Agent skills

Analyze advanced persistent threat (APT) group techniques using MITRE

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

Analyzes bootkit and advanced rootkit malware that infects the Master

Analyze Chromium-based browser artifacts using Hindsight to extract browsing

Campaign attribution analysis involves systematically evaluating evidence

Monitor Certificate Transparency logs using crt.sh and Certstream to

Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

Perform comprehensive forensic analysis of disk images using Autopsy

Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

Parse and analyze email headers to trace the origin of phishing emails,

Perform static and symbolic analysis of Solidity smart contracts using

Reverse engineer Go-compiled malware using Ghidra with specialized scripts

Detect and analyze heap spray attacks in memory dumps using Volatility3

Perform static analysis of malicious PDF documents using peepdf, pdfid,

Performs Linux memory acquisition using LiME (Linux Memory Extractor)

Detect and analyze covert communication channels used by malware including

Analyze Microsoft Outlook PST and OST files for email forensic evidence

Parse Windows Prefetch files to determine program execution history including

Traces ransomware cryptocurrency payment flows using blockchain analysis

Examine file system slack space, MFT entries, USN journal, and alternate