Incident Response

Scan files, URLs and domains against VirusTotal reputation data via Composio

Correlate logs, PCAP and disk artifacts into an incident timeline

Analyze memory dumps, disk timelines and PCAPs while preserving incident evidence

Analyze suspicious samples statically and dynamically and write IOC and YARA rules

Analyze RAM captures with Volatility to extract processes and artifacts

Make hash-verified forensic disk images with dd or dcfldd on Linux

Statically analyze Android malware APKs with apktool, jadx and androguard

Analyze bootkits and rootkits in MBR, VBR and UEFI firmware for hidden persistence

Build a unified browser timeline of history, downloads and cookies with Hindsight

Extract Cobalt Strike beacon configs to expose C2 servers and operator tradecraft

Reverse-engineer malware C2 traffic, beacon patterns and fallback infrastructure

Map an intrusion across kill-chain phases to find where defenses failed

Analyze E01, AFF and raw disk images in Autopsy to recover deleted files and timelines

Investigate compromised Docker containers through images, layers, volumes and logs

Trace phishing email origins through headers and validate SPF, DKIM and DMARC

Find heap spray NOP sleds and shellcode in memory dumps with Volatility3

Analyze Linux ELF malware, botnets and cryptominers with static and dynamic tracing

Find hidden kernel modules and hooked syscalls in Linux memory dumps with Volatility3

Reconstruct attacker activity from Linux logs, cron jobs, SSH keys and shell history

Parse Windows LNK and Jump List files to prove file access and program execution

Extract VBA macro attack chains from Word, Excel and PowerPoint files with olevba

Extract embedded JavaScript and shellcode from malicious PDFs with peepdf

Detonate malware in Cuckoo Sandbox to record file, registry, network and API activity

Enumerate Windows persistence in run keys, services and scheduled tasks with Autoruns

Spot sandbox and VM evasion tricks like timing checks and sleep inflation in malware

Find injected code, hidden processes and credentials in RAM dumps with Volatility

Acquire Linux RAM with LiME and analyze it in Volatility 3 for intrusion evidence

Recover deleted file evidence and timelines from the NTFS MFT with MFTECmd

Trace C2, lateral movement and exfiltration in captures with Wireshark, Zeek and NetFlow

Identify malware C2 protocols and payload downloads from sandbox network traffic

Extract messages, attachments and deleted items from Outlook PST and OST files

Find embedded JavaScript and exploits in malicious PDFs without opening them

Find Linux persistence in cron, systemd, LD_PRELOAD, shell profiles and SSH keys

Build a Windows program execution timeline from Prefetch files with PECmd

Assess ransomware encryption flaws and decryption feasibility for recovery work

Trace ransomware payment wallets and fund flows through mixers and exchanges

Recover hidden NTFS data from slack space, the USN journal and alternate streams

Trace trojanized updates, compromised build pipelines and sideloaded dependencies

Check UEFI firmware and boot components for bootkits like BlackLotus and MoonBounce

Rebuild USB device history from registry keys, event logs and setupapi logs

Parse Amcache hives for program execution, app installs and driver loads

Pull target paths and timestamps from Windows LNK files for DFIR timelines

Rebuild Windows program run history and accessed files from Prefetch with Python

Read Windows registry hives with RegRipper for user activity and persistence entries

Reconstruct folder browsing history from Windows Shellbag registry artifacts

Automate malware submission to sandboxes and scanners to get verdicts and IOCs

Build live incident response dashboards in Splunk, Elastic or Grafana for SOC leads

Write incident response playbooks with step-by-step procedures aligned to NIST 800-61r3

Build collaborative forensic incident timelines in Timesketch from Plaso and log data