Skill UI

Conduct batch malware hunts by crafting YARA rules, compiling them with yara-python, and scanning files, directories, and memory dumps to match malicious patterns or IOCs for triage and post-collection analysis.

This skill guides the programmatic creation, enrichment, and secure sharing of threat intelligence within a MISP platform. Using the official PyMISP Python library, users can manage Indicators of Compromise (IOCs), apply MITRE ATT&CK tags, configure sharing groups, and export structured data in STIX 2.1 format. It is essential for security assessments, incident response, and automated threat intelligence pipelines.

Guides SOC analysts through NIST SP 800-61r3 and SANS PICERL-based incident triage, covering alert enrichment, severity scoring, classification, and escalation steps for SIEM/EDR-generated threats and IOC matches.

Provides methodology and scripts for proactive threat hunting, IOC sweeps, and statistical anomaly detection that surface attacker activity before automated alerts fire.