その他のスキル

Identifies and unpacks packed binaries: detecting packers from section names and entropy, automatically unpacking UPX, and manually unpacking custom packers by finding the OEP and dumping. Activates for requests to unpack a packed sample, detect a packer, or recover the original binary from UPX or a custom packer.

日本語の概要は準備中です。原文の説明を表示しています。

Converts hunt findings into portable Sigma detection rules: choosing the right logsource, expressing robust selection/filter logic, setting level and ATT&CK tags, and validating before converting to a SIEM query. Activates for requests to write a Sigma rule, convert a hunt to a detection, or create portable SIEM detection logic.

日本語の概要は準備中です。原文の説明を表示しています。

Writes and validates Suricata/Snort IDS rules for network-based malware detection, covering rule anatomy, content/pcre matching, flow and threshold options, and common mistakes that cause false positives or no matches. Activates for requests to write a Suricata rule, create Snort signatures, or build network detection rules from IOCs or C2 patterns.

日本語の概要は準備中です。原文の説明を表示しています。

Builds a safe, isolated environment for detonating and analyzing malware using virtualization, host-only or simulated networking, and snapshotting. Activates for requests about creating a malware lab, sandbox VM, isolated analysis environment, or safe detonation setup.

日本語の概要は準備中です。原文の説明を表示しています。

Uses YARA to classify and triage samples at scale: applying rule sets, reading matches and string offsets, tuning for false positives, and organizing rules for malware family identification. Activates for requests to scan files with YARA, apply YARA rules, or classify samples by signature.

日本語の概要は準備中です。原文の説明を表示しています。

Structures a clear, actionable malware analysis report covering summary, sample identity, capabilities, IOCs, ATT&CK mapping, and detection guidance for both technical and decision-making audiences. Activates for requests to write, structure, or review a malware analysis or reverse-engineering report.

日本語の概要は準備中です。原文の説明を表示しています。

Automates batch reverse engineering by generating Ghidra analyzeHeadless commands and post-analysis script skeletons to import, auto-analyze, and export results for many samples without the GUI. Activates for requests to script Ghidra headless analysis, batch-analyze samples with Ghidra, or generate an analyzeHeadless command and post-script.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for domain fronting and CDN abuse by detecting TLS SNI versus HTTP Host header mismatches and high-reputation CDN domains carrying anomalous traffic in network telemetry. Activates for requests to hunt domain fronting, detect SNI/Host mismatch, or find CDN abuse used to mask C2.

日本語の概要は準備中です。原文の説明を表示しています。

Maps hunts and detections to MITRE ATT&CK for coverage analysis: tagging hypotheses with techniques, building a coverage matrix from completed hunts, and identifying high-risk gaps to prioritize next. Activates for requests to map hunts to ATT&CK, build a coverage heatmap, or find detection gaps by technique.

日本語の概要は準備中です。原文の説明を表示しています。

Uses capa to identify malware capabilities from a binary: running rule-based detection over disassembly, mapping matched capabilities to MITRE ATT&CK and MBC, and interpreting results to focus deeper analysis. Activates for requests to run capa, generate a capability report, or map a sample's behaviors to ATT&CK automatically.

日本語の概要は準備中です。原文の説明を表示しています。

Identifies a sample's true file type independent of its extension: matching magic bytes and structural signatures, detecting container/archive formats, and flagging extension-content mismatches used to disguise malware. Activates for requests to identify a file type, check magic bytes, or detect a disguised/spoofed extension.

日本語の概要は準備中です。原文の説明を表示しています。

Profiles a threat actor by aggregating observed ATT&CK techniques into a TTP profile and comparing it against known-group technique sets to estimate similarity and candidate attribution. Activates for requests to profile a threat actor, compare observed TTPs to known groups, or estimate attribution from technique overlap.

日本語の概要は準備中です。原文の説明を表示しています。

Computes cryptographic and fuzzy fingerprints for malware samples: MD5/SHA-1/SHA-256 for exact identity, plus import hashing (imphash), section hashing, and fuzzy hashes (ssdeep, TLSH) to cluster related variants. Activates for requests to hash a sample, compute imphash, or fingerprint files for similarity clustering.

日本語の概要は準備中です。原文の説明を表示しています。

Identifies cryptographic algorithms embedded in a binary by scanning for well-known constants and tables (AES S-box, SHA-256/MD5 init constants, ChaCha sigma, CRC32 table, base64 alphabet). Activates for requests to identify crypto in a binary, find AES/SHA constants, or detect which encryption algorithm a sample uses.

日本語の概要は準備中です。原文の説明を表示しています。

Extracts indicators of compromise from raw analysis artifacts: parsing strings dumps, sandbox reports, PCAP summaries, and logs for URLs, domains, IPs, hashes, mutexes, and file paths, then deduplicating and typing them. