# Blueteam Operations

> Blue Team Operations

- Skill: `j4flmao/blueteam-operations` (Agent Skill)
- Install (CLI): `npx skillmds@latest add j4flmao/blueteam-operations`
- Raw SKILL.md: https://api.skillmd.com/api/skills/j4flmao/blueteam-operations/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: j4flmao (https://skillmd.com/u/j4flmao)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/j4flmao/blueteam-operations

---

# Blue Team Operations

> [!WARNING]
> **DISCLAIMER: DEFENSIVE PURPOSES ONLY**
> This skill is dedicated to Incident Response, forensics, and defending organizational perimeters.

## 1. Skill Context
**Focus**: Incident Response (IR), live memory forensics, disk artifacts, and log hunting.
**Triggers**: analyze memory dump, threat hunting, forensic artifacts, incident response plan

## 2. Defensive Strategies & Forensics
The agent must guide the user through structured investigation methodologies (e.g., PICERL - Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned).

### Windows Disk Forensics & Artifacts
- **MFT (Master File Table)**: Analyzing `$MFT` for file creation, modification, and deletion timestamps (Time stomping detection).
- **Execution Evidence**: 
  - **Prefetch (`.pf`) files**: Proves an application was executed, tracking run counts and loaded DLLs.
  - **Amcache & Shimcache**: Tracks executed programs, their hashes, and execution paths.
- **Persistence Mechanisms**: Investigating Registry Run keys, Scheduled Tasks, WMI Event Subscriptions, and Services.

### Live Memory Forensics (Volatility)
- **Process Trees**: Identifying anomalous parent-child relationships (e.g., `cmd.exe` spawning from `spoolsv.exe`).
- **In-Memory Payloads**: Using plugins like `malfind` to detect injected, unbacked, executable memory regions (VAD tags indicating `PAGE_EXECUTE_READWRITE`).
- **Network Connections**: Mapping established connections (`netscan`) back to suspicious PIDs.

### Threat Hunting
- **Hypothesis-Driven Hunting**: Formulating assumptions (e.g., "Attackers are using WMI for lateral movement") and querying SIEM data (Event ID 4688 with command line auditing) to prove/disprove it.
- **Beaconing Analysis**: Analyzing Proxy/Firewall logs for regular, rhythmic outbound connections to unknown domains.

## 3. Output Format
- Provide structured IR playbooks.
- Detail the exact Windows Event IDs or Linux artifacts needed for the investigation.
- Recommend forensic tools (e.g., Volatility, KAPE, Eric Zimmerman's tools).