Skill UI

Analyze Cuckoo Sandbox and AnyRun behavioral JSON reports to detect timing checks, VM artifacts, user interaction probes, and sleep inflation that signal malware trying to evade sandbox analysis, then map findings to MITRE ATT&CK T1497.

Automates deploying and configuring CrowdStrike Falcon EDR agents across Windows, macOS, and Linux endpoints, tuning prevention and response policies, and integrating Falcon telemetry with SIEMs to maintain real-time behavioral and threat detection coverage.

Detection guidance for Business Email Compromise using gateway rules, behavioral analytics, and finance controls to catch suspicious requests before funds or data are exposed.

Implements UEBA using Elasticsearch/OpenSearch to normalize authentication, file, and network logs, establish behavioral baselines, calculate anomaly scores through deviation and peer-group analysis, and correlate indicators into SOC-ready alerts for insider threat detection.

Detects malicious process injection techniques through memory forensics, Sysmon/API monitoring, and behavioral signals, aiding EDR/SIEM teams in spotting DLL injection, hollowing, APC/thread hijacking, reflective loading, and similar stealthy attacks.

Processes malware samples to extract file, network, host, and behavioral indicators for sharing threat intelligence, building blocklists, and crafting detection signatures from validated analysis artifacts.

Enriches malware file hashes via the VirusTotal API v3, collecting detection ratios, behavioral insights, YARA matches, and contextual threat intelligence for SOC triage, incident response, and IOC validation workflows.