Skill UI

This advanced skill details dual-use security techniques for analyzing protected binaries, conducting malware analysis, and performing authorized penetration testing. It strictly mandates that users confirm explicit written authorization, adhere to defined scope, and ensure legal compliance (e.g., CFAA, DMCA). Use cases include CTF competitions, academic research, and internal security auditing, emphasizing defensive recommendations and evidence preservation.

This advanced skill details dual-use security techniques for analyzing protected binaries, conducting malware analysis, and performing authorized penetration testing. It strictly mandates that users confirm explicit written authorization, adhere to defined scope, and ensure legal compliance (e.g., CFAA, DMCA). Use cases include CTF competitions, academic research, and internal security auditing, emphasizing defensive recommendations and evidence preservation.

A comprehensive, step-by-step guide for security professionals to perform deep-dive malware analysis. It covers methodologies for static analysis (disassemblers, imports), dynamic execution (sandboxing, monitoring), identifying Indicators of Compromise (IOCs), and structuring professional threat reports. Essential for incident response and threat intelligence.

This comprehensive guide provides techniques for acquiring, analyzing, and extracting artifacts from memory dumps. It covers best practices for digital forensics, crucial for incident response and malware analysis. Users learn how to use industry-standard tools like Volatility 3 on Windows, Linux, and macOS, including process, network, and registry deep dives.

This skill performs comprehensive static analysis of Android APK malware. It utilizes industry-standard tools like androguard and apktool to decompile resources, inspect manifests, and identify dangerous permissions, obfuscated code patterns, dynamic loading mechanisms, and suspicious API calls without executing the sample. It is essential for security analysts, SOC teams, and threat hunters building detection rules or triaging suspicious malware samples.

A comprehensive forensic workflow for detecting persistent, deep-seated malware, such as bootkits and advanced rootkits. The analysis covers multiple layers, including boot sectors (MBR/VBR), UEFI firmware modules, and kernel memory forensics. It is essential for investigating sophisticated, nation-state level threats that evade standard anti-malware and EDR solutions.

Systematically evaluates cyber-campaign evidence to attribute a cyber operation to a specific threat actor. This skill utilizes advanced analytical frameworks like the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh multiple indicators, including infrastructure overlaps, TTP consistency, malware similarity, and operational patterns, providing confidence-weighted attribution assessments for incident response.

A comprehensive guide for analyzing malicious Linux ELF binaries. Covers static inspection using tools like readelf and elftools, dynamic tracing with strace/ltrace, and deep reverse engineering using Ghidra/IDA. Essential for investigating botnets, ransomware, and rootkits in Linux server or container environments.

A comprehensive cybersecurity tool designed to analyze malicious VBA and XLM macros embedded within Microsoft Office documents (Word, Excel, PowerPoint). It facilitates deep forensic investigation by extracting, deobfuscating, and tracing the full attack chain, including identifying auto-execution triggers, payload download URLs, and file writing techniques. Useful for malware analysts investigating phishing campaigns and maldocs.

A comprehensive guide to utilizing Cuckoo Sandbox for deep dynamic analysis of suspicious malware samples. This workflow walks through sample submission, real-time monitoring, and programmatic extraction of behavioral indicators, including process activity, network communications (DNS, HTTP), file system changes, and registry modifications, essential for threat intelligence and IOC extraction.

This skill enables deep analysis of malware families using the Malpedia API. It allows users to retrieve canonical aliases, associated threat actors, and YARA detection rules, and map complex relationships like loader-payload chains. Ideal for threat intelligence research, incident response, and building automated detection signatures.

Analyzes behavioral reports from security sandboxes (Cuckoo, AnyRun) to detect advanced anti-analysis and evasion techniques. It specifically identifies indicators such as timing checks, hypervisor artifact queries, user interaction patterns, and environment fingerprinting. This tool is essential for threat hunting, enhancing detection rules, and conducting deep malware triage.