메뉴
Investigate a phishing campaign — email header analysis, URL/domain investigation, attachment analysis, credential harvesting checks, and threat intel.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | phishing-investigation |
| description | Investigate a phishing campaign — email header analysis, URL/domain investigation, attachment analysis, credential harvesting checks, and threat intel. |
Investigate the phishing incident involving the specified target.
Usage: /phishing-investigation <target>
Where <target> is the phishing email, URL, or evidence path — e.g. /evidence/phish-email.eml, suspicious-login.example.com.
If no target is provided, ask the user for the phishing evidence.
get_template(name="phishing-investigation", target="$ARGUMENTS")Run a full 11-phase forensic investigation across all MCP servers — disk, memory, Windows artifacts, malware, network, OSINT, threat intel, timeline, and reporting.
Run a 6-phase forensic investigation — evidence intake, artifact collection, network analysis, threat intel, timeline reconstruction, and reporting.
Run a 7-phase incident response — triage, containment assessment, evidence collection, attack chain reconstruction, threat intel, impact assessment, and reporting.
Analyze a malware sample — static analysis with Ghidra/Radare2/Capa, YARA scanning, string extraction, and VirusTotal/MalwareBazaar lookup.
Analyze a memory dump — process analysis, network connections, persistence mechanisms, malware detection with Volatility3, and reporting.
Analyze network traffic — PCAP triage, protocol analysis, anomaly detection, IoC extraction, stream reconstruction, and reporting.