Incident Response

name: incident-response description: >- Incident response operations including volatile evidence collection (memory, disk, network), forensic tools (Volatility, KAPE, dc3dd), IR runbooks, triage procedures, timeline reconstruction, containment strategies, eradication, and post-incident analysis with after-action reports. domain: cybersecurity subdomain: incident-response tags: - forensics - dfir - triage - ioc - memory-forensics - timeline-analysis - evidence-collection - containment - eradication version: "1.1" author: defconxt license: AGPL-3.0 compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent. metadata: mitre-attack: ["T1070", "T1036", "T1059", "T1486"] nist-csf: ["RS.RP-1", "RS.AN-1", "RS.AN-3", "RS.MI-1", "RS.MI-2"] frameworks: ["NIST SP 800-61", "RFC 3227", "SANS IR Process"]

name: incident-response description: > DFIR and incident response skill for CIPHER. Activates on incident triage, forensic artifact collection, evidence preservation, memory acquisition, containment procedures, timeline reconstruction, and post-incident analysis. Trigger keywords: DFIR, forensics, triage, IOC, compromise, breach, exfiltration, ransomware response, containment, eradication, evidence, memory acquisition, Wireshark, Chainsaw, Hayabusa, Volatility. domain: cybersecurity subdomain: incident-response tags:

• forensics
• dfir
• triage
• ioc
• memory-forensics
• network-forensics
• timeline-analysis
• containment
• evidence-preservation
• ransomware version: "1.1" author: defconxt license: AGPL-3.0 compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent. metadata: mitre-attack:
  • T1059 # Command and Scripting Interpreter
  • T1003 # OS Credential Dumping
  • T1078 # Valid Accounts
  • T1021 # Remote Services
  • T1190 # Exploit Public-Facing Application
  • T1486 # Data Encrypted for Impact (Ransomware)
  • T1053 # Scheduled Task/Job
  • T1543 # Create or Modify System Process
  • T1547 # Boot or Logon Autostart Execution
  • T1070 # Indicator Removal

SKILL: Incident Response

When to Use

Activate this skill when the operator:

• Describes an active incident or asks for triage guidance
• Requests IR runbooks (ransomware, AD compromise, cloud compromise)
• Needs forensic artifact locations (Windows, Linux, macOS)
• Asks about evidence collection, memory acquisition, or disk imaging
• Wants timeline reconstruction (Plaso, MFT, EVTX correlation)
• Needs containment or eradication procedures
• Asks about Wireshark/tshark analysis or network forensics
• Discusses post-incident analysis, after-action reports, or detection gaps

Do NOT use for: threat modeling (use security-architecture), detection rule writing (use detection-engineering), or red team operations (use offensive skill).

Prerequisites

Example: Volatile Evidence Collection

# Collect volatile evidence in order of volatility (RFC 3227)
# 1. Network connections
ss -tulnp > /evidence/network-connections.txt

# 2. Running processes
ps auxf > /evidence/processes.txt

# 3. Open files
lsof -nP > /evidence/open-files.txt

# 4. Logged-in users
w > /evidence/users.txt
last -25 >> /evidence/users.txt

# 5. Generate hash manifest
sha256sum /evidence/*.txt > /evidence/manifest.sha256

Example: Windows Event Log Triage

# Failed logins (Event ID 4625)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 100 |
  Select-Object TimeCreated, @{N='User';E={$_.Properties[5].Value}},
  @{N='Source';E={$_.Properties[19].Value}} | Format-Table

# New service installations (Event ID 7045)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} -MaxEvents 50 |
  Select-Object TimeCreated, @{N='Service';E={$_.Properties[0].Value}} | Format-Table

Quick Reference

Workflow

Phase 1 — Volatile Evidence Collection

Collect volatile data before ANYTHING else. NIST 800-86 order:

running processes → network connections → logged-in users → loaded modules → ARP cache

Full collection scripts (Linux + Windows) and memory acquisition commands:

→ references/volatile-evidence.md

Phase 2 — Forensic Analysis & Artifact Collection

Memory analysis with Volatility 3, live process analysis with System Informer, forensic artifact locations (Windows/Linux/macOS), network forensics with tshark/Wireshark (display filters, capture filters, attack pattern filters), timeline reconstruction (Plaso, MFT, EVTX correlation), containment strategies (network isolation, account containment), IOC scanning (YARA, LOKI, Fenrir), and post-incident after-action report structure.

→ references/forensics-tools.md

Phase 3 — Incident Runbooks & Response Chains

Scenario-specific runbooks and operational key chains:

• Ransomware Response — triage, containment, evidence preservation, pre-ransomware IOCs
• Active Directory Compromise — DCSync detection, golden ticket, krbtgt rotation
• Cloud Account Compromise (AWS) — CloudTrail investigation, IAM containment, DenyAll policy
• Key Chain: Initial Triage → Scoped Compromise (first 2 hours)
• Key Chain: Evidence Collection → Forensic Package
• Key Chain: Containment → Eradication Pipeline

→ references/ir-runbooks.md

Verification

After completing an IR engagement, confirm:

• Volatile data collected BEFORE any reboot or disk modification
• All evidence hashed (SHA-256) with chain of custody documented
• Memory image acquired and verified (hash match)
• Event logs exported to write-protected location
• Timeline normalized to UTC from all log sources
• Patient zero identified with earliest compromise evidence
• All persistence mechanisms catalogued and removed
• Credentials rotated (compromised → service → privileged → krbtgt if AD)
• Initial access vector patched before systems restored
• After-action report includes detection gap analysis mapped to ATT&CK
• SIEM rules updated to cover observed TTPs

v1.1 | Validated: 2026-03-13