re-forensics

What it does: This skill helps investigate computer systems after a security incident by examining memory dumps and threat information. It collects evidence from running processes, network connections, stolen passwords, and suspicious files. It then looks up this evidence in threat databases to identify which malware family or hacker group was involved. What it does: This skill helps investigate computer systems after a security incident by examining memory dumps and threat information. It collects evidence from running processes, network connections, stolen passwords, and suspicious files. It then looks up this evidence in threat databases to identify which malware family or hacker group was involved. When to use it: Use this when you have a memory dump file from a compromised computer and need to understand what happened. Use it when you found suspicious files or network activity and want to know if they match known malware. Use it when investigating deleted files on a hard drive or analyzing container images for hidden threats.