Skill UI

This skill provides systematic methods and advanced techniques to deobfuscate multi-layered PowerShell malware. It utilizes Abstract Syntax Tree (AST) analysis, dynamic execution tracing, and specialized tools to reveal hidden payloads, C2 infrastructure, and the original malicious logic. It is essential for security analysts, red teamers, and incident response teams performing deep malware analysis.

This solution automates the processing of AWS GuardDuty findings using EventBridge and AWS Lambda. It enables real-time incident response capabilities, including automatic quarantine of compromised EC2 resources, comprehensive forensic snapshot creation, and immediate high-severity security notifications via SNS. Ideal for SOC teams seeking to drastically reduce Mean Time To Response (MTTR) and strengthen cloud security posture.

This script performs statistical analysis on Zeek connection logs (conn.log) to detect Command and Control (C2) beaconing patterns. It leverages the ZAT library to load data into Pandas DataFrames, calculates inter-arrival time statistics, and flags connections with low standard deviation relative to the mean. This technique is crucial for network threat hunting and security incident investigation when identifying malicious, periodic callbacks.

This guide teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous, comprehensive threat detection across entire AWS accounts and workloads. It covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting various finding severity levels, and building robust, automated incident response playbooks using EventBridge and AWS Lambda for immediate containment actions.

A comprehensive guide for security teams on detecting and responding to unauthorized crypto mining operations in cloud environments (AWS, Azure). It details a multi-layered approach, utilizing cost anomaly detection, compute utilization monitoring, GuardDuty findings, and network flow log analysis (VPC/KQL) to identify resource hijacking attempts and suspicious activity across EC2, ECS, and EKS workloads.

A comprehensive skill designed for advanced security analysis, detecting malicious behaviors across mobile applications (Android/iOS). It performs multi-layered analysis, including static indicator checks (permissions, manifest), dynamic instrumentation via Frida, network traffic monitoring (C2 communication, exfiltration), and automated scanning (MobSF). Use this when investigating suspicious apps, detecting trojans, or performing malware triage.

A comprehensive skill for detecting early-stage ransomware indicators before data encryption occurs. It utilizes advanced network detection tools such as Zeek and Suricata, combined with SIEM correlation rules and threat intelligence feeds. This method monitors the entire pre-encryption kill chain, identifying precursor behaviors like initial access broker activity, Cobalt Strike C2 beaconing, credential harvesting (e.g., Mimikatz signatures), and data staging attempts, enabling timely incident response and containment.

This script is designed for malware analysis, specifically targeting .NET-based Remote Access Trojans (RATs) like Agent Tesla. It automatically extracts embedded and obfuscated configuration data, including SMTP credentials, FTP endpoints, Telegram tokens, and C2 webhooks. It utilizes advanced techniques such as regex pattern matching, Base64 decoding, and simulating XOR/SHA256 decryption to reveal critical threat intelligence for security research.

This skill provides a systematic methodology for detecting Command and Control (C2) beaconing patterns in network traffic. It utilizes advanced statistical techniques, including Coefficient of Variation (CV) and jitter analysis, applied to network flow logs (Zeek, proxy, firewall). It is crucial for proactive threat hunting and incident response to identify compromised endpoints communicating periodically with malicious infrastructure.

This skill guides threat hunters in detecting Cobalt Strike Command and Control (C2) beacons. It utilizes advanced network forensic techniques, including analyzing default TLS certificate serials, JA3/JA3S/JARM fingerprints, beacon jitter, and HTTP profile matching. Detection is achieved by correlating data from Zeek logs, Suricata rules, and Python PCAP analysis to identify suspicious outbound communications.

This capability provides advanced threat hunting by analyzing network telemetry (DNS, proxy, connection logs) to detect Command and Control (C2) beaconing patterns. It uses statistical analysis, frequency detection, and jitter analysis to identify compromised endpoints communicating with adversary infrastructure, crucial for proactive threat detection and incident response.

A comprehensive guide and detection methodology for identifying covert communication channels utilizing DNS records. This technique analyzes Zeek dns.log for indicators such as high-entropy subdomains, excessive query volume, unusually long query lengths, and abnormal record type distributions, which suggest data exfiltration or Command and Control (C2) activity.