[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFJHXJNQ0P0AHTBEWE6KMK":3,"skill-same:01M6AFJHXJNQ0P0AHTBEWE6KMK":101},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":61,"ownerHtmlUrl":62,"ownerBlogUrl":63,"ownerDescription":64,"updatedAt":65,"install":66,"resources":79},"01M6AFJHXJNQ0P0AHTBEWE6KMK","parsing-artifacts-with-eric-zimmerman-tools",null,"Parse Windows forensic artifacts—$MFT\u002F$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV\u002FJSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR\u002Fincident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file\u002Ffolder access, and persistence evidence from acquired forensic images.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fparsing-artifacts-with-eric-zimmerman-tools\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"parsing artifacts with eric zimmerman tools","artifacts","Tools","eric-zimmerman","artifact-parsing","registry-forensics","analysis","collection","execution","shellbags","digital-forensics","cybersecurity","amcache","prefetch","mftecmd","mft","dfir","file","registry","windows","2026-11-10 10:12:30",false,"---\nname: parsing-artifacts-with-eric-zimmerman-tools\ndescription: Parse Windows forensic artifacts—$MFT\u002F$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV\u002FJSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR\u002Fincident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file\u002Ffolder access, and persistence evidence from acquired forensic images.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- digital-forensics\n- eric-zimmerman\n- registry-forensics\n- prefetch\n- shellbags\n- mft\n- dfir\n- artifact-parsing\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\nmitre_attack:\n- T1112\n---\n# Parsing Artifacts with Eric Zimmerman Tools\n\n> **Authorized Use Only:** These tools parse evidence acquired from systems. Only analyze data you are authorized to handle, maintain chain of custody, and work from forensic copies rather than originals.\n\n## Overview\n\nEric Zimmerman's Tools (EZ Tools) are a free, open-source suite of high-fidelity Windows forensic parsers, each focused on a specific artifact class and each producing analyst-ready CSV\u002FJSON output. They are the de facto standard for Windows artifact analysis and are what KAPE's `!EZParser` module invokes under the hood. Key tools include:\n\n- **MFTECmd** — parses `$MFT`, `$J` ($UsnJrnl), `$Boot`, `$SDS`, and `$LogFile` from NTFS volumes.\n- **PECmd** — parses Windows Prefetch (`.pf`) for evidence of program execution.\n- **RECmd** — registry hive parser\u002Fsearcher driven by batch plugins (RECmd Batch files).\n- **SBECmd** — parses ShellBags (folder access history) from `UsrClass.dat`\u002F`NTUSER.DAT`.\n- **AmcacheParser** — parses `Amcache.hve` for application execution and metadata.\n- **AppCompatCacheParser** — parses ShimCache (AppCompatCache) from `SYSTEM` hive.\n- **LECmd** — parses LNK shortcut files. **JLECmd** — parses Jump Lists. **EvtxECmd** — parses EVTX event logs to a normalized schema.\n\nOutput is designed to load into **Timeline Explorer** (also by Eric Zimmerman), a fast CSV\u002FExcel viewer purpose-built for filtering, tagging, and pivoting across forensic CSVs. The 2025+ releases run on .NET and also work natively on Linux.\n\n## When to Use\n\n- After triage collection (e.g. with KAPE) when you need to parse raw artifacts into structured, searchable evidence.\n- To establish program execution, file\u002Ffolder access, and persistence during incident response.\n- To build artifact-specific CSVs that feed timelines, Timesketch, or SIEM ingestion.\n\n## Prerequisites\n\n- Download EZ Tools via the official downloader (keeps tools current):\n  ```powershell\n  # Download\u002Fupdate all .NET 6 tools into C:\\Tools\\EZ\n  .\\Get-ZimmermanTools.ps1 -Dest C:\\Tools\\EZ\n  ```\n  Source: https:\u002F\u002Fericzimmerman.github.io\u002F and https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FGet-ZimmermanTools\n- .NET runtime (bundled with current releases).\n- Forensic copies of the artifacts (mounted image, KAPE collection, or extracted hives).\n\n## Objectives\n\n- Parse the MFT, prefetch, shellbags, registry, and amcache from a collection.