windows-intrusion-timeline_skill

Overview

This skill builds a targeted intrusion timeline for Windows incidents by ingesting available artifacts (event logs, EDR exports, SIEM CSVs, and triage notes). It reconstructs observed actions, highlights gaps and uncertainty, and produces concrete follow-up queries to confirm hypotheses. Outputs separate facts from interpretation and assigns confidence to each finding.

How this skill works

I parse structured telemetry (Security, Sysmon, PowerShell, System, TaskScheduler, EDR process trees) and normalize timestamps. I select a suspicious seed event when present, pivot on process/Logon/Network identifiers, and trace backward/forward to map parent/child activity across hosts. For each row I record the observed fields, interpretive hypothesis, and a High/Med/Low confidence justification, and I call out missing logs or fields that would improve certainty.

When to use it

• You need a succinct incident narrative from limited Windows telemetry to brief stakeholders.
• Validating lateral movement, abnormal logons, or suspicious process chains across hosts.
• Prioritizing collection of missing artifacts (Sysmon, PowerShell script blocks, EDR process trees).
• Generating targeted SIEM/EDR queries to confirm key hypotheses quickly.

Best practices

• Provide a bounded time window and relevant hosts/users to reduce noise and protect privacy.
• Supply structured exports (CSV/JSON) with timestamp, host, user, process, parent IDs, and command line where possible.
• Mark timezone and any known clock skew; label untrusted timestamps explicitly.
• If you redact usernames, use consistent pseudonyms so chains remain traceable.
• When a suspicious execution is found, include ±30 minutes of surrounding logs and any EDR process tree.

Example use cases

• Pivot from a Sysmon EID 1 process creation that runs encoded PowerShell to find drop and C2 connections.
• Correlate Security 4624 logons with task scheduler events to detect lateral execution via scheduled tasks.
• Map privilege escalation by linking 4672 events, service creation (System 7045), and new scheduled tasks.
• Rapidly produce follow-up EventID filters for the SOC to run in the SIEM and confirm host compromise.