Skill UI

A comprehensive guide and technical framework for detecting and mitigating ransomware kill switch mechanisms. It details methods for analyzing mutex guards, domain-based communication, and registry checks. Learn how to deploy proactive mutex vaccination and use Sysmon/DNS monitoring to prevent malware execution during incident response and analysis.

A comprehensive guide for advanced memory forensics using Volatility 2 and 3. This playbook covers artifact extraction, including hidden process detection, network connections, credential dumping, DLL analysis, and code injection detection (malfind). It is essential for incident response, malware analysis, and reconstructing attack timelines from memory dumps.

A comprehensive skill for detecting and analyzing malicious behavior in mobile applications (Android/iOS). It employs multi-layered security analysis, including static indicator checking (permissions, manifest), dynamic instrumentation (Frida), network traffic monitoring, and automated scanning (MobSF). Use this skill when investigating suspicious apps for data exfiltration, C2 communication, or unauthorized access.

A comprehensive guide detailing the systematic workflow for analyzing malicious Linux ELF binaries. It covers essential techniques including static analysis (using readelf, elftools), dynamic tracing (strace, ltrace), and deep reverse engineering (GDB) of various threats like botnets, cryptominers, and ransomware targeting Linux environments, containers, and cloud infrastructure.

A highly specialized, downstream skill for advanced threat analysis. This tool is used to recover hidden configurations, decode C2 (Command and Control) parameters, unpack staged payloads, and extract Indicators of Compromise (IOCs) from complex malware samples. It focuses on identifying the exact decode chains—including compression, encoding, and crypto steps—and linking recovered fields to observed behavioral outcomes within a sandbox environment.

This specialized skill automates advanced forensic network analysis on captured packet data (PCAP). It is designed for reconstructing complex network sessions (TCP/UDP), decoding obscure or custom protocols (e.g., C2, custom binary), and correlating packet sequences with host or malware behavior. Use when evidence is embedded in protocol framing, timing, or session state, requiring reassembly beyond simple packet inspection.

This specialized skill guides deep-dive analysis for binary-heavy challenges, including CTF, malware analysis, and advanced forensics. It covers reverse engineering binaries, unpacking samples, inspecting memory dumps, debugging crashes, and building exploit chains by correlating artifacts like files, memory, and network packets.

This comprehensive guide details the methodology for reverse engineering macOS and Mach-O binaries. It covers analyzing application bundles, deciphering Objective-C/Swift symbols, examining code signing and hardened runtime features, and performing both static (using tools like Ghidra, IDA) and dynamic analysis (using lldb, Frida) to aid in malware analysis and platform security research.

A comprehensive guide covering the entire lifecycle of malware analysis, from initial triage and deep static reverse engineering to automated sandboxing and behavioral monitoring. It details a multi-stage workflow that includes extracting Indicators of Compromise (IOCs), generating detection rules using YARA and Sigma, and identifying anti-analysis techniques. Ideal for threat intelligence researchers and incident responders.