\n- Produce normalized CSV\u002FJSON per artifact.\n- Load results into Timeline Explorer for analysis.\n- Establish execution and access evidence supporting the investigation.\n\n## MITRE ATT&CK Mapping\n\n| ID | Official Technique Name | Relevance to this skill |\n|----|------------------------|--------------------------|\n| T1112 | Modify Registry | RECmd, AmcacheParser, and AppCompatCacheParser parse registry-resident artifacts; analysts use them to detect adversary registry modification (persistence, defense evasion) recorded in hives. |\n\nThese are defensive parsers; the mapping reflects the artifact (registry) most relevant to the adversary behavior they help uncover.\n\n## Workflow\n\n### 1. Download\u002Fupdate the tools\nKeep parsers current so they handle the latest artifact formats.\n```powershell\n.\\Get-ZimmermanTools.ps1 -Dest C:\\Tools\\EZ\n```\n\n### 2. Parse the MFT for file-system activity\n`-f` points at a single `$MFT`; `--csv` sets the output directory and `--csvf` the filename. Add `--csvf` for $J\u002FUsnJrnl with `-f $J`.\n```cmd\nMFTECmd.exe -f \"E:\\collection\\C\\$MFT\" --csv \"E:\\out\\mft\" --csvf MFT.csv\n\nREM Parse the USN Journal change log\nMFTECmd.exe -f \"E:\\collection\\C\\$Extend\\$J\" --csv \"E:\\out\\mft\" --csvf UsnJrnl.csv\n```\n\n### 3. Parse Prefetch for execution evidence\n`-d` recurses a directory of `.pf` files. Output CSV + JSON.\n```cmd\nPECmd.exe -d \"E:\\collection\\C\\Windows\\Prefetch\" --csv \"E:\\out\\prefetch\" --csvf Prefetch.csv --json \"E:\\out\\prefetch\\json\"\n```\n\n### 4. Parse ShellBags for folder-access history\n`-d` points at the directory containing the user's `UsrClass.dat`\u002F`NTUSER.DAT` (or `-f` a single hive).\n```cmd\nSBECmd.exe -d \"E:\\collection\\C\\Users\\jsmith\" --csv \"E:\\out\\shellbags\"\n```\n\n### 5. Parse the registry with RECmd batch plugins\nRECmd is driven by batch files (`--bn`) that bundle plugins; the `Kroll_Batch` file is comprehensive. `-d` recurses a directory of hives.\n```cmd\nRECmd.exe -d \"E:\\collection\\C\\Windows\\System32\\config\" --bn \"C:\\Tools\\EZ\\RECmd\\BatchExamples\\Kroll_Batch.reb\" --csv \"E:\\out\\registry\" --csvf Registry.csv\n\nREM Search a single hive for a value\u002Fkey\nRECmd.exe -f \"E:\\collection\\C\\Users\\jsmith\\NTUSER.DAT\" --sk \"Run\" --csv \"E:\\out\\registry\"\n```\n\n### 6. Parse Amcache and ShimCache\n```cmd\nAmcacheParser.exe -f \"E:\\collection\\C\\Windows\\AppCompat\\Programs\\Amcache.hve\" --csv \"E:\\out\\amcache\" -i\n\nAppCompatCacheParser.exe -f \"E:\\collection\\C\\Windows\\System32\\config\\SYSTEM\" --csv \"E:\\out\\shimcache\"\n```\n\n### 7. Parse LNK, Jump Lists, and EVTX\n```cmd\nLECmd.exe -d \"E:\\collection\\C\\Users\\jsmith\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv \"E:\\out\\lnk\"\n\nJLECmd.exe -d \"E:\\collection\\C\\Users\\jsmith\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv \"E:\\out\\jumplists\"\n\nEvtxECmd.exe -d \"E:\\collection\\C\\Windows\\System32\\winevt\\Logs\" --csv \"E:\\out\\evtx\" --csvf EventLogs.csv\n```\n\n### 8. Analyze in Timeline Explorer\nOpen the resulting CSVs in Timeline Explorer (`TimelineExplorer.exe`). Use column filters, conditional formatting, and tagging to pivot on time, file path, and user. CSVs from all EZ Tools share consistent timestamp columns for cross-artifact correlation.\n\n### 9. Cross-correlate\nBuild a working theory by correlating PECmd (execution time) with MFTECmd (file creation), Amcache\u002FShimCache (program presence), and ShellBags\u002FLNK (access), all anchored on UTC timestamps.