forensics-team

What problem does it solve?

This Skill provides an expert-level analysis of network traffic (PCAP) and security incidents, enabling the identification of temporal patterns, attack types, and attribution with the rigor of an elite forensics team.

Core Features & Use Cases

• Deep Packet Analysis: Utilizes raw PCAP data as the primary source of truth, dissecting traffic from the OSI layer outward.
• Native Tooling: Employs standard Linux command-line tools for efficient and reliable analysis.
• Incident Response & Threat Hunting: Aids in reconstructing breach timelines, identifying command-and-control (C2) channels, and attributing malicious activity.
• Use Case: Analyze a PCAP file to identify a web shell attempt by examining HTTP headers, decoding base64 encoded commands, and correlating with network layer anomalies.

Quick Start

Act as the Lead Forensic Analyst and analyze the provided PCAP snippet surrounding the alert time, focusing on raw packet data and Layer 3/4 anomalies.