New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Performing Endpoint Forensics Investigation

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction.

Apache-2.0Auto-check: notesSecurity

Install Performing Endpoint Forensics Investigation

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-endpoint-forensics-investigation -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills performing-endpoint-forensics-investigation --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/performing-endpoint-forensics-investigation .claude/skills/performing-endpoint-forensics-investigation && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
performing-endpoint-forensics-investigation
GitHub stars
34k
Token cost
~2k tokens
SKILL.md length
371 words
Files
8 (incl. scripts, references, assets)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction.

  • Works in 6 steps: Evidence Preservation (Order of… → Disk Imaging → Memory Analysis with Volatility 3 → …
  • Investigating security incidents
  • SKILL.md covers When to Use, Prerequisites, Workflow and Key Concepts, plus 2 more sections
  • Runs Python scripts from its folder

What it does

Performing Endpoint Forensics Investigation is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Use when investigating security incidents, collecting evidence for legal proceedings, or analyzing endpoint compromise scope. Activates for requests involving endpoint forensics, memory analysis, disk forensics, or incident investigation.

Its SKILL.md is about 2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Security, covering Digital forensics and Security operations. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Investigating security incidents
  • Collecting evidence for legal proceedings
  • Analyzing endpoint compromise scope

Example prompts

  • “Use the performing-endpoint-forensics-investigation skill to perform digital forensics investigation on compromised endpoints including memory…”
  • “/performing-endpoint-forensics-investigation”

Requirements

  • Python 3

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Evidence Preservation (Order of Volatility)
  2. Disk Imaging
  3. Memory Analysis with Volatility 3
  4. Windows Artifact Analysis
  5. Timeline Reconstruction
  6. Document Findings

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Performing Endpoint Forensics Investigation loads about 2k tokens when it runs, and up to ~4.5k if it reads all its reference files. Until then it costs about 110 tokens; SKILL.md has 371 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~110
When it runs · the whole SKILL.md, loaded when a task matches
~2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteRuns commands with sudoSKILL.md:77
    sudo insmod lime.ko "path=/evidence/memory.lime format=lime"
  • NoteRuns commands with sudoSKILL.md:111
    sudo dc3dd if=/dev/sda of=/evidence/disk.dd hash=sha256 log=/evidence/imaging.log

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 371 words, ~2,047 tokens.

Download SKILL.mdSave it as .claude/skills/performing-endpoint-forensics-investigation/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
performing-endpoint-forensics-investigation
description
Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Use when investigating security incidents, collecting evidence for legal proceedings, or analyzing endpoint compromise scope. Activates for requests involving endpoint forensics, memory analysis, disk forensics, or incident investigation.
domain
cybersecurity
subdomain
endpoint-security
tags
endpoint, forensics, memory-analysis, disk-imaging, incident-investigation, Volatility
version
1.0.0
author
mahipal
license
Apache-2.0
nist_csf
PR.PS-01, PR.PS-02, DE.CM-01, PR.IR-01
mitre_attack
T1055, T1547, T1059, T1036, T1005

Performing Endpoint Forensics Investigation

When to Use

Use this skill when:

  • Investigating a confirmed or suspected endpoint compromise requiring forensic analysis
  • Collecting volatile and non-volatile evidence for incident response or legal proceedings
  • Analyzing memory dumps for malware, injected code, or credential theft artifacts
  • Reconstructing attacker timelines from endpoint artifacts (prefetch, shimcache, amcache)

Do not use this skill for live threat hunting (use EDR/SIEM) or network forensics.

