# Incident Response & Digital Forensics > IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology - Skill: `masriyan/incident-response-digital-forensics` (Agent Skill, multi-file: 5 files) - Install (CLI): `npx skillmds@latest add masriyan/incident-response-digital-forensics` - Raw SKILL.md: https://api.skillmd.com/api/skills/masriyan/incident-response-digital-forensics/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: Masriyan (https://skillmd.com/u/masriyan) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/masriyan/incident-response-digital-forensics --- # Incident Response & Digital Forensics ## Purpose Enable Claude to assist with structured incident response operations following NIST SP 800-61 and the SANS PICERL framework. Claude generates IR playbooks, guides evidence collection with chain of custody, constructs forensic timelines, interprets memory forensics output, and produces post-incident reports. --- ## Activation Triggers This skill activates when the user asks about: - Creating an incident response playbook (ransomware, phishing, breach, etc.) - Evidence collection and chain of custody procedures - Forensic timeline construction from logs or artifacts - Memory forensics using Volatility - Post-incident report generation - DFIR (Digital Forensics and Incident Response) procedures - Containment and eradication strategies - Root cause analysis for security incidents - IR metrics, SLA tracking, or reporting for management --- ## Prerequisites ```bash pip install pyyaml jinja2 pandas python-dateutil ``` **Recommended DFIR tools:** - `Volatility 3` — Memory forensics framework - `Autopsy / Sleuth Kit` — Disk forensics - `plaso / log2timeline` — Supertimeline generation - `KAPE` — Evidence collection (Windows) - `Velociraptor` — Enterprise-scale endpoint forensics - `FTK Imager` — Forensic imaging (Windows) - `dd / dcfldd / dc3dd` — Disk imaging (Linux) --- ## PICERL Framework Overview Every IR engagement follows the PICERL lifecycle: | Phase | Key Actions | Skill Outputs | |-------|------------|---------------| | **P**reparation | Verify tools, comms, access | Readiness checklist | | **I**dentification | Confirm incident, scope, severity | Incident classification | | **C**ontainment | Isolate systems, stop spread | Containment actions list | | **E**radication | Remove threat, close access | Eradication checklist | | **R**ecovery | Restore systems, verify integrity | Recovery runbook | | **L**essons Learned | Post-incident review | IR report + improvements | --- ## Core Capabilities ### 1. IR Playbook Creation **When the user asks to create a playbook for a specific incident type:** Claude generates detailed, role-assigned playbooks in this structure: **Ransomware Response Playbook (Example):** ```markdown # IR Playbook: Ransomware Attack Version: 2.0 | Owner: SOC Manager | Review: Quarterly ## Trigger Conditions - Multiple encrypted files discovered (ransom extension detected) - Ransom note found on file shares or desktop - EDR alert for mass file modification activity - User reports files inaccessible with unfamiliar extensions ## Severity Classification - CRITICAL: Domain controller / backup infrastructure affected - HIGH: Production servers / business-critical data affected - MEDIUM: Isolated workstation, contained environment --- ## Phase 1: Identification (Target: 15 minutes) **IR Lead:** - [ ] Confirm incident is ransomware (verify encrypted files + ransom note) - [ ] Determine initial infection vector (phishing? RDP? Supply chain?) - [ ] Identify Patient Zero — first encrypted system - [ ] Assess scope: How many systems? Which business units? - [ ] Declare incident severity and notify stakeholders - [ ] Open incident ticket and begin documentation **Forensics:** - [ ] DO NOT REBOOT infected systems (preserve volatile evidence) - [ ] Capture memory dump: `winpmem_mini_x64_rc2.exe output.raw` - [ ] Collect running processes: `tasklist /v > processes.txt` - [ ] Collect network connections: `netstat -ano > netstat.txt` ## Phase 2: Containment (Target: 30 minutes) **Network Team:** - [ ] Isolate affected systems (pull network cable or quarantine in VLAN) - [ ] Block identified C2 IPs/domains at perimeter firewall - [ ] Disable RDP externally if RDP was the initial vector - [ ] Preserve network capture if encryption is still occurring **Active Directory:** - [ ] Identify all accounts used by the ransomware (service accounts, domain accounts) - [ ] Reset passwords for all potentially compromised accounts - [ ] Revoke active sessions for affected accounts - [ ] Check for newly created privileged accounts ## Phase 3: Eradication - [ ] Identify all persistence mechanisms (registry, services, scheduled tasks) - [ ] Remove all malicious artifacts - [ ] Verify no backdoors remain (check with Autoruns, process scanning) - [ ] Patch the exploited vulnerability if one was used ## Phase 4: Recovery - [ ] Restore from