dfir-skills

SOC alert triage and investigation guidance. Paste an alert description and observables to get structured investigation steps, hypothesis generation, and recommended queries for your SIEM/EDR.

Generate a comprehensive DFIR incident report by consolidating findings from all analysis skills (memory, disk, network, log, malware, IOCs, timeline). Produces an executive and technical report.

Analyze disk images and filesystem artifacts using Sleuthkit (mmls, fls, icat), binwalk, strings, and bulk_extractor. Recover deleted files, build timelines, and examine partition structures.

Acquire and preserve digital evidence following forensic best practices. Disk imaging, memory capture, log collection, and chain of custody documentation. Inspired by SIFT workstation methodology.

Extract, deduplicate, and classify Indicators of Compromise (IOCs) from any evidence source — files, logs, memory dumps, PCAPs, reports, or pasted text. Outputs structured IOC lists in multiple formats.

Analyze system and security logs (auth.log, syslog, Windows EVTX, Apache/Nginx, JSON logs). Detect brute force, lateral movement, privilege escalation, and anomalous activity.

Perform static analysis and triage of suspicious files. Extract hashes, strings, metadata, PE headers, ELF info, embedded URLs, and indicators using strings, file, exiftool, readelf, objdump, radare2, and binwalk.

Analyze memory dumps using Volatility 3 and strings. Enumerate processes, network connections, injected code, and suspicious artifacts from RAM captures.

Analyze PCAP/PCAPNG network captures using tshark. Detect C2 beacons, data exfiltration, lateral movement, DNS tunneling, and suspicious traffic patterns.

Reverse engineer binaries using radare2 (r2), rabin2, objdump, readelf, and strings. Analyze PE/ELF executables, shellcode, scripts, and documents. Covers disassembly, control flow, imports, crypto detection, and anti-analysis techniques.

Build a unified forensic timeline from multiple evidence sources — filesystem MACBtimes, logs, memory artifacts, and network events. Produces a chronological attack narrative.

List all available DFIR/SOC skills and installed forensic tools with descriptions and use cases. Quick reference for the analyst.