菜单
Build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across file systems, logs, and artifacts into a unified chronological view.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/xalgord/xalgorix --skill performing-timeline-reconstruction-with-plaso命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.
基于 SOC 职业分类
正在显示 SKILL.md
| name | performing-timeline-reconstruction-with-plaso |
| description | Build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across file systems, logs, and artifacts into a unified chronological view. |
| domain | cybersecurity |
| subdomain | digital-forensics |
| tags | ["forensics","timeline-analysis","plaso","log2timeline","super-timeline","event-correlation"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"] |
A super-timeline's greatest weakness is that it makes noise and forged timestamps look identical to ground truth. Guard against these:
log2timeline.py with the correct --timezone and confirm the image's TimeZoneInformation registry value. A wrong offset or a host whose clock was manually changed silently shifts events, fabricating false sequences. State the timezone basis in every report.$MFT/$UsnJrnl alone can dominate. Without a --filter-file or psort date-range/source filter you will drown. Pivot from known anchors (malware execution, login) and expand outward rather than reading top-to-bottom.$STANDARD_INFORMATION times that Plaso surfaces; the harder-to-forge $FILE_NAME ($FN) times come from a separate MFT parse. Compare $SI vs $FN to spot timestomping, and corroborate a file's "creation" against USN Journal, Prefetch/Amcache execution, and event logs before trusting it.--parsers list, anything outside it is invisible; deleted/rotated logs and VSS snapshots won't appear unless included. "No evidence in the timeline" must be qualified by which parsers and sources were actually processed.$MFT access times are unreliable on modern Windows, antivirus/indexing/backup touch files en masse, and Prefetch reflects execution by any caller. Confirm a pivotal event with at least two independent artifact types (e.g., Prefetch + 4688 + LNK) before placing it in the narrative.# Install Plaso on Ubuntu/Debian
sudo add-apt-repository ppa:gift/stable
sudo apt-get update
sudo apt-get install plaso-tools
# Or install via pip
pip install plaso
# Or use Docker (recommended for dependency isolation)
docker pull log2timeline/plaso
# Verify installation
log2timeline.py --version
psort.py --version
# Create output directory
mkdir -p /cases/case-2024-001/timeline/
# Verify the forensic image
img_stat /cases/case-2024-001/images/evidence.dd
# Basic processing of a disk image (all parsers)
log2timeline.py \
--storage-file /cases/case-2024-001/timeline/evidence.plaso \
/cases/case-2024-001/images/evidence.dd
# Process with specific parsers for faster targeted analysis
log2timeline.py \
--parsers "winevtx,prefetch,mft,usnjrnl,lnk,recycle_bin,chrome_history,firefox_history,winreg" \
--storage-file /cases/case-2024-001/timeline/evidence.plaso \
/cases/case-2024-001/images/evidence.dd
# Process with a filter file to focus on specific paths
cat << 'EOF' > /cases/case-2024-001/timeline/filter.txt
/Windows/System32/winevt/Logs
/Windows/Prefetch
/Users/*/NTUSER.DAT
/Users/*/AppData/Local/Google/Chrome
/Users/*/AppData/Roaming/Mozilla/Firefox
/$MFT
/$UsnJrnl:$J
/Windows/System32/config
EOF
log2timeline.py \
--filter-file /cases/case-2024-001/timeline/filter.txt \
--storage-file /cases/case-2024-001/timeline/evidence.plaso \
/cases/case-2024-001/images/evidence.dd
# Using Docker
docker run --rm -v /cases:/cases log2timeline/plaso log2timeline \
--storage-file /cases/case-2024-001/timeline/evidence.plaso \
/cases/case-2024-001/images/evidence.dd
# Process multiple evidence sources into one timeline
log2timeline.py \
--storage-file /cases/case-2024-001/timeline/combined.plaso \
