Skill Claude CodeCodex
Use this skill for all memory image analysis on the SIFT workstation. Always run as root (sudo su) — some plugins require elevated privileges to resolve symbols.
52 5d ago B 0 tokens
original MIT
52Stars on the repository
11Mods indexed here, across every type
5d agoLast push, which is what freshness is scored on
MITLicence, which decides whether bodies are shown
Skill Claude CodeCodex
Use this skill for all super-timeline creation, filtering, and analysis tasks using the Plaso suite on the SANS SIFT workstation. Plaso parses hundreds of artifact types from disk images, mounted filesystems, and individual files into a unified timeline.
52 5d ago B 0 tokens
original MIT
sleuthkit
03Skill Claude CodeCodex
Use this skill for disk image analysis, filesystem navigation, file extraction, and file carving on the SIFT workstation. Evidence images are commonly in E01 (Expert Witness Format). Always mount read-only to preserve evidence integrity.
52 5d ago B 0 tokens
original MIT
Skill Claude CodeCodex
Use this skill for Windows host-based artifact analysis on the SIFT workstation. Covers Eric Zimmerman (EZ) Tools, ASEP/persistence analysis, Windows event log parsing, and execution/access evidence artifacts.
52 5d ago A 0 tokens
original MIT
yara-hunting
05Skill Claude CodeCodex
Use this skill for IOC sweeps, malware identification, and threat hunting. YARA 4.1.0 runs locally on SIFT Linux for scanning files and memory images. Velociraptor is an endpoint agent — hunts are deployed via its web console, not run directly from the SIFT command line.
52 5d ago A 0 tokens
original MIT