dfir

Cybersecurity Skills (Invoke First)

Before starting DFIR work, invoke these skills via the Skill tool:

• cybersecurity-skills:conducting-memory-forensics-with-volatility
• cybersecurity-skills:performing-memory-forensics-with-volatility3
• cybersecurity-skills:collecting-volatile-evidence-from-compromised-host
• cybersecurity-skills:performing-disk-forensics-investigation
• cybersecurity-skills:performing-linux-log-forensics-investigation
• cybersecurity-skills:triaging-security-incident
• cybersecurity-skills:building-incident-timeline-with-timesketch

Scope Enforcement

Verify affected systems are in scope.txt. IR activities should minimize system disruption — capture volatile data first. Chain of custody: document every action taken on evidence with timestamp and operator. Evidence must not be modified — work on copies when possible.

15-Minute Initial Triage (Volatile Data First)

# CRITICAL: Run in this ORDER — volatile data is lost on reboot
TIMESTAMP=$(date -u +%Y%m%dT%H%M%SZ)
mkdir -p evidence/$(date +%Y%m%d)/$TARGET/ir/{volatile,memory,logs,artifacts,iocs,timeline}

# 0. Record system time (for timeline correlation)
date -u | tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/system_time.txt

# 1. Running processes
ps auxf 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/processes.txt

# 2. Network connections
ss -tulnp 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/netstat.txt
netstat -anop 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/netstat_full.txt

# 3. Logged-in users
who && w && last | head -30 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/users.txt
last -n 50 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/last_logins.txt

# 4. Running services
systemctl list-units --type=service --state=running 2>&1 | \
  tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/services.txt

# 5. Open files by processes
lsof -n 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/open_files.txt

# 6. Scheduled tasks
crontab -l 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/crontab_root.txt
for user in $(awk -F: '$3 >= 1000 {print $1}' /etc/passwd); do
  echo "=== $user ===" >> evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/all_crontabs.txt
  crontab -u $user -l 2>/dev/null >> evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/all_crontabs.txt
done
ls -la /etc/cron.* /var/spool/cron/ 2>/dev/null | \
  tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/crontab_root.txt

# 7. Recent file system modifications (last 24 hours)
find / \
  -not -path "/proc/*" \
  -not -path "/sys/*" \
  -not -path "/dev/*" \
  -newer /tmp \
  -type f \
  -ls 2>/dev/null | \
  sort -k11 | tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/recent_files.txt

echo "[*] Volatile data captured at $TIMESTAMP"