/cases/case-2024-001/images/workstation.dd
log2timeline.py \
--storage-file /cases/case-2024-001/timeline/combined.plaso \
/cases/case-2024-001/images/server.dd
# Export full timeline to CSV (super-timeline format)
psort.py \
-o l2tcsv \
-w /cases/case-2024-001/timeline/full_timeline.csv \
/cases/case-2024-001/timeline/evidence.plaso
# Export with date range filter (focus on incident window)
psort.py \
-o l2tcsv \
-w /cases/case-2024-001/timeline/incident_window.csv \
/cases/case-2024-001/timeline/evidence.plaso \
"date > '2024-01-15 00:00:00' AND date < '2024-01-20 23:59:59'"
# Export in JSON Lines format (for ingestion into SIEM/Timesketch)
psort.py \
-o json_line \
-w /cases/case-2024-001/timeline/timeline.jsonl \
/cases/case-2024-001/timeline/evidence.plaso
# Export with specific source type filters
psort.py \
-o l2tcsv \
-w /cases/case-2024-001/timeline/registry_events.csv \
/cases/case-2024-001/timeline/evidence.plaso \
"source_short == 'REG'"
psort.py \
-o l2tcsv \
-w /cases/case-2024-001/timeline/evtx_events.csv \
/cases/case-2024-001/timeline/evidence.plaso \
"source_short == 'EVT'"
# Export for Timeline Explorer (dynamic CSV)
psort.py \
-o dynamic \
-w /cases/case-2024-001/timeline/timeline_explorer.csv \
/cases/case-2024-001/timeline/evidence.plaso
# Install Timesketch (Docker deployment)
git clone https://github.com/google/timesketch.git
cd timesketch
docker compose up -d
# Import Plaso file into Timesketch via CLI
timesketch_importer \
--host http://localhost:5000 \
--username analyst \
--password password \
--sketch_id 1 \
--timeline_name "Case 2024-001 Workstation" \
/cases/case-2024-001/timeline/evidence.plaso
# Alternatively, import JSONL
timesketch_importer \
--host http://localhost:5000 \
--username analyst \
--sketch_id 1 \
--timeline_name "Case 2024-001" \
/cases/case-2024-001/timeline/timeline.jsonl
# In Timesketch web UI:
# 1. Search for events: "data_type:windows:evtx:record AND event_identifier:4624"
# 2. Apply Sigma analyzers for automated detection
# 3. Star/tag important events
# 4. Create stories documenting the investigation narrative
# 5. Share with team members
# Analyze specific time periods around known events
python3 << 'PYEOF'
import csv
from collections import defaultdict
from datetime import datetime
# Load incident window timeline
events_by_hour = defaultdict(list)
source_counts = defaultdict(int)
with open('/cases/case-2024-001/timeline/incident_window.csv', 'r', errors='ignore') as f:
reader = csv.DictReader(f)
total = 0
for row in reader:
total += 1
timestamp = row.get('datetime', row.get('date', ''))
source = row.get('source_short', row.get('source', 'Unknown'))
description = row.get('message', row.get('desc', ''))
source_counts[source] += 1
# Group by hour for activity patterns
try:
dt = datetime.strptime(timestamp[:19], '%Y-%m-%dT%H:%M:%S')
hour_key = dt.strftime('%Y-%m-%d %H:00')
events_by_hour[hour_key].append({
'time': timestamp,
'source': source,
'description': description[:200]
})
except (ValueError, TypeError):
pass
print(f"Total events in incident window: {total}\n")
print("=== EVENTS BY SOURCE TYPE ===")
for source, count in sorted(source_counts.items(), key=lambda x: x[1], reverse=True):
print(f" {source}: {count}")
print("\n=== ACTIVITY BY HOUR ===")
for hour in sorted(events_by_hour.keys()):
count = len(events_by_hour[hour])
bar = '#' * min(count // 10, 50)
print(f" {hour}: {count:>6} events {bar}")
# Find hours with unusual activity spikes
avg = total / max(len(events_by_hour), 1)
print(f"\n=== ANOMALOUS HOURS (>{avg*3:.0f} events) ===")
for hour in sorted(events_by_hour.keys()):
if len(events_by_hour[hour]) > avg * 3:
print(f" {hour}: {len(events_by_hour[hour])} events (SPIKE)")
PYEOF
| Concept | Description |
|---|---|
| Super-timeline | Unified chronological view combining all artifact timestamps from multiple sources |
