85 tagged dfir, measured the same way as everything else here.
Browse within: malware-analysis 65reverse-engineering 65detection-engineering 59mitre-attack 58static-analysis 13incident-response 12forensics 11digital-forensics 8pdf 8deleted-files 7file-recovery 7file-system-forensics 7logfile 7malware 7
Skill Claude CodeCodex
Research, author, and validate AI agent artifact catalog entries documenting the forensic artifacts AI agents leave on endpoints - install paths, config and credential files, MCP server configs, listening ports, process trees, registry keys, and the Windows event log records that prove a tool ran. Use this skill…
Skill Claude CodeCodex
Analyzes a memory image with Volatility 3 to find malware: rogue processes, injected code, suspicious network connections, loaded modules, and persistence, then extracts artifacts for further analysis. Activates for requests to do memory forensics, analyze a RAM dump, or hunt malware in memory with Volatility.
Skill Claude CodeCodex
Analyzes how a ransomware sample encrypts files: identifying the crypto scheme (symmetric/asymmetric/hybrid), key handling, file targeting and extension/marker changes, shadow-copy deletion, and ransom-note artifacts. Activates for requests to analyze ransomware encryption, assess decryptability, or study ransomware…
Skill Claude CodeCodex
Uses x64dbg to dynamically debug Windows malware: setting strategic breakpoints on APIs, stepping through unpacking and decryption, dumping memory at the right moment, and manipulating execution to reach hidden code. Activates for requests to debug malware with x64dbg, set API breakpoints, or step through unpacking in…
Skill Claude CodeCodexCursor
Process image files into validated CASE/UCO or CAC knowledge graphs. Use when the user provides images, receipts, screenshots, scans, photos, OCR output, or asks to convert an image file into CASE/UCO/CAC JSON-LD.
kev365/xways-xtension-builder-skill
Skill Claude CodeCodex
This skill should be used when the user asks to "create/scaffold a new X-Tension", "wrap a CLI tool in an X-Tension", "port a convention into an X-Tension" (helper-exe verification, Ctrl-to-save, output-dir), "audit/modernize an X-Tension", "build/compile an X-Tension", "prep an X-Tension for public release", or asks…
Skill Claude CodeCodex
REQUIRED when the user says "start investigation", "investigate", "analyze case", "Read case-templates/manifest.json", references a manifest.json, or provides a SAVVYDFIR-MCP caseid. Defines the 5-phase DFIR methodology from evidence mounting through report generation, with mandatory tools, decision points, and…
Skill Claude CodeCodex
Load when you have an initial finding and need to determine what to investigate next. Defines universal pivot chains from each artifact type to related evidence, enabling systematic investigation expansion.
Skill Claude CodeCodex
Load when you need exact command syntax for SIFT Workstation tools. Covers Volatility 3, Sleuth Kit, EZ Tools, Plaso, YARA, and Regripper with actual invocation examples and output parsing guidance.
Skill Claude CodeCodex
Use when writing or creating Sigma rules, reviewing detection rules, discussing detection coverage, or working with YAML detection files in this repo. Enforces this project's rule-quality standards (ATT&CK mapping, severity justification, false-positive documentation, test cases, naming convention) before a rule is…