Claude Skills by MustafaKemal0146

Araştır: compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.

tespit etme
kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to

İncele: Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.

Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell

Şunu analiz et: NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT,

Analyze Microsoft Outlook PST and OST files for email forensic evidence including message content, headers, attachments, deleted items, and metadata using libpff, pst-utils, and forensic email

Parse Windows Prefetch files to Belirle: program execution history including run counts, timestamps, and referenced files for forensic investigation.

İncele: file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.

Araştır: USB device connection history from Windows registry, event logs, and setupapi logs to track removable media usage and potential data exfiltration.

Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application installation, and driver loading for digital forensics investigations. Uses Eric

Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.

Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, tespit etme
renamed or masquerading binaries, and identify suspicious program

Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.

Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, tespit etme
Erişim: removable media and network shares, and establish user interaction with directories even

Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.

Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to tespit etme
lateral movement, persistence, and privilege escalation.

Identify, collect, and analyze ransomware attack artifacts to Belirle: the variant, initial access vector, encryption scope, and recovery options.

Conduct forensic investigations in cloud environments by collecting and analyzing logs, snapshots, and metadata from AWS, Azure, and GCP services.

Perform forensic acquisition and analysis of cloud storage services including Google Drive, OneDrive, Dropbox, and Box by collecting both API-based remote data and local sync client artifacts

Recover files from disk images and unalBul:d space using Foremost's header-footer signature carving to extract evidence regardless of file system state.

Perform forensic investigation of Linux system logs including syslog, auth.log, systemd journal, kern.log, and application logs to reconstruct user activity, tespit etme
unauthorized access, and

Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations.

Systematically Araştır: all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.

Analyze volatile memory dumps using Volatility 3 to extract running processes, network connections, loaded modules, and evidence of malicious activity.

Acquire and analyze mobile device data using Cellebrite UFED and open-source tools to extract communications, location data, and application artifacts.

Capture and analyze network traffic using Wireshark and tshark to reconstruct network events, extract artifacts, and identify malicious communications.

Perform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious

Perform forensic analysis of SQLite databases to recover deleted records from freelists and WAL files, decode encoded timestamps, and extract evidence from browser history, messaging apps,

tespit etme
and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.

Build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across file systems, logs, and artifacts into a unified chronological view.

Perform comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite including KAPE, MFTECmd, PECmd, LECmd, JLECmd, and Timeline Explorer for parsing registry

Recover deleted files from disk images and storage media using PhotoRec's file signature-based carving engine regardless of file system damage.

Configures host-based intrusion Tespit systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use Dağıt:ing yaparken OSSEC, Wazuh,

Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, network protection, and exploit protection.

Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat Tespit and forensic investigation. Use enabling yaparken audit policies for

Dağıt:s and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat Tespit, behavioral analysis, and automated response. Use onboarding yaparken endpoints

Dağıt:s and configures osquery for real-time endpoint monitoring using SQL-based queries to Denetle: running processes, open ports, installed software, and system configuration. Use building yaparken

tespit etme (s) defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use investigating yaparken suspicious

tespit etme (s) fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use building yaparken Tespits for PowerShell-based

Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use Dağıt:ing yaparken

Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when

Implements application whitelisting using Windows AppLocker to restrict unauthorized software execution on endpoints, reducing attack surface from malware, unauthorized tools, and shadow IT.

Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthorized access in case of device loss or theft. Use Dağıt:ing yaparken encryption

Implements endpoint Data Loss Prevention (DLP) controls to tespit etme
and prevent sensitive data exfiltration through email, USB, cloud storage, and printing. Use Dağıt:ing yaparken DLP agents, creating

Configure AIDE (Advanced Intrusion Tespit Environment) for file integrity monitoring including baseline creation, scheduled integrity checks, change Tespit, and alerting

Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent

Implements USB device control policies to restrict unauthorized removable media access on endpoints, preventing data exfiltration and malware introduction via USB devices. Use Dağıt:ing yaparken

Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Use investigating yaparken security