侦探与刑事调查员

investigation.md ★ 14.5k

from "danielmiessler"

OSINT and people-finding — structured investigations, company intel, due diligence, and ethical people search across public records and social media. USE WHEN O

crime-case-identify.md ★ 6.4k

from "EverMind-AI"

First determine the case type (murder, theft, arson, accident), then search using domain-specific terminology

crime-role-chain.md ★ 6.4k

from "EverMind-AI"

Track from victim to suspect to lawyer to witness — the answer is usually an indirectly connected person or detail

ai-scam-defense.md ★ 2.0k

from "LeoYeAI"

Identify and defend against AI-powered scams including deepfakes, voice cloning, AI phishing, and fake job offers. Use when someone received a suspicious call f

security-case-management.md ★ 493

from "elastic"

Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or mana

initial-incident-intake-scoping.md ★ 314

from "tsale"

First-hour intake checklist + questions that produce an actionable scope and evidence plan.

target-profiling.md ★ 141

from "jmagly"

Research and build a target system profile via SSH — discovers OS, services, users, network baseline, and security stack

respond-malware.md ★ 109

from "dandye"

Respond to a malware incident following PICERL methodology. Use when malware is detected on endpoints. Orchestrates triage, containment, eradication, and recove

hunt-lateral-movement.md ★ 109

from "dandye"

Hunt for lateral movement using PsExec, WMI, or similar techniques. Use when proactively searching for attackers moving through your network using admin tools.

respond-ransomware.md ★ 109

from "dandye"

Respond to a ransomware incident following PICERL methodology. Use when ransomware is detected or suspected. Orchestrates identification, containment, eradicati

correlate-ioc.md ★ 109

from "dandye"

Check for existing SIEM alerts and case management entries related to IOCs. Use to understand if an indicator has triggered previous alerts or is part of ongoin

full-investigation.md ★ 109

from "dandye"

Complete Tier 2 investigation workflow. Orchestrates deep investigation of escalated cases: deep-dive-ioc, correlate-ioc, specialized triage (malware/login), pi

triage-malware.md ★ 109

from "dandye"

Triage a suspected malicious file hash. Use when investigating malware alerts or suspicious files. Analyzes GTI file report, behavioral indicators, identifies a

hunt-threat.md ★ 109

from "dandye"

Conduct proactive, hypothesis-driven threat hunting. Use when performing advanced hunting based on threat intelligence, TTPs, or anomalies. For Tier 3 analysts

respond-compromised-account.md ★ 109

from "dandye"

Respond to a potentially compromised user account. Use when impossible travel, credential stuffing, successful phishing, or suspicious activity indicates accoun