Prerequisites

  • Forensic workstation with analysis tools (Volatility 3, KAPE, Autopsy, Eric Zimmerman tools)
  • Write-blocker for disk imaging (hardware or software)
  • Secure evidence storage with chain-of-custody documentation
  • Memory acquisition tool (WinPMEM, FTK Imager, Magnet RAM Capture)
  • Administrative access to the target endpoint (or physical access)

Workflow

Step 1: Evidence Preservation (Order of Volatility)

Collect evidence from most volatile to least volatile:

1. System memory (RAM) - Most volatile
2. Network connections and routing tables
3. Running processes and open files
4. Disk contents (file system)
5. Removable media
6. Logs and backup data - Least volatile

Memory Acquisition:

powershell
# WinPMEM (Windows)
winpmem_mini_x64.exe memdump.raw

# FTK Imager - Create memory capture via GUI
# File → Capture Memory → Destination path → Capture Memory

# Linux (LiME kernel module)
sudo insmod lime.ko "path=/evidence/memory.lime format=lime"

Volatile Data Collection:

powershell
# Capture running processes
Get-Process | Export-Csv "evidence\processes.csv" -NoTypeInformation
tasklist /v > "evidence\tasklist.txt"

# Capture network connections
netstat -anob > "evidence\netstat.txt"
Get-NetTCPConnection | Export-Csv "evidence\tcp_connections.csv"

# Capture logged-on users
query user > "evidence\logged_users.txt"

# Capture scheduled tasks
schtasks /query /fo CSV /v > "evidence\scheduled_tasks.csv"

# Capture services
Get-Service | Export-Csv "evidence\services.csv"

# Capture DNS cache
ipconfig /displaydns > "evidence\dns_cache.txt"
Step 2: Disk Imaging
powershell
# FTK Imager - Create forensic disk image
# File → Create Disk Image → Physical Drive → E01 format
# Always verify image hash (MD5/SHA1) matches source

# dd (Linux)
sudo dc3dd if=/dev/sda of=/evidence/disk.dd hash=sha256 log=/evidence/imaging.log

# Verify image integrity
sha256sum /evidence/disk.dd
# Compare with hash generated during imaging
Step 3: Memory Analysis with Volatility 3
bash
# Identify OS profile
vol -f memdump.raw windows.info

# List running processes
vol -f memdump.raw windows.pslist
vol -f memdump.raw windows.pstree

# Find hidden processes
vol -f memdump.raw windows.psscan

# Analyze network connections
vol -f memdump.raw windows.netscan

# Detect process injection
vol -f memdump.raw windows.malfind

# Extract command line arguments
vol -f memdump.raw windows.cmdline

# Analyze DLLs loaded by processes
vol -f memdump.raw windows.dlllist --pid 1234

# Extract files from memory
vol -f memdump.raw windows.filescan | grep -i "suspicious"
vol -f memdump.raw windows.dumpfiles --pid 1234

# Detect credential theft
vol -f memdump.raw windows.hashdump
vol -f memdump.raw windows.lsadump

# Registry analysis from memory
vol -f memdump.raw windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run"
Step 4: Windows Artifact Analysis
Key forensic artifacts and their tools:

Prefetch Files (C:\Windows\Prefetch\):
  Tool: PECmd.exe (Eric Zimmerman)
  Shows: Program execution history with timestamps and run counts
  Command: PECmd.exe -d "C:\Windows\Prefetch" --csv output\

ShimCache (AppCompatCache):
  Tool: AppCompatCacheParser.exe
  Shows: Programs that existed on system (even if deleted)
  Command: AppCompatCacheParser.exe -f SYSTEM --csv output\

AmCache (C:\Windows\appcompat\Programs\Amcache.hve):
  Tool: AmcacheParser.exe
  Shows: Program execution with SHA1 hashes and install timestamps
  Command: AmcacheParser.exe -f Amcache.hve --csv output\

NTFS artifacts ($MFT, $UsnJrnl, $LogFile):
  Tool: MFTECmd.exe
  Shows: Complete file system timeline including deleted files
  Command: MFTECmd.exe -f "$MFT" --csv output\

Event Logs:
  Tool: EvtxECmd.exe
  Shows: Security, System, PowerShell, Sysmon events
  Command: EvtxECmd.exe -d "C:\Windows\System32\winevt\Logs" --csv output\

