Security & Testing Agent Skills for Grok Build

Extract and analyze Cobalt Strike beacon configuration from PE files

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

Perform static and symbolic analysis of Solidity smart contracts using

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo

Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and…

Detect kernel-level rootkits in Linux memory dumps using Volatility3

Examine Linux system artifacts (auth logs, cron/systemd persistence,

Analyze Windows LNK shortcut files and Jump List artifacts with LECmd,

Analyzes malicious VBA macros embedded in Microsoft Office documents

Perform static analysis of malicious PDF documents using peepdf, pdfid,

Use Sysinternals Autoruns to systematically enumerate and analyze malware

Detect sandbox and VM evasion techniques in malware samples by analyzing

Performs Linux memory acquisition using LiME (Linux Memory Extractor)

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous…

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications…

Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group…

Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and…

Analyzes structured and unstructured threat intelligence feeds to extract