Skill UI

A powerful toolkit utilizing Objection and Frida for authorized mobile penetration testing. It enables deep runtime analysis of iOS applications, allowing users to inspect sensitive data in the keychain, filesystem, and memory. Key capabilities include bypassing client-side protections such as SSL pinning and jailbreak detection without requiring source code access.

This tool parses Kubernetes API server audit logs (JSON lines) to detect critical security events. It specifically targets unauthorized access, secret enumeration, RBAC escalation, privileged pod creation, and shell access (exec/attach). Use it for incident response, threat hunting, or building SIEM detection rules.

This guide details the comprehensive process of using the Linux Audit framework (auditd) to detect advanced security threats. It covers deploying specific rules to monitor critical system files, detecting unauthorized privilege escalation, process injection, and suspicious system calls. Users can then leverage ausearch and aureport to efficiently query, reconstruct timelines, and summarize findings for forensic analysis and compliance auditing.

A comprehensive guide for analyzing malicious Linux ELF binaries. Covers static inspection using tools like readelf and elftools, dynamic tracing with strace/ltrace, and deep reverse engineering using Ghidra/IDA. Essential for investigating botnets, ransomware, and rootkits in Linux server or container environments.

This skill provides a structured approach to detecting kernel-level rootkits in Linux environments. It utilizes memory forensics with Volatility3 (checking syscalls, hidden modules) and compares system views (/proc vs /sys) to identify tampered kernel structures, hooked syscalls, and concealed processes. It also integrates live scanning tools like rkhunter for comprehensive security incident investigation.

A comprehensive guide for digital forensics analysts to investigate compromised Linux systems. This workflow details the collection and analysis of critical system artifacts, including authentication logs, shell histories, SSH keys, and system configurations. Use this methodology during incident response to detect rootkits, unauthorized persistence mechanisms, and reconstruct full attacker activity.

This skill details the forensic analysis of Windows LNK shortcut files and Jump Lists. These artifacts record critical user activity, including file access and program execution, even after the original source files have been deleted. It covers using specialized tools (LECmd, JLECmd) and Python parsing techniques to reconstruct user timelines, making it essential for incident response and deep digital forensics examinations.

A comprehensive cybersecurity tool designed to analyze malicious VBA and XLM macros embedded within Microsoft Office documents (Word, Excel, PowerPoint). It facilitates deep forensic investigation by extracting, deobfuscating, and tracing the full attack chain, including identifying auto-execution triggers, payload download URLs, and file writing techniques. Useful for malware analysts investigating phishing campaigns and maldocs.

A comprehensive workflow for performing static and dynamic analysis of malicious PDF documents. It utilizes tools like peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Ideal for triaging phishing attachments, analyzing exploit documents, and building threat signatures in a controlled forensic environment.

This skill guides users through analyzing suspicious URLs using the URLScan.io platform or API. It provides a safe environment to capture screenshots, DOM content, network traffic, and analyze JavaScript behavior to investigate phishing attempts, credential harvesting, and sophisticated malicious redirects without risking the analyst's system.

A comprehensive guide to utilizing Cuckoo Sandbox for deep dynamic analysis of suspicious malware samples. This workflow walks through sample submission, real-time monitoring, and programmatic extraction of behavioral indicators, including process activity, network communications (DNS, HTTP), file system changes, and registry modifications, essential for threat intelligence and IOC extraction.

This skill enables deep analysis of malware families using the Malpedia API. It allows users to retrieve canonical aliases, associated threat actors, and YARA detection rules, and map complex relationships like loader-payload chains. Ideal for threat intelligence research, incident response, and building automated detection signatures.