clean backup (verified pre-infection) - [ ] Validate backup integrity before restoration - [ ] Rebuild from gold image if backup compromised - [ ] Verify data integrity after restoration - [ ] Phased return to production ## Phase 5: Lessons Learned (Within 2 weeks) - [ ] Full incident timeline documented - [ ] Root cause identified and remediated - [ ] Detection gaps addressed - [ ] CSOC playbook updated - [ ] Management report delivered ``` **Other supported playbook types:** - Phishing Campaign Response - Data Breach / Exfiltration - Business Email Compromise (BEC) - Insider Threat - DDoS Attack - Account Compromise / Credential Stuffing - Supply Chain Compromise - Cloud Misconfiguration / Breach ### 2. Evidence Collection & Chain of Custody **When the user asks to collect forensic evidence:** **Order of Volatility (most volatile → least volatile):** ``` 1. CPU registers and cache 2. Routing tables, ARP cache, process table 3. Memory (RAM) — ALWAYS capture first 4. Temporary file systems, swap space 5. Running processes and open files 6. Network connections and open ports 7. Disk images 8. Log files (local + remote SIEM) 9. Physical media ``` **Evidence Collection Commands:** ```bash # Windows — Live acquisition winpmem_mini_x64_rc2.exe memory.raw # Memory dump tasklist /svc > processes.txt # Running processes netstat -ano > connections.txt # Network connections wmic process get caption,processid,parentprocessid,commandline > process_full.txt reg export HKLM reg_hklm.reg # Registry dir /s /a "C:\Users\*\AppData\Roaming\*" > appdata.txt # Linux — Live acquisition sudo avml /tmp/memory.lime # Memory dump (avml) ps auxf > processes.txt # Process tree netstat -tulnap > connections.txt # Network connections cat /proc/*/cmdline | strings > process_cmdlines.txt ls -la /tmp/ /var/tmp/ /dev/shm/ > temp_dirs.txt crontab -l -u root > crontabs.txt find / -mtime -7 -type f > recently_modified.txt # Modified in last 7 days ``` **Chain of Custody Template:** ```markdown ## Evidence Chain of Custody Form | Field | Value | |-------|-------| | Evidence ID | IR-2025-001-E01 | | Incident ID | IR-2025-001 | | Description | Memory dump from HOSTNAME (192.168.1.100) | | Collected by | [Analyst Name] | | Collection time | 2025-05-28 14:30 UTC | | Collection method | winpmem_mini_x64_rc2.exe | | MD5 hash | [hash of evidence file] | | SHA256 hash | [hash of evidence file] | | Storage location | \nas\ir\IR-2025-001\evidence\ | | Chain of custody | Analyst → Evidence Locker → Lab | **Access Log:** | Date/Time | Person | Purpose | Signature | |-----------|--------|---------|-----------| | 2025-05-28 14:30 | [Analyst] | Initial collection | [Sig] | ``` ### 3. Forensic Timeline Analysis **When the user asks to build an incident timeline:** 1. **Collect timestamps from all available sources:** - Windows Event Logs (Security, System, Application, PowerShell) - Web server access logs - Firewall / proxy logs - Email server logs (delivery, read receipts) - File system timestamps (Modified, Accessed, Changed, Born) - Registry LastWrite timestamps - Prefetch timestamps (evidence of execution) 2. **Normalize to UTC** — Confirm system timezone before conversion 3. **Generate supertimeline:** ```bash python scripts/timeline_builder.py --logs ./collected_logs/ --output timeline.csv python scripts/timeline_builder.py --logs ./logs/ --format html --start "2025-05-20" --end "2025-05-28" ``` 4. **Identify the kill chain progression:** ```markdown ## Incident Timeline — [Incident ID] [T-72h] 2025-05-25 09:15 UTC — DELIVERY Phishing email received: "Invoice_May2025.pdf.exe" from spoofed sender Mail log: SMTP delivery to user@victim.com from 185.x.x.x [T-48h] 2025-05-26 14:22 UTC — EXECUTION User executed attachment: Event 4688 (process creation) Parent: outlook.exe → Child: powershell.exe -enc [base64] [T-48h] 2025-05-26 14:22 UTC — C2 ESTABLISHED Outbound connection: 203.x.x.x:443 (beacon_interval: 60s) DNS query: malicious-c2.evil.com → 203.x.x.x [T-24h] 2025-05-27 02:00 UTC — LATERAL MOVEMENT PsExec from WORKSTATION01 to SERVER02 (admin$) Event 4624 (login type 3) on SERVER02 from WORKSTATION01 [T-2h] 2025-05-27 12:30 UTC — DATA EXFILTRATION Large POST request (450MB) to dropbox-like service [T-0h] 2025-05-28 14:00 UTC — DETECTION SOC analyst detected anomalous outbound transfer ``` ### 4. Memory Forensics **When the user shares Volatility output or asks about memory forensics:** **Essential Volatility 3 Commands:** ```bash # Process listing python vol.py -f memory.raw windows.pslist python vol.py -f memory.raw windows.pstree # Show parent-child python vol.py -f memory.raw windows.psscan # Find hidden processes # Network connections python vol.py -f memory.raw windows.netscan python vol.py -f memory.raw windows.netstat # DLL and module analysis python vol.py -f memory.raw windows.dlllist --pid [PID] python vol.py -f memory.raw windows.modscan # All loaded modules # Malware detection python vol.py -f memory.raw windows.malfind # Injected code python vol.py -f memory.raw windows.hollowfind # Process hollowing # Registry from memory python vol.py -f memory.raw windows.registry.hivelist python vol.py -f memory.raw windows.registry.printkey --key "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" # File artifacts python vol.py -f memory.raw windows.filescan python vol.py -f memory.raw windows.dumpfiles --physaddr [addr] ``` **Suspicious Memory Indicators:** - Process without corresponding disk file (process hollowing) - `explorer.exe` or `svchost.exe` with unusual parent - Network connections from system processes (lsass.exe, csrss.exe) - Executable memory regions flagged by `windows.malfind` - Stacked THREADS in injected shellcode regions ### 5. Post-Incident Report **When the user asks for an IR report for management or compliance:** ```markdown # Post-Incident Report — [Incident ID] **Classification:** CONFIDENTIAL **Incident Type:** [Ransomware / Data Breach / etc.] **Severity:** [Critical / High / Medium] **Incident Window:** [Start] to [End] UTC **Systems Affected:** [Count and names] **Data Impact:** [Data at risk / confirmed exfiltrated] **Report Date:** [Date] **Report Author:** [IR Lead] --- ## 1. Executive Summary [3-4 sentences: what happened, how it happened, impact, and current status] ## 2. Incident Timeline [Key events table with timestamps] ## 3. Root Cause Analysis **Initial Vector:** [Phishing / Unpatched service / Credential theft / etc.] **Root Cause:** [Specific technical cause] **Contributing Factors:** - [Factor 1: e.g., no MFA on VPN] - [Factor 2: e.g., delayed patch deployment] ## 4. Impact Assessment - **Systems Compromised:** [List] - **Data Accessed/Exfiltrated:** [Description + quantity] - **Business Impact:** [Downtime hours, revenue impact, regulatory] - **Customer/Partner Impact:** [If applicable] ## 5. Containment & Remediation Actions [Chronological list of actions taken] ## 6. Compliance Notification Requirements - **GDPR:** [Required if EU personal data — 72-hour notification to DPA] - **HIPAA:** [Required if PHI — notify HHS within 60 days] - **PCI-DSS:** [Required if cardholder data — notify card brands immediately] - **State breach laws:** [Applicable laws and timelines] ## 7. Recommendations | Priority | Recommendation | Owner | Due Date | |----------|---------------|-------|---------| | Critical | Deploy MFA for all remote access | IT | 2025-06-01 | | High | Accelerate patch cycle for internet-facing systems | IT | 2025-06-15 | | Medium | Implement email attachment sandboxing | Security | 2025-07-01 | ## 8. Lessons Learned [What worked, what didn't, process improvements] ``` --- ## Script Reference ### `timeline_builder.py` ```bash python scripts/timeline_builder.py --logs ./collected_logs/ --output timeline.csv python scripts/timeline_builder.py --logs ./logs/ --format html --start "2025-05-20" --end "2025-05-28" ``` --- ## Skill Integration | Condition | Adjacent Skill | |-----------|---------------| | Alert received from SOC → activate IR | ← Skill 11 (CSOC Automation) | | Malware samples collected → analyze | → Skill 05 (Malware Analysis) | | IOCs extracted → hunt in environment | → Skill 06 (Threat Hunting) | | Log deep-dive needed | → Skill 12 (Log Analysis) | --- ## References - [NIST SP 800-61 Rev. 2 — Computer Security Incident Handling](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final) - [SANS Incident Response Process](https://www.sans.org/white-papers/33901/) - [Volatility 3 Documentation](https://volatility3.readthedocs.io/) - [Velociraptor Documentation](https://docs.velociraptor.app/) - [DFIR.training Resource Hub](https://www.dfir.training/) - [The Art of Memory Forensics (Book)](https://www.wiley.com/en-us/The+Art+of+Memory+Forensics-p-9781118825099) --- ## v3.0 Enhancements (2026 Update) **Cloud- and identity-era IR:** - **Cloud IR** — pull and triage AWS CloudTrail, Azure Activity/Entra sign-in & audit, and GCP Audit logs; preserve volatile cloud state (snapshots, IAM key disabling) before remediation. - **Identity & SaaS compromise** — handle token theft/replay, OAuth consent abuse, and federated trust attacks; revoke sessions/refresh tokens, rotate signing keys, review conditional-access. - **Modern toolkit** — Velociraptor for fleet-scale collection; Hayabusa/Chainsaw + Sigma over EVTX for rapid Windows timelining; KAPE for triage images. - **Ransomware specifics** — identify double/triple-extortion, exfil-before-encrypt evidence, ESXi/Linux scope, and recovery validation against immutable backups. - **Business Email Compromise** — inbox-rule and forwarding abuse, app-password persistence, mailbox audit log review. **Process rule (unchanged priority):** follow NIST SP 800-61 / SANS PICERL; preserve chain of custody; in cloud/OT contexts weigh evidence preservation against service/safety continuity (→ Skill 18 for OT).