Skill UI

A comprehensive guide for digital forensics analysts to investigate compromised Linux systems. This workflow details the collection and analysis of critical system artifacts, including authentication logs, shell histories, SSH keys, and system configurations. Use this methodology during incident response to detect rootkits, unauthorized persistence mechanisms, and reconstruct full attacker activity.

A comprehensive tool for security professionals to enumerate and analyze malware persistence mechanisms across critical Windows Auto-Start Extensibility Points (ASEPs). It systematically scans registry run keys, scheduled tasks, services, drivers, and startup locations. Ideal for incident response, threat hunting, and validating the complete removal of malicious autostart entries.

This skill outlines the comprehensive process of memory forensics on compromised Linux systems. It guides users through acquiring volatile memory using the LiME kernel module and analyzing the resulting image with the Volatility 3 framework. Key artifacts extracted include process lists, network connections, bash history, and loaded kernel modules, making it an essential technique for incident response, threat hunting, and security investigations.

This skill details advanced digital forensics techniques for recovering metadata and content of deleted files by analyzing the NTFS Master File Table ($MFT). It covers examining key system artifacts like $LogFile and $UsnJrnl, and analyzing MFT slack space. Use this when reconstructing file system timelines, investigating data loss, or detecting anti-forensic techniques like timestomping during a Windows forensic examination.

This tool correlates multiple system artifacts, including Windows registry keys (USBSTOR, MountedDevices), Event Logs, and SetupAPI logs, to reconstruct a detailed timeline of USB device usage. It determines first/last connection timestamps, tracks device provenance, and maps drive letter assignments. Essential for digital forensics investigations, insider threat detection, and verifying compliance regarding removable media usage.

This comprehensive guide details the systematic extraction and analysis of Windows Registry hives (SAM, SYSTEM, SOFTWARE, NTUSER.DAT) from forensic images. It demonstrates how to use specialized tools like RegRipper and Python scripts to uncover critical artifacts, including user activity history, persistence mechanisms (autorun keys), installed software records, and evidence of system compromise, which is crucial for digital forensics investigations.

A comprehensive toolkit designed to automatically extract Indicators of Compromise (IOCs) from malware samples. It harvests critical artifacts including file hashes (MD5, SHA256), network indicators (IPs, domains, URLs), and host artifacts (registry keys, mutexes) using static, dynamic, and PCAP analysis. Essential for threat intelligence, building defense rules (YARA, Snort), and incident response.

This tool leverages the Rekall memory forensics framework to conduct deep analysis of memory dumps. It is designed to detect sophisticated threats such as process hollowing, injected code via VAD anomalies, hidden operating system processes, and rootkit presence. It applies key forensic plugins (pslist, malfind, vadinfo) essential for rigorous incident response and malware analysis.

This skill guides proactive security auditing and threat hunting for registry-based persistence artifacts (MITRE T1547) in Windows environments. It focuses on identifying mechanisms such as Run/RunOnce keys, Winlogon modifications, IFEO debugger injection, and COM hijacking to detect malware autostart techniques and scope compromises during incident response.

This guide details a threat hunting technique for detecting persistence mechanisms utilizing Windows Registry Run keys (T1547.001). By analyzing Sysmon Event ID 13 logs, it identifies suspicious auto-start entries pointing to temporary directories, encoded PowerShell commands, or abused LOLBins. Essential for SOC analysts and security engineers investigating incidents and developing robust detection rules.

This guide details implementing robust code signing for various build artifacts, including binaries, packages, and containers. It covers both traditional GPG key-based signing and modern, keyless signing using Sigstore/cosign. Use this process to establish verifiable trust chains, ensure artifact integrity against supply-chain tampering, prove authenticity, and meet advanced security standards like SLSA.

This skill implements a simplified version of the Signal Protocol, focusing on robust end-to-end encryption (E2EE) for messaging applications. It covers critical cryptographic components including X3DH key agreement, the Double Ratchet algorithm for continuous key management, and AES-256-GCM for message encryption. The implementation ensures forward secrecy, meaning that compromising a current key does not reveal past messages. Use this when designing, building, or evaluating the security architecture of a messaging service to guarantee that only communicating parties can read the messages.