Skill UI

A comprehensive forensic workflow for detecting persistent, deep-seated malware, such as bootkits and advanced rootkits. The analysis covers multiple layers, including boot sectors (MBR/VBR), UEFI firmware modules, and kernel memory forensics. It is essential for investigating sophisticated, nation-state level threats that evade standard anti-malware and EDR solutions.

A specialized tool designed for incident responders and threat hunters. It extracts critical configuration data—such as C2 server addresses, malleable profiles, watermarks, and communication settings—from Cobalt Strike beacon payloads found in PE files or memory dumps. This analysis is crucial for mapping attacker infrastructure and improving defensive detection rules.

This skill provides a comprehensive guide to detecting and analyzing heap spray exploitation techniques from raw memory dumps. Utilizing Volatility3's advanced plugins (such as malfind and vadinfo), users can identify key forensic artifacts like NOP sled patterns, suspicious executable memory regions, and embedded shellcode. It is essential for malware analysts and digital forensics investigators conducting incident response.

A powerful toolkit utilizing Objection and Frida for authorized mobile penetration testing. It enables deep runtime analysis of iOS applications, allowing users to inspect sensitive data in the keychain, filesystem, and memory. Key capabilities include bypassing client-side protections such as SSL pinning and jailbreak detection without requiring source code access.

This skill provides a structured approach to detecting kernel-level rootkits in Linux environments. It utilizes memory forensics with Volatility3 (checking syscalls, hidden modules) and compares system views (/proc vs /sys) to identify tampered kernel structures, hooked syscalls, and concealed processes. It also integrates live scanning tools like rkhunter for comprehensive security incident investigation.

Walks through analyzing RAM dumps with Volatility 3/2 to uncover injected code, hidden processes, network activity, and credentials when responding to compromised hosts.

This skill outlines the comprehensive process of memory forensics on compromised Linux systems. It guides users through acquiring volatile memory using the LiME kernel module and analyzing the resulting image with the Volatility 3 framework. Key artifacts extracted include process lists, network connections, bash history, and loaded kernel modules, making it an essential technique for incident response, threat hunting, and security investigations.

A comprehensive system for systematically collecting, categorizing, and enriching Indicators of Compromise (IOCs) from various sources (network logs, memory dumps, email, etc.). It supports the entire incident response lifecycle, ensuring structured data representation using STIX/TAXII formats for robust threat intelligence sharing and defensive system automation.

A comprehensive guide for collecting volatile forensic evidence from a compromised host while adhering to the order of volatility. This process captures critical data—including memory dumps, network connections, running processes, and system state—before the host is isolated or powered down. Essential for root cause analysis, fileless malware investigation, and maintaining a defensible chain of custody for legal proceedings.

This guide details the comprehensive workflow for conducting memory forensics using Volatility 3. It covers the entire incident response lifecycle, from acquiring raw RAM dumps to analyzing processes, detecting rootkits, investigating network connections, and extracting sensitive artifacts like credentials and injected code. Essential for live memory analysis in cybersecurity investigations.

This skill simulates Pass-the-Ticket (PtT) attacks, a critical post-exploitation technique. It involves dumping active Kerberos tickets (TGT/TGS) from memory (LSASS) on a compromised host and injecting them into another session. This allows an attacker to impersonate the ticket owner and perform lateral movement or escalate privileges without needing the user's password. Use exclusively for authorized red-teaming and security auditing.

This skill provides comprehensive detection methods for credential dumping techniques, a critical post-exploitation phase in cyber attacks. It targets the extraction of sensitive credentials from LSASS memory, SAM registry hives, and NTDS.dit using advanced security visibility. Detection relies on analyzing Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and complex SIEM correlation rules, making it essential for SOC analysts and threat hunters investigating advanced persistent threats (APTs).