원클릭으로 Manus에서 모든 스킬 실행

competition-forensic-timeline

스타8,362

포크1,314

업데이트2026년 5월 24일 11:23

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DFIR chronology, cross-artifact correlation, persistence chains, and incident timeline reconstruction. Use when the user asks to build a forensic timeline, correlate EVTX, PCAP, registry, disk, memory, mailbox, or browser artifacts, explain the order of attacker actions, or pinpoint the stage where the decisive artifact appears. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

zhaoxuya520

zhaoxuya520/reverse-skill

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Competition Forensic Timeline

Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.

Use this skill when the hard part is not finding one artifact, but turning many artifacts into one replayable chronology.

Reply in Simplified Chinese unless the user explicitly requests English.

Quick Start

Pick the smallest reliable anchor: first execution, first logon, first network session, first file write, or first mailbox action.
Normalize timestamps, time zones, hostnames, users, process IDs, message IDs, and file paths before correlating.
Build one minimal chain from foothold to persistence, execution, access, or exfiltration.
Separate confirmed event order from inferred gaps.
Reproduce the decisive timeline segment that yields the artifact or privilege conclusion.

Workflow

1. Establish Timeline Anchors

Collect only the active surfaces: EVTX, Sysmon, registry, Amcache, prefetch, browser artifacts, mail traces, PCAPs, memory, or filesystem metadata.
Record clock source, timezone, and any drift or truncation that could reorder events.
Link shared identifiers across sources: PID, logon ID, GUID, message ID, hostname, username, IP, or hash.

2. Correlate The Execution Graph

Track process tree, service or task creation, network sessions, file writes, registry changes, mailbox rules, or token use as one path.
Distinguish causal edges from coincidence by matching identifiers and adjacency, not just nearby timestamps.
Keep raw artifact and parsed summary side by side so every step can be traced back.

3. Compress To The Decisive Story

Reduce the timeline to the smallest sequence that proves initial access, persistence, lateral movement, collection, or artifact recovery.
Call out missing validation steps separately instead of mixing them into confirmed chronology.
If the task becomes mainly about malware config extraction or a Windows pivot edge, switch to the tighter specialized skill.

Read This Reference

Load references/forensic-timeline.md for anchor selection, cross-source correlation, and evidence packaging.
If the hard part is packet reassembly, protocol framing, or transferred-object extraction from a capture, prefer $competition-pcap-protocol.

What To Preserve

Source file paths, event IDs, logon IDs, message IDs, PIDs, hashes, and timestamps with timezone noted
One compact timeline table or ordered list for the decisive segment
Raw artifacts, parsed output, and inferred edges kept separate

이 저장소의 다른 Skills

같은 저장소

pentest-tools

zhaoxuya520/reverse-skill

主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。

2026-07-108.4k

reverse-engineering

zhaoxuya520/reverse-skill

Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.

2026-07-058.4k

apk-reverse

zhaoxuya520/reverse-skill

在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。

2026-07-038.4k

binary-diff

zhaoxuya520/reverse-skill

跨版本符号迁移与二进制差分。当你有旧版本的符号/逆向结果，需要快速迁移到新版本时使用。适用场景：内核缺 PDB 用旧版符号推导、程序更新后批量迁移函数名、应用更新后快速定位新偏移。核心方法：用 LLM 做结构化差异比对，程序化输入输出，成本极低（200 函数 ~1 元）。触发关键词：符号迁移、bindiff、跨版本、PDB 缺失、函数偏移迁移、symbol migration、binary diff、版本对比。

2026-07-038.4k

diagram-generator

zhaoxuya520/reverse-skill

generate, refine, validate, and render diagrams from natural language, notes, code snippets, schemas, tables, or existing diagram source. use for flowcharts, swimlanes, sequence diagrams, state diagrams, er diagrams, class diagrams, architecture/c4-style diagrams, dependency graphs, gantt charts, mind maps, user journeys, sankey-style flows, org charts, network graphs, and other visual models. supports mermaid by default, graphviz dot for complex graph layout, plantuml for uml-heavy engineering diagrams, and svg output when direct markup is more reliable.

2026-07-038.4k

edr-bypass-re

zhaoxuya520/reverse-skill

逆向防御方实现 → 红队针对性绕过。把 EDR / Defender / AV 的 hook 表、ETW provider、AMSI 实现先逆向出来，再写针对性的 unhook / 间接 syscall / ETW patch / call stack spoof。对照 MITRE ATT&CK T1562 防御规避。触发关键词：EDR 绕过、AV bypass、免杀、unhook、direct syscall、indirect syscall、Hell's Gate、Halo's Gate、 Tartarus Gate、ETW patch、AMSI patch、call stack spoofing、hardware breakpoint Blindside、MITRE T1562、 ntdll unhook、kernel callback、CrowdStrike 绕过、Defender 绕过、Sentinel One 绕过、Elastic Defend、 Sysmon 规避、PPID spoof、Sleep mask、Process Hollowing、Reflective DLL。

2026-07-038.4k

name

competition-forensic-timeline

description

Competition Forensic Timeline

Use this skill when the hard part is not finding one artifact, but turning many artifacts into one replayable chronology.

Reply in Simplified Chinese unless the user explicitly requests English.

Quick Start

Pick the smallest reliable anchor: first execution, first logon, first network session, first file write, or first mailbox action.
Normalize timestamps, time zones, hostnames, users, process IDs, message IDs, and file paths before correlating.
Build one minimal chain from foothold to persistence, execution, access, or exfiltration.
Separate confirmed event order from inferred gaps.
Reproduce the decisive timeline segment that yields the artifact or privilege conclusion.

Workflow

1. Establish Timeline Anchors

Collect only the active surfaces: EVTX, Sysmon, registry, Amcache, prefetch, browser artifacts, mail traces, PCAPs, memory, or filesystem metadata.
Record clock source, timezone, and any drift or truncation that could reorder events.
Link shared identifiers across sources: PID, logon ID, GUID, message ID, hostname, username, IP, or hash.

2. Correlate The Execution Graph

Track process tree, service or task creation, network sessions, file writes, registry changes, mailbox rules, or token use as one path.
Distinguish causal edges from coincidence by matching identifiers and adjacency, not just nearby timestamps.
Keep raw artifact and parsed summary side by side so every step can be traced back.

3. Compress To The Decisive Story

Reduce the timeline to the smallest sequence that proves initial access, persistence, lateral movement, collection, or artifact recovery.
Call out missing validation steps separately instead of mixing them into confirmed chronology.
If the task becomes mainly about malware config extraction or a Windows pivot edge, switch to the tighter specialized skill.

Read This Reference

Load references/forensic-timeline.md for anchor selection, cross-source correlation, and evidence packaging.
If the hard part is packet reassembly, protocol framing, or transferred-object extraction from a capture, prefer $competition-pcap-protocol.

What To Preserve

Source file paths, event IDs, logon IDs, message IDs, PIDs, hashes, and timestamps with timezone noted
One compact timeline table or ordered list for the decisive segment
Raw artifacts, parsed output, and inferred edges kept separate