Skill UI

This skill detects covert data exfiltration occurring over DNS tunnels. It analyzes DNS query names by computing Shannon entropy, examining query length distributions, and identifying high subdomain cardinality. It is essential for security operations, incident response, and proactive threat hunting when suspicious or encoded DNS activity is suspected.

This skill enables sophisticated runtime dynamic analysis of Android applications using industry-standard tools like Frida and Objection. It is used to observe application behavior, intercept API calls, monitor network traffic, and bypass client-side security protections (e.g., root detection, anti-debugging). Essential for identifying vulnerabilities and analyzing obfuscated code that static analysis cannot reach.

Perform interactive malware analysis in the ANY.RUN cloud sandbox to trigger real-time behavior, inspect process trees, monitor network traffic, and capture system changes without local sandbox setup.

This skill guides comprehensive digital forensics investigations on compromised endpoints. It covers evidence collection (memory acquisition, disk imaging) and deep artifact analysis, including volatile data, MFT records, and prefetch files. Use it for incident response, legal evidence collection, and determining the scope of a breach by reconstructing attacker timelines.

A comprehensive guide for analyzing firmware images from embedded systems, IoT devices, routers, and specialized components like UEFI/BIOS. This skill covers advanced techniques including filesystem extraction, binary reverse engineering (using Ghidra/IDA), rootkit detection, and deep forensic analysis to uncover backdoors, implants, and supply chain compromises. Essential for cybersecurity professionals investigating compromised hardware.

This skill automates GraphQL introspection to extract the complete API schema, including types, queries, mutations, and subscriptions. It is designed to map the entire attack surface, helping authorized testers identify sensitive endpoints and test for vulnerabilities such as query depth abuse, batching attacks, and resource exhaustion. Ideal for comprehensive API security assessment.

This skill provides a comprehensive, multi-stage guide for investigating insider threats. It covers the entire lifecycle, from receiving an allegation and ensuring legal authorization, to covert evidence collection (DLP logs, endpoint forensics), advanced user behavior pattern analysis, and reconstructing a detailed activity timeline for potential legal action. Essential for security incident response.

This skill utilizes the Shodan API to perform comprehensive IP reputation analysis. It enriches IP addresses by identifying open ports, running services, known vulnerabilities (CVEs), and hosting context. It is crucial for threat intelligence enrichment, incident triage, and security assessments, helping security professionals assess the risk level and potential compromise of exposed infrastructure.

This comprehensive guide details how to perform deep forensic analysis on various Linux system logs (auth.log, syslog, systemd journal, audit.log). It teaches methods to reconstruct user activity, identify unauthorized access attempts, trace privilege escalation, and establish comprehensive event timelines following a security incident or during a security audit.

A comprehensive guide for cybersecurity professionals detailing the process of collecting, parsing, and correlating system, application, and security logs (Windows EVTX, Linux syslog, web logs). It helps reconstruct event timelines, identify breach activity, and establish evidence for forensic reports.

This skill provides a comprehensive workflow for analyzing malicious software to extract actionable Indicators of Compromise (IOCs). It covers static analysis (PE parsing, hashing, string extraction) and dynamic analysis techniques. Users learn how to identify file hashes, network indicators (C2 IPs, domains), registry modifications, and behavioral artifacts, ultimately formatting the findings into standard STIX 2.1 formats for sharing and incident response.

A comprehensive guide for digital forensics professionals on analyzing volatile memory dumps using Volatility 3. Learn to extract critical evidence, including running processes, network connections, loaded DLLs, system credentials, and detecting advanced threats like process hollowing and rootkits. Essential for incident response and malware analysis.