1---2name: forensics-triage3description: Digital forensics and incident response triage skill for disk, memory, network, cloud, and endpoint artifacts. Covers Volatility 3, Velociraptor, KAPE, Plaso, Autopsy, Chainsaw, Hayabusa, Zeek, Arkime, EVTX, AWS/Azure/GCP audit logs, and timeline reconstruction. Use to extract IOCs, build incident timelines, and produce defensible analyst reports.4---56# Forensics Triage78## Operating Rules910- Preserve chain of custody: hash before and after handling; record acquisition method, examiner, and timezone (UTC preferred).11- Work on copies; mount images read-only; document every tool, version, and flag.12- Separate observation (`what the artifact says`) from inference (`what likely happened`).1314## Triage Workflow15161. Collect: `KAPE` targets, `velociraptor` artifacts, memory via `winpmem`/`avml`, cloud logs via provider exports.172. Parse: `plaso/log2timeline` for super-timeline; `chainsaw`/`hayabusa` for Windows EVTX; `volatility3` for RAM; `bulk_extractor` for carving.183. Reconstruct timeline: anchor on initial access, then enumerate execution, persistence, lateral movement, collection, exfil, impact.194. Extract IOCs: hashes, domains, IPs, mutexes, registry keys, scheduled tasks, services, cron, browser artifacts, cloud principals.205. Correlate: cross-host, cross-cloud, identity-tier; build a narrative with ATT&CK mapping.216. Report: timeline, scope, dwell time, attribution confidence, recommendations.2223## Cloud and Identity Focus2425- AWS: CloudTrail, GuardDuty, IAM Access Analyzer, Athena queries; assume-role chains.26- Azure: AAD sign-in/audit, MCAS, Defender; OAuth consent abuse.27- GCP: Cloud Audit, Workspace Login; service account key misuse.28- Identity: token theft, primary refresh token abuse, federation trust manipulation.2930## Output Contract3132- `chain-of-custody.md`, `acquisition.log`.33- `timeline.csv` super-timeline with annotations.34- `iocs.stix.json`, `findings.md` per host/account.35- `report.md`: executive narrative, root cause, dwell time, scope, recovery steps, lessons learned.
Masriyan