\n\n## Tools and Resources\n\n| Tool | Artifact parsed | Link |\n|------|-----------------|------|\n| MFTECmd | $MFT, $J, $Boot, $SDS, $LogFile | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FMFTECmd |\n| PECmd | Prefetch | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FPECmd |\n| RECmd | Registry hives | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FRECmd |\n| SBECmd | ShellBags | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FShellbags |\n| AmcacheParser | Amcache.hve | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FAmcacheParser |\n| AppCompatCacheParser | ShimCache | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FAppCompatCacheParser |\n| LECmd \u002F JLECmd | LNK \u002F Jump Lists | https:\u002F\u002Fericzimmerman.github.io\u002F |\n| EvtxECmd | EVTX event logs | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002Fevtx |\n| Timeline Explorer | CSV analysis viewer | https:\u002F\u002Fericzimmerman.github.io\u002F |\n| Get-ZimmermanTools | Downloader\u002Fupdater | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FGet-ZimmermanTools |\n\n## Common Flags\n\n| Flag | Meaning |\n|------|---------|\n| `-f \u003Cfile>` | Parse a single file |\n| `-d \u003Cdir>` | Recurse a directory |\n| `--csv \u003Cdir>` | CSV output directory |\n| `--csvf \u003Cname>` | CSV output filename |\n| `--json \u003Cdir>` | JSON output directory |\n| `--bn \u003Cfile>` | RECmd batch (.reb) file |\n| `-i` | AmcacheParser: include file entries (unassociated) |\n\n## Validation Criteria\n\n- [ ] EZ Tools downloaded\u002Fupdated via Get-ZimmermanTools\n- [ ] $MFT (and $J) parsed to CSV\n- [ ] Prefetch parsed for execution evidence\n- [ ] ShellBags parsed for folder-access history\n- [ ] Registry parsed with Kroll_Batch (RECmd)\n- [ ] Amcache and ShimCache parsed\n- [ ] LNK\u002FJump Lists\u002FEVTX parsed as needed\n- [ ] Output loaded and reviewed in Timeline Explorer\n- [ ] Cross-artifact correlation performed on UTC timestamps\n","# Parsing Artifacts with Eric Zimmerman Tools\n\n> **Authorized Use Only:** These tools parse evidence acquired from systems. Only analyze data you are authorized to handle, maintain chain of custody, and work from forensic copies rather than originals.\n\n## Overview\n\nEric Zimmerman's Tools (EZ Tools) are a free, open-source suite of high-fidelity Windows forensic parsers, each focused on a specific artifact class and each producing analyst-ready CSV\u002FJSON output. They are the de facto standard for Windows artifact analysis and are what KAPE's `!EZParser` module invokes under the hood. Key tools include:\n\n- **MFTECmd** — parses `$MFT`, `$J` ($UsnJrnl), `$Boot`, `$SDS`, and `$LogFile` from NTFS volumes.\n- **PECmd** — parses Windows Prefetch (`.pf`) for evidence of program execution.\n- **RECmd** — registry hive parser\u002Fsearcher driven by batch plugins (RECmd Batch files).\n- **SBECmd** — parses ShellBags (folder access history) from `UsrClass.dat`\u002F`NTUSER.DAT`.\n- **AmcacheParser** — parses `Amcache.hve` for application execution and metadata.\n- **AppCompatCacheParser** — parses ShimCache (AppCompatCache) from `SYSTEM` hive.\n- **LECmd** — parses LNK shortcut files. **JLECmd** — parses Jump Lists. **EvtxECmd** — parses EVTX event logs to a normalized schema.\n\nOutput is designed to load into **Timeline Explorer** (also by Eric Zimmerman), a fast CSV\u002FExcel viewer purpose-built for filtering, tagging, and pivoting across forensic CSVs. The 2025+ releases run on .NET and also work natively on Linux.\n\n## When to Use\n\n- After triage collection (e.g. with KAPE) when you need to parse raw artifacts into structured, searchable evidence.\n- To establish program execution, file\u002Ffolder access, and persistence during incident response.\n- To build artifact-specific CSVs that feed timelines, Timesketch, or SIEM ingestion.\n\n## Prerequisites\n\n- Download EZ Tools via the official downloader (keeps tools current):\n  ```powershell\n  # Download\u002Fupdate all .NET 6 tools into C:\\Tools\\EZ\n  .\\Get-ZimmermanTools.ps1 -Dest C:\\Tools\\EZ\n  ```\n  Source: https:\u002F\u002Fericzimmerman.github.io\u002F and https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FGet-ZimmermanTools\n- .NET runtime (bundled with current releases).\n- Forensic copies of the artifacts (mounted image, KAPE collection, or extracted hives).\n\n## Objectives\n\n- Parse the MFT, prefetch, shellbags, registry, and amcache from a collection.\n- Produce normalized CSV\u002FJSON per artifact.\n- Load results into Timeline Explorer for analysis.\n- Establish execution and access evidence supporting the investigation.