Skill UI

This tool leverages the Rekall memory forensics framework to conduct deep analysis of memory dumps. It is designed to detect sophisticated threats such as process hollowing, injected code via VAD anomalies, hidden operating system processes, and rootkit presence. It applies key forensic plugins (pslist, malfind, vadinfo) essential for rigorous incident response and malware analysis.

This guide details how to implement robust Security Orchestration, Automation, and Response (SOAR) playbooks using Palo Alto XSOAR. It covers building automated, multi-stage incident response workflows (e.g., phishing, malware analysis, DDoS containment) by integrating various security tools. Use this when automating manual SOC tasks, structuring incident playbooks, or improving overall security posture and compliance.

CAPE is an open-source sandbox derived from Cuckoo, designed for automated dynamic malware analysis. It features advanced behavioral instrumentation, capturing system changes, network traffic (PCAP), and specialized parsers to extract malware configurations (e.g., Emotet, Cobalt Strike). Use this skill for incident response, security assessments, and validating security controls against complex payloads and evasion techniques.

This tool facilitates interactive dynamic malware analysis using the ANY.RUN cloud sandbox. It allows analysts to detonate suspicious samples, observe real-time execution behavior, and manually interact with prompts (like dialogs or CAPTCHAs). Key outputs include detailed process trees, network traffic analysis (C2 communication), and identification of all Indicators of Compromise (IOCs), mapping observed behaviors to MITRE ATT&CK. Essential for rapid, sophisticated behavioral analysis without maintaining local sandbox infrastructure.

A comprehensive tool suite designed to analyze firmware images from embedded devices, including routers, IoT endpoints, and critical system components like UEFI/BIOS. It facilitates deep security analysis by performing firmware extraction, filesystem integrity checks, binary reverse engineering, and sophisticated detection of bootkits, backdoors, and unauthorized modifications.

This skill provides a comprehensive workflow for analyzing malicious software to extract actionable Indicators of Compromise (IOCs). It covers static analysis (PE parsing, hashing, string extraction) and dynamic analysis techniques. Users learn how to identify file hashes, network indicators (C2 IPs, domains), registry modifications, and behavioral artifacts, ultimately formatting the findings into standard STIX 2.1 formats for sharing and incident response.

This script systematically investigates all persistence mechanisms on Windows and Linux systems. It analyzes critical areas like the Windows Registry (SYSTEM, SOFTWARE, HKCU), scheduled tasks, and common run keys to identify how malware maintains access and survives system reboots. It is essential for advanced incident response, threat hunting, and digital forensics investigations.

A comprehensive guide detailing how to perform rapid malware triage and classification using YARA rules. Learn to write sophisticated rules that match file patterns, unique strings, byte sequences, and structural PE characteristics. Ideal for automating signature-based scanning, developing custom detection rules for zero-day threats, and building robust analysis pipelines.

This guide details how to perform pre-execution static analysis of Windows PE malware samples using tools like PEStudio, Python's pefile, and FLOSS. It focuses on examining file headers, section entropy, import address tables (IAT), and embedded strings to identify malicious functionalities, packing techniques, and indicators of compromise (IOCs) without running the binary. Ideal for initial triage of suspicious executables.

A comprehensive guide and workflow demonstrating how to use YARA rules for proactive threat hunting. This method helps detect unknown malware, suspicious patterns, and Indicators of Compromise (IOCs) across filesystems, memory dumps, and network artifacts, making it essential for incident response and security analysis.

This comprehensive guide details a step-by-step workflow for reverse engineering malware binaries using Ghidra. It guides users through static and dynamic analysis techniques to study internal logic, C2 communication protocols, cryptographic routines, and obfuscation methods at the assembly and pseudo-C code level. Use this when deep code review is required to extract configuration data, understand exploit mechanisms, or develop detection signatures.

A comprehensive workflow and guide for reverse engineering malware compiled using the Rust language. It specifically addresses complex challenges unique to Rust binaries, including non-null-terminated fat-pointer strings, monomorphization artifacts, and intricate error handling chains (Result/Option). Ideal for security analysts and red teams performing deep analysis of modern, resilient attack artifacts.