| MACB timestamps | Modified, Accessed, Changed (metadata), Born (created) - four key file timestamp types |
| Plaso storage file | SQLite-based intermediate format storing parsed events before export |
| L2T CSV | Log2timeline CSV format with standardized columns for timeline events |
| Parser | Plaso module extracting timestamps from a specific artifact type (e.g., winevtx, prefetch) |
| Psort | Plaso sorting and filtering tool for post-processing storage files |
| Timesketch | Google open-source collaborative timeline analysis platform |
| Pivot points | Known timestamps (e.g., malware execution) used to focus investigation scope |
| Tool | Purpose |
|---|---|
| log2timeline (Plaso) | Primary timeline generation engine parsing 100+ artifact types |
| psort | Plaso output filtering, sorting, and export utility |
| Timesketch | Web-based collaborative forensic timeline analysis platform |
| Timeline Explorer | Eric Zimmerman's Windows GUI for CSV timeline analysis |
| KAPE | Automated triage collection feeding into Plaso processing |
| mactime (TSK) | Simpler timeline generation from Sleuth Kit bodyfiles |
| Excel/Sheets | Manual timeline review for small filtered datasets |
| Elastic/Kibana | Alternative visualization platform for JSONL timeline data |
Scenario 1: Ransomware Attack Reconstruction Process the full disk image with Plaso, filter to the week before encryption was discovered, identify the initial access vector from browser history and event logs, trace privilege escalation through registry and Prefetch, map lateral movement from network logon events, pinpoint encryption start from MFT timestamps showing mass file modifications.
Scenario 2: Data Theft Investigation Create super-timeline from suspect's workstation, filter for USB device connection events, file access timestamps, and cloud storage browser activity, build a narrative showing data staging, compression, and exfiltration, present timeline to legal team with tagged evidence points.
Scenario 3: Multi-System Breach Analysis Process disk images from all affected systems into a single Plaso storage file, import into Timesketch for collaborative analysis, search for lateral movement patterns across system timelines, identify the patient-zero system and initial compromise vector, map the full attack chain across the environment.
Scenario 4: Insider Threat After-Hours Activity Filter timeline to non-business hours only, identify file access patterns outside normal working times, correlate with authentication events (badge access, VPN logon), search for data access to sensitive directories during these periods, build evidence package for HR/legal.
Timeline Reconstruction Summary:
Evidence Sources:
Disk Image: evidence.dd (500 GB, NTFS)
Plaso Storage: evidence.plaso (2.3 GB)
Processing Statistics:
Total events extracted: 4,567,890
Parsers used: 45 (winevtx, prefetch, mft, usnjrnl, lnk, chrome, firefox, winreg, ...)
Processing time: 3h 45m
Incident Window (2024-01-15 to 2024-01-20):
Events in window: 234,567
Event Sources:
MFT: 89,234
Event Logs: 45,678
USN Journal: 56,789
Registry: 23,456
Prefetch: 1,234
Browser: 5,678
LNK Files: 2,345
Other: 10,153
Key Timeline Events:
2024-01-15 14:32 - Phishing email opened (browser)
2024-01-15 14:33 - Malicious document downloaded
2024-01-15 14:35 - PowerShell executed (Prefetch + Event Log)
2024-01-15 14:36 - C2 connection established (Registry + Event Log)
2024-01-16 02:30 - Mimikatz execution (Prefetch)
2024-01-16 02:45 - Lateral movement to DC (Event Log)
2024-01-17 03:00 - Data exfiltration (MFT + USN Journal)
2024-01-18 03:00 - Log clearing (Event Log)
Exported Files:
Full Timeline: /timeline/full_timeline.csv (4.5M rows)
Incident Window: /timeline/incident_window.csv (234K rows)
Timesketch Import: /timeline/timeline.jsonl