan --yara-file /path/to/rules.yar --pid PID
# Mount E01
mkdir -p /mnt/evidence /mnt/disk
ewfmount /evidence/disk/image.E01 /mnt/evidence/
mmls /mnt/evidence/ewf1 # Get partition offsets
OFFSET=2048 # Replace with actual NTFS offset
mount -o ro,loop,offset=$((OFFSET*512)) /mnt/evidence/ewf1 /mnt/disk/
# List files
fls -r -p /mnt/evidence/ewf1 -o $OFFSET | head -100 # All files
fls -r -p -d /mnt/evidence/ewf1 -o $OFFSET # Deleted only
# Extract by inode
icat -o $OFFSET /mnt/evidence/ewf1 INODE > /cases/extracted_file
# Filesystem stats
fsstat -o $OFFSET /mnt/evidence/ewf1
# Extract $MFT (always inode 0)
icat -o $OFFSET /mnt/evidence/ewf1 0 > /cases/mft/\$MFT
# MFT parsing
MFTECmd -f /cases/mft/\$MFT --csv /cases/mft/ --csvf mft_output.csv
# Event log parsing
EvtxECmd -f /mnt/disk/Windows/System32/winevt/Logs/Security.evtx --csv /cases/evtx/ --csvf security.csv
EvtxECmd -d /mnt/disk/Windows/System32/winevt/Logs/ --csv /cases/evtx/ --csvf all_logs.csv
# Prefetch
PECmd -d /mnt/disk/Windows/Prefetch/ --csv /cases/prefetch/ --csvf prefetch.csv
# Application Compatibility Cache
AppCompatCacheParser -f /mnt/disk/Windows/System32/config/SYSTEM --csv /cases/shimcache/ --csvf shimcache.csv
# LNK files
LECmd -d /mnt/disk/Users/ --csv /cases/lnk/ --csvf lnk.csv -q
# Jump Lists
JLECmd -d /mnt/disk/Users/ --csv /cases/jumplists/ --csvf jumplists.csv -q
# ShellBags
SBECmd -d /mnt/disk/Users/ --csv /cases/shellbags/ --csvf shellbags.csv
# Create super timeline (slow - 30-120 min for 100GB image)
log2timeline.py --parsers win10 /cases/timeline/case.plaso /mnt/disk/
# Query timeline
psort.py -o dynamic /cases/timeline/case.plaso "date > \'2026-01-01\' AND date < \'2026-02-01\'" > /cases/timeline/filtered.csv
psort.py -o l2tcsv /cases/timeline/case.plaso > /cases/timeline/full.csv
# Scan directory
yara -r /path/to/rules.yar /mnt/disk/Windows/Temp/
# Scan specific file
yara /path/to/rules.yar /cases/extracted/suspicious.exe
# Scan memory dump
yara /path/to/rules.yar /evidence/memory/extracted/dump.raw
regripper -r /mnt/disk/Windows/System32/config/SAM -p samparse
regripper -r /mnt/disk/Windows/System32/config/SYSTEM -p services
regripper -r /mnt/disk/Users/*/NTUSER.DAT -p userassist
/mnt/disk/Windows/System32/config/ # Registry hives
/mnt/disk/Windows/Prefetch/ # Prefetch files
/mnt/disk/Windows/System32/winevt/Logs/ # Event logs
/mnt/disk/$MFT # Master File Table
/mnt/disk/Users/*/NTUSER.DAT # User registry
/mnt/disk/Users/*/AppData/ # User artifacts