New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Performing Windows Artifact Analysis With Eric Zimmerman Tools

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Performs comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite (KAPE, MFTECmd, PECmd, LECmd, JLECmd, Timeline Explorer) to parse registry hives, prefetch…

Apache-2.0Auto-check passedSecurity

Install Performing Windows Artifact Analysis With Eric Zimmerman Tools

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-windows-artifact-analysis-with-eric-zimmerman-tools -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills performing-windows-artifact-analysis-with-eric-zimmerman-tools --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools .claude/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
performing-windows-artifact-analysis-with-eric-zimmerman-tools
GitHub stars
34k
Token cost
~3k tokens
SKILL.md length
796 words
Files
8 (incl. scripts, references, assets)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Performs comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite (KAPE, MFTECmd, PECmd, LECmd, JLECmd, Timeline Explorer) to parse registry hives, prefetch…

  • Works in 4 steps: Artifact Collection with KAPE → Artifact Processing with EZ Tools → Timeline Analysis → …
  • Tasks that involve Digital forensics
  • SKILL.md covers Overview, When to Use, Prerequisites and Tool Suite Components, plus 5 more sections
  • Runs Python scripts from its folder; reaches kroll.com

What it does

Performing Windows Artifact Analysis With Eric Zimmerman Tools is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Performs comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite (KAPE, MFTECmd, PECmd, LECmd, JLECmd, Timeline Explorer) to parse registry hives, prefetch files, event logs, and file system metadata. Use during DFIR investigations that need a timeline of program execution, file access, and persistence built from Windows artifacts.

Its SKILL.md is about 3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Security, covering Digital forensics. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Digital forensics

Example prompts

  • “Use the performing-windows-artifact-analysis-with-eric-zimmerman-tools skill to perform comprehensive Windows forensic artifact analysis using Eric…”
  • “/performing-windows-artifact-analysis-with-eric-zimmerman-tools”

Requirements

  • Python 3

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Artifact Collection with KAPE
  2. Artifact Processing with EZ Tools
  3. Timeline Analysis
  4. Timestomping Detection

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • kroll.com

    Also links to:

    • ericzimmerman.github.io
    • sans.org

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Performing Windows Artifact Analysis With Eric Zimmerman Tools loads about 3k tokens when it runs, and up to ~4.9k if it reads all its reference files. Until then it costs about 110 tokens; SKILL.md has 796 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~110
When it runs · the whole SKILL.md, loaded when a task matches
~3k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 796 words, ~3,014 tokens.

Download SKILL.mdSave it as .claude/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
performing-windows-artifact-analysis-with-eric-zimmerman-tools
description
Performs comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite (KAPE, MFTECmd, PECmd, LECmd, JLECmd, Timeline Explorer) to parse registry hives, prefetch files, event logs, and file system metadata. Use during DFIR investigations that need a timeline of program execution, file access, and persistence built from Windows artifacts.
domain
cybersecurity
subdomain
digital-forensics
tags
eric-zimmerman, ez-tools, kape, mftecmd, pecmd, lecmd, jlecmd, registry-forensics, windows-forensics, timeline-explorer, dfir, artifact-analysis
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
RS.AN-03, DE.AE-02, RS.MA-01
mitre_attack
T1005, T1074, T1119, T1070, T1059

Performing Windows Artifact Analysis with Eric Zimmerman Tools

Overview

Eric Zimmerman's EZ Tools suite is a collection of open-source forensic utilities that have become the global standard for Windows digital forensics investigations. Originally developed by a former FBI agent and current SANS instructor, these tools parse and analyze critical Windows artifacts including the Master File Table ($MFT), registry hives, prefetch files, event logs, shortcut (LNK) files, and jump lists. The suite integrates with KAPE (Kroll Artifact Parser and Extractor) for automated artifact collection and processing, producing structured CSV output that can be ingested into Timeline Explorer for visual analysis. EZ Tools are widely used by law enforcement, corporate incident responders, and forensic consultants worldwide.

