Results for “dfir”

Build forensic super timelines from disk images using Plaso (log2timeline) and triage them in Timesketch.

Guides securing and deploying the Dify platform in production, covering SSRF protection, code sandboxing, Docker/Kubernetes deployment, monitoring, and recovery.

Use this skill when the user asks about Driver Qualification Files (DQF) — what must be in a DQ file under 49 CFR 391, retention periods, what's required pre-hire vs ongoing, document expiration tracking, audit-readiness for driver files, common DQF deficiencies that auditors find, or how to handle missing documents on existing drivers. Always cite the specific subsection of 49 CFR 391.

Generate Sigma-based forensic timelines from Windows EVTX files using Hayabusa for incident response triage.

Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.

Configure Cloudflare DDoS protection with managed rulesets, rate limiting, WAF rules, Bot Management, and origin protection to mitigate volumetric, protocol, and application-layer attacks.

Prevent domain spoofing and phishing by implementing SPF, DKIM, and DMARC email authentication protocols with DNS configuration and validation.

Guides authorized digital forensics and incident response workflows including memory dump analysis, disk timeline creation, PCAP investigation, and artifact triage with evidence preservation.

Secure boot and firmware update workflows for Zephyr RTOS. Covers MCUboot integration, production image signing, DFU protocols (MCUmgr), fail-safe rollback mechanisms, and mbedTLS crypto basics. Trigger when implementing over-the-air (OTA) updates, securing the boot process, or managing cryptographic keys.

Detect and triage infrastructure drift by comparing declared Terraform state against live cloud resources using scheduled pipelines and audit logs.

Analyzes DeFi protocol risk before deposit, decomposes headline APY into sustainable yield, emissions, and drag factors, and flags common rug-risk patterns in tokenomics, liquidity, and governance. Advisory only—no wallet access, no private key handling, no transaction signing, no on-chain execution.

Automates GDPR Data Subject Access Request (DSAR) workflows including identity verification, PII discovery across databases and files using regex and NER, data mapping, response templating per Article 15 requirements, deadline tracking, and audit logging.

Detect and exploit Server-Side Request Forgery vulnerabilities by identifying user-controlled URL parameters, testing for internal service access, cloud metadata endpoints, and file scheme reads, with bypass techniques for common filters.

Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.

Use this skill when sorting paperwork between a driver's personnel file and the regulated DQ file. Covers FMCSA-required documents vs employer documents, audit-scope vs HR-scope, retention differences.

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.

Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.