Skill UI

This advanced skill details dual-use security techniques for analyzing protected binaries, conducting malware analysis, and performing authorized penetration testing. It strictly mandates that users confirm explicit written authorization, adhere to defined scope, and ensure legal compliance (e.g., CFAA, DMCA). Use cases include CTF competitions, academic research, and internal security auditing, emphasizing defensive recommendations and evidence preservation.

This advanced skill details dual-use security techniques for analyzing protected binaries, conducting malware analysis, and performing authorized penetration testing. It strictly mandates that users confirm explicit written authorization, adhere to defined scope, and ensure legal compliance (e.g., CFAA, DMCA). Use cases include CTF competitions, academic research, and internal security auditing, emphasizing defensive recommendations and evidence preservation.

A comprehensive, step-by-step guide for security professionals to perform deep-dive malware analysis. It covers methodologies for static analysis (disassemblers, imports), dynamic execution (sandboxing, monitoring), identifying Indicators of Compromise (IOCs), and structuring professional threat reports. Essential for incident response and threat intelligence.

Memory Forensics Toolkit consolidates guidance for acquiring memory dumps, running Volatility analysis, and following incident response workflows to triage malware and forensic cases.

Static analysis workflow using apktool, jadx, and androguard to decompile Android APK malware, inspect manifests, permissions, APIs, and produce structured IOC/risk reports for SOC investigators.

Analyzes campaign attribution evidence with the Diamond Model and ACH, covering infrastructure overlaps, TTP consistency, malware similarities, timing, and language signals to help SOC analysts and hunters assess threat actor confidence.

Dissects malware command-and-control channels to understand beacon rhythms, command structures, data encoding, and infrastructure for detection development and threat intelligence workflows.

Reverse engineer stripped Go malware in Ghidra with GoResolver and Python helpers to recover function metadata, strings, and dependencies while giving SOC analysts actionable steps for threat hunting and detection tuning.

Provides a workflow for investigating malicious Linux ELF binaries, walking through static analysis, dynamic tracing, string detection and reverse-engineering steps so analysts can interrogate botnets, miners, rootkits and other server/container threats.

Analyzes VBA and XLM macro malware hidden in Office documents to reveal download URLs, execution chains, persistence tactics, and anti-analysis tricks for informed incident response.

Runs suspect binaries through Cuckoo Sandbox to capture process creation, file drops, registry edits, network traffic, and API calls, producing detailed behavior reports and IOCs for controlled malware investigations.

Use Sysinternals Autoruns to scan Windows ASEPs, flag unsigned binaries, suspicious paths, and LOLBin launch strings, compare results to clean baselines, and validate persistence indicators for malware hunting and response.