168 tagged dfir, measured the same way as everything else here.
Browse within: malware-analysis 130reverse-engineering 129detection-engineering 120mitre-attack 119threat-hunting 44incident-response 31forensics 30static-analysis 23malware 14digital-forensics 13mft 12mftecmd 12deleted-files 11file-recovery 11
Skill Claude CodeCodex needs its repo
Research, author, and validate AI agent artifact catalog entries documenting the forensic artifacts AI agents leave on endpoints - install paths, config and credential files, MCP server configs, listening ports, process trees, registry keys, and the Windows event log records that prove a tool ran. Use this skill…
Skill Claude CodeCodex
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
Skill Claude CodeCodex
Which Valhuntir MCP tool or SIFT tool to use for a question, file, IOC or artifact, and the step-by-step workflows that combine them (IOC investigation, threat actor research, detection engineering, malware analysis, disk, memory, timeline and network). Use when choosing tools or planning a multi-step analysis.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: