mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-11 10:03:42 +03:00
mukul975
c21af3347e
- Add scripts/agent.py and references/api-reference.md to all remaining skills - Update all 648 LICENSE files: copyright now reads 'Mahipal' - Add implementing-security-monitoring-with-datadog (new skill with full anatomy) - All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md
2.0 KiB
2.0 KiB
API Reference: Collecting Volatile Evidence from Compromised Host
RFC 3227 Order of Volatility
| Priority | Source | Persistence |
|---|---|---|
| 1 | CPU registers, cache | Nanoseconds |
| 2 | Physical memory (RAM) | Power cycle |
| 3 | Network state | Seconds-minutes |
| 4 | Running processes | Minutes |
| 5 | Disk (filesystem) | Persistent |
| 6 | Remote logging / monitoring | Persistent |
| 7 | Physical configuration | Persistent |
| 8 | Archival media | Long-term |
Memory Acquisition Tools
| Tool | Platform | Command |
|---|---|---|
| AVML | Linux | avml /path/to/output.lime |
| WinPmem | Windows | winpmem_mini_x64.exe output.raw |
| LiME | Linux | insmod lime.ko "path=/tmp/mem.lime format=lime" |
| Magnet RAM Capture | Windows | GUI-based acquisition |
Linux Collection Commands
# Network connections
ss -tunap > /evidence/netstat.txt
# Process list with tree
ps auxwwf > /evidence/processes.txt
# Open files
lsof -nP > /evidence/open_files.txt
# Network config
ip addr show > /evidence/ifconfig.txt
ip route show > /evidence/routes.txt
ip neigh show > /evidence/arp.txt
# Logged-in users
w > /evidence/users.txt
last -50 > /evidence/last_logins.txt
# Cron jobs
crontab -l > /evidence/crontab.txt
ls -la /etc/cron.d/ >> /evidence/crontab.txt
Windows Collection Commands
:: Network connections
netstat -anob > C:\evidence\netstat.txt
:: Process list
tasklist /V /FO CSV > C:\evidence\processes.csv
wmic process get ProcessId,Name,CommandLine /format:csv > C:\evidence\wmic_procs.csv
:: Network config
ipconfig /all > C:\evidence\ipconfig.txt
route print > C:\evidence\routes.txt
arp -a > C:\evidence\arp.txt
:: DNS cache
ipconfig /displaydns > C:\evidence\dns_cache.txt
:: Scheduled tasks
schtasks /query /FO CSV /V > C:\evidence\schtasks.csv
:: Logged-in users
query user > C:\evidence\users.txt
Evidence Integrity
# Hash collected files
sha256sum /evidence/*.txt > /evidence/checksums.sha256
# Verify later
sha256sum -c /evidence/checksums.sha256