Incident Response

This is a comprehensive IR playbook that walks you through the full incident lifecycle, from scoping and evidence collection through containment and reporting. It's built around Volatility 3, Plaso, and modern log analysis tools like Chainsaw and Hayabusa. The memory forensics section is genuinely useful, covering process injection detection, rootkit hunting, and credential extraction with specific commands you can run. What I appreciate is the practical timeline analysis workflow and the structured IOC extraction guidance. The reporting template alone saves hours when you're writing up findings at 2am. If you're doing incident response work, this gives you a solid procedural framework with the actual commands instead of just theory.

Install to Claude Code

npx -y skills add hypnguyen1209/offensive-claude --skill incident-response --agent claude-code