Best digital forensics skills, page 2

Analyze memory dumps using Volatility3 plugins to detect injected code, rootkits, credential theft, and malware artifacts in Windows, Linux, and macOS memory images.

mukul975/Anthropic-Cybersecurity-Skills

Performs comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite (KAPE, MFTECmd, PECmd, LECmd, JLECmd, Timeline Explorer) to parse registry hives, prefetch…

mukul975/Anthropic-Cybersecurity-Skills

Analyze Linux, SteamOS, Steam Deck, Wine, or Proton game-security boundaries.

gmh5225/awesome-game-security

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials.

mukul975/Anthropic-Cybersecurity-Skills

Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets.

mukul975/Anthropic-Cybersecurity-Skills

Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available…

mukul975/Anthropic-Cybersecurity-Skills

Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident…

mukul975/Anthropic-Cybersecurity-Skills

Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading.

mukul975/Anthropic-Cybersecurity-Skills

Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection.

mukul975/Anthropic-Cybersecurity-Skills

Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and…

mukul975/Anthropic-Cybersecurity-Skills

Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into…

mukul975/Anthropic-Cybersecurity-Skills

Recovers files from disk images and unallocated space using Foremost's header-footer signature carving, extracting evidence independent of the file system's state.

mukul975/Anthropic-Cybersecurity-Skills

Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process…

mukul975/Anthropic-Cybersecurity-Skills

Forensic bug and issue triage. An agent skill from aj-geddes/claude-code-bmad-skills.

aj-geddes/claude-code-bmad-skills

Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection.

ancoleman/ai-design-components

Performs forensic analysis of SQLite databases by examining B-tree page structures, recovering deleted records from freelist pages and Write-Ahead Log (WAL) files, decoding encoded timestamps, and…

mukul975/Anthropic-Cybersecurity-Skills

Extracts and analyzes browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge using sqlite3, DB Browser for SQLite, Hindsight, and NirSoft tools…

mukul975/Anthropic-Cybersecurity-Skills

Audit a Node.js project's installed npm dependency tree for known CVEs by wrapping the npm audit JSON output and emitting findings in the canonical penetration-tester schema.

jeremylongshore/tons-of-skills-marketplace

Audit a Python project's installed dependencies for known CVEs by wrapping pip-audit (PyPA's official vulnerability auditor) and emitting findings in the canonical penetration-tester schema.

jeremylongshore/tons-of-skills-marketplace

Memory forensics playbook using Volatility 2/3. An agent skill from yaklang/hack-skills.

yaklang/hack-skills

Coordinate Levyra work through OpenClaw using a dedicated repository workspace, compact delegation, specialized review and CI agents, project-native skills, evidence collection, durable memory, and…

LUC4N3X/Levyra-deepsound

Guides forensic analysis of disk images — integrity verification, partition layout, file-system survey, deleted-file recovery and timeline reconstruction.

criptogus/agent-evolve-network

Systematically map and remove malware, backdoors, and attacker persistence mechanisms (registry Run keys, scheduled tasks, WMI subscriptions, services, cron/init.d) from infected Windows and Linux…

mukul975/Anthropic-Cybersecurity-Skills

GEO-focused fact-checking and evidence collection assistant for written content.

LeoYeAI/openclaw-master-skills

Build a read-only compromise timeline and evidence bundle from local Git history and public forge/archive records.

alpha-omega-security/scrutineer

Compliance and security auditing for Cursor IDE usage: SOC 2, GDPR, HIPAA assessment, evidence collection, and remediation.

jeremylongshore/tons-of-skills-marketplace

日志分析与日志逃逸方法论。理解蓝队如何通过日志追踪攻击行为（SIEM/Event Log/Syslog），以及红队如何规避日志记录或精准清除痕迹。当需要设计无痕操作或分析日志监控覆盖范围时使用

wgpsec/AboutSecurity

内存取证与反内存取证方法论。从蓝队视角理解内存取证如何发现恶意行为（Volatility3 分析流程），从红队视角掌握如何规避内存检测（进程隐藏、内存加密、痕迹清除）。当需要分析内存 dump 或设计反取证策略时使用

wgpsec/AboutSecurity

Design a focused lesson observation protocol with specific look-fors and evidence collection methods.

GarethManning/education-agent-skills

Guides continuous privacy compliance monitoring implementation including automated control testing, evidence collection automation, real-time compliance dashboards, alert-based remediation…

mukul975/Privacy-Data-Protection-Skills

Build a reproducible Google Search workflow that validates parameters, optional result sections, and bounded pagination.

jeremylongshore/tons-of-skills-marketplace

移动设备取证：Android/iOS 备份解析、应用数据提取、删除恢复与时间线. An agent skill from dslsdzc/rev-skills.

dslsdzc/rev-skills

AWS VPC networking audit covering CIDR architecture, Security Group and NACL rule analysis, Transit Gateway connectivity, VPC Flow Log forensics, Route Table validation, and ENI/EIP resource…

LeoYeAI/openclaw-master-skills

Incident response process management following the NIST 800-61 lifecycle.

LeoYeAI/openclaw-master-skills

Network forensics evidence collection and analysis during security incidents.

LeoYeAI/openclaw-master-skills

Run digital forensics and incident response — triage, evidence acquisition with chain of custody, host and cloud artifact analysis, timeline reconstruction, scoping, containment, eradication, and…

trilwu/secskills

磁盘/文件系统取证：删除恢复、时间线、可疑文件定位. An agent skill from dslsdzc/rev-skills.

dslsdzc/rev-skills

Guides privacy audit evidence collection processes including evidence planning, sampling strategies, documentation standards, chain of custody, interview techniques, system walkthrough procedures…

mukul975/Privacy-Data-Protection-Skills

Conducts digital forensics investigations following a personal data breach, covering evidence preservation, chain of custody documentation, log analysis, scope determination, and root cause analysis.

mukul975/Privacy-Data-Protection-Skills

On-site and remote vendor audit procedures per GDPR Article 28(3)(h).

mukul975/Privacy-Data-Protection-Skills