[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71E2MN79P1ZAS90A16P24R0":3,"skill-same:01M71E2MN79P1ZAS90A16P24R0":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":25,"linkOnly":26,"markdownContent":27,"markdownBody":28,"frontMatter":29,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":35,"updatedAt":36,"install":37,"resources":50},"01M71E2MN79P1ZAS90A16P24R0","linux-forensic-disk-timeline-plaso-forensic",null,"Linux Forensic Disk Timeline Plaso Forensic.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux-forensic-disk-timeline-plaso-forensic\u002FSKILL.md",[],[19,20,21,22,23,24],"timeline","plaso","disk","linux forensic disk timeline plaso forensic","linux","cybersecurity","2026-11-10 10:12:30",false,"---\nname: linux-forensic-disk-timeline-plaso-forensic\ndescription: \"Linux Forensic Disk Timeline Plaso Forensic.\"\ndomain: cybersecurity\n---\n\n|\n| log2timeline (Plaso) | Primary timeline generation engine parsing 100+ artifact types |\n| psort | Plaso output filtering, sorting, and export utility |\n| Timesketch | Web-based collaborative forensic timeline analysis platform |\n| Timeline Explorer | Eric Zimmerman's Windows GUI for CSV timeline analysis |\n| KAPE | Automated triage collection feeding into Plaso processing |\n| mactime (TSK) | Simpler timeline generation from Sleuth Kit bodyfiles |\n| Excel\u002FSheets | Manual timeline review for small filtered datasets |\n| Elastic\u002FKibana | Alternative visualization platform for JSONL timeline data |\n\n## Common Scenarios\n\n**Scenario 1: Ransomware Attack Reconstruction**\nProcess the full disk image with Plaso, filter to the week before encryption was discovered, identify the initial access vector from browser history and event logs, trace privilege escalation through registry and Prefetch, map lateral movement from network logon events, pinpoint encryption start from MFT timestamps showing mass file modifications.\n\n**Scenario 2: Data Theft Investigation**\nCreate super-timeline from suspect's workstation, filter for USB device connection events, file access timestamps, and cloud storage browser activity, build a narrative showing data staging, compression, and exfiltration, present timeline to legal team with tagged evidence points.\n\n**Scenario 3: Multi-System Breach Analysis**\nProcess disk images from all affected systems into a single Plaso storage file, import into Timesketch for collaborative analysis, search for lateral movement patterns across system timelines, identify the patient-zero system and initial compromise vector, map the full attack chain across the environment.\n\n**Scenario 4: Insider Threat After-Hours Activity**\nFilter timeline to non-business hours only, identify file access patterns outside normal working times, correlate with authentication events (badge access, VPN logon), search for data access to sensitive directories during these periods, build evidence package for HR\u002Flegal.\n\n## Output Format\n\n```\nTimeline Reconstruction Summary:\n  Evidence Sources:\n    Disk Image: evidence.dd (500 GB, NTFS)\n    Plaso Storage: evidence.plaso (2.3 GB)\n\n  Processing Statistics:\n    Total events extracted: 4,567,890\n    Parsers used: 45 (winevtx, prefetch, mft, usnjrnl, lnk, chrome, firefox, winreg, ...)\n    Processing time: 3h 45m\n\n  Incident Window (2024-01-15 to 2024-01-20):\n    Events in window: 234,567\n    Event Sources:\n      MFT:          89,234\n      Event Logs:   45,678\n      USN Journal:  56,789\n      Registry:     23,456\n      Prefetch:     1,234\n      Browser:      5,678\n      LNK Files:    2,345\n      Other:        10,153\n\n  Key Timeline Events:\n    2024-01-15 14:32 - Phishing email opened (browser)\n    2024-01-15 14:33 - Malicious document downloaded\n    2024-01-15 14:35 - PowerShell executed (Prefetch + Event Log)\n    2024-01-15 14:36 - C2 connection established (Registry + Event Log)\n    2024-01-16 02:30 - Mimikatz execution (Prefetch)\n    2024-01-16 02:45 - Lateral movement to DC (Event Log)\n    2024-01-17 03:00 - Data exfiltration (MFT + USN Journal)\n    2024-01-18 03:00 - Log clearing (Event Log)\n\n  Exported Files:\n    Full Timeline:     \u002Ftimeline\u002Ffull_timeline.csv (4.5M rows)\n    Incident Window:   \u002Ftimeline\u002Fincident_window.csv (234K rows)\n    Timesketch Import: \u002Ftimeline\u002Ftimeline.jsonl\n```\n","|\n| log2timeline (Plaso) | Primary timeline generation engine parsing 100+ artifact types |\n| psort | Plaso output filtering, sorting, and export utility |\n| Timesketch | Web-based collaborative forensic timeline analysis platform |\n| Timeline Explorer | Eric Zimmerman's Windows GUI for CSV timeline analysis |\n| KAPE | Automated triage collection feeding into Plaso processing |\n| mactime (TSK) | Simpler timeline generation from Sleuth Kit bodyfiles |\n| Excel\u002FSheets | Manual timeline review for small filtered datasets |\n| Elastic\u002FKibana | Alternative visualization platform for JSONL timeline data |\n\n## Common Scenarios\n\n**Scenario 1: Ransomware Attack Reconstruction**\nProcess the full disk image with Plaso, filter to the week before encryption was discovered, identify the initial access vector from browser history and event logs, trace privilege escalation through registry and Prefetch, map lateral movement from network logon events, pinpoint encryption start from MFT timestamps showing mass file modifications.