\n\n## MITRE ATT&CK Mapping\n\n| ID | Official Technique Name | Relevance to this skill |\n|----|------------------------|--------------------------|\n| T1112 | Modify Registry | RECmd, AmcacheParser, and AppCompatCacheParser parse registry-resident artifacts; analysts use them to detect adversary registry modification (persistence, defense evasion) recorded in hives. |\n\nThese are defensive parsers; the mapping reflects the artifact (registry) most relevant to the adversary behavior they help uncover.\n\n## Workflow\n\n### 1. Download\u002Fupdate the tools\nKeep parsers current so they handle the latest artifact formats.\n```powershell\n.\\Get-ZimmermanTools.ps1 -Dest C:\\Tools\\EZ\n```\n\n### 2. Parse the MFT for file-system activity\n`-f` points at a single `$MFT`; `--csv` sets the output directory and `--csvf` the filename. Add `--csvf` for $J\u002FUsnJrnl with `-f $J`.\n```cmd\nMFTECmd.exe -f \"E:\\collection\\C\\$MFT\" --csv \"E:\\out\\mft\" --csvf MFT.csv\n\nREM Parse the USN Journal change log\nMFTECmd.exe -f \"E:\\collection\\C\\$Extend\\$J\" --csv \"E:\\out\\mft\" --csvf UsnJrnl.csv\n```\n\n### 3. Parse Prefetch for execution evidence\n`-d` recurses a directory of `.pf` files. Output CSV + JSON.\n```cmd\nPECmd.exe -d \"E:\\collection\\C\\Windows\\Prefetch\" --csv \"E:\\out\\prefetch\" --csvf Prefetch.csv --json \"E:\\out\\prefetch\\json\"\n```\n\n### 4. Parse ShellBags for folder-access history\n`-d` points at the directory containing the user's `UsrClass.dat`\u002F`NTUSER.DAT` (or `-f` a single hive).\n```cmd\nSBECmd.exe -d \"E:\\collection\\C\\Users\\jsmith\" --csv \"E:\\out\\shellbags\"\n```\n\n### 5. Parse the registry with RECmd batch plugins\nRECmd is driven by batch files (`--bn`) that bundle plugins; the `Kroll_Batch` file is comprehensive. `-d` recurses a directory of hives.\n```cmd\nRECmd.exe -d \"E:\\collection\\C\\Windows\\System32\\config\" --bn \"C:\\Tools\\EZ\\RECmd\\BatchExamples\\Kroll_Batch.reb\" --csv \"E:\\out\\registry\" --csvf Registry.csv\n\nREM Search a single hive for a value\u002Fkey\nRECmd.exe -f \"E:\\collection\\C\\Users\\jsmith\\NTUSER.DAT\" --sk \"Run\" --csv \"E:\\out\\registry\"\n```\n\n### 6. Parse Amcache and ShimCache\n```cmd\nAmcacheParser.exe -f \"E:\\collection\\C\\Windows\\AppCompat\\Programs\\Amcache.hve\" --csv \"E:\\out\\amcache\" -i\n\nAppCompatCacheParser.exe -f \"E:\\collection\\C\\Windows\\System32\\config\\SYSTEM\" --csv \"E:\\out\\shimcache\"\n```\n\n### 7. Parse LNK, Jump Lists, and EVTX\n```cmd\nLECmd.exe -d \"E:\\collection\\C\\Users\\jsmith\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv \"E:\\out\\lnk\"\n\nJLECmd.exe -d \"E:\\collection\\C\\Users\\jsmith\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv \"E:\\out\\jumplists\"\n\nEvtxECmd.exe -d \"E:\\collection\\C\\Windows\\System32\\winevt\\Logs\" --csv \"E:\\out\\evtx\" --csvf EventLogs.csv\n```\n\n### 8. Analyze in Timeline Explorer\nOpen the resulting CSVs in Timeline Explorer (`TimelineExplorer.exe`). Use column filters, conditional formatting, and tagging to pivot on time, file path, and user. CSVs from all EZ Tools share consistent timestamp columns for cross-artifact correlation.\n\n### 9. Cross-correlate\nBuild a working theory by correlating PECmd (execution time) with MFTECmd (file creation), Amcache\u002FShimCache (program presence), and ShellBags\u002FLNK (access), all anchored on UTC timestamps.\n\n## Tools and Resources\n\n| Tool | Artifact parsed | Link |\n|------|-----------------|------|\n| MFTECmd | $MFT, $J, $Boot, $SDS, $LogFile | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FMFTECmd |\n| PECmd | Prefetch | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FPECmd |\n| RECmd | Registry hives | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FRECmd |\n| SBECmd | ShellBags | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FShellbags |\n| AmcacheParser | Amcache.hve | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FAmcacheParser |\n| AppCompatCacheParser | ShimCache | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FAppCompatCacheParser |\n| LECmd \u002F JLECmd | LNK \u002F Jump Lists | https:\u002F\u002Fericzimmerman.github.io\u002F |\n| EvtxECmd | EVTX event logs | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002Fevtx |\n| Timeline Explorer | CSV analysis viewer | https:\u002F\u002Fericzimmerman.github.io\u002F |\n| Get-ZimmermanTools | Downloader\u002Fupdater | https:\u002F\u002Fgithub.com\u002FEricZimmerman\u002FGet-ZimmermanTools |\n\n## Common Flags\n\n| Flag | Meaning |\n|------|---------|\n| `-f \u003Cfile>` | Parse a single file |\n| `-d \u003Cdir>` | Recurse a directory |\n| `--csv \u003Cdir>` | CSV output directory |\n| `--csvf \u003Cname>` | CSV output filename |\n| `--json \u003Cdir>` | JSON output directory |\n| `--bn \u003Cfile>` | RECmd batch (.reb) file |\n| `-i` | AmcacheParser: include file entries (unassociated) |\n\n## Validation Criteria\n\n- [ ] EZ Tools downloaded\u002Fupdated via Get-ZimmermanTools\n- [ ] $MFT (and $J) parsed to CSV\n- [ ] Prefetch parsed for execution evidence\n- [ ] ShellBags parsed for folder-access history\n- [ ] Registry parsed with Kroll_Batch (RECmd)\n- [ ] Amcache and ShimCache parsed\n- [ ] LNK\u002FJump Lists\u002FEVTX parsed as needed\n- [ ] Output loaded and reviewed in Timeline Explorer\n- [ ] Cross-artifact correlation performed on UTC timestamps\n",{"name":5,"tags":49,"author":50,"domain":35,"license":15,"version":51,"nist_csf":52,"subdomain":34,"description":7,"mitre_attack":54},[34,27,29,37,33,39,40,28],"mahipal","1.0",[53],"RS.AN-03",[55],"T1112","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fparsing-artifacts-with-eric-zimmerman-tools",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill parsing-artifacts-with-eric-zimmerman-tools",{"tool":72,"command":73},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill parsing-artifacts-with-eric-zimmerman-tools",{"tool":75,"command":76},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill parsing-artifacts-with-eric-zimmerman-tools","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fparsing-artifacts-with-eric-zimmerman-tools\u002FSKILL.md",true,[80,85,91,95],{"path":81,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fparsing-artifacts-with-eric-zimmerman-tools\u002FLICENSE",{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fapi-reference.md","REFERENCE","参考文档",2305,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fparsing-artifacts-with-eric-zimmerman-tools\u002Freferences\u002Fapi-reference.md",{"path":92,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fstandards.md",1213,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fparsing-artifacts-with-eric-zimmerman-tools\u002Freferences\u002Fstandards.md",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Fagent.py","SCRIPT","脚本",4745,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fparsing-artifacts-with-eric-zimmerman-tools\u002Fscripts\u002Fagent.py",[102,128,151,179,196,223],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":109,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[108],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[110,111,112,113,114,35,115,116,117,118,25,119,120,121,122,123,124,125,126,127],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":135,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[134],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[136,124,137,138,114,139,35,117,140,141,142,26,143,144,145,146,147,148,149,150],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":161,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[157,160],{"categoryNo":158,"categoryName":159,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[145,162,163,164,165,35,166,167,140,168,169,170,171,172,173,174,175,176,177,178],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":186,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[185],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[43,187,188,35,42,189,190,191,40,39,38,192,37,27,34,193,26,31,194,195],"kape","triaging windows with kape","browser","logs","windows-forensics","data","SET","pecmd","artifact-collection",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":203,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[202],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[204,205,206,35,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":230,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[229],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[114,231,35,232,41,233,234,235,236,237,238,174,32,175,30,239,240,241,242,243],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]