Security & Testing Agent Skills for Microsoft Copilot

Detect sandbox evasion techniques in malware samples by analyzing timing

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,

Detect and analyze covert communication channels used by malware including

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

Craft, send, sniff, and dissect network packets using Scapy for protocol

Captures and analyzes network packet data using Wireshark and tshark

Analyze Microsoft Outlook PST and OST files for email forensic evidence

Identifies and unpacks UPX-packed and other packed malware samples to

Detect and analyze Linux persistence mechanisms including crontab entries,

Detect PowerShell Empire framework artifacts in Windows event logs by

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX

Analyzes encryption algorithms, key management, and file encryption

Identify ransomware network indicators including C2 beaconing patterns,

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON

Leverages Splunk Enterprise Security and SPL (Search Processing Language)

Analyzes structured and unstructured threat intelligence feeds to extract

Investigate USB device connection history from Windows registry, event

Parses and analyzes the Windows Amcache.hve registry hive to extract

Parse Windows LNK shortcut files to extract target paths, timestamps,

Parse Windows Prefetch files using the windowsprefetch Python library

Extract and analyze Windows Registry hives to uncover user activity,