Skill UI

This skill automates the enrichment of Indicators of Compromise (IOCs) by orchestrating lookups across multiple industry-leading threat intelligence sources (e.g., VirusTotal, AbuseIPDB, Shodan). It provides contextual scoring and disposition recommendations for IPs, domains, URLs, and hashes. Ideal for SOC analysts during alert triage or incident investigation to quickly assess risk and scope.

This skill leverages the VirusTotal API to perform comprehensive threat intelligence enrichment on file hashes (MD5, SHA-1, SHA-256). It retrieves detection rates from 70+ AV engines, behavioral sandbox reports, associated indicators of compromise (IOCs), and contextual threat data. Use this tool for rapid SOC triage, accurate incident response validation, and enhancing threat hunting workflows.

This skill provides a comprehensive workflow for analyzing malicious software to extract actionable Indicators of Compromise (IOCs). It covers static analysis (PE parsing, hashing, string extraction) and dynamic analysis techniques. Users learn how to identify file hashes, network indicators (C2 IPs, domains), registry modifications, and behavioral artifacts, ultimately formatting the findings into standard STIX 2.1 formats for sharing and incident response.

This comprehensive guide details a professional workflow for performing network forensics using Wireshark and tshark. Learn how to analyze captured PCAP files to identify malicious communications, reconstruct data exfiltration, extract crucial artifacts (HTTP, SMB, DICOM), and detect indicators of compromise (IOCs). Essential for incident response and malware analysis.

This skill automates deep packet capture (PCAP) analysis using tshark and pyshark. It is invaluable for security assessments and incident response, enabling the extraction of protocol statistics, identification of suspicious network flows (e.g., port scanning, beaconing), and comprehensive extraction of Indicators of Compromise (IOCs), including IPs, domains, and URLs. It also specializes in detecting complex anomalies like DNS tunneling.

A comprehensive guide for performing static analysis of Windows Portable Executable (PE) files using tools like PEStudio and scripting libraries. This technique examines file headers, calculates section entropy, identifies suspicious API calls (e.g., process injection, persistence), and extracts obfuscated strings and Indicators of Compromise (IoCs) without executing the sample, making it a crucial step in malware triage and reverse engineering.

A comprehensive guide and workflow demonstrating how to use YARA rules for proactive threat hunting. This method helps detect unknown malware, suspicious patterns, and Indicators of Compromise (IOCs) across filesystems, memory dumps, and network artifacts, making it essential for incident response and security analysis.

This skill demonstrates how to use PyMISP, the official Python library, to programmatically interact with the MISP threat intelligence platform. Users can create, enrich, and manage structured threat events, including adding Indicators of Compromise (IOCs), applying TLP/MITRE ATT&CK tags, and exporting data in STIX 2.1 format for cross-platform sharing, making it ideal for security assessments and incident response.

Provides methodology and scripts for proactive threat hunting, IOC sweeps, and statistical anomaly detection that surface attacker activity before automated alerts fire.

This technique guides users to use precise chemical compound names, specific concentration values (e.g., "1.5 mg/L"), and taxonomic synonym counts as exact-match search anchors when querying biological literature. By leveraging quotation marks and combining multiple specific terms, it uniquely identifies research papers or species details, greatly improving search precision in biochemistry and botany.