Incident Response

This is a comprehensive IR playbook that walks you through the full incident lifecycle, from scoping and evidence collection through containment and reporting. It's built around Volatility 3, Plaso, and modern log analysis tools like Chainsaw and Hayabusa. The memory forensics section is genuinely useful, covering process injection detection, rootkit hunting, and credential extraction with specific commands you can run. What I appreciate is the practical timeline analysis workflow and the structured IOC extraction guidance. The reporting template alone saves hours when you're writing up findings at 2am. If you're doing incident response work, this gives you a solid procedural framework with the actual commands instead of just theory.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill incident-response --agent claude-code

Installs into .claude/skills of the current project.

Files

Incident Response & Digital Forensics

When to Activate

Active security incident: triage, scoping, evidence acquisition, containment, eradication
Memory forensics — process injection, rootkit (incl. eBPF), credential-theft, network artifacts
Windows event-log / artifact timelining and super-timeline reconstruction
Anti-forensics detection — timestomping, log clearing, secure deletion, VSS recovery
Cloud incident response — AWS/Azure/GCP identity-plane attacks and forensic collection
Ransomware / extortion response — hypervisor (ESXi) encryption, backup destruction, fast-dwell intrusions
Verifying suspect DFIR tooling used as adversary persistence (Velociraptor CVE-2025-6264)
Repository-compromise post-mortem — a poisoned public repo / force-pushed malicious commit / deleted PR (recover via dangling commits + GH Archive + Wayback + Events API; see references/repo-compromise-forensics.md)