skills.rest
yogiex
yogiexCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

offsec-ir-200

Guides incident response workflows covering Splunk analysis, disk and memory forensics, and OSIR exam reporting.

Updated Jun 5, 2026
Search Tags:#incident response#volatility#siem#splunk#yara#digital forensics#osir
One-click install
npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill offsec-ir-200-yogiex
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offsec-ir-200
Source: https://github.com/yogiex/opencode-cyber-security-skills/tree/main/skills/offsec-ir-200
Command: npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill offsec-ir-200-yogiex

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve? Preparing for the OffSec IR-200 (OSIR) certification requires mastering the full incident response lifecycle, Splunk SPL detection queries, disk and memory forensics, and structured post-mortem reporting, and this Skill consolidates all of that guidance in one place. ## Core Features & Use Cases - Splunk SIEM Detection Queries: Ready-to-use SPL queries for brute force, lateral movement, persistence, Kerberoasting, and C2 detection across Windows Event Logs and Sysmon. - Digital Forensics Workflows: Step-by-step Autopsy disk analysis and Volatility 3 memory analysis commands, including malfind, psscan, and netscan usage. - Exam Strategy & Reporting: 8-hour time management plan, scoring breakdown (50/70 to pass), report templates, chain of custody tables, and regulatory notification checklists (GDPR, HIPAA, SEC). - Use Case: During an OSIR practice lab, ask for the SPL query to detect pass-the-hash activity, then get the Volatility 3 commands to confirm process injection on the compromised host. ## Quick Start Ask the agent to walk you through investigating a suspected ransomware incident using Splunk logs and a memory dump following the OSIR exam methodology.

Frequently Asked Questions about offsec-ir-200

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect brute force attacks with Splunk SPL queries?▼

Use EventCode 4625 from WinEventLog:Security and aggregate failures per source IP with stats. Filter with a threshold like FailedCount > 20 and count distinct targeted accounts to identify brute force patterns.

How to analyze a memory dump with Volatility 3?▼

Start with windows.info to identify the system, then run windows.pslist and windows.psscan to compare for hidden processes. Use windows.malfind to detect injected code and windows.netscan to find C2 connections from suspicious PIDs.

What is the difference between Volatility 2 and Volatility 3?▼

Volatility 3 does not require a profile parameter; windows.info handles identification automatically. Plugin names also changed, using namespaced commands like windows.pslist instead of the plain pslist from Volatility 2.

What score is needed to pass the OSIR exam?▼

The OSIR exam has 70 total points across two phases, and passing requires 50 points. You can pass with 4 of 4 Phase 1 Splunk exercises plus 1 of 2 Phase 2 forensics exercises, or 3 of 4 Phase 1 plus both Phase 2 exercises.

How do I write a YARA rule for malware detection?▼

Define meta information, string patterns such as suspicious commands or C2 indicators, and a condition specifying how many strings must match. Test the rule with yara -s against samples before submitting, since overly broad rules produce false positives.

What are the limitations of Splunk queries in the OSIR exam environment?▼

Field names and data models may differ from practice labs, so verify fields with a raw search first. Sysmon EventCode 22 for DNS may be unavailable depending on the environment's Sysmon configuration, and incorrect time ranges can cause inaccurate results.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

analyzing-windows-event-logs-in-splunk

Detects Windows authentication attacks, privilege escalation, persistence, and lateral movement using Splunk SPL queries.

Community
Intermediate
abnejsolutions-altabnejsolutions-alt

glba-expert

Provide GLBA compliance guidance covering Safeguards Rule, Privacy Rule, and vendor management.

Community
Advanced
jaskaranhundaljaskaranhundal
3

threat-intelligence

Enrich security events by classifying IOCs and mapping behaviors to MITRE ATT&CK techniques.

Community
Advanced
daemon-blockint-techdaemon-blockint-tech
7

threat-hunter

Validate adversary hypotheses across enterprise telemetry using MITRE ATT&CK mapping.

Community
Advanced