What are LNK and Jump List artifacts used for in forensics?

They provide persistent evidence of file access, program execution, and user behavior, even if the original files or shortcuts have been deleted.

Does this skill support Windows 11 forensics?

Yes, it includes guidance on the differences in artifact generation between Windows 10 and Windows 11, such as modified Jump List behavior for modern applications.

Which tools are required to use this skill effectively?

The skill utilizes Eric Zimmerman's tools (LECmd and JLECmd) and Python libraries like pylnk3 or LnkParse3 for automated analysis.

Can this skill detect activity on network shares?

Yes, LNK files often contain UNC paths and NetBIOS names that identify access to remote servers and shared network resources.

Windows Artifact Forensics (LNK & Jump Lists)

Name: Windows Artifact Forensics (LNK & Jump Lists)
Author: mukul975

bymukul975

•

4,121

•

安全与测试

Analyzes Windows LNK files and Jump List artifacts to establish forensic evidence of file access and user activity.

This skill empowers AI agents to perform digital forensic investigations by parsing Windows LNK shortcuts and Jump Lists using industry-standard tools like LECmd and JLECmd. It provides detailed methodologies for recovering metadata such as target paths, timestamps, volume serial numbers, and machine identifiers, even after target files are deleted. This is essential for SOC analysts and incident responders looking to reconstruct timelines, prove file execution, or identify network share access during security investigations.

主要功能

01Automated parsing of Shell Link Binary formats using LECmd and JLECmd

02Recovery of metadata including timestamps, MAC addresses, and volume serials

034,121 GitHub stars

04Evidence extraction for file access, program execution, and user behavior

05Detailed mapping to NIST CSF 2.0 and MITRE ATT&CK frameworks

06Support for analyzing both Automatic and Custom Jump List destinations

使用场景

01Incident response to detect unauthorized program execution from suspicious paths

02Threat hunting for lateral movement through evidence of network share access

03Digital forensic investigations to prove a suspect accessed specific files or directories

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills analyzing-lnk-file-and-jump-list-artifacts

For use in Claude.ai and ChatGPT

主要功能

01Automated parsing of Shell Link Binary formats using LECmd and JLECmd

02Recovery of metadata including timestamps, MAC addresses, and volume serials

034,121 GitHub stars

04Evidence extraction for file access, program execution, and user behavior

05Detailed mapping to NIST CSF 2.0 and MITRE ATT&CK frameworks

06Support for analyzing both Automatic and Custom Jump List destinations

使用场景

01Incident response to detect unauthorized program execution from suspicious paths

02Threat hunting for lateral movement through evidence of network share access

03Digital forensic investigations to prove a suspect accessed specific files or directories

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills analyzing-lnk-file-and-jump-list-artifacts

For use in Claude.ai and ChatGPT