Skill UI

Examines packet captures, Zeek logs, and NetFlow data to uncover C2 channels, lateral movement, and exfiltration during security incidents, guiding analysts through capture, filtering, and IOC extraction workflows.

This solution guides the implementation of a phishing reporting button within email clients, creating a critical feedback loop for security teams. By integrating with SOAR platforms, reported suspicious emails undergo automated triage, including IOC extraction, sandbox analysis, and threat intelligence checks. The workflow enables rapid classification, automated remediation (e.g., mass retraction, sender blocking), and provides detailed feedback to the user reporter, significantly enhancing overall security posture.

This skill provides a comprehensive workflow for analyzing malicious software to extract actionable Indicators of Compromise (IOCs). It covers static analysis (PE parsing, hashing, string extraction) and dynamic analysis techniques. Users learn how to identify file hashes, network indicators (C2 IPs, domains), registry modifications, and behavioral artifacts, ultimately formatting the findings into standard STIX 2.1 formats for sharing and incident response.

Comprehensive workflow for analyzing suspected malware via static, dynamic, and behavioral techniques. Covers IOC extraction, YARA/Sigma rule generation, sandbox automation, and anti-analysis bypassing.

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Provides structured phases for static and dynamic analysis, IOC extraction, YARA rule creation, and reporting.