Skill UI

A comprehensive guide and technical framework for detecting and mitigating ransomware kill switch mechanisms. It details methods for analyzing mutex guards, domain-based communication, and registry checks. Learn how to deploy proactive mutex vaccination and use Sysmon/DNS monitoring to prevent malware execution during incident response and analysis.

A comprehensive guide for advanced memory forensics using Volatility 2 and 3. This playbook covers artifact extraction, including hidden process detection, network connections, credential dumping, DLL analysis, and code injection detection (malfind). It is essential for incident response, malware analysis, and reconstructing attack timelines from memory dumps.

A comprehensive skill for detecting and analyzing malicious behavior in mobile applications (Android/iOS). It employs multi-layered security analysis, including static indicator checking (permissions, manifest), dynamic instrumentation (Frida), network traffic monitoring, and automated scanning (MobSF). Use this skill when investigating suspicious apps for data exfiltration, C2 communication, or unauthorized access.

A comprehensive workflow and deep technical guide for analyzing malicious Linux ELF binaries. Covers static analysis (reading ELF headers, checking entropy, identifying strings), dynamic tracing (monitoring system calls and library usage with strace/ltrace), and reverse engineering (using GDB) of threats like ransomware, botnets, and rootkits targeting Linux servers and containers (x86_64, ARM).

A highly specialized, downstream skill for advanced threat analysis. This tool is used to recover hidden configurations, decode C2 (Command and Control) parameters, unpack staged payloads, and extract Indicators of Compromise (IOCs) from complex malware samples. It focuses on identifying the exact decode chains—including compression, encoding, and crypto steps—and linking recovered fields to observed behavioral outcomes within a sandbox environment.

This specialized skill automates advanced forensic network analysis on captured packet data (PCAP). It is designed for reconstructing complex network sessions (TCP/UDP), decoding obscure or custom protocols (e.g., C2, custom binary), and correlating packet sequences with host or malware behavior. Use when evidence is embedded in protocol framing, timing, or session state, requiring reassembly beyond simple packet inspection.

This specialized skill guides deep-dive analysis for binary-heavy challenges, including CTF, malware analysis, and advanced forensics. It covers reverse engineering binaries, unpacking samples, inspecting memory dumps, debugging crashes, and building exploit chains by correlating artifacts like files, memory, and network packets.

Creates task-oriented technical documentation with progressive disclosure for READMEs, API docs, architecture docs, and markdown. Also generates formal security reports (reverse engineering, penetration testing, CTF, malware/APT analysis) in the user's project directory with Evidence-Finding-Path chain.

This comprehensive guide details the methodology for reverse engineering macOS and Mach-O binaries. It covers analyzing application bundles, deciphering Objective-C/Swift symbols, examining code signing and hardened runtime features, and performing both static (using tools like Ghidra, IDA) and dynamic analysis (using lldb, Frida) to aid in malware analysis and platform security research.

Comprehensive workflow for analyzing suspected malware via static, dynamic, and behavioral techniques. Covers IOC extraction, YARA/Sigma rule generation, sandbox automation, and anti-analysis bypassing.

A comprehensive, structured guide for reverse engineering and analyzing managed .NET/C# binaries. This skill covers the full workflow, including initial identification (CLR check), deobfuscation (using tools like de4dot), static analysis via IL view (dnSpyEx), and dynamic debugging. It is essential for analyzing malware, red team tools, and patching compiled C# applications.

Provides IDA Pro reverse engineering capabilities for analyzing binaries, PE/ELF/APK/DLL/SO files, firmware, and malware. Supports decompilation, password discovery, vulnerability analysis, and software cracking workflows. Uses deterministic scripts for HTTP server management and file opening to avoid known MCP schema and lock issues.