菜单
Load when you need to determine which forensic tool to use for a specific Windows artifact type. Maps artifact categories to exact MCP tools and Bash commands using the Practical Windows Forensics taxonomy.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/kismatkunwar89/SAVVYDFIR-MCP --skill artifact-routing命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
REQUIRED when the user says "start investigation", "investigate", "analyze case", "Read case-templates/manifest.json", references a manifest.json, or provides a SAVVYDFIR-MCP case_id. Defines the 5-phase DFIR methodology from evidence mounting through report generation, with mandatory tools, decision points, and quality gates that the report coverage gate enforces.
Load when you have an initial finding and need to determine what to investigate next. Defines universal pivot chains from each artifact type to related evidence, enabling systematic investigation expansion.
Load when running sigma_scan(), interpreting anomaly results, or mapping findings to MITRE ATT&CK techniques. Covers all 5 universal detectors, severity levels, and pivot patterns from each detection type.
基于 SOC 职业分类
正在显示 SKILL.md
| name | artifact-routing |
| description | Load when you need to determine which forensic tool to use for a specific Windows artifact type. Maps artifact categories to exact MCP tools and Bash commands using the Practical Windows Forensics taxonomy. |
| allowed-tools | ["Bash"] |
| Artifact | MCP Tool | What It Proves |
|---|---|---|
| Prefetch (.pf) | extract_prefetch() | Binary executed, first/last 8 run times |
| Amcache.hve | get_amcache() | Binary existed + SHA-1 hash (survives deletion) |
| ShimCache | run_analysis() on AppCompatCache CSV | Binary existed on disk (not necessarily executed) |
| BAM/DAM | run_analysis() on registry export | Binary executed by specific user (Win10+) |
| UserAssist | run_analysis() on registry export | GUI program execution with count + timestamp |
| Artifact | MCP Tool | What It Proves |
|---|---|---|
| $MFT | extract_mft_timeline() | All files that ever existed, SI vs FN timestamps |
| Deleted files | list_deleted_files() | Files removed during/after attack |
| $UsnJrnl | run_analysis() on MFTECmd $J output | File creation/deletion/rename journal |
| $LogFile | N/A (manual parsing) | NTFS transaction log |
| Artifact | MCP Tool | What It Proves |
|---|---|---|
| Run/RunOnce | extract_registry_run_keys() | Auto-start binaries |
| Services | summarize_evtx(channel="System") → Event 7045 | New service installation |
| Scheduled Tasks | summarize_evtx(channel="Security") → Event 4698 | Scheduled task creation |
| WMI | Manual: strings on OBJECTS.DATA | WMI event subscriptions |
| Startup Folder | list_deleted_files() + extract_mft_timeline() | LNK files in Startup |
| Artifact | MCP Tool | What It Proves |
|---|---|---|
| Active connections | scan_network() | C2 beacons, lateral movement, data exfil |
| DNS cache | run_analysis() on DNS cache export | Resolved domains |
| Browser history | run_analysis() on SQLite export | URLs visited |
| SRUM | run_analysis() on SRUM CSV | Network usage per application |
| Artifact | MCP Tool | What It Proves |
|---|---|---|
| Process list | list_processes() | Running processes from PEB linked list |
| Hidden processes | scan_processes() | DKOM-hidden processes via pool tag scan |
| Code injection | detect_injection() | PAGE_EXECUTE_READWRITE VAD regions |
| DLL list | list_dlls() | Loaded DLLs per process |
| Credentials | Manual: vol3 windows.hashdump | SAM hashes, LSA secrets |
| Artifact | MCP Tool | What It Proves |
|---|---|---|
| Event 4624 Type 3 | summarize_evtx(channel="Security") | Network logon from remote host |
| Event 4648 | summarize_evtx(channel="Security") | Explicit credential logon |
| Event 5140/5145 | summarize_evtx(channel="Security") | Network share access |
| PSExec | extract_prefetch() + Event 7045 | Remote execution via PsExec |
| WMI | Event 4688 with wmiprvse.exe parent | Remote WMI execution |
| Check | MCP Tool | What It Detects |
|---|---|---|
| All 10 checks (6 core + 4 extended) | compare_disk_and_memory() | Fileless, cleanup, injection, C2, persistence, timestomping + USN-journal validation, ShimCache-vs-Amcache clearing, EID 1102 log clearing, SRUM exfiltration |
| Universal anomalies | sigma_scan() | Process masquerade, orphans, suspicious persistence, high-value events |