competition-forensic-timeline

1# Competition Forensic Timeline
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the hard part is not finding one artifact, but turning many artifacts into one replayable chronology.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Pick the smallest reliable anchor: first execution, first logon, first network session, first file write, or first mailbox action.
122. Normalize timestamps, time zones, hostnames, users, process IDs, message IDs, and file paths before correlating.
133. Build one minimal chain from foothold to persistence, execution, access, or exfiltration.
144. Separate confirmed event order from inferred gaps.
155. Reproduce the decisive timeline segment that yields the artifact or privilege conclusion.
16 
17## Workflow
18 
19### 1. Establish Timeline Anchors
20 
21- Collect only the active surfaces: EVTX, Sysmon, registry, Amcache, prefetch, browser artifacts, mail traces, PCAPs, memory, or filesystem metadata.
22- Record clock source, timezone, and any drift or truncation that could reorder events.
23- Link shared identifiers across sources: PID, logon ID, GUID, message ID, hostname, username, IP, or hash.
24 
25### 2. Correlate The Execution Graph
26…