tsale/awesome-dfir-skills

This skill helps you assemble a targeted Windows intrusion timeline from artifacts, highlighting gaps, and generating follow-up queries to validate hypotheses.

This skill helps you write, validate, and troubleshoot osquery queries against platform schemas to improve accuracy and performance.

This skill helps threat hunters generate a cross-platform PowerShell abuse hunt plan with queries, telemetries, and pivots for rapid investigation.

This skill converts messy intake notes into a clear incident scope and evidence plan, speeding first-hour decision making.

This skill helps analysts map Mitre ATT&CK tactics and techniques to detections and threat models, enabling precise risk insights.

This skill performs analyst-grade static analysis, TI triage, and behavioral reasoning on suspicious PE files to produce actionable malware reports.