本文へ移動
cccskills
無料GitHub で公開

forensics-triage

Digital forensics and incident response triage skill for disk, memory, network, cloud, and endpoint artifacts. Covers Volatility 3, Velociraptor, KAPE, Plaso, Autopsy, Chainsaw, Hayabusa, Zeek, Arkime, EVTX, AWS/Azure/GCP audit logs, and timeline reconstruction. Use to extract IOCs, build incident timelines, and produce defensible analyst reports.

インストール方法を見る

含まれるファイル(2)

  • SKILL.md2.0 KB
  • agents/openai.yaml244 B

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Forensics Triage

Operating Rules

  • Preserve chain of custody: hash before and after handling; record acquisition method, examiner, and timezone (UTC preferred).
  • Work on copies; mount images read-only; document every tool, version, and flag.
  • Separate observation (what the artifact says) from inference (what likely happened).

Triage Workflow

  1. Collect: KAPE targets, velociraptor artifacts, memory via winpmem/avml, cloud logs via provider exports.
  2. Parse: plaso/log2timeline for super-timeline; chainsaw/hayabusa for Windows EVTX; volatility3 for RAM; bulk_extractor for carving.
  3. Reconstruct timeline: anchor on initial access, then enumerate execution, persistence, lateral movement, collection, exfil, impact.
  4. Extract IOCs: hashes, domains, IPs, mutexes, registry keys, scheduled tasks, services, cron, browser artifacts, cloud principals.
  5. Correlate: cross-host, cross-cloud, identity-tier; build a narrative with ATT&CK mapping.
  6. Report: timeline, scope, dwell time, attribution confidence, recommendations.

Cloud and Identity Focus

  • AWS: CloudTrail, GuardDuty, IAM Access Analyzer, Athena queries; assume-role chains.
  • Azure: AAD sign-in/audit, MCAS, Defender; OAuth consent abuse.
  • GCP: Cloud Audit, Workspace Login; service account key misuse.
  • Identity: token theft, primary refresh token abuse, federation trust manipulation.

Output Contract

  • chain-of-custody.md, acquisition.log.
  • timeline.csv super-timeline with annotations.
  • iocs.stix.json, findings.md per host/account.
  • report.md: executive narrative, root cause, dwell time, scope, recovery steps, lessons learned.

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

AI and LLM red-teaming skill for evaluating prompt injection, jailbreak, data exfiltration, tool abuse, agent hijack, RAG poisoning, model denial of service, and unsafe tool-use chains in Gemini, Claude, GPT, and open-weight models. Use to build evaluation harnesses, attack corpora, defensive guardrails, and red-team reports for AI systems you own or are authorized to test.

日本語の概要は準備中です。原文の説明を表示しています。

Garyson26/Trident-SecOps-Skills202026年9月30日 更新

API security automation skill for REST, GraphQL, gRPC, and WebSocket APIs. Covers OpenAPI/AsyncAPI ingestion, authenticated fuzzing, OWASP API Top 10 (BOLA, BFLA, mass assignment, SSRF), schema diffing, GraphQL introspection abuse, JWT and OAuth misuse, rate-limit and replay testing. Use to automate API assessments with safe, scoped, evidence-backed findings.

日本語の概要は準備中です。原文の説明を表示しています。

Garyson26/Trident-SecOps-Skills202026年9月30日 更新

Assembly programming and low-level debugging skill for reading, writing, explaining, optimizing, and reviewing assembly across x86, x86-64, ARM, AArch64, RISC-V, calling conventions, ABI boundaries, inline assembly, disassembly, stack frames, registers, and binary-level behavior. Use for .s/.asm files, compiler output, reverse-engineering snippets, low-level performance, and crash analysis.

日本語の概要は準備中です。原文の説明を表示しています。

Garyson26/Trident-SecOps-Skills202026年9月30日 更新

Bug bounty workflow skill for program scope mapping, recon-to-report automation, deduplication against prior submissions, and high-signal reporting on HackerOne, Bugcrowd, Intigriti, YesWeHack, and self-hosted programs. Use to organize bounty work end to end while staying inside program rules.

日本語の概要は準備中です。原文の説明を表示しています。

Garyson26/Trident-SecOps-Skills202026年9月30日 更新

Assistant-behavior design skill for approximating a Claude-like analytical, careful, conversational style without claiming to be Claude or Anthropic. Use when the user asks to duplicate, emulate, adapt, or recreate a Claude-style "mythos" or persona for prompts, agent specs, writing style, reasoning discipline, safety posture, or UX behavior.

日本語の概要は準備中です。原文の説明を表示しています。

Garyson26/Trident-SecOps-Skills202026年9月30日 更新

Cloud security posture skill for AWS, Azure, GCP, and multi-cloud. Covers IAM least-privilege, key and secret hygiene, network exposure, data protection, logging coverage, IaC scanning (Terraform, CloudFormation, Bicep, Pulumi), CSPM remediation, and landing-zone hardening. Use for misconfig discovery, IaC review, and automated drift-and-fix workflows on cloud accounts you own.

日本語の概要は準備中です。原文の説明を表示しています。

Garyson26/Trident-SecOps-Skills202026年9月30日 更新

Garyson26 のスキルをすべて見る

このスキルの問題を報告する