\n\n**Scenario 2: Data Theft Investigation**\nCreate super-timeline from suspect's workstation, filter for USB device connection events, file access timestamps, and cloud storage browser activity, build a narrative showing data staging, compression, and exfiltration, present timeline to legal team with tagged evidence points.\n\n**Scenario 3: Multi-System Breach Analysis**\nProcess disk images from all affected systems into a single Plaso storage file, import into Timesketch for collaborative analysis, search for lateral movement patterns across system timelines, identify the patient-zero system and initial compromise vector, map the full attack chain across the environment.\n\n**Scenario 4: Insider Threat After-Hours Activity**\nFilter timeline to non-business hours only, identify file access patterns outside normal working times, correlate with authentication events (badge access, VPN logon), search for data access to sensitive directories during these periods, build evidence package for HR\u002Flegal.\n\n## Output Format\n\n```\nTimeline Reconstruction Summary:\n  Evidence Sources:\n    Disk Image: evidence.dd (500 GB, NTFS)\n    Plaso Storage: evidence.plaso (2.3 GB)\n\n  Processing Statistics:\n    Total events extracted: 4,567,890\n    Parsers used: 45 (winevtx, prefetch, mft, usnjrnl, lnk, chrome, firefox, winreg, ...)\n    Processing time: 3h 45m\n\n  Incident Window (2024-01-15 to 2024-01-20):\n    Events in window: 234,567\n    Event Sources:\n      MFT:          89,234\n      Event Logs:   45,678\n      USN Journal:  56,789\n      Registry:     23,456\n      Prefetch:     1,234\n      Browser:      5,678\n      LNK Files:    2,345\n      Other:        10,153\n\n  Key Timeline Events:\n    2024-01-15 14:32 - Phishing email opened (browser)\n    2024-01-15 14:33 - Malicious document downloaded\n    2024-01-15 14:35 - PowerShell executed (Prefetch + Event Log)\n    2024-01-15 14:36 - C2 connection established (Registry + Event Log)\n    2024-01-16 02:30 - Mimikatz execution (Prefetch)\n    2024-01-16 02:45 - Lateral movement to DC (Event Log)\n    2024-01-17 03:00 - Data exfiltration (MFT + USN Journal)\n    2024-01-18 03:00 - Log clearing (Event Log)\n\n  Exported Files:\n    Full Timeline:     \u002Ftimeline\u002Ffull_timeline.csv (4.5M rows)\n    Incident Window:   \u002Ftimeline\u002Fincident_window.csv (234K rows)\n    Timesketch Import: \u002Ftimeline\u002Ftimeline.jsonl\n```\n",{"name":5,"domain":24,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Flinux-forensic-disk-timeline-plaso-forensic","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill linux-forensic-disk-timeline-plaso-forensic",{"tool":43,"command":44},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill linux-forensic-disk-timeline-plaso-forensic",{"tool":46,"command":47},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill linux-forensic-disk-timeline-plaso-forensic","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux-forensic-disk-timeline-plaso-forensic\u002FSKILL.md",true,[51],{"path":52,"resourceType":53,"resourceTypeDesc":54,"sizeBytes":55,"sourceHtmlUrl":56},"index.json","REFERENCE","参考文档",572,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux-forensic-disk-timeline-plaso-forensic\u002Findex.json",[58,83,106,128,150,166],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":25},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,24,82],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":25},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[90,65,91,68,92,93,94,24,95,96,97,98,99,100,70,101,102,103,104,105],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":25},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[113,114,115,116,117,118,24,95,119,96,120,121,70,103,122,123,124,125,126,127],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":25},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[66,135,136,137,138,139,140,71,141,24,82,142,143,144,145,146,147,148,149,70],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":25},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[157,158,66,159,137,139,160,71,161,141,24,82,96,162,163,164,165,149,70,72],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":25},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[173,66,137,174,160,71,175,176,24,82,177,178,179,180,181,182,70,72,183,184],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]