meltedinhex/analyst-ai-pack
59 skills
$npx skills add meltedinhex/analyst-ai-packSkillInstalls
analyzing-android-dex-malwareReverses Android malware: unpacking APKs, decompiling DEX bytecode to readableanalyzing-api-call-tracesAnalyzes API call traces from a sandbox or API monitor (JSON) to group calls byanalyzing-authenticode-signaturesAnalyzes Windows Authenticode signatures on PE files: checking for a signature,analyzing-banking-trojan-webinjectsAnalyzes banking trojan webinject configurations to extract targeted institutions,analyzing-compiled-python-malwareAnalyzes Python-based malware packaged as PyInstaller/py2exe executables by detectinganalyzing-cryptominer-malwareAnalyzes cryptojacking/coinminer malware by extracting mining pool endpointsanalyzing-dotnet-malware-internalsReverses .NET/managed malware: decompiling MSIL back to C#, defeating commonanalyzing-elf-binaries-on-linuxStatically analyzes Linux ELF malware: ELF header and sections, dynamic symbolsanalyzing-excel-4-macro-malwareAnalyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheetanalyzing-golang-malware-internalsAnalyzes Go-compiled malware by recovering function names from the pclntab, detectinganalyzing-infostealer-credential-theftAnalyzes infostealer samples by mapping the browser, credential store, wallet, andanalyzing-java-jar-malwareAnalyzes Java/JAR malware (such as Adwind/jRAT-class cross-platform RATs) byanalyzing-loaders-and-droppersAnalyzes loader and dropper samples by identifying staging behavior — embedded oranalyzing-mach-o-binaries-on-macosStatically analyzes macOS Mach-O malware: parsing the header and load commands,analyzing-malicious-iso-and-container-filesAnalyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloadsanalyzing-malicious-lnk-filesAnalyzes weaponized Windows shortcut (.lnk) files: parsing the shell link structureanalyzing-malicious-office-macrosAnalyzes malicious Office documents by extracting and reviewing VBA macros andanalyzing-malicious-onenote-and-html-smugglingAnalyzes two modern delivery techniques: malicious OneNote (.one) attachments withanalyzing-malicious-pdfsAnalyzes malicious PDF documents: parsing the object structure for JavaScript,analyzing-malicious-vbscript-and-wsfAnalyzes malicious VBScript, WSF, and HTA scripts: parsing WSF/HTA containers,analyzing-malware-in-memory-with-volatility3Analyzes a memory image with Volatility 3 to find malware: rogue processes,analyzing-pe-imports-and-exportsAnalyzes a PE file''s import and export tables to infer capability: mapping importedanalyzing-position-independent-codeAnalyzes position-independent code and shellcode by identifying GetPC/PEB-walkanalyzing-ransomware-encryption-behaviorAnalyzes how a ransomware sample encrypts files: identifying the crypto schemeanalyzing-rat-command-and-controlAnalyzes remote access trojan command-and-control by mapping the RAT command set,analyzing-rich-header-and-compiler-artifactsAnalyzes the PE Rich header and related compiler artifacts to fingerprint the buildanalyzing-rust-malware-internalsAnalyzes Rust-compiled malware by detecting the Rust toolchain signature, demanglinganalyzing-webshellsAnalyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-executionanalyzing-windows-driver-malwareAnalyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE foranalyzing-wiper-malwareAnalyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwriteautomating-analysis-with-r2pipeAutomates radare2/rizin analysis through r2pipe to script function enumeration, stringbuilding-a-sample-management-workflowEstablishes a disciplined malware sample repository: content-addressed storage bybuilding-a-threat-hunt-hypothesisFrames a structured, testable threat-hunting hypothesis: grounding it in adversarybuilding-config-extractorsBuilds reusable malware configuration extractors by applying a declarative JSON specbuilding-zeek-analytics-for-huntingBuilds Zeek-based network hunting analytics by writing scripts and analyzing Zeek logsbypassing-anti-vm-and-sandbox-checksBypasses anti-VM and sandbox checks during analysis by locating the specific detectioncapturing-and-analyzing-malware-network-trafficCaptures and analyzes malware network traffic from a detonation: extracting C2collecting-volatile-evidence-from-a-suspect-hostCollects volatile evidence from a potentially compromised host in correct order ofdebugging-malware-with-x64dbgUses x64dbg to dynamically debug Windows malware: setting strategic breakpointsdecrypting-embedded-configurationDecrypts statically embedded malware configuration blobs by trying common schemesdefanging-and-sharing-iocsPrepares indicators of compromise for safe sharing: defanging URLs, domains, IPs,defeating-control-flow-flatteningDefeats control-flow-flattening obfuscation by identifying the dispatcher/state-defeating-string-and-api-obfuscationRecovers obfuscated strings and resolves dynamically loaded APIs in malware:deobfuscating-malicious-javascriptDeobfuscates malicious JavaScript from droppers, web pages, and HTA/scriptlets:deobfuscating-malicious-powershellDeobfuscates malicious PowerShell by decoding -EncodedCommand, reversing stringdetecting-process-injection-in-memoryDetects process injection in a memory image by identifying private executable regionsdetecting-sandbox-evasion-behaviorDetects sandbox and analysis evasion techniques in a sample by scanning staticdiffing-malware-samples-to-find-changesCompares two related malware samples to surface what changed between variants usingdissecting-boot-and-kernel-rootkitsAnalyzes bootkit and rootkit samples by identifying boot-process tampering (MBR/VBR/dumping-and-rebuilding-a-pe-from-memoryRebuilds a usable PE file from a memory dump by fixing the section alignmentemulating-shellcode-with-unicornEmulates position-independent shellcode in a controlled CPU emulator (Unicorn) toenriching-iocs-with-threat-intel-sourcesEnriches indicators with context from threat-intel sources: planning lookups againstestablishing-telemetry-baselinesEstablishes behavioral baselines from historical telemetry (process, network, orextracting-and-classifying-stringsExtracts ASCII and Unicode strings from a binary and classifies them intoextracting-cobalt-strike-beacon-configExtracts and interprets a Cobalt Strike Beacon configuration: decoding theextracting-config-from-a-running-sampleExtracts an embedded malware configuration (C2 hosts, ports, campaign IDs, keys) fromextracting-encryption-keys-from-binariesLocates candidate encryption keys in a binary by finding high-entropy fixed-sizeextracting-iocs-from-analysis-outputExtracts indicators of compromise from raw analysis artifacts: parsing stringsgenerating-capability-reports-with-capaUses capa to identify malware capabilities from a binary: running rule-based