When to Use

  • When conducting security assessments that involve performing windows artifact analysis with eric zimmerman tools
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Windows 10/11 or Windows Server 2016+ analysis workstation
  • .NET 6 Runtime installed (required for EZ Tools v2.x+)
  • Administrative privileges on the analysis workstation
  • Forensic disk image or triage collection from target system
  • At least 8 GB RAM (16 GB recommended for large datasets)
  • Familiarity with NTFS file system structures and Windows internals

Tool Suite Components

KAPE (Kroll Artifact Parser and Extractor)

KAPE is the primary orchestration tool that automates artifact collection (Targets) and processing (Modules). It uses configuration files (.tkape and .mkape) to define what artifacts to collect and which EZ Tools to run against them.

Installation and Setup:

powershell
# Download KAPE from https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape
# Extract to C:\Tools\KAPE

# Update KAPE targets and modules
C:\Tools\KAPE\gkape.exe  # GUI version
C:\Tools\KAPE\kape.exe   # CLI version

# Sync latest EZ Tools binaries
C:\Tools\KAPE\Get-KAPEUpdate.ps1

Running KAPE Collection and Processing:

powershell
# Collect artifacts from E: drive (mounted forensic image) and process with EZ Tools
kape.exe --tsource E: --tdest C:\Cases\Case001\Collection --target KapeTriage --mdest C:\Cases\Case001\Processed --module !EZParser

# Collect specific artifact categories
kape.exe --tsource E: --tdest C:\Cases\Case001\Collection --target FileSystem,RegistryHives,EventLogs --mdest C:\Cases\Case001\Processed --module MFTECmd,RECmd,EvtxECmd

# Live system triage collection (run as administrator)
kape.exe --tsource C: --tdest D:\LiveTriage\Collection --target KapeTriage --mdest D:\LiveTriage\Processed --module !EZParser --vhdx LiveTriageImage
MFTECmd - Master File Table Parser

MFTECmd parses the NTFS $MFT, $J (USN Journal), $Boot, $SDS, and $LogFile into human-readable CSV format.

powershell
# Parse the $MFT file
MFTECmd.exe -f "C:\Cases\Evidence\$MFT" --csv C:\Cases\Output --csvf MFT_output.csv

# Parse the USN Journal ($J)
MFTECmd.exe -f "C:\Cases\Evidence\$J" --csv C:\Cases\Output --csvf USNJournal_output.csv

# Parse $Boot for volume information
MFTECmd.exe -f "C:\Cases\Evidence\$Boot" --csv C:\Cases\Output --csvf Boot_output.csv

# Parse $SDS for security descriptors
MFTECmd.exe -f "C:\Cases\Evidence\$SDS" --csv C:\Cases\Output --csvf SDS_output.csv

Key Fields in MFT Output:

FieldDescription
EntryNumberMFT record number
ParentEntryNumberParent directory MFT record
InUseWhether the record is active or deleted
FileNameName of the file or directory
Created0x10$STANDARD_INFORMATION creation timestamp
Created0x30$FILE_NAME creation timestamp
LastModified0x10$STANDARD_INFORMATION modification timestamp
IsDirectoryBoolean indicating directory or file
FileSizeLogical file size in bytes
ExtensionFile extension
PECmd - Prefetch File Parser

PECmd parses Windows Prefetch files (.pf) to provide evidence of program execution, including run counts and timestamps.

powershell
# Parse all prefetch files from a directory
PECmd.exe -d "C:\Cases\Evidence\Windows\Prefetch" --csv C:\Cases\Output --csvf Prefetch_output.csv

# Parse a single prefetch file with verbose output
PECmd.exe -f "C:\Cases\Evidence\Windows\Prefetch\CMD.EXE-4A81B364.pf" --json C:\Cases\Output

# Parse prefetch with keyword filtering
PECmd.exe -d "C:\Cases\Evidence\Windows\Prefetch" -k "powershell,cmd,wscript,cscript,mshta" --csv C:\Cases\Output --csvf SuspiciousExec.csv
RECmd - Registry Explorer Command Line

