Skill UI

Guides writing high-quality YARA-X detection rules for malware hunting, covering naming conventions, string selection, performance tuning, migrations from legacy YARA, and reducing false positives when authoring, reviewing, or debugging signatures.

Yara Authoring helps security teams write precise YARA rules for threat detection and malware hunting by guiding string/tag management and metadata handling so signature creation keeps pace with investigations.

This skill performs comprehensive static analysis of Android APK malware. It utilizes industry-standard tools like androguard and apktool to decompile resources, inspect manifests, and identify dangerous permissions, obfuscated code patterns, dynamic loading mechanisms, and suspicious API calls without executing the sample. It is essential for security analysts, SOC teams, and threat hunters building detection rules or triaging suspicious malware samples.

A deep-dive tool for cybersecurity professionals to analyze malware Command and Control (C2) communication across multiple protocols (HTTP, HTTPS, DNS, custom). It helps reverse-engineer beaconing patterns, decode proprietary protocols, and map threat actor infrastructure, making it crucial for building robust detection signatures and attributing threats.

This skill enables deep analysis of malware families using the Malpedia API. It allows users to retrieve canonical aliases, associated threat actors, and YARA detection rules, and map complex relationships like loader-payload chains. Ideal for threat intelligence research, incident response, and building automated detection signatures.

Analyzes behavioral reports from security sandboxes (Cuckoo, AnyRun) to detect advanced anti-analysis and evasion techniques. It specifically identifies indicators such as timing checks, hypervisor artifact queries, user interaction patterns, and environment fingerprinting. This tool is essential for threat hunting, enhancing detection rules, and conducting deep malware triage.

A comprehensive guide for analyzing PCAP files captured during malware execution. It demonstrates advanced techniques using Wireshark, Zeek, Suricata, and Python (scapy) to identify Command and Control (C2) communications, data exfiltration channels, Domain Generation Algorithms (DGA), and periodic beaconing patterns. Essential for malware reverse engineering and network threat detection.

This skill provides a structured methodology and tools for investigating sophisticated supply chain attacks. It focuses on detecting trojanized software updates, compromised build pipelines, and hidden dependencies by performing deep binary comparison, code signing verification, and anomaly detection. Use it during incident response to map out intrusion vectors and assess the full scope of a security breach.

A comprehensive, multi-stage framework for responding to confirmed or suspected malware infections across an enterprise. This guide covers the entire incident lifecycle: detection, scoping, containment, deep analysis (mapping to MITRE ATT&CK), thorough eradication, and system recovery, ensuring all steps are documented for resilience and compliance.

This skill provides comprehensive guidance and detection rules for identifying fileless malware, in-memory attacks, and living-off-the-land techniques. It covers detecting PowerShell exploitation, reflective DLL injection, WMI abuse, and registry-resident threats, enabling security teams to build robust detections when traditional antivirus fails.

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and LOLBins. Use for fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.

A comprehensive guide to implementing advanced security measures in Google Workspace. This covers enhanced pre-delivery scanning, anti-spoofing detection, attachment protection, and setting up Enhanced Safe Browsing to safeguard against sophisticated phishing and malware attacks within organizational emails. Ideal for security administrators and compliance teams.