Security & Testing Agent Skills

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect

Analyze Microsoft Outlook PST and OST files for email forensic evidence

Identifies and unpacks UPX-packed and other packed malware samples to

Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to

Detect and analyze Linux persistence mechanisms including crontab entries,

Detect PowerShell Empire framework artifacts in Windows event logs by

Analyzes encryption algorithms, key management, and file encryption

Identify ransomware network indicators including C2 beaconing patterns,

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON

Leverages Splunk Enterprise Security and SPL (Search Processing Language)

Analyzes structured and unstructured threat intelligence feeds to extract

Parses and analyzes the Windows Amcache.hve registry hive to extract

Parse Windows LNK shortcut files to extract target paths, timestamps,

Auditing Microsoft Entra ID (Azure Active Directory) configuration to

Auditing Google Cloud Platform IAM permissions to identify overly permissive

Auditing Kubernetes cluster RBAC configurations to identify overly permissive

Auditing Terraform infrastructure-as-code for security misconfigurations

Automates the enrichment of raw indicators of compromise with multi-source

Build an automated system to track adversary infrastructure using passive

Extract and catalog attack patterns from cyber threat intelligence reports

Builds an automated malware submission and analysis pipeline that collects