Skill UI

This guide details the comprehensive process of using the Linux Audit framework (auditd) to detect advanced security threats. It covers deploying specific rules to monitor critical system files, detecting unauthorized privilege escalation, process injection, and suspicious system calls. Users can then leverage ausearch and aureport to efficiently query, reconstruct timelines, and summarize findings for forensic analysis and compliance auditing.

A comprehensive guide for analyzing malicious Linux ELF binaries. Covers static inspection using tools like readelf and elftools, dynamic tracing with strace/ltrace, and deep reverse engineering using Ghidra/IDA. Essential for investigating botnets, ransomware, and rootkits in Linux server or container environments.

This skill provides a comprehensive method for detecting kernel-level rootkits on Linux systems. It leverages memory forensics using Volatility3 on physical memory dumps, combined with cross-view analysis (comparing /proc vs /sys) and live system scanning (rkhunter). Techniques include identifying hooked syscall tables, discovering hidden kernel modules, and detecting tampered system structures.

Comprehensive digital forensic analysis guide for Linux systems. It covers the collection and examination of critical artifacts such as authentication logs, shell histories, user configurations, system files (passwd, shadow), and persistence mechanisms to effectively detect security compromises, unauthorized access, and malicious activity.

This skill details the forensic analysis of Windows LNK shortcut files and Jump Lists. It enables investigators to reconstruct user activity, track file access, and determine program execution history by parsing critical metadata like timestamps, paths, and system identifiers, even when the original artifacts are deleted.

A comprehensive cybersecurity tool designed to analyze malicious VBA and XLM macros embedded within Microsoft Office documents (Word, Excel, PowerPoint). It facilitates deep forensic investigation by extracting, deobfuscating, and tracing the full attack chain, including identifying auto-execution triggers, payload download URLs, and file writing techniques. Useful for malware analysts investigating phishing campaigns and maldocs.

This guide details the process of performing static analysis on potentially malicious PDF documents. It utilizes advanced tools like peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use this method when triaging suspicious attachments from phishing emails or conducting deep forensic examination of weaponized document artifacts to generate actionable Indicators of Compromise (IOCs).

This skill guides users through analyzing suspicious URLs using the URLScan.io platform or API. It provides a safe environment to capture screenshots, DOM content, network traffic, and analyze JavaScript behavior to investigate phishing attempts, credential harvesting, and sophisticated malicious redirects without risking the analyst's system.

This skill automates the execution of suspicious malware samples within a secure, isolated Cuckoo Sandbox environment. It observes comprehensive runtime behaviors, including process creation chains, file system tampering, registry modifications, network communications, and API calls. It is essential for generating detailed behavioral reports, extracting Indicators of Compromise (IOCs), and classifying unknown malware samples.

This skill provides a comprehensive guide to using the Malpedia API for advanced malware intelligence analysis. Users can track malware family relationships, analyze variant evolution, extract associated YARA rules for detection, and map connections to specific threat actors. It is essential for security researchers and SOC analysts building robust threat models.

This skill provides a comprehensive workflow for detecting and analyzing malware persistence mechanisms on Windows systems. It automates the use of Sysinternals Autoruns via scripting to scan hundreds of Auto-Start Extensibility Points (ASEPs), including registry keys, services, scheduled tasks, and drivers. The process flags suspicious entries like unsigned binaries, suspicious paths, or dangerous command-line arguments, making it an essential tool for security incident response and threat hunting.

This skill analyzes behavioral reports (Cuckoo/AnyRun) to detect anti-analysis techniques used by malware, such as timing checks, VM artifact queries, user interaction monitoring, and environment fingerprinting. It provides a structured method for security researchers and SOC analysts to understand malware's true capabilities and detect evasion attempts.