TShark Traffic Analysis
AgentSecOps/SecOpsAgentKit
Guides authorized packet capture and analysis with TShark, Wireshark's command-line tool, for security investigations, malware detection and forensic examination of network traffic.
Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.
Install Dfir
$ npx skills add transilienceai/communitytools --skill dfir -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install transilienceai/communitytools dfir --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/dfir .claude/skills/dfir && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "dfir" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/dfir into .claude/skills/dfir/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dfir", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/transilienceai/communitytools/tree/main/skills/dfirType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add transilienceai/communitytools --skill dfir -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install transilienceai/communitytools dfir --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/dfir .agents/skills/dfir && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "dfir" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/dfir into .agents/skills/dfir/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dfir", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add transilienceai/communitytools --skill dfir -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install transilienceai/communitytools dfir --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/dfir .cursor/skills/dfir && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "dfir" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/dfir into .cursor/skills/dfir/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dfir", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/transilienceai/communitytools.git --path skills/dfir--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add transilienceai/communitytools --skill dfir -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install transilienceai/communitytools dfir --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/dfir .gemini/skills/dfir && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "dfir" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/dfir into .gemini/skills/dfir/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dfir", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install transilienceai/communitytools dfirInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add transilienceai/communitytools --skill dfir -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/dfir .github/skills/dfir && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "dfir" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/dfir into .github/skills/dfir/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dfir", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add transilienceai/communitytools --skill dfir -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install transilienceai/communitytools dfir --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/dfir .opencode/skills/dfir && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "dfir" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/dfir into .opencode/skills/dfir/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dfir", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
dfir- GitHub stars
- 562
- Token cost
- ~1.5k tokens
- SKILL.md length
- 685 words
- Files
- 37
- Skills in repo
- 35
- Repo updated
- First seen
- Licence
- MIT
At a glance
Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.
- Works in 6 steps: Inventory evidence — List all artifacts… → Parse structured data — EVTX with… → Identify attack indicators — Key Event… → …
- Investigating security incidents
- SKILL.md covers Techniques, Workflow, Tools and Quick Reference: Key Event IDs, plus 2 more sections
- Calls pip and brew; reaches schemas.microsoft.com
What it does
Dfir is an agent skill from transilienceai/communitytools. Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when investigating security incidents, analyzing Sherlocks, or performing threat hunting on provided evidence files.
Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 41 other files (for example `reference/INDEX.md`, `reference/c2-traffic-decryption.md` and `reference/dfir-principles.md`).
It sits in Security, covering Digital forensics and Security operations. It works with Wireshark. The repository describes itself as: Open-source Claude Code skills, agents, and slash commands for AI-powered penetration testing, bug bounty hunting, and security research. The licence is MIT.
When your agent uses it
- Investigating security incidents
- Analyzing Sherlocks
- Performing threat hunting on provided evidence files
Example prompts
- “/dfir”
Requirements
- Python 3
Workflow steps
6 steps, taken from the first numbered list in SKILL.md.
- Inventory evidence — List all artifacts (EVTX, pcap, MFT, prefetch, registry)
- Parse structured data — EVTX with python-evtx, pcap with tshark, MFT with analyzeMFT
- Identify attack indicators — Key Event IDs, suspicious traffic patterns, anomalous files
- Correlate across sources — Match timestamps, IPs, LogonIDs, and process IDs across artifacts
- Reconstruct timeline — Build chronological attack chain with UTC timestamps
- Answer investigative questions — Map findings to specific incident response queries
What it can do on your machine
Read from SKILL.md and the folder at commit 95fdc12. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
pipbrew
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
schemas.microsoft.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Dfir loads about 1.5k tokens when it runs. Until then it costs about 72 tokens; SKILL.md has 685 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from transilienceai/communitytools at commit 95fdc12, republished under its MIT licence (© transilienceai). 685 words, ~1,523 tokens.
Download SKILL.mdSave it as
.claude/skills/dfir/SKILL.md (or your agent's skills folder). This skill also uses 36 other files; get the full folder from GitHub.- name
- dfir
- description
- Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when investigating security incidents, analyzing Sherlocks, or performing threat hunting on provided evidence files.
DFIR
Investigate security incidents by analyzing event logs, network captures, and filesystem artifacts. Detect and reconstruct AD attack chains.
