Performs comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite (KAPE, MFTECmd, PECmd, LECmd, JLECmd, Timeline Explorer) to parse registry hives, prefetch files, event logs, and file system metadata. Use during DFIR investigations that need a timeline of program execution, file access, and persistence built from Windows artifacts.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-windows-artifact-analysis-with-eric-zimmerman-toolsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-windows-artifact-analysis-with-eric-zimmerman-tools -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-windows-artifact-analysis-with-eric-zimmerman-tools -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/performing-windows-artifact-analysis-with-eric-zimmerman-toolsgh skill install mukul975/Anthropic-Cybersecurity-Skills performing-windows-artifact-analysis-with-eric-zimmerman-toolsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools ~/.claude/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools ~/.agents/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools # Codex, Cursor, Gemini CLI, Copilot, OpenCode