RECmd processes Windows registry hives using batch files that define which keys and values to extract.

powershell
# Process all registry hives with the default batch file
RECmd.exe --bn C:\Tools\KAPE\Modules\bin\RECmd\BatchExamples\RECmd_Batch_MC.reb -d "C:\Cases\Evidence\Registry" --csv C:\Cases\Output --csvf Registry_output.csv

# Process a single NTUSER.DAT hive
RECmd.exe -f "C:\Cases\Evidence\Users\suspect\NTUSER.DAT" --bn C:\Tools\KAPE\Modules\bin\RECmd\BatchExamples\RECmd_Batch_MC.reb --csv C:\Cases\Output

# Process SYSTEM hive for USB device history
RECmd.exe -f "C:\Cases\Evidence\Registry\SYSTEM" --bn C:\Tools\KAPE\Modules\bin\RECmd\BatchExamples\RECmd_Batch_MC.reb --csv C:\Cases\Output
EvtxECmd - Windows Event Log Parser

EvtxECmd parses Windows Event Log (.evtx) files into structured CSV format with customizable event ID maps.

powershell
# Parse all event logs from a directory
EvtxECmd.exe -d "C:\Cases\Evidence\Windows\System32\winevt\Logs" --csv C:\Cases\Output --csvf EventLogs_output.csv

# Parse a single event log
EvtxECmd.exe -f "C:\Cases\Evidence\Security.evtx" --csv C:\Cases\Output --csvf Security_output.csv

# Parse with custom maps for enhanced field extraction
EvtxECmd.exe -d "C:\Cases\Evidence\Logs" --csv C:\Cases\Output --maps C:\Tools\KAPE\Modules\bin\EvtxECmd\Maps
LECmd and JLECmd - Shortcut and Jump List Parsers
powershell
# Parse LNK files from Recent directory
LECmd.exe -d "C:\Cases\Evidence\Users\suspect\AppData\Roaming\Microsoft\Windows\Recent" --csv C:\Cases\Output --csvf LNK_output.csv

# Parse Jump Lists (automatic destinations)
JLECmd.exe -d "C:\Cases\Evidence\Users\suspect\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations" --csv C:\Cases\Output --csvf JumpLists_auto.csv

# Parse Jump Lists (custom destinations)
JLECmd.exe -d "C:\Cases\Evidence\Users\suspect\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" --csv C:\Cases\Output --csvf JumpLists_custom.csv
SBECmd - Shellbag Explorer Command Line
powershell
# Parse shellbags from a directory of registry hives
SBECmd.exe -d "C:\Cases\Evidence\Registry" --csv C:\Cases\Output --csvf Shellbags_output.csv

# Parse shellbags from a live system (requires admin)
SBECmd.exe --live --csv C:\Cases\Output --csvf LiveShellbags_output.csv
Timeline Explorer - Visual Analysis

Timeline Explorer is the GUI tool for analyzing CSV output from all EZ Tools. It supports filtering, sorting, column grouping, and conditional formatting.

powershell
# Launch Timeline Explorer and open CSV output
TimelineExplorer.exe "C:\Cases\Output\MFT_output.csv"

Key Timeline Explorer Features:

  • Column-level filtering with regular expressions
  • Conditional formatting for timestamp anomalies
  • Multi-column sorting for chronological analysis
  • Export filtered results to new CSV files
  • Bookmarking rows of interest