Registry Hives (SAM, SYSTEM, SOFTWARE, NTUSER.DAT):
  Tool: RECmd.exe with batch files
  Shows: User accounts, services, installed software, USB history
  Command: RECmd.exe -d "C:\Windows\System32\config" --bn BatchExamples\RECmd_Batch_MC.reb --csv output\
Step 5: Timeline Reconstruction
bash
# Use KAPE for automated artifact collection
kape.exe --tsource C: --tdest C:\evidence\kape_output \
  --target KapeTriage --module !EZParser

# Create super timeline with plaso/log2timeline
log2timeline.py timeline.plaso disk_image.E01
psort.py -o l2tcsv timeline.plaso -w timeline.csv

# Filter timeline around incident timeframe
psort.py -o l2tcsv timeline.plaso "date > '2026-02-20' AND date < '2026-02-22'" -w filtered_timeline.csv
Step 6: Document Findings

Structure forensic report:

1. Executive Summary
2. Scope and Methodology
3. Evidence Inventory (with chain of custody)
4. Timeline of Events
5. Findings and Analysis
   - Initial access vector
   - Persistence mechanisms
   - Lateral movement
   - Data access/exfiltration
6. Indicators of Compromise (IOCs)
7. Recommendations
8. Appendices (tool output, hashes, raw evidence)

Key Concepts

TermDefinition
Order of VolatilityEvidence collection priority from most volatile (RAM) to least volatile (backups)
Chain of CustodyDocumented record of evidence handling from collection to presentation
Write BlockerHardware or software device that prevents modification of source evidence
Super TimelineConsolidated chronological view of all artifact timestamps for incident reconstruction
PrefetchWindows artifact recording program execution history
ShimCacheApplication compatibility artifact tracking program existence on endpoint
Show full SKILL.md (143 more words)Show less

Tools & Systems

  • Volatility 3: Memory forensics framework for analyzing RAM dumps
  • KAPE (Kroll Artifact Parser and Extractor): Automated triage collection and parsing
  • Eric Zimmerman Tools: Suite of Windows artifact parsers (PECmd, MFTECmd, RECmd, etc.)
  • Autopsy/Sleuth Kit: Disk forensics platform for file system analysis
  • FTK Imager: Forensic imaging and memory acquisition tool
  • Plaso/log2timeline: Super timeline creation framework

Common Pitfalls

  • Modifying evidence on live system: Always image before analysis. Running tools on a live system alters timestamps and memory state.
  • Forgetting chain of custody: Evidence without documented chain of custody is inadmissible in legal proceedings.
  • Analyzing only disk, ignoring memory: In-memory-only malware (fileless attacks) leaves no disk artifacts. Always capture memory first.
  • Not hashing evidence: All evidence must be cryptographically hashed at collection time to prove integrity.
  • Tunnel vision: Focusing on one artifact when the timeline tells a broader story. Always build a comprehensive timeline.

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/performing-endpoint-forensics-investigation of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Performing Endpoint Forensics Investigation next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Performing Endpoint Forensics Investigation compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Performing Endpoint Forensics Investigation this skillmukul975/Anthropic-Cybersecurity-Skills34k—~2kAutomated safety check: NotesApache-2.0
Dfirtransilienceai/communitytools563—~1.5kAutomated safety check: PassMIT
TShark Traffic AnalysisAgentSecOps/SecOpsAgentKit2201 repos~4.8kAutomated safety check: NotesCustom licence
Forensics OsqueryAgentSecOps/SecOpsAgentKit2201 repos~4.9kAutomated safety check: NotesCustom licence
Ir VelociraptorAgentSecOps/SecOpsAgentKit2201 repos~3.1kAutomated safety check: PassCustom licence
Log Evasionwgpsec/AboutSecurity1.8k—~1.2kAutomated safety check: PassNone

Similar skills

  • Dfir

    transilienceai/communitytools

    Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.

