メニュー
Investigate a ransomware incident — triage, artifact analysis, attack chain reconstruction, malware analysis, network forensics, and reporting.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Run a full 11-phase forensic investigation across all MCP servers — disk, memory, Windows artifacts, malware, network, OSINT, threat intel, timeline, and reporting.
Run a 6-phase forensic investigation — evidence intake, artifact collection, network analysis, threat intel, timeline reconstruction, and reporting.
Run a 7-phase incident response — triage, containment assessment, evidence collection, attack chain reconstruction, threat intel, impact assessment, and reporting.
Analyze a malware sample — static analysis with Ghidra/Radare2/Capa, YARA scanning, string extraction, and VirusTotal/MalwareBazaar lookup.
Analyze a memory dump — process analysis, network connections, persistence mechanisms, malware detection with Volatility3, and reporting.
Analyze network traffic — PCAP triage, protocol analysis, anomaly detection, IoC extraction, stream reconstruction, and reporting.
| name | ransomware-investigation |
| description | Investigate a ransomware incident — triage, artifact analysis, attack chain reconstruction, malware analysis, network forensics, and reporting. |
Investigate the ransomware incident affecting the specified target.
Usage: /ransomware-investigation <target>
Where <target> is the evidence path or affected system — e.g. /evidence/encrypted-host/, /evidence/ransom-note.txt.
If no target is provided, ask the user for the evidence location.
get_template(name="ransomware-investigation", target="$ARGUMENTS")