Investigation Workflow

Step 1: Artifact Collection with KAPE
powershell
# Full triage collection from forensic image mounted at E:
kape.exe --tsource E: --tdest C:\Cases\Case001\Collected --target KapeTriage --vhdx TriageImage --zv false
Show full SKILL.md (316 more words)Show less
Step 2: Artifact Processing with EZ Tools
powershell
# Process all collected artifacts
kape.exe --msource C:\Cases\Case001\Collected --mdest C:\Cases\Case001\Processed --module !EZParser
Step 3: Timeline Analysis
  1. Open processed CSV files in Timeline Explorer
  2. Sort by timestamp columns to establish chronological order
  3. Filter for specific file extensions, paths, or event IDs
  4. Cross-reference MFT timestamps with event log entries
  5. Identify timestomping by comparing $SI and $FN timestamps
  6. Document findings with bookmarks and exported filtered views
Step 4: Timestomping Detection
powershell
# In Timeline Explorer, compare these columns:
# Created0x10 ($STANDARD_INFORMATION) vs Created0x30 ($FILE_NAME)
# If Created0x10 < Created0x30, timestomping is indicated
# $FILE_NAME timestamps are harder to manipulate than $STANDARD_INFORMATION

Forensic Artifacts Reference

ToolArtifactLocation
MFTECmd$MFTRoot of NTFS volume
MFTECmd$J (USN Journal)$Extend$UsnJrnl:$J
PECmdPrefetch filesC:\Windows\Prefetch*.pf
RECmdNTUSER.DATC:\Users{user}\NTUSER.DAT
RECmdSYSTEM hiveC:\Windows\System32\config\SYSTEM
RECmdSAM hiveC:\Windows\System32\config\SAM
RECmdSOFTWARE hiveC:\Windows\System32\config\SOFTWARE
EvtxECmdEvent logsC:\Windows\System32\winevt\Logs*.evtx
LECmdLNK filesC:\Users{user}\AppData\Roaming\Microsoft\Windows\Recent\
JLECmdJump listsC:\Users{user}\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\
SBECmdShellbagsNTUSER.DAT and UsrClass.dat registry hives

Common Investigation Scenarios

Malware Execution Evidence
  1. Parse Prefetch with PECmd to identify executed binaries
  2. Cross-reference with MFT for file creation timestamps
  3. Check Amcache.hve with RECmd for SHA1 hashes of executables
  4. Correlate with Event Log entries for process creation (Event ID 4688)
Data Exfiltration Investigation
  1. Parse USN Journal with MFTECmd for file rename/delete operations
  2. Analyze LNK files with LECmd for recently accessed documents
  3. Review Shellbags with SBECmd for directory browsing activity
  4. Check for USB device connections in SYSTEM registry with RECmd
Lateral Movement Detection
  1. Parse Security.evtx with EvtxECmd for logon events (4624, 4625)
  2. Analyze RDP-related event logs (Microsoft-Windows-TerminalServices)
  3. Cross-reference with network share access from SMB logs
  4. Review scheduled tasks and services for persistence mechanisms

Output Format and Integration

All EZ Tools produce CSV output that can be:

  • Analyzed in Timeline Explorer for visual investigation
  • Imported into Splunk, Elastic, or other SIEM platforms
  • Processed by Python/PowerShell scripts for automated analysis
  • Combined into super timelines using log2timeline/Plaso

References

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Performing Windows Artifact Analysis With Eric Zimmerman Tools next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Performing Windows Artifact Analysis With Eric Zimmerman Tools compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Performing Windows Artifact Analysis With Eric Zimmerman Tools this skillmukul975/Anthropic-Cybersecurity-Skills34k—~3kAutomated safety check: PassApache-2.0
Oss ForensicsTommy-yw/RunbookHermes5463 repos~5kAutomated safety check: PassMIT
Ctf Malwareljagiello/ctf-skills3.4k—~2.1kAutomated safety check: NotesMIT
Dfirtransilienceai/communitytools563—~1.5kAutomated safety check: PassMIT
TShark Traffic AnalysisAgentSecOps/SecOpsAgentKit2201 repos~4.8kAutomated safety check: NotesCustom licence
Runtime Memory Sample Acquisitiondslsdzc/rev-skills135—~2kAutomated safety check: PassApache-2.0

Similar skills

  • Oss Forensics

    Tommy-yw/RunbookHermes

    Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories.

    546 GitHub starsUsed in 3 repos~5k tokens
    SecurityAuto-check passed

  • Ctf Malware

    ljagiello/ctf-skills

    Provides malware analysis and network traffic techniques for CTF challenges.

