Skill UI

Perform comprehensive digital forensic analysis on raw (dd), E01, or AFF disk images using industry-standard tools like Autopsy and The Sleuth Kit. This process allows investigators to recover deleted files, examine file system metadata, search for specific keywords, and build detailed investigation timelines. It is essential for generating structured reports from digital evidence in legal and cybersecurity investigations.

This skill analyzes DNS query logs to detect sophisticated threats such as data exfiltration via DNS tunneling, Domain Generation Algorithm (DGA) usage, and covert Command and Control (C2) channels. It utilizes advanced techniques like entropy analysis, query volume anomaly detection, and subdomain length analysis within SIEM platforms, helping SOC teams identify threats that bypass traditional network security controls.

A powerful toolkit utilizing Objection and Frida for authorized mobile penetration testing. It enables deep runtime analysis of iOS applications, allowing users to inspect sensitive data in the keychain, filesystem, and memory. Key capabilities include bypassing client-side protections such as SSL pinning and jailbreak detection without requiring source code access.

This tool analyzes network packet captures (PCAP) to detect covert communication channels used by malware for Command and Control (C2) and data exfiltration. It specifically focuses on identifying indicators of DNS tunneling, ICMP tunneling, and protocol abuse patterns, providing scoring and detailed reasons for suspicious activity. Useful for threat hunting and security incident investigation.

This tool parses NetFlow v9 and IPFIX records to conduct deep network security analysis. It is crucial for investigating security incidents by building traffic baselines and applying statistical methods. Key detection capabilities include identifying port scanning, data exfiltration attempts, command and control (C2) beaconing patterns, and general volumetric anomalies in network traffic.

Examines packet captures, Zeek logs, and NetFlow data to uncover C2 channels, lateral movement, and exfiltration during security incidents, guiding analysts through capture, filtering, and IOC extraction workflows.

A comprehensive guide for deep packet inspection and network forensics using Wireshark and tshark. This skill is critical for incident response, where it allows users to capture, filter, and analyze network packet data to identify malicious command-and-control traffic, diagnose complex protocol issues, extract indicators of compromise (IOCs), and reconstruct data exfiltration paths. Use it for validating security rules and understanding network anomalies.

A comprehensive toolset for digital forensics investigators, enabling the parsing of proprietary Microsoft Outlook PST and OST files. It extracts critical evidence including full message content, detailed email headers (for message routing/tracing), attachments, and deleted items from the Recoverable Items folder. Essential for e-discovery, legal investigations, and security incident response to reconstruct communication patterns and analyze message metadata.

This skill provides a structured methodology and Python implementation for monitoring and analyzing data leak sites (DLS) associated with ransomware groups. It helps security analysts track victim postings, extract threat intelligence on group tactics, assess sector-specific risks, and understand evolving ransomware threat landscapes for proactive defense.

This comprehensive skill analyzes Zeek conn.log and NetFlow data to proactively detect advanced indicators of ransomware activity. It identifies critical threats such as Command and Control (C2) beaconing patterns, connections to TOR exit nodes, large-scale data exfiltration flows, and suspicious DNS anomalies. It is essential for threat hunting and complex security incident response.

A comprehensive guide utilizing Splunk Enterprise Security and SPL to conduct deep forensic analysis of security incidents. This skill covers correlating disparate sources like Windows event logs, firewall records, proxy data, and Sysmon logs to detect TTPs, reconstruct timelines, and identify anomalies, making it essential for incident response and threat hunting.

This system maps advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework. Utilizing the attackcti library to query STIX/TAXII data, it generates specialized ATT&CK Navigator layer files. It is essential for security analysts to profile threat actors, visualize comprehensive coverage heatmaps, and precisely assess detection gaps against sophisticated adversaries.