Skill UI

Detects abnormal access patterns across major cloud storage platforms, including AWS S3, GCS, and Azure Blob Storage. By analyzing cloud audit logs (CloudTrail, etc.), this tool identifies critical security threats such as after-hours bulk data downloads, sudden spikes in API calls (GetObject spikes), access from new geographic IPs, and potential data exfiltration. It utilizes statistical baselines and time-series anomaly detection for proactive threat hunting and security incident investigation.

A comprehensive toolset for analyzing Cobalt Strike Malleable C2 profiles. It parses advanced C2 communication configurations to extract crucial Indicators of Compromise (IOCs) such as HTTP headers, DNS settings, URI patterns, and user agents. The analysis is vital for threat hunting, developing network detection signatures (Suricata/Snort), and understanding evasion techniques used by advanced persistent threats (APTs).

A comprehensive guide and workflow for digital forensics investigators to analyze raw email headers. This tool helps trace the true origin of suspicious emails, verify sender authenticity, and detect advanced spoofing techniques by validating crucial protocols like SPF, DKIM, and DMARC. It covers everything from header parsing to domain infrastructure analysis and IP reputation checks.

This skill provides a comprehensive guide to detecting and analyzing heap spray exploitation techniques from raw memory dumps. Utilizing Volatility3's advanced plugins (such as malfind and vadinfo), users can identify key forensic artifacts like NOP sled patterns, suspicious executable memory regions, and embedded shellcode. It is essential for malware analysts and digital forensics investigators conducting incident response.

This skill analyzes Indicators of Compromise (IOCs)—such as IP addresses, domains, and file hashes—by querying multiple threat intelligence platforms (VirusTotal, AbuseIPDB, MISP). It determines maliciousness confidence, assigns blocking priorities, and attributes threats to campaigns, crucial for incident response, threat triage, and making informed security decisions.

This guide details the comprehensive process of using the Linux Audit framework (auditd) to detect advanced security threats. It covers deploying specific rules to monitor critical system files, detecting unauthorized privilege escalation, process injection, and suspicious system calls. Users can then leverage ausearch and aureport to efficiently query, reconstruct timelines, and summarize findings for forensic analysis and compliance auditing.

Comprehensive digital forensic analysis guide for Linux systems. It covers the collection and examination of critical artifacts such as authentication logs, shell histories, user configurations, system files (passwd, shadow), and persistence mechanisms to effectively detect security compromises, unauthorized access, and malicious activity.

This skill details the forensic analysis of Windows LNK shortcut files and Jump Lists. It enables investigators to reconstruct user activity, track file access, and determine program execution history by parsing critical metadata like timestamps, paths, and system identifiers, even when the original artifacts are deleted.

This guide details the process of performing static analysis on potentially malicious PDF documents. It utilizes advanced tools like peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use this method when triaging suspicious attachments from phishing emails or conducting deep forensic examination of weaponized document artifacts to generate actionable Indicators of Compromise (IOCs).

This skill automates the execution of suspicious malware samples within a secure, isolated Cuckoo Sandbox environment. It observes comprehensive runtime behaviors, including process creation chains, file system tampering, registry modifications, network communications, and API calls. It is essential for generating detailed behavioral reports, extracting Indicators of Compromise (IOCs), and classifying unknown malware samples.

This skill provides a comprehensive guide to using the Malpedia API for advanced malware intelligence analysis. Users can track malware family relationships, analyze variant evolution, extract associated YARA rules for detection, and map connections to specific threat actors. It is essential for security researchers and SOC analysts building robust threat models.

This skill provides a comprehensive workflow for detecting and analyzing malware persistence mechanisms on Windows systems. It automates the use of Sysinternals Autoruns via scripting to scan hundreds of Auto-Start Extensibility Points (ASEPs), including registry keys, services, scheduled tasks, and drivers. The process flags suspicious entries like unsigned binaries, suspicious paths, or dangerous command-line arguments, making it an essential tool for security incident response and threat hunting.