---
name: dfir-adf31eefa066
source: transilienceai/communitytools
license: MIT
description: Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when investigating security incidents, analyzing Sherlocks, or performing threat hunting on provided evidence files.
---

# DFIR

Investigate security incidents by analyzing event logs, network captures, and filesystem artifacts. Detect and reconstruct AD attack chains.

## Techniques

| Domain | Key Capabilities |
|--------|-----------------|
| **Windows Event Logs** | EVTX parsing, Event ID correlation, logon tracking, privilege enumeration |
| **Network Forensics** | PCAP analysis, NTLM extraction, LLMNR/NBT-NS poisoning detection, relay identification |
| **Filesystem Forensics** | MFT parsing, Prefetch analysis, VSS artifact recovery, Linux persistence, timeline reconstruction |
| **AD Attack Detection** | Kerberoasting, AS-REP roasting, NTDS dump, NTLM relay, credential theft |
| **Memory Forensics** | Volatility3 analysis: process trees, file extraction, SID resolution, command lines |
| **Hash Analysis** | NTLMv2 hash construction from pcap, offline cracking validation |

## Workflow

1. **Inventory evidence** — List all artifacts (EVTX, pcap, MFT, prefetch, registry)
2. **Parse structured data** — EVTX with `python-evtx`, pcap with `tshark`, MFT with `analyzeMFT`
3. **Identify attack indicators** — Key Event IDs, suspicious traffic patterns, anomalous files
4. **Correlate across sources** — Match timestamps, IPs, LogonIDs, and process IDs across artifacts
5. **Reconstruct timeline** — Build chronological attack chain with UTC timestamps
6. **Answer investigative questions** — Map findings to specific incident response queries

## Tools

```bash
pip install python-evtx windowsprefetch analyzeMFT
brew install wireshark p7zip hashcat
```

| Tool | Purpose |
|------|---------|
| `python-evtx` | Parse Windows .evtx files |
| `tshark` | CLI pcap analysis (NTLM, LLMNR, SMB filters) |
| `analyzeMFT` | Parse NTFS Master File Table |
| `windowsprefetch` | Parse Windows prefetch files (Windows host only) |
| `hashcat` | Hash cracking (NTLMv2 mode 5600, Kerberos mode 13100/18200) |
| `volatility3` | Memory dump analysis (pstree, filescan, dumpfiles, getsid, cmdline) |
| `7z` | Extract AES-encrypted evidence ZIPs |

## Quick Reference: Key Event IDs

| Event ID | Log | Indicates |
|----------|-----|-----------|
| 4624 | Security | Successful logon (check Type + IP mismatch) |
| 4768 | Security | TGT request (PreAuthType=0 → AS-REP roast) |
| 4769 | Security | TGS request (EncType=0x17 → Kerberoast) |
| 4799 | Security | Group membership enumerated (VSS/ntdsutil) |
| 5140 | Security | Network share accessed |
| 7036 | System | Service state change (VSS start → NTDS dump) |
| 325/326/327 | Application | ESENT database create/detach/close |
| 330 | Application | ESENT database file info |
| 3006/3008 | DNS Client Events | DNS query sent/response received (malicious domain lookups) |
| 106/200 | Task Scheduler | Scheduled task created/executed (persistence via schtasks) |

## Reference

- [windows-event-analysis.md](reference/windows-event-analysis.md) — EVTX parsing patterns and AD attack detection
- [network-forensics.md](reference/network-forensics.md) — PCAP analysis for NTLM, LLMNR, relay detection
- [filesystem-forensics.md](reference/filesystem-forensics.md) — MFT, Prefetch, VSS artifact analysis

## Critical Rules

- **Answer formatting**: When forensics questions ask for "the value" of a code variable (e.g., PHP `$shell`), include language-specific string delimiters and terminators (e.g., `'value';` not just `value`). Check placeholder hints for format clues.
- For malicious Office OOXML, inspect more than VBA streams: attackers may split staged Base64 or script content across drawing/object descriptors, shared strings, named cells, and hidden UserForm control captions/values.
- When a VBA byte array starts with an `fnstenv`/`pop` decoder stub, convert signed integers to raw bytes and test a Shikata-style rolling XOR decode before treating the shellcode as corrupt.
- For legacy Excel BIFF/XLS malware, inspect `BOUNDSHEET` records for `hidden` or `very hidden` worksheets and specifically check for Excel 4.0 macro sheets; changing the hidden-state byte or parsing the sheet directly can expose staged strings and flag fragments that never appear in normal workbook views.
- For webshell traffic in PCAPs, recover static keys from the uploaded server-side code first, then decrypt operator tasking before chasing later payloads; if a dropped XOR key file is referenced by a shellcode stage, verify where the encoded region actually starts instead of XORing the whole blob from offset zero.
- **PowerShell stager pattern** (in-place reverse + base64 + IEX): when a stage-1 PS script does `[array]::Reverse($charArr)` followed by `FromBase64String("$charArr")`, the `-join` line is often a red herring — string interpolation of a char array uses `$OFS=' '` and `FromBase64String` tolerates whitespace. Reverse the original base64 string (not the joined-with-spaces version) and decode to get stage 2.
- **Multi-fragment flag exfil**: forensic challenges may split a flag across (a) a hardcoded `$partN` in the malware that is *defined but never referenced* (often base64'd), and (b) a field of the captured C2 POST body. Decrypt the body with the static AES key from the leaked stage-2 source (PowerShell `Encrypt-String` puts `IV‖ciphertext` then base64-wraps); inspect every JSON field for further base64.
- All timestamps in **UTC** — convert from local time zones in pcap/logs. **AM/PM trap**: 12:XX AM = 00:XX (midnight), 12:XX PM = 12:XX (noon). 12 AM ≠ 01:00.
- Parse EVTX with `python-evtx` (XML namespace: `http://schemas.microsoft.com/win/2004/08/events/event`)
- Use `tshark` for pcap (not scapy for large files) — filter with `-Y` display filters
- Decompress Win10 prefetch (MAM\x04 header) with `dissect.util.compression.lzxpress_huffman`
- For AES-encrypted ZIPs (compression method 99), use `7z` not `unzip`


---
Source attribution: 26zl
Original project: https://github.com/26zl/cybersec-toolkit/blob/2ad2519d437cda1f8a822ef7adc336993601a5ac/.claude/skills/dfir/SKILL.md
License: MIT
License information: https://opensource.org/license/mit
Original upstream instructions; downloaded from Mega AI Hub.

## Upstream license notice

MIT License

Copyright (c) 2026 26zl

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.



# Mega AI Hub resource metadata

Creator / publisher: 26zl
Original project: https://github.com/26zl/cybersec-toolkit/blob/2ad2519d437cda1f8a822ef7adc336993601a5ac/.claude/skills/dfir/SKILL.md
Attribution basis: Source repository record

Fields of work: Data & Analytics, Development & Engineering
Roles: Data Analyst, QA / Test Engineer, Security Engineer
Specialties: API, Testing
Tools: 7Z, Analyzemft, Hashcat, Python Evtx, Tshark, Volatility3, Windowsprefetch
Country applicability: Country not specified
Classification basis: Source catalog labels
Instruction SHA-256: bc8937699fc0addee2a7cdd2a58af8ea1147f79c7f2dbcec521071bd717e5197