DFIR — memory dumps, log analysis, timeline mapping, root cause analysis. Use when investigating incidents or performing forensic post-mortems.
How this skill is triggered — by the user, by Claude, or both
Slash command
/security-compliance-pro:forensic-investigatorThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill is used within development environments to analyze security incidents, trace attacker footprints, and interpret digital evidence. It extracts security indicators from memory dumps (crash dumps, heap dumps), scans application/audit/access logs for anomalous behavior, constructs unified event timelines from multiple data sources, and identifies the root cause of an attack vector from i...
This skill is used within development environments to analyze security incidents, trace attacker footprints, and interpret digital evidence. It extracts security indicators from memory dumps (crash dumps, heap dumps), scans application/audit/access logs for anomalous behavior, constructs unified event timelines from multiple data sources, and identifies the root cause of an attack vector from initial compromise to ultimate impact. The goal is to answer: "What happened, how did it happen, what was the blast radius, and how do we prevent a recurrence?"
Core principle: No forensics can occur without evidence integrity. Any step that compromises the chain of custody invalidates the findings legally and technically.
NO FORENSIC FINDING CAN BE REPORTED WITHOUT FULLY DOCUMENTING THE CHAIN OF CUSTODY AND VERIFYING EVIDENCE INTEGRITY.
If the chain of custody is broken, the entire analysis report will be rejected during audits, legal proceedings, or post-mortem reviews.
Use this when:
Use this ESPECIALLY when:
Don't skip when:
BEFORE proceeding:
Clarify the incident type (unauthorized access, exfiltration, RCE, DoS) and isolate affected systems. Notify response stakeholders.
# Hash verification of a memory dump
sha256sum memory_dump.raw > memory_dump.raw.sha256
# Digital signature of a log file
gpg --detach-sign --armor auth.log
BEFORE proceeding:
Ensure the target system was not powered down before extracting memory. Memory is volatile unless captured before rebooting or cold boot attacks.
pslist, psscan) — flag anomalous or hidden processes.netscan) — log connections going to unlisted IPs.ldrmodules, malfind) — locate hidden or encrypted memory sections.cmdscan, consoles) — recover executed command strings.# Example: Identifying suspicious processes with Volatility
# volatility -f memory.dump --profile=Win10x64 pslist
suspicious_processes = [
{"pid": 4521, "name": "svch0st.exe", "parent": "services.exe"}, # Typo squatting
{"pid": 6723, "name": "powershell.exe", "parent": "winword.exe"}, # Word macro spawning execution
{"pid": 8891, "name": "rundll32.exe", "parent": "outlook.exe"}, # Outlook OLE execution
]
heap_strings = {
"file": "heap_dump_java.bin",
"secrets_found": ["AKIA...", "password=..."],
"risk": "HIGH - Secrets leak confirmed in memory"
}
BEFORE proceeding:
Collect all log files (application logs, audit logs, access logs, syslog, cloud trails) and centralize them.
# Regex log signature matching examples
log_patterns = {
"brute_force": r"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.*401.*",
"off_hours": r"(0[0-2]|2[0-3]):[0-5][0-9]:[0-5][0-9]",
"suspicious_user_agent": r"(curl|python-requests|Go-http-client|wget).*(POST|PUT)",
"large_response": r".*Content-Length: [5-9]\d{5,}", # 500KB+
}
findings = {
"brute_force_attempts": 1523,
"successful_after_brute": 1,
"off_hours_access": 47,
"suspicious_data_exports": 3,
"source_ips": ["185.220.101.x", "91.121.87.x"]
}
BEFORE proceeding:
Verify all memory dump analyses and log audits are complete, with findings tagged.
INCIDENT TIMELINE
=======================================
Timestamp Event Source
---------------------------------------------------
2026-05-17 03:12:45 Port scan detected (22, 443) firewall.log
2026-05-17 03:14:02 HTTP 200 /wp-admin access.log
2026-05-17 03:14:30 POST /wp-login.php (Failed x47) access.log
2026-05-17 03:17:12 POST /wp-login.php (SUCCESS) access.log
2026-05-17 03:18:44 wp-admin plugin upload access.log
2026-05-17 03:20:01 webshell.php written to disk file_audit.log
2026-05-17 03:25:33 curl request to 185.220.101.x process.log
2026-05-17 04:12:00 PostgreSQL dump executed db_audit.log
2026-05-17 04:45:00 Data compression utility run process.log
2026-05-17 04:47:00 SCP egress transfer to remote firewall.log
---------------------------------------------------
INITIAL ENTRY: 03:17:12 — EGRESS: 04:47:00 (Duration: 94 min)
BEFORE proceeding:
Ensure the timeline is fully populated and events are mapped to the kill chain.
If you catch yourself thinking:
ALL OF THESE MEAN: STOP. Return to the relevant phase.
Watch for these redirections:
When you see these: STOP. Return to the relevant phase.
| Excuse | Reality |
|---|---|
| "Hashing is just double work." | Hashing is the only way to prove evidence integrity. Without it, logs are dismissed as untrusted. |
| "A memory dump is too large to scan; logs are sufficient." | Memory contains volatile runtime parameters (e.g., active sockets, keys) that logs cannot capture. |
| "We couldn't find anomalies, so no breach occurred." | Attackers can scrub logs; a gap in log entries is itself a critical finding. |
| "Writing a timeline is too time-consuming." | Without a chronological timeline, you cannot identify how the entry vector relates to egress. |
| "We shut down the host, so the threat is contained." | Shutting down the host clears memory, destroying volatile evidence. Analyze before shutdown. |
After completing this process:
npx claudepluginhub haj1t/senior-dev-squad-skills --plugin security-compliance-proProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.