SAVVYDFIR-MCP: Skill for Claude Code

Pivot Methodology - Universal Investigation Chains

From a Suspicious Process

Process (PID, name, path)
  ├── detect_injection(pid=PID)      → Check for code injection
  ├── list_dlls(pid=PID)             → Check loaded DLLs
  ├── scan_network(dump_path)        → Filter connections by PID
  ├── extract_prefetch()             → Find .PF file for execution proof
  ├── get_amcache()                  → Get SHA-1 hash of binary
  └── list_deleted_files()           → Check if binary was deleted after execution

From a Network Connection

Connection (remote_ip, remote_port, PID)
  ├── Look up owning process via PID  → What binary is talking?
  ├── detect_injection(pid=PID)       → Is the process injected?
  ├── Timeline query around timestamp  → What else happened at this time?
  ├── YARA scan memory for C2 sigs    → Known malware family?
  └── Check other connections to same IP → How many hosts are beaconing?

From a Prefetch Entry

Prefetch (executable_name, run_count, last_run_times)
  ├── Is the binary still on disk?    → fls or ls
  │   ├── YES → sha256sum + check VirusTotal
  │   └── NO  → Attacker cleaned up (check deleted files + amcache SHA-1)
  ├── What DLLs did it reference?     → referenced_files in prefetch
  ├── What user ran it?               → Correlate with Event 4688 at same timestamp
  └── Timeline around first_run_time  → What happened just before execution?

From a Registry Persistence Key

Registry Key (path, value_data)
  ├── Does the binary in value_data exist on disk?
  │   ├── YES → Hash it, check amcache, check if it was timestomped
  │   └── NO  → Binary deleted but persistence remains (compromised + partial cleanup)
  ├── When was the key last written?  → Correlate with timeline
  ├── Who created it?                 → Check Event 4657 (registry audit) or 4688
  └── What type of persistence?       → Map to ATT&CK: T1547, T1053, T1543, etc.

From a Deleted File

Deleted File (path, inode, size)
  ├── extract_prefetch()              → Was the deleted file ever executed?
  ├── get_amcache()                   → SHA-1 hash survived deletion?
  ├── extract_mft_timeline()          → When was it created? Modified? Deleted?
  ├── icat to extract content         → Recover the file for analysis
  └── YARA scan the extracted file    → Known malware signature?