Security & Testing Agent Skills

Create forensically sound bit-for-bit disk images using dd and dcfldd

Detect dangerous ACL misconfigurations in Active Directory using ldap3

Perform static analysis of Android APK malware samples using apktool

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect

Analyze advanced persistent threat (APT) group techniques using MITRE

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

Analyzes bootkit and advanced rootkit malware that infects the Master

Analyze Chromium-based browser artifacts using Hindsight to extract browsing

Campaign attribution analysis involves systematically evaluating evidence

Monitor Certificate Transparency logs using crt.sh and Certstream to

Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage

Extract and analyze Cobalt Strike beacon configuration from PE files

Analyzes malware command-and-control (C2) communication protocols to

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

Investigate compromised Docker containers by analyzing images, layers,

Parse and analyze email headers to trace the origin of phishing emails,

Perform static and symbolic analysis of Solidity smart contracts using

Reverse engineer Go-compiled malware using Ghidra with specialized scripts

Analyzes indicators of compromise (IOCs) including IP addresses, domains,

Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and…

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod,