Skill UI

This advanced skill details dual-use security techniques for analyzing protected binaries, conducting malware analysis, and performing authorized penetration testing. It strictly mandates that users confirm explicit written authorization, adhere to defined scope, and ensure legal compliance (e.g., CFAA, DMCA). Use cases include CTF competitions, academic research, and internal security auditing, emphasizing defensive recommendations and evidence preservation.

This advanced skill details dual-use security techniques for analyzing protected binaries, conducting malware analysis, and performing authorized penetration testing. It strictly mandates that users confirm explicit written authorization, adhere to defined scope, and ensure legal compliance (e.g., CFAA, DMCA). Use cases include CTF competitions, academic research, and internal security auditing, emphasizing defensive recommendations and evidence preservation.

A comprehensive, step-by-step guide for security professionals to perform deep-dive malware analysis. It covers methodologies for static analysis (disassemblers, imports), dynamic execution (sandboxing, monitoring), identifying Indicators of Compromise (IOCs), and structuring professional threat reports. Essential for incident response and threat intelligence.

This comprehensive guide provides techniques for acquiring, analyzing, and extracting artifacts from memory dumps. It covers best practices for digital forensics, crucial for incident response and malware analysis. Users learn how to use industry-standard tools like Volatility 3 on Windows, Linux, and macOS, including process, network, and registry deep dives.

A comprehensive tool for performing static analysis on Android APK malware samples. It utilizes androguard, apktool, and jadx to detect dangerous permission combinations, suspicious API calls (like reflection or crypto), dynamic code loading patterns, and extract Indicators of Compromise (IOCs) for robust security incident response and threat hunting.

This skill provides a systematic framework for analyzing cyber campaign attribution. It involves collecting, weighting, and correlating diverse indicators—such as infrastructure overlaps, TTP consistency, malware code similarities, and operational patterns—to determine the responsible threat actor. Utilizing structured methodologies like Analysis of Competing Hypotheses (ACH) and the Diamond Model, users can build confidence-weighted assessments to enhance threat intelligence accuracy.

A comprehensive guide for analyzing malicious Linux ELF binaries. Covers static inspection using tools like readelf and elftools, dynamic tracing with strace/ltrace, and deep reverse engineering using Ghidra/IDA. Essential for investigating botnets, ransomware, and rootkits in Linux server or container environments.

A comprehensive cybersecurity tool designed to analyze malicious VBA and XLM macros embedded within Microsoft Office documents (Word, Excel, PowerPoint). It facilitates deep forensic investigation by extracting, deobfuscating, and tracing the full attack chain, including identifying auto-execution triggers, payload download URLs, and file writing techniques. Useful for malware analysts investigating phishing campaigns and maldocs.

This skill automates the execution of suspicious malware samples within a secure, isolated Cuckoo Sandbox environment. It observes comprehensive runtime behaviors, including process creation chains, file system tampering, registry modifications, network communications, and API calls. It is essential for generating detailed behavioral reports, extracting Indicators of Compromise (IOCs), and classifying unknown malware samples.

This skill provides a comprehensive guide to using the Malpedia API for advanced malware intelligence analysis. Users can track malware family relationships, analyze variant evolution, extract associated YARA rules for detection, and map connections to specific threat actors. It is essential for security researchers and SOC analysts building robust threat models.

This skill provides a comprehensive workflow for detecting and analyzing malware persistence mechanisms on Windows systems. It automates the use of Sysinternals Autoruns via scripting to scan hundreds of Auto-Start Extensibility Points (ASEPs), including registry keys, services, scheduled tasks, and drivers. The process flags suspicious entries like unsigned binaries, suspicious paths, or dangerous command-line arguments, making it an essential tool for security incident response and threat hunting.

This skill analyzes behavioral reports (Cuckoo/AnyRun) to detect anti-analysis techniques used by malware, such as timing checks, VM artifact queries, user interaction monitoring, and environment fingerprinting. It provides a structured method for security researchers and SOC analysts to understand malware's true capabilities and detect evasion attempts.