Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

DFIR · transilienceai | DecimalAI

securityby transilienceai

DFIR

transilienceai/dfir

Source transilienceai/communitytools ↗License MIT

Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.

SkillScore95Maintained

Automatic

Security & AppSec pack

Last verified 8/19/2026

What it changes

Passed 21 of 22 test cases with the skill, and 18 of 22 without it.

Without skill82%

With skill95%

Checks it passed that the model alone missed

Apply a rolling XOR decoder test before declaring the payload corrupt
Inspect shared strings, drawing objects, or control captions for staged content
Reverse the raw base64 string directly rather than decoding the space-delimited string

3 fixed18 passed either way1 still failing0 broke

Pass-rate lift: +14 pp
Tokens: +67%
Agent turns: 0%
Response time: -48%

Model gemini-3.6-flashMeasured 8/19/2026v121 of 22 cases passed with skill

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/transilienceai-dfir/SKILL.md https://app.decimal.ai/s/transilienceai-dfir/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add transilienceai-dfir, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/transilienceai-dfir/ and pins it in .decimal/skills.lock

decimalai skills add transilienceai-dfir

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/transilienceai-dfir/SKILL.md https://app.decimal.ai/s/transilienceai-dfir/SKILL.md

Raw file: /s/transilienceai-dfir/SKILL.md ↗ · machine-readable summary at /s/transilienceai-dfir.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 3

Prompt

During VBA macro analysis, you find a byte array beginning with an `fnstenv` and `pop` decoder sequence. If direct execution analysis fails, how should the signed array elements be handled prior to payload analysis?

What was checked, without and with the skill
Checked	Without skill	With skill
Convert signed integers into raw bytes	Passed	Passed
Apply a rolling XOR decoder test before declaring the payload corrupt	Missed	Passed

case-03 · gemini-3.6-flash · 8/19/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md76 linessingle file

DFIR

Investigate security incidents by analyzing event logs, network captures, and filesystem artifacts. Detect and reconstruct AD attack chains.

Techniques

Domain	Key Capabilities
Windows Event Logs	EVTX parsing, Event ID correlation, logon tracking, privilege enumeration
Network Forensics	PCAP analysis, NTLM extraction, LLMNR/NBT-NS poisoning detection, relay identification
Filesystem Forensics	MFT parsing, Prefetch analysis, VSS artifact recovery, Linux persistence, timeline reconstruction
AD Attack Detection	Kerberoasting, AS-REP roasting, NTDS dump, NTLM relay, credential theft
Memory Forensics	Volatility3 analysis: process trees, file extraction, SID resolution, command lines
Hash Analysis	NTLMv2 hash construction from pcap, offline cracking validation

Workflow

Inventory evidence — List all artifacts (EVTX, pcap, MFT, prefetch, registry)
Parse structured data — EVTX with python-evtx, pcap with tshark, MFT with analyzeMFT
Identify attack indicators — Key Event IDs, suspicious traffic patterns, anomalous files
Correlate across sources — Match timestamps, IPs, LogonIDs, and process IDs across artifacts
Reconstruct timeline — Build chronological attack chain with UTC timestamps
Answer investigative questions — Map findings to specific incident response queries

Tools

pip install python-evtx windowsprefetch analyzeMFT
brew install wireshark p7zip hashcat

Tool	Purpose
`python-evtx`	Parse Windows .evtx files
`tshark`	CLI pcap analysis (NTLM, LLMNR, SMB filters)
`analyzeMFT`	Parse NTFS Master File Table
`windowsprefetch`	Parse Windows prefetch files (Windows host only)
`hashcat`	Hash cracking (NTLMv2 mode 5600, Kerberos mode 13100/18200)
`volatility3`	Memory dump analysis (pstree, filescan, dumpfiles, getsid, cmdline)
`7z`	Extract AES-encrypted evidence ZIPs

Track record

Benchmark

21 / 22

test cases passed, vs 18 / 22 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

transilienceai / communitytools

skills/dfir/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1

Other skills for the same job

Published skills whose descriptions closely match this one, with their headline benchmark lift.

a5c-ai/incident-forensicsDigital forensics and incident response capabilities. Analyze memory dumps with Volatility, parse filesystem artifacts, extract browser forensics, analyze Windows event logs, create forensic timelines, recover deleted files, and generate forensic reports.Close match+13 pp pass-rate lift

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

See it in action

What's inside

DFIR

Techniques

Workflow

Tools

Track record

Benchmark

Adoption

SkillSafety

Source

Other skills for the same job

Related skills