Malware

analyzing-bootkit-and-rootkit-samples is a malware analysis skill for MBR, VBR, UEFI, and rootkit investigations. Use it to inspect boot sectors, firmware modules, and anti-rootkit indicators when compromise persists below the OS layer. It is suited for analysts who need a practical guide, clear workflow, and evidence-based triage for Malware Analysis.

analyzing-supply-chain-malware-artifacts is a malware-analysis skill for tracing trojanized updates, poisoned dependencies, and build-pipeline tampering. Use it to compare trusted and untrusted artifacts, extract indicators, assess compromise scope, and report findings with less guesswork.

analyzing-ransomware-payment-wallets is a read-only blockchain-forensics skill for tracing ransomware payment wallets, following fund movement, and clustering related addresses for Security Audit and incident response. Use it when you have a BTC address, tx hash, or suspected wallet and need evidence-backed attribution support.

analyzing-ransomware-encryption-mechanisms skill for malware analysis, focused on identifying ransomware encryption, key handling, and decryption feasibility. Use it to inspect AES, RSA, ChaCha20, hybrid schemes, and implementation flaws that may support recovery.

analyzing-ransomware-leak-site-intelligence helps monitor ransomware data leak sites, extract victim and group signals, and produce structured threat intelligence for incident response, sector risk review, and adversary tracking.

extracting-iocs-from-malware-samples skill guide for malware analysis: extract hashes, IPs, domains, URLs, host artifacts, and validation cues from samples for threat intel and detection.

eradicating-malware-from-infected-systems is a cybersecurity incident response skill for removing malware, backdoors, and persistence mechanisms after containment. It includes workflow guidance, reference files, and scripts for Windows and Linux cleanup, credential rotation, root-cause remediation, and validation.

detecting-process-injection-techniques helps analyze suspicious in-memory activity, validate EDR alerts, and identify process hollowing, APC injection, thread hijacking, reflective loading, and classic DLL injection for Security Audit and malware triage.

analyzing-packed-malware-with-upx-unpacker is a malware-analysis skill for identifying UPX-packed samples, handling modified UPX headers, and recovering the original executable for static review in Ghidra or IDA. Use it when `upx -d` fails or when you need a faster UPX packer check and unpacking workflow.

analyzing-memory-dumps-with-volatility is a Volatility 3 skill for memory forensics, malware triage, hidden processes, injection, network activity, and credentials in RAM dumps on Windows, Linux, or macOS. Use it when you need a repeatable analyzing-memory-dumps-with-volatility guide for incident response and malware analysis.

analyzing-macro-malware-in-office-documents helps malware analysts inspect malicious VBA in Word, Excel, and PowerPoint files, decode obfuscation, and extract IOCs, execution paths, and payload staging logic for phishing triage, incident response, and document malware analysis.

analyzing-golang-malware-with-ghidra helps analysts reverse engineer Go-compiled malware in Ghidra with workflows for function recovery, string extraction, build metadata, and dependency mapping. The analyzing-golang-malware-with-ghidra skill is useful for malware triage, incident response, and Security Audit tasks that need practical, Go-specific analysis steps.

analyzing-linux-elf-malware helps analyze suspicious Linux ELF binaries for malware analysis, with guidance for architecture checks, strings, imports, static triage, and early indicators of botnets, miners, rootkits, ransomware, and container threats.

The detecting-fileless-malware-techniques skill supports Malware Analysis workflows for investigating fileless malware that runs in memory through PowerShell, WMI, .NET reflection, registry-resident payloads, and LOLBins. Use it to move from suspicious alerts to evidence-backed triage, detection ideas, and next-step hunting.

deobfuscating-javascript-malware helps analysts turn heavily obfuscated malicious JavaScript into readable code for malware analysis, phishing pages, web skimmers, droppers, and browser-delivered payloads. Use this deobfuscating-javascript-malware skill for structured deobfuscation, decode tracing, and controlled review when simple minification is not the issue.

conducting-malware-incident-response helps IR teams triage suspected malware, confirm infections, scope spread, contain endpoints, and support eradication and recovery. It is designed for conducting-malware-incident-response for Incident Response workflows with evidence-backed steps, telemetry-driven decisions, and practical containment guidance.

building-c2-infrastructure-with-sliver-framework helps authorized red team and Security Audit work plan, install, and use Sliver-based C2 infrastructure with redirectors, HTTPS listeners, operator access, and resilience checks. It includes a practical guide, workflow files, and repo scripts for deployment and validation.

analyzing-windows-registry-for-artifacts helps analysts extract evidence from Windows Registry hives to identify user activity, installed software, autoruns, USB history, and compromise indicators for incident response or Security Audit workflows.

Analyze the threat landscape using MISP with the analyzing-threat-landscape-with-misp skill. It summarizes event statistics, IoC distributions, threat actor and malware trends, and time-based changes to support Threat Intelligence reports, SOC briefings, and hunting priorities.

analyzing-pdf-malware-with-pdfid is a PDF malware triage skill for detecting embedded JavaScript, exploit markers, object streams, attachments, and suspicious actions before opening a file. It supports static analysis for malicious PDF investigation, incident response, and analyzing-pdf-malware-with-pdfid for Security Audit workflows.

analyzing-network-traffic-of-malware helps inspect PCAPs and telemetry from sandbox runs or incident response to find C2, exfiltration, payload downloads, DNS tunneling, and detection ideas. It is a practical analyzing-network-traffic-of-malware guide for Security Audit and malware triage.

analyzing-command-and-control-communication helps analyze malware C2 traffic to identify beaconing, decode commands, map infrastructure, and support Security Audit, threat hunting, and malware triage with PCAP-based evidence and practical workflow guidance.