Agent skill
Performing Log Analysis for Forensic Investigation
Collect, parse, and correlate system, application, and security logs
OpenClawData & Analytics
mukul97535,531
Apache-2.0View resource
Agent skills
Reusable instructions for compatible AI agents.
Explore by field
Loading catalog totals…Field counts come from the latest full-catalog snapshot. A resource can belong to several fields and platforms.
Resources
Search resultsAgent skill
DFIR
Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when investigating security incidents, analyzing Sherlocks, or performing threat hunting on provided evidence files.
OpenClawData & Analytics
26zl87
Agent skill
Hunting for Anomalous PowerShell Execution
Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event
ClaudeCodexOpenClawDevelopment & Engineering
26zl87
Apache-2.0View resource
Agent skill
Hunting for Lateral Movement via WMI
Detect WMI-based lateral movement by analyzing Windows Event ID 4688
OpenClawDevelopment & Engineering
26zl87
Apache-2.0View resource
Agent skill
Hunting for Unusual Service Installations
Detect suspicious Windows service installations (MITRE ATT&CK T1543.003)
ClaudeCodexOpenClawDevelopment & Engineering
26zl87
Apache-2.0View resource
Agent skill
Detecting RDP Brute Force Attacks
Detect RDP brute force attacks by analyzing Windows Security Event Logs
OpenClawDevelopment & Engineering
costrict-plugins-repo75
Apache-2.0View resource
Agent skill
Analyzing PowerShell Script Block Logging
Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX
OpenClawData & Analytics
hironow0
Apache-2.0View resource
Agent skill
Hunting for Anomalous PowerShell Execution
Hunt for malicious PowerShell activity by analyzing Script Block Logging
ClaudeCodexOpenClawDevelopment & Engineering
hironow0
Apache-2.0View resource
Agent skill
Hunting for Lateral Movement via WMI
Detect WMI-based lateral movement by analyzing Windows Event ID 4688
OpenClawDevelopment & Engineering
hironow0
Apache-2.0View resource
Agent skill
Hunting for Unusual Service Installations
Detect suspicious Windows service installations (MITRE ATT&CK T1543.003)
ClaudeCodexOpenClawDevelopment & Engineering
hironow0
Apache-2.0View resource
Agent skill
Detecting RDP Brute Force Attacks
Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.
ClaudeCodexOpenClawDevelopment & Engineering
luokai014
Apache-2.0View resource
Agent skill
Hunting for Anomalous PowerShell Execution
Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and ...
ClaudeCodexOpenClawDevelopment & Engineering
luokai014
Apache-2.0View resource
No matching resources
Try a broader search or clear some filters.
Platform labels describe intended use. Read each resource's author credits, requirements and available access methods.