Skill UI

A deep dive toolset for forensic investigation of advanced persistent threats (APT) at the firmware level. It analyzes UEFI variable modifications, SPI flash implants, Secure Boot bypass techniques, and unauthorized components within the EFI System Partition (ESP). Utilizes tools like chipsec, flashrom, and YARA for comprehensive integrity verification.

This skill proactively hunts for advanced firmware threats, including UEFI bootkits (e.g., BlackLotus, ESPecter), residing in the EFI System Partition (ESP). It establishes a cryptographic baseline, verifies bootloader signatures, scans for out-of-band changes, and uses YARA rules to detect persistence mechanisms related to pre-OS compromise (MITRE ATT&CK T1542.003). Ideal for forensic investigations and security hardening.

A comprehensive guide covering the entire lifecycle of malware analysis, from initial triage and deep static reverse engineering to automated sandboxing and behavioral monitoring. It details a multi-stage workflow that includes extracting Indicators of Compromise (IOCs), generating detection rules using YARA and Sigma, and identifying anti-analysis techniques. Ideal for threat intelligence researchers and incident responders.

Provides a comprehensive framework for blue-team threat hunting and detection engineering. Users learn hypothesis-driven hunting techniques, optimize SIEM queries, and build robust detection rules using industry standards like Sigma and YARA. Essential for minimizing false positives and validating security controls in a defensive posture.