Skill UI

A comprehensive guide for analyzing malicious Linux ELF binaries. Covers static inspection using tools like readelf and elftools, dynamic tracing with strace/ltrace, and deep reverse engineering using Ghidra/IDA. Essential for investigating botnets, ransomware, and rootkits in Linux server or container environments.

This skill analyzes the cryptographic algorithms, key management systems, and file encryption routines employed by various ransomware families. It covers hybrid schemes like AES-RSA and modern ciphers such as ChaCha20. Use this when assessing data recovery feasibility, reverse engineering ransomware binaries, identifying implementation weaknesses (e.g., IV reuse, key derivation flaws), or developing custom decryptor tools.

This skill provides a structured methodology and Python implementation for monitoring and analyzing data leak sites (DLS) associated with ransomware groups. It helps security analysts track victim postings, extract threat intelligence on group tactics, assess sector-specific risks, and understand evolving ransomware threat landscapes for proactive defense.

This comprehensive skill analyzes Zeek conn.log and NetFlow data to proactively detect advanced indicators of ransomware activity. It identifies critical threats such as Command and Control (C2) beaconing patterns, connections to TOR exit nodes, large-scale data exfiltration flows, and suspicious DNS anomalies. It is essential for threat hunting and complex security incident response.

A comprehensive, structured playbook for Security Operations Centers (SOCs) detailing the entire lifecycle of ransomware incidents. It guides analysts through detection (SIEM queries), triage decision trees, containment (EDR/Firewall), evidence collection, and recovery phases, adhering to NIST CSF and MITRE ATT&CK frameworks.

This skill provides comprehensive guidance and PowerShell scripts for hardening Windows endpoints using Microsoft Defender for Endpoint (MDE). It covers advanced features like Attack Surface Reduction (ASR) rules to block common attack techniques, Controlled Folder Access for ransomware protection, and Network Protection. Use this for deploying enterprise-grade, compliance-required security policies via Intune or Group Policy.

This comprehensive guide provides a structured, multi-stage workflow for containing active security breaches. It details both short-term and long-term strategies, including network segmentation, endpoint isolation, credential revocation, and evidence preservation. Use this process during confirmed intrusions, ransomware attacks, or lateral movement events to effectively stop adversary activity and secure critical assets before eradication.

This tool deploys decoy canary files in critical system directories to provide early warning against ransomware attacks. Utilizing Python's watchdog library, it monitors for any read, modify, rename, or delete operations on these decoy files. Detection triggers immediate alerts via multiple channels (Email, Slack, Syslog), helping security teams identify and respond to malicious activity before full data encryption occurs. It serves as a crucial detection layer in a layered security defense.

A comprehensive skill for detecting early-stage ransomware indicators before data encryption occurs. It utilizes advanced network detection tools such as Zeek and Suricata, combined with SIEM correlation rules and threat intelligence feeds. This method monitors the entire pre-encryption kill chain, identifying precursor behaviors like initial access broker activity, Cobalt Strike C2 beaconing, credential harvesting (e.g., Mimikatz signatures), and data staging attempts, enabling timely incident response and containment.

This methodology guides security professionals in proactively hunting for suspicious activity related to Volume Shadow Copy deletion. By monitoring commands like vssadmin, wmic, and PowerShell usage, it helps detect anti-forensics techniques and preparatory steps often executed by ransomware actors, crucial during incident response or threat hunting exercises.

This guide details the deployment of deception technologies, including canary files and honeypot shares, to detect ransomware activity at its earliest stages. It outlines configuring file integrity monitoring (FIM) and using specialized tokens to trigger alerts when ransomware attempts encryption or performs lateral movement, significantly enhancing security posture beyond standard EDR.

This skill details implementing a ransomware-resistant, immutable backup strategy using the restic tool. It leverages S3-compatible Object Lock (Compliance Mode) to ensure Write Once Read Many (WORM) storage, preventing deletion or modification by attackers. The process includes automated backup, cryptographic integrity verification (restic check), and scheduled restore testing, adhering to advanced security standards like 3-2-1-1-0.