How do I install the Dfir Overview skill?

Run npx skillmds@latest add purpleailab/dfir-overview in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Dfir Overview safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Dfir Overview?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Dfir Overview free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Dfir Overview?

purpleailab (@purpleailab) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Dfir Overview by purpleailab — Agent Skill

Name: Dfir Overview
Author: purpleailab

Dfir Overview

Use to close the Offensive Vaccine loop on the defender side. The Detector agent produces Sigma / YARA rules from offensive operations; this catalog validates those rules against real memory dumps, event logs, and forensic artifacts using Volatility 3, plaso, and sigma-cli. Without this catalog, detection rules are theoretical.

purpleailab 97e93fa 3.3 KB Updated Sep 17, 2026

File contents

Forensicator / DFIR Skill Catalog

Decepticon emits attacks AND detection rules. This catalog feeds the detection rules back through real forensic artifacts to confirm they fire — closing the Offensive Vaccine loop on the operations side.

Playbooks

Inline technique reference — not separately loadable skills. The entries below are summarized here for direct use; there is no separate SKILL.md to open for each. Do NOT call the skill loader on them — apply the technique with your tools using this summary and the Workflow in this file.

Technique	Use for
volatility-windows	Volatility 3 Windows plugins: pslist, malfind, cmdline, netscan, dlllist, handles
volatility-linux	Volatility 3 Linux: linux.pslist, linux.bash, linux.malfind
plaso-timeline	psort + log2timeline; super-timeline construction; Sigma matchers on the timeline
sigma-cli-validation	sigma-cli convert + match against captured event logs
yara-scan	yara-x scan against memory dumps and disk images
event-log-mining	Windows Event Log (.evtx) extraction + key event ID reference
etw-trace	ETW provider triage; .etl file extraction
edr-validation	Replay an attack against a target with Velociraptor / OSQuery active; capture artifacts

Loop closure workflow

Run an offensive technique (e.g., dcsync from the ad-operator agent).
Detector agent emits Sigma rule describing the expected detection pattern (event 4662 with right ControlAccessRights, etc.).
Defender pushes the Sigma to the customer SIEM via sigma_to_splunk_savedsearch / sigma_to_sentinel_analyticrule / sigma_to_elastic_detection_rule.
Forensicator validates by:
- Collecting the event log from the DC at attack time.
- Running sigma-cli convert --target sqlite and matching against the log file.
- If the match count is 0 → detection rule has a bug. Iterate with Detector.
- If match count is N → detection works. Record the validation evidence in the engagement knowledge graph.
Patcher proposes the fix; Forensicator validates the patch doesn't break the detection (verify the rule still fires on attempted exploitation of the patched build).

Tools sandbox

Volatility 3 (vol, volshell) — already in operator's AGENTS.md tooling.
plaso (log2timeline, psort).
sigma-cli (sigma convert, sigma check).
yara-x (yr) — operator already has it installed at C:\Tools\yara-x\yr.exe.
Velociraptor + OSQuery (for live-system validation paths).

Why this is differentiating

Strix doesn't have this. XBOW doesn't have this. The "Offensive Vaccine" promise (every attack becomes a defense improvement) is only deliverable when someone validates the detection. Without Forensicator, the loop stops at "rule written". With it, the loop completes at "rule verified to fire on this attack class against this client's stack".

---name: dfir-overviewdescription: Use to close the Offensive Vaccine loop on the defender side. The Detector agent produces Sigma / YARA rules from offensive operations; this catalog validates those rules against real memory dumps, event logs, and forensic artifacts using Volatility 3, plaso, and sigma-cli. Without this catalog, detection rules are theoretical.---# Forensicator / DFIR Skill CatalogDecepticon emits attacks AND detection rules. This catalog feeds thedetection rules back through real forensic artifacts to confirm they fire— closing the Offensive Vaccine loop on the operations side.## Playbooks> **Inline technique reference — not separately loadable skills.** The entries below> are summarized here for direct use; there is no separate `SKILL.md` to open for> each. Do NOT call the skill loader on them — apply the technique with your tools> using this summary and the Workflow in this file.| Technique | Use for ||---|---|| **volatility-windows** | Volatility 3 Windows plugins: pslist, malfind, cmdline, netscan, dlllist, handles || **volatility-linux** | Volatility 3 Linux: linux.pslist, linux.bash, linux.malfind || **plaso-timeline** | psort + log2timeline; super-timeline construction; Sigma matchers on the timeline || **sigma-cli-validation** | sigma-cli convert + match against captured event logs || **yara-scan** | yara-x scan against memory dumps and disk images || **event-log-mining** | Windows Event Log (.evtx) extraction + key event ID reference || **etw-trace** | ETW provider triage; .etl file extraction || **edr-validation** | Replay an attack against a target with Velociraptor / OSQuery active; capture artifacts |## Loop closure workflow1. **Run an offensive technique** (e.g., `dcsync` from the ad-operator agent).2. **Detector agent emits Sigma rule** describing the expected detection pattern (event 4662 with right `ControlAccessRights`, etc.).3. **Defender pushes the Sigma to the customer SIEM** via `sigma_to_splunk_savedsearch` / `sigma_to_sentinel_analyticrule` / `sigma_to_elastic_detection_rule`.4. **Forensicator validates** by: - Collecting the event log from the DC at attack time. - Running `sigma-cli convert --target sqlite` and matching against the log file. - If the match count is 0 → detection rule has a bug. Iterate with Detector. - If match count is N → detection works. Record the validation evidence in the engagement knowledge graph.5. **Patcher proposes the fix**; Forensicator validates the patch doesn't break the detection (verify the rule still fires on attempted exploitation of the patched build).## Tools sandbox- Volatility 3 (`vol`, `volshell`) — already in operator's AGENTS.md tooling.- plaso (`log2timeline`, `psort`).- sigma-cli (`sigma convert`, `sigma check`).- yara-x (`yr`) — operator already has it installed at `C:\Tools\yara-x\yr.exe`.- Velociraptor + OSQuery (for live-system validation paths).## Why this is differentiatingStrix doesn't have this. XBOW doesn't have this. The "Offensive Vaccine"promise (every attack becomes a defense improvement) is only deliverablewhen someone validates the detection. Without Forensicator, the loopstops at "rule written". With it, the loop completes at "rule verified tofire on this attack class against this client's stack".

Frequently asked questions