Skill UI

A comprehensive, step-by-step guide for security professionals to perform deep-dive malware analysis. It covers methodologies for static analysis (disassemblers, imports), dynamic execution (sandboxing, monitoring), identifying Indicators of Compromise (IOCs), and structuring professional threat reports. Essential for incident response and threat intelligence.

A comprehensive forensic workflow for detecting persistent, deep-seated malware, such as bootkits and advanced rootkits. The analysis covers multiple layers, including boot sectors (MBR/VBR), UEFI firmware modules, and kernel memory forensics. It is essential for investigating sophisticated, nation-state level threats that evade standard anti-malware and EDR solutions.

A comprehensive guide for digital forensics professionals to investigate compromised Docker containers. It covers best practices for preserving container state, analyzing image layers, reviewing runtime logs, and examining host system artifacts to identify evidence of malicious activity, container escapes, or misconfigurations.

A comprehensive guide for digital forensics analysts to investigate compromised Linux systems. This workflow details the collection and analysis of critical system artifacts, including authentication logs, shell histories, SSH keys, and system configurations. Use this methodology during incident response to detect rootkits, unauthorized persistence mechanisms, and reconstruct full attacker activity.

This comprehensive toolkit provides deep static analysis capabilities for suspicious PDF documents. Using tools like PDFiD, pdf-parser, and peepdf, it identifies embedded malicious structures—including JavaScript code, shellcode, auto-actions, and exploit kits—without opening or rendering the file. It is essential for security analysts conducting threat triage, forensic investigation, and assessing potential attack vectors from suspicious attachments.

A comprehensive guide utilizing Splunk Enterprise Security and SPL to conduct deep forensic analysis of security incidents. This skill covers correlating disparate sources like Windows event logs, firewall records, proxy data, and Sysmon logs to detect TTPs, reconstruct timelines, and identify anomalies, making it essential for incident response and threat hunting.

This guide details the comprehensive workflow for conducting memory forensics using Volatility 3. It covers the entire incident response lifecycle, from acquiring raw RAM dumps to analyzing processes, detecting rootkits, investigating network connections, and extracting sensitive artifacts like credentials and injected code. Essential for live memory analysis in cybersecurity investigations.

This utility performs comprehensive forensic analysis on memory dumps. It leverages industry-standard tools like Volatility and Mimikatz to extract sensitive information, including cached credentials, NTLM/LM hashes, Kerberos tickets, and authentication tokens. It is crucial for incident response, assessing the scope of credential compromise, and investigating lateral movement attacks.

This tool leverages the Rekall memory forensics framework to conduct deep analysis of memory dumps. It is designed to detect sophisticated threats such as process hollowing, injected code via VAD anomalies, hidden operating system processes, and rootkit presence. It applies key forensic plugins (pslist, malfind, vadinfo) essential for rigorous incident response and malware analysis.

A comprehensive guide for SOC analysts and digital forensics experts. This skill covers the entire lifecycle of a phishing incident, from initial user report and header analysis (SPF, DKIM, DMARC) to detonating malicious URLs/attachments in sandboxes. It guides users on scoping the attack, identifying impacted users via SIEM/proxy logs, and executing containment measures like email purges.

Automates deep packet inspection using tshark and pyshark on PCAP files. This tool is designed for cybersecurity professionals to perform structured network forensics, compute protocol distribution, detect suspicious activity (like port scans, beaconing, and data exfiltration), extract critical IOCs (IPs, domains, URLs), and identify advanced threats such as DNS tunneling patterns. Ideal for incident response and security auditing.

Zeek is a powerful, open-source network analysis framework that functions as a passive security monitor. It generates highly detailed, structured logs (e.g., HTTP, DNS, TLS) from raw network traffic, allowing for deep metadata extraction. This skill guides users through deploying Zeek, writing custom detection scripts, and integrating the resulting rich security logs with SIEM platforms for advanced threat detection and forensic investigations.