Skill UI

Walks through analyzing RAM dumps with Volatility 3/2 to uncover injected code, hidden processes, network activity, and credentials when responding to compromised hosts.

This skill outlines the comprehensive process of memory forensics on compromised Linux systems. It guides users through acquiring volatile memory using the LiME kernel module and analyzing the resulting image with the Volatility 3 framework. Key artifacts extracted include process lists, network connections, bash history, and loaded kernel modules, making it an essential technique for incident response, threat hunting, and security investigations.

This skill provides comprehensive methods to detect Cobalt Strike beacon command-and-control (C2) traffic. It uses advanced network forensics techniques, including analyzing default TLS certificates (e.g., serial 8BB00EE), JA3/JA3S fingerprints, HTTP malleable profiles, and beacon interval jitter, leveraging Zeek logs, Suricata rules, and Python PCAP analysis. It is essential for threat hunters and SOC analysts investigating sophisticated C2 communications.

This automated toolkit streamlines memory forensics using the Volatility3 framework. It is designed to analyze raw memory dumps from Windows, Linux, and macOS, revealing complex threats such as process injection, hidden rootkits, malicious code artifacts, and illicit network connections that traditional disk-based methods cannot detect. Essential for real-time incident response and deep security auditing.

A comprehensive guide for performing deep network forensics using Wireshark and tshark. This technique analyzes raw PCAP/PCAPNG files captured during security incidents to reconstruct network events, identify data exfiltration methods, extract sensitive artifacts (credentials, files), detect Command-and-Control (C2) communications, and pinpoint network indicators of compromise (IOCs). Ideal for digital forensics and incident response teams.

A comprehensive guide and framework for performing digital forensics analysis on PCAP/PCAPNG files. This skill covers using industry-standard tools like Wireshark, tshark, tcpdump, and Python/Scapy to reconstruct network communications, extract evidence of data exfiltration, identify command-and-control (C2) activity, and trace lateral movement during incident response.

This specialized skill guides deep-dive analysis for binary-heavy challenges, including CTF, malware analysis, and advanced forensics. It covers reverse engineering binaries, unpacking samples, inspecting memory dumps, debugging crashes, and building exploit chains by correlating artifacts like files, memory, and network packets.