incident-response
Incident Response guides evidence collection and analysis during active security breaches across endpoints, memory, logs, and cloud environments. It covers triage acquisition with Velociraptor and KAPE, memory forensics via Volatility 3, Windows event-log timelining with Chainsaw and Hayabusa, anti-forensics detection including timestomping, cloud identity-plane attacks, and ransomware or ESXi hypervisor response.
Incident Response acquires and analyzes evidence from active security incidents using memory forensics, log timelining, and anti-forensics detection.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/incident-response · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/incident-response ~/.claude/skills/incident-responsenpx skillfed install hypnguyen1209/offensive-claude/incident-responseFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is incident-response and what does it cover?
Incident-response guides evidence collection and analysis during active security breaches across endpoints, memory, logs, and cloud environments. It covers triage acquisition with Velociraptor and KAPE, memory forensics via Volatility 3, Windows event-log timelining with Chainsaw and Hayabusa, anti-forensics detection including timestomping, cloud identity-plane attacks, and ransomware or ESXi hypervisor response.
How does incident-response help acquire and analyze evidence from active incidents?
Incident-response enables rapid evidence collection using Velociraptor and KAPE for endpoint triage, Volatility 3 for memory forensics, and Chainsaw/Hayabusa for Windows event-log analysis. These tools work together to reconstruct attack timelines from memory dumps, logs, and artifacts, supporting the primary intent to acquire and analyze evidence from active security incidents.
Can incident-response detect anti-forensics techniques and evidence tampering?
Yes. Incident-response addresses timestomping detection, log clearing, and other anti-forensics evasion techniques. Tools like Hayabusa and Chainsaw help identify suspicious event-log modifications, while memory forensics with Volatility 3 can reveal process injection and rootkit activity that attackers use to hide their tracks during active breaches.
What incident-response capabilities exist for ransomware and hypervisor attacks?
Incident-response includes dedicated ransomware triage and rapid-response playbooks, plus ESXi hypervisor-specific forensics and containment actions. These capabilities enable responders to quickly identify encryption activity, isolate affected systems, and preserve evidence from both traditional endpoints and virtualized infrastructure under active attack.
How does incident-response support cloud identity-plane forensics?
Incident-response covers cloud IR for AWS and Azure environments, including cloud audit-log investigation and credential-theft detection from identity-plane attacks. It guides responders through analyzing cloud identity events, detecting compromised credentials, and performing containment actions specific to cloud infrastructure during active incidents.
What tools and techniques does incident-response use for timeline reconstruction?
Incident-response uses super-timeline creation with Plaso and Timesketch, Windows event-log timelining via Chainsaw and Hayabusa with Sigma rules, and memory forensics via Volatility 3. These techniques correlate artifacts from multiple sources—memory dumps, logs, and endpoint collections—to reconstruct the complete attack timeline from initial compromise through post-exploitation activity.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: incident-response description: Use when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining, anti-forensics detection, cloud IR, ransomware/ESXi response metadata: type: defensive phase: response tools: velociraptor, volatility3, chainsaw, hayabusa, plaso, timesketch, uac, MFTECmd, EvtxECmd, dissect, certutil, awscli, az, gcloud mitre: TA0005 kill_chain: phase: [report] step: [8] attck_tactics: [TA0005, TA0007, TA0040, TA0010] attck_techniques: [T1070, T1070.001, T1070.004, T1070.006, T1562.001, T1070.008, T1055, T1014, T1003.001, T1486, T1490, T1485, T1078.004, T1552.005, T1528, T1219] depends_on: [red-team-ops, threat-hunting] feeds_into: [threat-hunting, malware-analysis] inputs: [memory_dumps, disk_images, triage_packages, log_data, cloud_audit_logs] outputs: [timeline, ioc_list, forensic_report, containment_actions, root_cause] references: - references/triage-collection.md - references/memory-forensics.md - references/windows-evtx-timeline.md - references/anti-forensics-detection.md - references/cloud-ir.md -
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 15 files
skills/incident-response/SKILL.md
skills/incident-response/references/anti-forensics-detection.md
skills/incident-response/references/cloud-ir.md
skills/incident-response/references/memory-forensics.md
skills/incident-response/references/ransomware-esxi-ir.md
skills/incident-response/references/repo-compromise-forensics.md
skills/incident-response/references/triage-collection.md
skills/incident-response/references/windows-evtx-timeline.md
skills/incident-response/scripts/cloud_ir_collect.py
skills/incident-response/scripts/dangling_commit_finder.py
skills/incident-response/scripts/ebpf_rootkit_hunt.sh
skills/incident-response/scripts/evtx_hunt.sh
skills/incident-response/scripts/gharchive_recover.py
skills/incident-response/scripts/ransomware_triage.ps1
skills/incident-response/scripts/timestomp_detect.py