Plugins
2 pluginscurated
Windows Forensics Toolkit
For digital forensics analysts investigating Windows systems using registry artifacts, prefetch, and event logs.
6 skills · plugin
@brycewang-stanford
ATC Skills
Twelve ATC-specific skills for the ACM SIGOPS Annual Technical Conference (formerly the USENIX Annual Technical Conference), grounded in the ATC 2026 SIGOPS call for papers, the USENIX ATC '25 research and artifact pages, the USENIX to SIGOPS transition record, and dblp.
2 skills · plugin
Results for “artifact”
9 skills
mukul975 Investigating Ransomware Attack Artifacts
Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.
24.6k · bundle
zhaoxuya520 Digital Forensics
Guides authorized digital forensics and incident response workflows including memory dump analysis, disk timeline creation, PCAP investigation, and artifact triage with evidence preservation.
12.8k · bundle
mukul975 Analyzing Supply Chain Malware Artifacts
Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.
24.6k · bundle
mukul975 Implementing Velociraptor For Ir Collection
Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments.
24.6k · bundle
More results
mukul975 Performing Memory Forensics With Volatility3 Plugins
Analyze memory dumps using Volatility3 plugins to detect injected code, rootkits, credential theft, and malware artifacts in Windows, Linux, and macOS memory images.
24.6k · bundle
mukul975 Hunting Evtx With Chainsaw
Hunt for threats in Windows Event Logs using Chainsaw, a fast Rust-based forensic tool that runs Sigma rules, keyword searches, and artifact analysis offline.
24.6k · bundle
mukul975 Analyzing Malware Sandbox Evasion Techniques
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports.
24.6k · bundle
mukul975 Analyzing Indicators Of Compromise
Triages and enriches indicators of compromise (IPs, domains, file hashes, URLs, email artifacts) from phishing emails, security alerts, or threat feeds, assigning confidence scores and dispositions using VirusTotal, AbuseIPDB, MalwareBazaar, and MISP.
24.6k · bundle
mukul975 Detecting Ntlm Relay With Event Correlation
Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, and auditing SMB and LDAP signing enforcement.
24.6k · bundle