Skill UI

Analyzes bootkits and rootkits that hijack the MBR/VBR or UEFI to persist below the OS, guiding firmware acquisition, signature comparison, and detection when AV/EDR miss pre-boot implants.

Analyzes Linux ELF malware—botnets, cryptominers, ransomware, and rootkits—on servers, containers, and clouds via static headers, dynamic tracing, and reverse engineering for x86_64 and ARM samples.

Detect kernel-level rootkits in Linux memory dumps by combining Volatility3 linux plugins (check_syscall, lsmod, hidden_modules, check_idt), cross-view /proc versus /sys analysis, and live scans with rkhunter/chkrootkit to report hooked syscalls and hidden modules.

Guides configuring host-based intrusion detection systems such as Wazuh, OSSEC, or AIDE for endpoint monitoring, file integrity policies, rootkit checks, and alert automation when deploying agents on Windows and Linux.

Detects stealthy rootkit behavior on compromised hosts by using memory forensics, cross-view process comparisons, kernel hook scanning, module validation, and hidden artifact discovery to confirm kernel-level compromise before remediation.