    3.4k GitHub stars~2.1k tokensUpdated 27 days ago
    SecurityAuto-check: notes

  • Dfir

    transilienceai/communitytools

    Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.

    563 GitHub stars~1.5k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • TShark Traffic Analysis

    AgentSecOps/SecOpsAgentKit

    Guides authorized packet capture and analysis with TShark, Wireshark's command-line tool, for security investigations, malware detection and forensic examination of network traffic.

    220 GitHub starsUsed in 1 repo~4.8k tokens
    SecurityAuto-check: notes

  • Runtime Memory Sample Acquisition

    dslsdzc/rev-skills

    Captures an analyzable sample from a live system when the target leaves no file on disk, by finding abnormal executable memory and the execution context that reached it.

    135 GitHub stars~2k tokensUpdated 6 days ago
    SecurityAuto-check passed

  • Digital Forensics

    zhaoxuya520/reverse-skill

    A skill your agent uses for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.

    41k GitHub starsUsed in 2 repos~389 tokens
    SecurityAuto-check: warnings

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Performing Windows Artifact Analysis With Eric Zimmerman Tools

What does Performing Windows Artifact Analysis With Eric Zimmerman Tools do?

Performs comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite (KAPE, MFTECmd, PECmd, LECmd, JLECmd, Timeline Explorer) to parse registry hives, prefetch…. Performing Windows Artifact Analysis With Eric Zimmerman Tools is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Performs comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite (KAPE, MFTECmd, PECmd, LECmd, JLECmd, Timeline Explorer) to parse registry hives, prefetch files, event logs, and file system metadata.

When should I use Performing Windows Artifact Analysis With Eric Zimmerman Tools?

Performing Windows Artifact Analysis With Eric Zimmerman Tools fits situations like: tasks that involve Digital forensics.

How do I install Performing Windows Artifact Analysis With Eric Zimmerman Tools in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-windows-artifact-analysis-with-eric-zimmerman-tools -a claude-code`. Or copy the skill folder (skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools in your project. Claude Code loads it when a task matches its description.

How do I install Performing Windows Artifact Analysis With Eric Zimmerman Tools in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-windows-artifact-analysis-with-eric-zimmerman-tools -a codex`. Or copy the skill folder (skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools in your project. Codex loads it when a task matches its description.

Can I use Performing Windows Artifact Analysis With Eric Zimmerman Tools in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-windows-artifact-analysis-with-eric-zimmerman-tools -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools, .gemini/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools, .github/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools and .opencode/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools in your project.

What does Performing Windows Artifact Analysis With Eric Zimmerman Tools need to run?

Going by SKILL.md and its folder, Performing Windows Artifact Analysis With Eric Zimmerman Tools needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Performing Windows Artifact Analysis With Eric Zimmerman Tools access the network?

SKILL.md names 3 domains. In commands or code: kroll.com; the agent is likely to contact it when it follows the instructions. As links in the text: ericzimmerman.github.io and sans.org. This is read from the text; nothing was executed.

Is Performing Windows Artifact Analysis With Eric Zimmerman Tools safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Performing Windows Artifact Analysis With Eric Zimmerman Tools use?

Performing Windows Artifact Analysis With Eric Zimmerman Tools is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Performing Windows Artifact Analysis With Eric Zimmerman Tools use?

About 3k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.9k tokens, read only when the agent opens those files.

What are the alternatives to Performing Windows Artifact Analysis With Eric Zimmerman Tools?

Skills that share tags, products or a category with Performing Windows Artifact Analysis With Eric Zimmerman Tools: Oss Forensics (Tommy-yw/RunbookHermes, 546 stars), Ctf Malware (ljagiello/ctf-skills, 3.4k stars), Dfir (transilienceai/communitytools, 563 stars) and TShark Traffic Analysis (AgentSecOps/SecOpsAgentKit, 220 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Performing Windows Artifact Analysis With Eric Zimmerman Tools?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.