competition-forensic-timelinelisted

# Competition Forensic Timeline Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first. Use this skill when the hard part is not finding one artifact, but turning many artifacts into one replayable chronology. Reply in Simplified Chinese unless the user explicitly requests English. ## Quick Start 1. Pick the smallest reliable anchor: first execution, first logon, first network session, first file write, or first mailbox action. 2. Normalize timestamps, time zones, hostnames, users, process IDs, message IDs, and file paths before correlating. 3. Build one minimal chain from foothold to persistence, execution, access, or exfiltration. 4. Separate confirmed event order from inferred gaps. 5. Reproduce the decisive timeline segment that yields the artifact or privilege conclusion. ## Workflow ### 1. Establish Timeline Anchors - Collect only the active surfaces: EVTX, Sysmon, registry, Amcache, prefetch, browser artifacts, mail traces, PCAPs, memory, or filesystem metadata. - Record clock source, timezone, and any drift or truncation that could reorder events. - Link shared identifiers across sources: PID, logon ID, GUID, message ID, hostname, username, IP, or hash. ### 2. Correlate The Execution Graph - Track process tree, service or task creation, network sessions, fil