Security & Testing Agent Skills for Grok Build

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

Campaign attribution analysis involves systematically evaluating evidence

Monitor Certificate Transparency logs using crt.sh and Certstream to

Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

Investigate compromised Docker containers by analyzing images, layers,

Parse and analyze email headers to trace the origin of phishing emails,

Perform static and symbolic analysis of Solidity smart contracts using

Reverse engineer Go-compiled malware using Ghidra with specialized scripts

Detect and analyze heap spray attacks in memory dumps using Volatility3

Analyzes indicators of compromise (IOCs) including IP addresses, domains,

Uses the Linux Audit framework (auditd) with ausearch and aureport utilities

Examine Linux system artifacts including auth logs, cron jobs, shell

Perform static analysis of malicious PDF documents using peepdf, pdfid,

URLScan.io is a free service for scanning and analyzing suspicious URLs.

Executes malware samples in Cuckoo Sandbox to observe runtime behavior

Detect sandbox evasion techniques in malware samples by analyzing timing

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,

Detect and analyze covert communication channels used by malware including

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

Craft, send, sniff, and dissect network packets using Scapy for protocol