itsbotandme/dfir-attck-ctfs

DFIR ATT&CK Investigation Labs is a collection of browser-playable, self-contained forensic training labs that guide an analyst through an investigative workflow mapped to the MITRE ATT&CK kill chain. Each lab presents staged investigative questions (answer reveals the technique) and ships three deliverables: an interactive HTML analyst terminal (pre-baked Volatility outputs and a JS terminal), a full DFIR investigation report (kill‑chain narrative, ATT&CK mapping, remediation, Sigma rules), and a junior-analyst walkthrough. Who uses it: DFIR/incident responders, instructors, and junior analysts for hands‑on training and assessment. Key features: runs offline in-browser or locally with no install, mobile-friendly UI, progressive hints, optional start script, and a Claude Code "ctf-builder" skill to auto‑generate new labs from forensic artifacts. Labs are MIT-licensed wrapper content; original challenge artifacts retain their upstream licenses.

AI-related keywords found in this repo's description, topics, or README summary — grouped by category. Each badge links to the corresponding ranking detail page.