    563 GitHub stars~1.5k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • TShark Traffic Analysis

    AgentSecOps/SecOpsAgentKit

    Guides authorized packet capture and analysis with TShark, Wireshark's command-line tool, for security investigations, malware detection and forensic examination of network traffic.

    220 GitHub starsUsed in 1 repo~4.8k tokens
    SecurityAuto-check: notes

  • Forensics Osquery

    AgentSecOps/SecOpsAgentKit

    SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases.

    220 GitHub starsUsed in 1 repo~4.9k tokens
    SecurityAuto-check: notes

  • Ir Velociraptor

    AgentSecOps/SecOpsAgentKit

    Endpoint visibility, digital forensics, and incident response using Velociraptor Query Language (VQL) for evidence collection and threat hunting at scale.

    220 GitHub starsUsed in 1 repo~3.1k tokens
    SecurityAuto-check passed

  • Log Evasion

    wgpsec/AboutSecurity

    日志分析与日志逃逸方法论。理解蓝队如何通过日志追踪攻击行为（SIEM/Event Log/Syslog），以及红队如何规避日志记录或精准清除痕迹。当需要设计无痕操作或分析日志监控覆盖范围时使用

    1.8k GitHub stars~1.2k tokensUpdated yesterday
    SecurityAuto-check passed

  • Incident Response Network

    LeoYeAI/openclaw-master-skills

    Network forensics evidence collection and analysis during security incidents.

    2.2k GitHub stars~5k tokensUpdated 2 mo ago
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Performing Endpoint Forensics Investigation

What does Performing Endpoint Forensics Investigation do?

Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Performing Endpoint Forensics Investigation is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction.

When should I use Performing Endpoint Forensics Investigation?

Performing Endpoint Forensics Investigation fits situations like: investigating security incidents; collecting evidence for legal proceedings; analyzing endpoint compromise scope.

How do I install Performing Endpoint Forensics Investigation in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-endpoint-forensics-investigation -a claude-code`. Or copy the skill folder (skills/performing-endpoint-forensics-investigation in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/performing-endpoint-forensics-investigation in your project. Claude Code loads it when a task matches its description.

How do I install Performing Endpoint Forensics Investigation in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-endpoint-forensics-investigation -a codex`. Or copy the skill folder (skills/performing-endpoint-forensics-investigation in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/performing-endpoint-forensics-investigation in your project. Codex loads it when a task matches its description.

Can I use Performing Endpoint Forensics Investigation in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-endpoint-forensics-investigation -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/performing-endpoint-forensics-investigation, .gemini/skills/performing-endpoint-forensics-investigation, .github/skills/performing-endpoint-forensics-investigation and .opencode/skills/performing-endpoint-forensics-investigation in your project.

What does Performing Endpoint Forensics Investigation need to run?

Going by SKILL.md and its folder, Performing Endpoint Forensics Investigation needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Performing Endpoint Forensics Investigation access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Performing Endpoint Forensics Investigation safe to install?

Our automated static check of SKILL.md found notes only (runs commands with sudo), nothing it rates as a warning. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Performing Endpoint Forensics Investigation use?

Performing Endpoint Forensics Investigation is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Performing Endpoint Forensics Investigation use?

About 2k tokens (SKILL.md is roughly 8.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.4k tokens, read only when the agent opens those files.

What are the alternatives to Performing Endpoint Forensics Investigation?

Skills that share tags, products or a category with Performing Endpoint Forensics Investigation: Dfir (transilienceai/communitytools, 563 stars), TShark Traffic Analysis (AgentSecOps/SecOpsAgentKit, 220 stars), Forensics Osquery (AgentSecOps/SecOpsAgentKit, 220 stars) and Ir Velociraptor (AgentSecOps/SecOpsAgentKit, 220 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Performing Endpoint Forensics Investigation?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.