Agent skills for Digital Forensics Analysts

35 agent skills are labelled for Digital Forensics Analysts work. They are listed by code score, out of 100.

All 35

1. yara-rule-authoring trailofbits/skills

   Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string select…

   Verified81B
2. analyzing-linux-audit-logs-for-intrusion mukul975/Anthropic-Cybersecurity-Skills

   Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activit…

   Verified80B
3. detecting-lateral-movement-with-zeek mukul975/Anthropic-Cybersecurity-Skills

   Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to iden…

   Verified80B
4. hunting-bootkits-in-efi-system-partition mukul975/Anthropic-Cybersecurity-Skills

   Baseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and verifying boot loaders, sc…

   79B
5. implementing-ransomware-kill-switch-detection mukul975/Anthropic-Cybersecurity-Skills

   Analyzes ransomware kill switch mechanisms, including mutex-based execution guards, domain-based kill switches (e.g. WannaCry-style), and registry termination checks, then impleme…

   79B
6. oss-forensics NousResearch/hermes-agent

   GitHub supply-chain forensics: recovery, IOCs, reporting.

   78B
7. analyzing-windows-amcache-artifacts mukul975/Anthropic-Cybersecurity-Skills

   Parses the Windows Amcache.hve registry hive with Eric Zimmerman's AmcacheParser and Timeline Explorer to extract evidence of program execution, application installation, and driv…

   78B
8. case-review zhaoxuya520/reverse-skill

   Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity b…

   74B
9. analyzing-linux-elf-malware mukul975/Anthropic-Cybersecurity-Skills

   Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, dyn…

   74B
10. analyzing-packed-malware-with-upx-unpacker mukul975/Anthropic-Cybersecurity-Skills

    Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executab…

    74B
11. analyzing-ransomware-encryption-mechanisms mukul975/Anthropic-Cybersecurity-Skills

    Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and…

    74B
12. analyzing-ransomware-payment-wallets mukul975/Anthropic-Cybersecurity-Skills

    Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters an…

    74B
13. analyzing-uefi-bootkit-persistence mukul975/Anthropic-Cybersecurity-Skills

    Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications, Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware integrity verification, detect…

    74B
14. performing-firmware-malware-analysis mukul975/Anthropic-Cybersecurity-Skills

    Analyzes firmware images for embedded malware, backdoors, and unauthorized modifications in routers, IoT devices, UEFI/BIOS, and embedded systems, covering firmware extraction, fi…

    74B
15. ida-reverse zhaoxuya520/reverse-skill

    IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to an…

    73B
16. detecting-malicious-npm-packages mukul975/Anthropic-Cybersecurity-Skills

    Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, and dynamic detonation with…

    73B
17. detecting-process-injection-techniques mukul975/Anthropic-Cybersecurity-Skills

    Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses…

    73B
18. performing-malware-hash-enrichment-with-virustotal mukul975/Anthropic-Cybersecurity-Skills

    Enrich malware file hashes (MD5, SHA-1, SHA-256) using the VirusTotal API v3 to retrieve multi-engine detection rates, sandbox behavioral analysis, YARA rule matches, related indi…

    73B
19. reverse-engineering-dotnet-malware-with-dnspy mukul975/Anthropic-Cybersecurity-Skills

    Reverse engineers .NET malware samples using the dnSpy decompiler and debugger to read C#/VB.NET source, deobfuscate code protected by tools like ConfuserEx or SmartAssembly, and…

    73B
20. radare2 zhaoxuya520/reverse-skill

    Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import ins…

    72B
21. analyzing-network-traffic-for-incidents mukul975/Anthropic-Cybersecurity-Skills

    Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfi…

    72B
22. analyzing-bootkit-and-rootkit-samples mukul975/Anthropic-Cybersecurity-Skills

    Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence, covering boot sector ana…

    71B
23. analyzing-malware-family-relationships-with-malpedia mukul975/Anthropic-Cybersecurity-Skills

    Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YARA rules, link families to threat actors, and map family relati…

    71B
24. detecting-rootkit-activity mukul975/Anthropic-Cybersecurity-Skills

    Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, and covert network connections using Volatility m…

    71B
25. detecting-secure-boot-bypass mukul975/Anthropic-Cybersecurity-Skills

    Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries agai…

    71B
26. hunting-evtx-with-chainsaw mukul975/Anthropic-Cybersecurity-Skills

    Run Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and high-speed keyword/regex search, plus analyze shimcache, SRUM…

    71B
27. hunting-for-defense-evasion-via-timestomping mukul975/Anthropic-Cybersecurity-Skills

    Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anom…

    71B
28. performing-insider-threat-investigation mukul975/Anthropic-Cybersecurity-Skills

    Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security polic…

    71B
29. acquiring-disk-image-with-dd-and-dcfldd mukul975/Anthropic-Cybersecurity-Skills

    Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acqui…

    70B
30. analyzing-macro-malware-in-office-documents mukul975/Anthropic-Cybersecurity-Skills

    Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download cradles, payload execution, persistence mechanisms, and anti-an…

    70B
31. analyzing-pdf-malware-with-pdfid mukul975/Anthropic-Cybersecurity-Skills

    Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determi…

    70B
32. building-super-timelines-with-plaso mukul975/Anthropic-Cybersecurity-Skills

    Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py, psort.py, and psteal.py CLI tools (fusing file-system MACB, registry, EVTX, browser history, prefetch, LN…

    70B
33. detecting-fileless-attacks-on-endpoints mukul975/Anthropic-Cybersecurity-Skills

    Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections f…

    70B
34. detecting-mobile-malware-behavior mukul975/Anthropic-Cybersecurity-Skills

    Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Us…

    70B
35. triaging-windows-with-kape mukul975/Anthropic-Cybersecurity-Skills

    Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with M…

    70B

Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.