Techniques
| Domain | Key Capabilities |
|---|---|
| Windows Event Logs | EVTX parsing, Event ID correlation, logon tracking, privilege enumeration |
| Network Forensics | PCAP analysis, NTLM extraction, LLMNR/NBT-NS poisoning detection, relay identification |
| Filesystem Forensics | MFT parsing, Prefetch analysis, VSS artifact recovery, Linux persistence, timeline reconstruction |
| AD Attack Detection | Kerberoasting, AS-REP roasting, NTDS dump, NTLM relay, credential theft |
| Memory Forensics | Volatility3 analysis: process trees, file extraction, SID resolution, command lines |
| Hash Analysis | NTLMv2 hash construction from pcap, offline cracking validation |
Workflow
- Inventory evidence — List all artifacts (EVTX, pcap, MFT, prefetch, registry)
- Parse structured data — EVTX with
python-evtx, pcap withtshark, MFT withanalyzeMFT - Identify attack indicators — Key Event IDs, suspicious traffic patterns, anomalous files
- Correlate across sources — Match timestamps, IPs, LogonIDs, and process IDs across artifacts
- Reconstruct timeline — Build chronological attack chain with UTC timestamps
- Answer investigative questions — Map findings to specific incident response queries
Tools
pip install python-evtx windowsprefetch analyzeMFT
brew install wireshark p7zip hashcat| Tool | Purpose |
|---|---|
python-evtx | Parse Windows .evtx files |
tshark | CLI pcap analysis (NTLM, LLMNR, SMB filters) |
analyzeMFT | Parse NTFS Master File Table |
windowsprefetch | Parse Windows prefetch files (Windows host only) |
hashcat | Hash cracking (NTLMv2 mode 5600, Kerberos mode 13100/18200) |
volatility3 | Memory dump analysis (pstree, filescan, dumpfiles, getsid, cmdline) |
7z | Extract AES-encrypted evidence ZIPs |
Quick Reference: Key Event IDs
| Event ID | Log | Indicates |
|---|---|---|
| 4624 | Security | Successful logon (check Type + IP mismatch) |
| 4768 | Security | TGT request (PreAuthType=0 → AS-REP roast) |
| 4769 | Security | TGS request (EncType=0x17 → Kerberoast) |
| 4799 | Security | Group membership enumerated (VSS/ntdsutil) |
| 5140 | Security | Network share accessed |
| 7036 | System | Service state change (VSS start → NTDS dump) |
| 325/326/327 | Application | ESENT database create/detach/close |
| 330 | Application | ESENT database file info |
| 3006/3008 | DNS Client Events | DNS query sent/response received (malicious domain lookups) |
| 106/200 | Task Scheduler | Scheduled task created/executed (persistence via schtasks) |
Reference
- windows-event-analysis.md — EVTX parsing patterns and AD attack detection
- network-forensics.md — PCAP analysis for NTLM, LLMNR, relay detection
- filesystem-forensics.md — MFT, Prefetch, VSS artifact analysis
Show full SKILL.md (364 more words)Show less
Critical Rules
- Answer formatting: When forensics questions ask for "the value" of a code variable (e.g., PHP
$shell), include language-specific string delimiters and terminators (e.g.,'value';not justvalue). Check placeholder hints for format clues. - For malicious Office OOXML, inspect more than VBA streams: attackers may split staged Base64 or script content across drawing/object descriptors, shared strings, named cells, and hidden UserForm control captions/values.
- When a VBA byte array starts with an
fnstenv/popdecoder stub, convert signed integers to raw bytes and test a Shikata-style rolling XOR decode before treating the shellcode as corrupt. - For legacy Excel BIFF/XLS malware, inspect
BOUNDSHEETrecords forhiddenorvery hiddenworksheets and specifically check for Excel 4.0 macro sheets; changing the hidden-state byte or parsing the sheet directly can expose staged strings and flag fragments that never appear in normal workbook views. - For webshell traffic in PCAPs, recover static keys from the uploaded server-side code first, then decrypt operator tasking before chasing later payloads; if a dropped XOR key file is referenced by a shellcode stage, verify where the encoded region actually starts instead of XORing the whole blob from offset zero.
- PowerShell stager pattern (in-place reverse + base64 + IEX): when a stage-1 PS script does
[array]::Reverse($charArr)followed byFromBase64String("$charArr"), the-joinline is often a red herring — string interpolation of a char array uses$OFS=' 'andFromBase64Stringtolerates whitespace. Reverse the original base64 string (not the joined-with-spaces version) and decode to get stage 2. - Multi-fragment flag exfil: forensic challenges may split a flag across (a) a hardcoded
$partNin the malware that is defined but never referenced (often base64'd), and (b) a field of the captured C2 POST body. Decrypt the body with the static AES key from the leaked stage-2 source (PowerShellEncrypt-StringputsIV‖ciphertextthen base64-wraps); inspect every JSON field for further base64. - All timestamps in UTC — convert from local time zones in pcap/logs. AM/PM trap: 12:XX AM = 00:XX (midnight), 12:XX PM = 12:XX (noon). 12 AM ≠ 01:00.
- Parse EVTX with
python-evtx(XML namespace:http://schemas.microsoft.com/win/2004/08/events/event) - Use
tsharkfor pcap (not scapy for large files) — filter with-Ydisplay filters - Decompress Win10 prefetch (MAM\x04 header) with
dissect.util.compression.lzxpress_huffman - For AES-encrypted ZIPs (compression method 99), use
7znotunzip
© transilienceai, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 36 other files in skills/dfir of transilienceai/communitytools.
