Skill UI

A comprehensive tool for performing static analysis on Android APK malware samples. It utilizes androguard, apktool, and jadx to detect dangerous permission combinations, suspicious API calls (like reflection or crypto), dynamic code loading patterns, and extract Indicators of Compromise (IOCs) for robust security incident response and threat hunting.

A comprehensive toolset for analyzing Cobalt Strike Malleable C2 profiles. It parses advanced C2 communication configurations to extract crucial Indicators of Compromise (IOCs) such as HTTP headers, DNS settings, URI patterns, and user agents. The analysis is vital for threat hunting, developing network detection signatures (Suricata/Snort), and understanding evasion techniques used by advanced persistent threats (APTs).

Walks through analyzing RAM dumps with Volatility 3/2 to uncover injected code, hidden processes, network activity, and credentials when responding to compromised hosts.

This skill outlines the comprehensive process of memory forensics on compromised Linux systems. It guides users through acquiring volatile memory using the LiME kernel module and analyzing the resulting image with the Volatility 3 framework. Key artifacts extracted include process lists, network connections, bash history, and loaded kernel modules, making it an essential technique for incident response, threat hunting, and security investigations.

This skill utilizes the Microsoft Graph API to parse Office 365 Unified Audit Logs for security incident investigation. It is designed to detect critical indicators of account compromise, including the creation of suspicious email forwarding rules, unauthorized mailbox delegation changes, suspicious OAuth application consent grants, and other signs related to Business Email Compromise (BEC).

A specialized tool and workflow for investigating supply chain attacks. It helps security analysts analyze compromised software updates, trojanized binaries, and dependency artifacts by comparing legitimate versions against suspect files. Key functions include binary diffing, identifying injected code, and documenting code signing anomalies to determine the scope of a security breach.

This comprehensive forensic workflow guides investigators through the extraction and detailed analysis of Windows Registry hives (SAM, SYSTEM, SOFTWARE, etc.). It is used during incident response to uncover critical artifacts, including user activity history, malware persistence mechanisms (autorun keys), installed software records, and evidence of system compromise.

This skill guides the creation of automated workflows for enriching raw Indicators of Compromise (IOCs) with multi-source threat intelligence context. It is designed for integration into SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR) or Python pipelines. By automatically querying multiple sources like VirusTotal, AbuseIPDB, and MISP, it significantly reduces analyst mean time to triage (MTTT) and standardizes the resulting threat context and confidence scoring.

Builds a comprehensive, automated pipeline for malware submission and analysis. It collects suspicious files from multiple sources (EDR, email gateways), automatically submits them to sandbox environments and multi-engine scanners, and generates detailed verdicts and Indicators of Compromise (IOCs). Essential for SOC teams needing to scale high-volume malware triage and incident response.

This skill facilitates the creation of real-time incident response dashboards across major SIEM platforms (Splunk, Elastic, Grafana). It provides SOC analysts and leadership with unified situational awareness by tracking affected systems, containment status, Indicators of Compromise (IOC) spread, and the entire incident response timeline, crucial for coordination and post-incident reporting.

This skill details the architecture and implementation of an automated Indicator of Compromise (IOC) enrichment pipeline using OpenCTI. It demonstrates how to connect OpenCTI to various external threat intelligence services (like VirusTotal, Shodan, AbuseIPDB) to automatically gather context, correlate indicators, and assign confidence scores. This is crucial for enhancing security monitoring and prioritizing threats for cyber analysts.

This guide details the deployment and usage of MISP (Malware Information Sharing Platform) to centralize, correlate, and distribute threat intelligence. It covers architectural concepts, integrating diverse OSINT and commercial feeds (like abuse.ch, AlienVault OTX), and automating the flow of Indicators of Compromise (IOCs) into SIEM and SOAR systems via Docker and Python APIs.