Skill UI

This advanced skill details dual-use security techniques for analyzing protected binaries, conducting malware analysis, and performing authorized penetration testing. It strictly mandates that users confirm explicit written authorization, adhere to defined scope, and ensure legal compliance (e.g., CFAA, DMCA). Use cases include CTF competitions, academic research, and internal security auditing, emphasizing defensive recommendations and evidence preservation.

This advanced skill details dual-use security techniques for analyzing protected binaries, conducting malware analysis, and performing authorized penetration testing. It strictly mandates that users confirm explicit written authorization, adhere to defined scope, and ensure legal compliance (e.g., CFAA, DMCA). Use cases include CTF competitions, academic research, and internal security auditing, emphasizing defensive recommendations and evidence preservation.

A comprehensive, step-by-step guide for security professionals to perform deep-dive malware analysis. It covers methodologies for static analysis (disassemblers, imports), dynamic execution (sandboxing, monitoring), identifying Indicators of Compromise (IOCs), and structuring professional threat reports. Essential for incident response and threat intelligence.

This comprehensive guide provides techniques for acquiring, analyzing, and extracting artifacts from memory dumps. It covers best practices for digital forensics, crucial for incident response and malware analysis. Users learn how to use industry-standard tools like Volatility 3 on Windows, Linux, and macOS, including process, network, and registry deep dives.

Guides writing high-quality YARA-X detection rules for malware hunting, covering naming conventions, string selection, performance tuning, migrations from legacy YARA, and reducing false positives when authoring, reviewing, or debugging signatures.

Yara Authoring helps security teams write precise YARA rules for threat detection and malware hunting by guiding string/tag management and metadata handling so signature creation keeps pace with investigations.

This skill performs comprehensive static analysis of Android APK malware. It utilizes industry-standard tools like androguard and apktool to decompile resources, inspect manifests, and identify dangerous permissions, obfuscated code patterns, dynamic loading mechanisms, and suspicious API calls without executing the sample. It is essential for security analysts, SOC teams, and threat hunters building detection rules or triaging suspicious malware samples.

A comprehensive forensic workflow for detecting persistent, deep-seated malware, such as bootkits and advanced rootkits. The analysis covers multiple layers, including boot sectors (MBR/VBR), UEFI firmware modules, and kernel memory forensics. It is essential for investigating sophisticated, nation-state level threats that evade standard anti-malware and EDR solutions.

Systematically evaluates cyber-campaign evidence to attribute a cyber operation to a specific threat actor. This skill utilizes advanced analytical frameworks like the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh multiple indicators, including infrastructure overlaps, TTP consistency, malware similarity, and operational patterns, providing confidence-weighted attribution assessments for incident response.

A deep-dive tool for cybersecurity professionals to analyze malware Command and Control (C2) communication across multiple protocols (HTTP, HTTPS, DNS, custom). It helps reverse-engineer beaconing patterns, decode proprietary protocols, and map threat actor infrastructure, making it crucial for building robust detection signatures and attributing threats.

This skill details the process of reverse engineering Go-compiled malware using Ghidra. It involves parsing Go-specific metadata structures like buildinfo and pclntab to recover stripped or obfuscated function names. Users can also extract embedded module paths and dependency strings, providing critical insight into the malware's capabilities and third-party dependencies.

This skill provides a comprehensive guide to detecting and analyzing heap spray exploitation techniques from raw memory dumps. Utilizing Volatility3's advanced plugins (such as malfind and vadinfo), users can identify key forensic artifacts like NOP sled patterns, suspicious executable memory regions, and embedded shellcode. It is essential for malware analysts and digital forensics investigators conducting incident response.