Security & Testing Agent Skills

Uses the Linux Audit framework (auditd) with ausearch and aureport utilities

Analyzes malicious Linux ELF (Executable and Linkable Format) binaries

Detect kernel-level rootkits in Linux memory dumps using Volatility3

Examine Linux system artifacts including auth logs, cron jobs, shell

Analyze Windows LNK shortcut files and Jump List artifacts to establish

Analyzes malicious VBA macros embedded in Microsoft Office documents

Perform static analysis of malicious PDF documents using peepdf, pdfid,

URLScan.io is a free service for scanning and analyzing suspicious URLs.

Executes malware samples in Cuckoo Sandbox to observe runtime behavior

Use the Malpedia platform and API to research malware family relationships,

Use Sysinternals Autoruns to systematically identify and analyze malware

Detect sandbox evasion techniques in malware samples by analyzing timing

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,

Performs Linux memory acquisition using LiME (Linux Memory Extractor)

Analyze the NTFS Master File Table ($MFT) to recover metadata and content

Detect and analyze covert communication channels used by malware including

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

Craft, send, sniff, and dissect network packets using Scapy for protocol

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

Analyzes network traffic generated by malware during sandbox execution

Captures and analyzes network packet data using Wireshark and tshark