forensics

Plugin forensics from marketplace aiwg in jmagly/aiwg. Commands read from the repo's manifest — today.

Skills (21)

• cloud-forensics

  AWS, Azure, and GCP forensic investigation covering audit logs, IAM review, storage access, network flows, and compute instance forensics

• container-forensics

  Forensic investigation of Docker, containerd/CRI-O, and Kubernetes — inventory, escape detection, eBPF runtime monitoring, RBAC and etcd audit. Use when investigating container compromise.

• evidence-preservation

  Chain of custody and evidence preservation procedures covering log collection, hash verification, custody documentation, and evidence packaging per RFC 3227

• exposure-analysis

  Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.

• forensics-acquire

  Evidence acquisition with chain of custody and hash verification

• forensics-hunt

  Threat hunt using Sigma rules against log sources

• forensics-investigate

  Full multi-agent investigation workflow

• forensics-ioc

  Extract and enrich indicators of compromise

• forensics-profile

  Build target system profile via SSH or cloud API enumeration

• forensics-quickref

  AUTO-INVOKE when user mentions forensics, incident response, IOC, log analysis, evidence preservation, breach investigation, threat hunting, attack timeline. Forensics framework quick reference — discovery phrases for incident response, log analysis, evidence preservation, IOC extraction.

• forensics-report

  Generate forensic investigation report

• forensics-status

  Show investigation status dashboard

• forensics-timeline

  Build correlated event timeline from multiple sources

• forensics-triage

  Quick triage investigation following RFC 3227 volatility order

• ioc-extraction

  Extract, classify, deduplicate, and enrich IOCs from investigation artifacts; map to STIX 2.1 observables

• linux-forensics

  Generalized Linux incident response and forensic analysis covering Debian/Ubuntu, RHEL/CentOS/Rocky, and SUSE families

• log-analysis

  Correlate auth.log, syslog, journald, application, and web logs to detect brute force, privilege escalation, and lateral movement.

• memory-forensics

  Volatility 3 memory forensics workflows covering acquisition with LiME and WinPmem, and structured analysis using Volatility 3 plugin reference

• sigma-hunting

  Apply Sigma rules against log sources for threat hunting; convert rules to Elasticsearch, Splunk, and grep queries

• supply-chain-forensics

  SBOM analysis, build pipeline forensics, and dependency verification covering package integrity, build reproducibility, and CI/CD pipeline tampering

• target-profiling

  Research and build a target system profile via SSH — discovers OS, services, users, network baseline, and security stack

Subagents (13)

• Cloud Analyst

  AWS/Azure/GCP forensic artifact collection and analysis agent covering audit logs, IAM review, network flow analysis, and API activity anomaly detection

• Container Analyst

  Docker, containerd, and Kubernetes forensics agent. Analyzes container configurations, images, volumes, and network settings to detect privilege escalation vectors, container escapes, image tampering, and unauthorized containers. Covers eBPF runtime monitoring (Falco, Tetragon, Tracee), image layer

• Forensic Acquisition Agent

  Evidence collection and chain of custody agent. Handles forensic image creation, log preservation, hash verification (SHA-256), and chain of custody documentation for all collected artifacts.

• Forensics Orchestrator

  Multi-agent workflow coordination agent that manages the full digital forensics investigation lifecycle from initial scoping through final reporting

• IOC Analyst

  IOC extraction, enrichment, and STIX 2.1 formatting agent that identifies indicators of compromise from investigation artifacts and produces an actionable IOC register

• Log Analyst

  Authentication, system, and application log analysis agent. Parses auth.log, syslog, journal, and application logs to detect brute force, privilege escalation, unauthorized access, and lateral movement indicators.

• Memory Analyst

  Volatility 3 memory forensics specialist for process analysis, rootkit detection, injected code identification, and credential extraction from memory dumps

• Network Analyst

  Network traffic analysis, C2 detection, and lateral movement detection agent. Analyzes connection state, DNS queries, and traffic patterns to identify beaconing, data exfiltration, and command-and-control infrastructure.

• Persistence Hunter

  Persistence mechanism detection agent. Sweeps cron, systemd, SSH keys, LD_PRELOAD, PAM modules, kernel modules, login scripts, and init scripts. Maps all findings to MITRE ATT&CK persistence techniques.

• Recon Agent

  Target reconnaissance and system profiling agent. Discovers system topology, services, users, and network baselines through SSH or cloud API enumeration to produce a target-profile artifact before investigation begins.

• Reporting Agent

  Forensic report generation agent that compiles investigation findings into structured professional forensic reports with executive summary, technical findings, timeline, and remediation plan

• Timeline Builder

  Multi-source event correlation and timeline reconstruction agent that produces chronological incident timelines with attribution from auth logs, syslog, journal, filesystem, and application sources

• Triage Agent

  Quick triage and volatile data capture agent. Follows RFC 3227 volatility order to capture network state, processes, memory maps, deleted binaries, and kernel modules before any disk operations.

Similar plugins