- SKILL.md
- reference/INDEX.md
- reference/c2-traffic-decryption.md
- reference/dfir-principles.md
- reference/filesystem-forensics.md
- reference/network-forensics.md
- reference/scenarios/ad-attack-detection/dcsync-detection.md
- reference/scenarios/ad-attack-detection/golden-ticket-detection.md
- reference/scenarios/ad-attack-detection/kerberos-roast-detection.md
- reference/scenarios/ad-attack-detection/lateral-movement-indicators.md
- reference/scenarios/filesystem/lnk-file-analysis.md
- reference/scenarios/filesystem/ntfs-mft-analysis.md
- reference/scenarios/filesystem/prefetch-analysis.md
- reference/scenarios/filesystem/shellbags-userassist.md
- reference/scenarios/filesystem/timeline-creation.md
- reference/scenarios/log-analysis/linux-auth-logs.md
- … and 21 more
Open the folder on GitHubat commit 95fdc12
Compare with similar skills
Dfir next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Dfir this skilltransilienceai/communitytools | 562 | — | ~1.5k | Automated safety check: Pass | MIT | |
| TShark Traffic AnalysisAgentSecOps/SecOpsAgentKit | 220 | 1 repos | ~4.8k | Automated safety check: Notes | Custom licence | |
| Network Covert Channel Analysismukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2k | Automated safety check: Pass | Apache-2.0 | |
| Forensics OsqueryAgentSecOps/SecOpsAgentKit | 220 | 1 repos | ~4.9k | Automated safety check: Notes | Custom licence | |
| Performing Network Packet Capture Analysismukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.3k | Automated safety check: Pass | Apache-2.0 | |
| Detecting Arp Poisoning In Network Trafficmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3.8k | Automated safety check: Notes | Apache-2.0 |
Similar skills
Network Covert Channel Analysis
mukul975/Anthropic-Cybersecurity-Skills
Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.
Forensics Osquery
AgentSecOps/SecOpsAgentKit
SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases.
Performing Network Packet Capture Analysis
mukul975/Anthropic-Cybersecurity-Skills
Perform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic…
Detecting Arp Poisoning In Network Traffic
mukul975/Anthropic-Cybersecurity-Skills
Detect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARP Inspection (DAI), Wireshark packet analysis, and custom Python monitoring scripts that flag gratuitous ARP floods, IP-to-MAC…
Analyzing Network Traffic For Incidents
mukul975/Anthropic-Cybersecurity-Skills
Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and…
More from transilienceai/communitytools
All 35 skills in this repoGitHub Workflow
transilienceai/communitytools
GitHub workflow automation — branching, committing, pushing, pull requests, issues, and code review.
Pci Secure Software
transilienceai/communitytools
Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation.
Protect With Password
transilienceai/communitytools
Generate ONE strong password and apply it to each referenced file (PDF, Word, Excel, PowerPoint, or any type).
Skill Update
transilienceai/communitytools
Skill creation, update and management — generates skill directory structure, validates against best practices, enforces line count limits.
Source Code Scanning
transilienceai/communitytools
Security-focused source code review and SAST. An agent skill from transilienceai/communitytools.
Transilience Report Style
transilienceai/communitytools
Generate a Transilience-branded PDF report (pentest, vuln assessment, compliance, threat intel) from a single findings JSON using the bundled ReportLab generator.
Related
Works with
Categories
Questions about Dfir
What does Dfir do?
Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Dfir is an agent skill from transilienceai/communitytools. Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.
When should I use Dfir?
Dfir fits situations like: investigating security incidents; analyzing Sherlocks; performing threat hunting on provided evidence files.
How do I install Dfir in Claude Code?
Run `npx skills add transilienceai/communitytools --skill dfir -a claude-code`. Or copy the skill folder (skills/dfir in transilienceai/communitytools) into .claude/skills/dfir in your project. Claude Code loads it when a task matches its description.
How do I install Dfir in Codex?
Run `npx skills add transilienceai/communitytools --skill dfir -a codex`. Or copy the skill folder (skills/dfir in transilienceai/communitytools) into .agents/skills/dfir in your project. Codex loads it when a task matches its description.
Can I use Dfir in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add transilienceai/communitytools --skill dfir -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/dfir, .gemini/skills/dfir, .github/skills/dfir and .opencode/skills/dfir in your project.
What does Dfir need to run?
Going by SKILL.md and its folder, Dfir needs the command-line tools its instructions call (pip and brew). Our summary lists: Python 3.
Does Dfir access the network?
SKILL.md names 1 domain. In commands or code: schemas.microsoft.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.
Is Dfir safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Dfir use?
Dfir is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Dfir use?
About 1.5k tokens (SKILL.md is roughly 6.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Dfir?
Skills that share tags, products or a category with Dfir: TShark Traffic Analysis (AgentSecOps/SecOpsAgentKit, 220 stars), Network Covert Channel Analysis (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Forensics Osquery (AgentSecOps/SecOpsAgentKit, 220 stars) and Performing Network Packet Capture Analysis (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Dfir?
transilienceai (a GitHub organization) maintains it in transilienceai/communitytools, which has 562 GitHub stars. The repository holds 35 skills in this directory. The repository was last updated on July 29, 2026.
Source: transilienceai/communitytools on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.