Skill UI

A comprehensive, step-by-step guide for security professionals to perform deep-dive malware analysis. It covers methodologies for static analysis (disassemblers, imports), dynamic execution (sandboxing, monitoring), identifying Indicators of Compromise (IOCs), and structuring professional threat reports. Essential for incident response and threat intelligence.

A comprehensive tool for performing static analysis on Android APK malware samples. It utilizes androguard, apktool, and jadx to detect dangerous permission combinations, suspicious API calls (like reflection or crypto), dynamic code loading patterns, and extract Indicators of Compromise (IOCs) for robust security incident response and threat hunting.

A comprehensive toolset for analyzing Cobalt Strike Malleable C2 profiles. It parses advanced C2 communication configurations to extract crucial Indicators of Compromise (IOCs) such as HTTP headers, DNS settings, URI patterns, and user agents. The analysis is vital for threat hunting, developing network detection signatures (Suricata/Snort), and understanding evasion techniques used by advanced persistent threats (APTs).

This skill analyzes Indicators of Compromise (IOCs)—such as IP addresses, domains, and file hashes—by querying multiple threat intelligence platforms (VirusTotal, AbuseIPDB, MISP). It determines maliciousness confidence, assigns blocking priorities, and attributes threats to campaigns, crucial for incident response, threat triage, and making informed security decisions.

This guide details the process of performing static analysis on potentially malicious PDF documents. It utilizes advanced tools like peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use this method when triaging suspicious attachments from phishing emails or conducting deep forensic examination of weaponized document artifacts to generate actionable Indicators of Compromise (IOCs).

This skill automates the execution of suspicious malware samples within a secure, isolated Cuckoo Sandbox environment. It observes comprehensive runtime behaviors, including process creation chains, file system tampering, registry modifications, network communications, and API calls. It is essential for generating detailed behavioral reports, extracting Indicators of Compromise (IOCs), and classifying unknown malware samples.

A comprehensive guide for deep packet inspection and network forensics using Wireshark and tshark. This skill is critical for incident response, where it allows users to capture, filter, and analyze network packet data to identify malicious command-and-control traffic, diagnose complex protocol issues, extract indicators of compromise (IOCs), and reconstruct data exfiltration paths. Use it for validating security rules and understanding network anomalies.

A specialized threat hunting skill designed to detect remnants of the PowerShell Empire post-exploitation framework. It analyzes Windows event logs (specifically Script Block and Module Logging) for key Indicators of Compromise (IOCs), such as default launcher strings, Base64 encoded payloads, known module signatures (e.g., Mimikatz), and staging URL patterns. The output provides a detailed JSON report, comprehensive timeline, and MITRE ATT&CK mapping for incident response and security validation.

This skill provides a systematic methodology for mapping real-world threat actor Tactics, Techniques, and Procedures (TTPs) to the globally recognized MITRE ATT&CK framework. Users learn how to leverage tools like ATT&CK Navigator and Python libraries (e.g., attackcti, stix2) to analyze security incidents, visualize technical coverage heatmaps, identify critical detection gaps, and generate actionable intelligence reports linking observed Indicators of Compromise (IOCs) to specific adversary techniques across various platforms (Enterprise, Mobile, ICS).

This skill guides the creation of automated workflows for enriching raw Indicators of Compromise (IOCs) with multi-source threat intelligence context. It is designed for integration into SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR) or Python pipelines. By automatically querying multiple sources like VirusTotal, AbuseIPDB, and MISP, it significantly reduces analyst mean time to triage (MTTT) and standardizes the resulting threat context and confidence scoring.

Builds a comprehensive, automated pipeline for malware submission and analysis. It collects suspicious files from multiple sources (EDR, email gateways), automatically submits them to sandbox environments and multi-engine scanners, and generates detailed verdicts and Indicators of Compromise (IOCs). Essential for SOC teams needing to scale high-volume malware triage and incident response.

This skill outlines the development of an automated pipeline to ingest raw Indicators of Compromise (IOCs) from various sources. It performs normalization, defanging (e.g., converting 'http://' to 'hxxp://'), and converts indicators into the standardized STIX 2.1 format. The processed, safe indicators can then be securely distributed via TAXII feeds, MISP, and other threat intelligence platforms.