incident-response
Incident Response guides evidence collection and analysis during active security breaches across endpoints, memory, logs, and cloud environments. It covers triage acquisition with Velociraptor and KAPE, memory forensics via Volatility 3, Windows event-log timelining with Chainsaw and Hayabusa, anti-forensics detection including timestomping, cloud identity-plane attacks, and ransomware or ESXi hypervisor response.
Incident Response acquires and analyzes evidence from active security incidents using memory forensics, log timelining, and anti-forensics detection.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-03
Incident Response acquires and analyzes evidence from active security incidents using memory forensics, log timelining, and anti-forensics detection. Incident Response guides evidence collection and analysis during active security breaches across endpoints, memory, logs, and cloud environments. It covers triage acquisition with Velociraptor and KAPE, memory forensics via Volatility 3, Windows event-log timelining with Chainsaw and Hayabusa, anti-forensics detection including timestomping, cloud identity-plane attacks, and ransomware or ESXi hypervisor response.
Use it when
- Incident-response enables rapid evidence collection using Velociraptor and KAPE for endpoint triage, Volatility 3 for memory forensics.
- Yes.
Verify before relying
Read SKILL.md below before installing (17 files). Open directory: indexed for reading, not audited.
Install
hypnguyen1209/offensive-claude/incident-response · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is incident-response and what does it cover?
Incident-response guides evidence collection and analysis during active security breaches across endpoints, memory, logs, and cloud environments. It covers triage acquisition with Velociraptor and KAPE, memory forensics via Volatility 3, Windows event-log timelining with Chainsaw and Hayabusa, anti-forensics detection including timestomping, cloud identity-plane attacks, and ransomware or ESXi hypervisor response.
How does incident-response help acquire and analyze evidence from active incidents?
Incident-response enables rapid evidence collection using Velociraptor and KAPE for endpoint triage, Volatility 3 for memory forensics, and Chainsaw/Hayabusa for Windows event-log analysis. These tools work together to reconstruct attack timelines from memory dumps, logs, and artifacts, supporting the primary intent to acquire and analyze evidence from active security incidents.
Can incident-response detect anti-forensics techniques and evidence tampering?
Yes. Incident-response addresses timestomping detection, log clearing, and other anti-forensics evasion techniques. Tools like Hayabusa and Chainsaw help identify suspicious event-log modifications, while memory forensics with Volatility 3 can reveal process injection and rootkit activity that attackers use to hide their tracks during active breaches.
What incident-response capabilities exist for ransomware and hypervisor attacks?
Incident-response includes dedicated ransomware triage and rapid-response playbooks, plus ESXi hypervisor-specific forensics and containment actions. These capabilities enable responders to quickly identify encryption activity, isolate affected systems, and preserve evidence from both traditional endpoints and virtualized infrastructure under active attack.
How does incident-response support cloud identity-plane forensics?
Incident-response covers cloud IR for AWS and Azure environments, including cloud audit-log investigation and credential-theft detection from identity-plane attacks. It guides responders through analyzing cloud identity events, detecting compromised credentials, and performing containment actions specific to cloud infrastructure during active incidents.
What tools and techniques does incident-response use for timeline reconstruction?
Incident-response uses super-timeline creation with Plaso and Timesketch, Windows event-log timelining via Chainsaw and Hayabusa with Sigma rules, and memory forensics via Volatility 3. These techniques correlate artifacts from multiple sources—memory dumps, logs, and endpoint collections—to reconstruct the complete attack timeline from initial compromise through post-exploitation activity.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
name: incident-response description: Use when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining, anti-forensics detection, cloud IR, ransomware/ESXi response metadata: type: defensive phase: response tools: velociraptor, volatility3, chainsaw, hayabusa, plaso, timesketch, uac, MFTECmd, EvtxECmd, dissect, certutil, awscli, az, gcloud mitre: TA0005 kill_chain: phase: [report] step: [8] attck_tactics: [TA0005, TA0007, TA0040, TA0010] attck_techniques: [T1070, T1070.001, T1070.004, T1070.006, T1562.001, T1070.008, T1055, T1014, T1003.001, T1486, T1490, T1485, T1078.004, T1552.005, T1528, T1219] depends_on: [red-team-ops, threat-hunting] feeds_into: [threat-hunting, malware-analysis] inputs: [memory_dumps, disk_images, triage_packages, log_data, cloud_audit_logs] outputs: [timeline, ioc_list, forensic_report, containment_actions, root_cause] references: - references/triage-collection.md - references/memory-forensics.md - references/windows-evtx-timeline.md - references/anti-forensics-detection.md - references/cloud-ir.md -
(truncated - see the full file via the links below)
File tree — 15 files
skills/incident-response/SKILL.md
skills/incident-response/references/anti-forensics-detection.md
skills/incident-response/references/cloud-ir.md
skills/incident-response/references/memory-forensics.md
skills/incident-response/references/ransomware-esxi-ir.md
skills/incident-response/references/repo-compromise-forensics.md
skills/incident-response/references/triage-collection.md
skills/incident-response/references/windows-evtx-timeline.md
skills/incident-response/scripts/cloud_ir_collect.py
skills/incident-response/scripts/dangling_commit_finder.py
skills/incident-response/scripts/ebpf_rootkit_hunt.sh
skills/incident-response/scripts/evtx_hunt.sh
skills/incident-response/scripts/gharchive_recover.py
skills/incident-response/scripts/ransomware_triage.ps1
skills/incident-response/scripts/timestomp_detect.py
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Acquire and analyze evidence from an active security incident”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Threat Hunting equips you to conduct hypothesis-driven threat investigations across Windows endpoints, network traffic, and cloud identity using Sigma-based detection rules, MITRE ATT&CK mapping, and offline triage tools. Execute C2 hunting via JA4 fingerprinting and beaconing analysis, detect post-exploitation techniques like LSASS dumping and LOLBin abuse, and validate detection coverage with purple-team emulation.
Malware Analysis guides you through identifying unknown binaries, unpacking obfuscated loaders, and safely detonating samples to recover fileless artifacts and in-memory payloads. Extract C2 configurations, detect beacon traffic patterns, and author low-false-positive detection rules from your findings.
Cloud Security targets identity and access control weaknesses across major cloud platforms. It covers IAM privilege escalation, credential harvesting via metadata SSRF, Entra device-code attacks, GCP service-account impersonation chains, Kubernetes container breakout, and CI/CD federation trust abuse. Includes scripts and references for reconnaissance, exploitation, and lateral movement within cloud environments.
Crypto-analysis evaluates cryptographic posture across TLS/SSL/SSH configurations, public-key implementations, and token schemes. It detects cipher downgrades, weak key generation, nonce reuse, AEAD misuse, and JWT algorithm confusion using integrated tools like testssl.sh, openssl, and hashcat. Use it to identify cryptographic flaws before attackers do.
EDR Evasion covers defensive bypass methods used in red team engagements, from userland hook removal and direct syscall execution to AMSI patching and memory encryption. Learn how EDRs monitor endpoints and the techniques—including PPID spoofing, process injection variants, and ETW patching—that evade their detection.
Reverse Engineering provides techniques and tools for static and dynamic analysis of compiled binaries, firmware, and protected code. Recover decompiled source, unpack obfuscated samples, bypass anti-debugging defenses, and extract vulnerability details through patch diffing and protocol inference.