Skill UI

Learn how to build and share structured threat intelligence objects, including indicators, malware, and campaigns, using the stix2 Python library. This guide details publishing data via the TAXII 2.1 protocol, making it essential for developing threat intelligence platforms, automating IOC exchange, and creating machine-readable reports for ISAC/ISAO communities.

Learn how to deploy and configure a TAXII 2.1 server using OpenTAXII and Medallion. This guide covers publishing STIX 2.1 bundles, managing collections for various threat feeds, and integrating the resulting data stream with SIEM/SOAR platforms to automate the exchange of cyber indicators between organizations.

This skill provides comprehensive forensic analysis of cryptocurrency payment flows stemming from ransomware attacks. It leverages blockchain APIs and advanced techniques to identify wallet clusters, track fund movement through obfuscation methods like mixers and peel chains, and map funds to exchanges. It is crucial for law enforcement, incident responders, and threat intelligence analysts conducting ransomware attribution.

A specialized tool for blockchain forensics, designed to trace the movement of ransomware payments across public blockchains (like Bitcoin). By leveraging APIs from services like Chainalysis and WalletExplorer, it identifies wallet clusters, tracks funds through mixers and tumblers, and maps fund flow from the victim to final exchange deposits. Essential for law enforcement attribution and threat intelligence gathering.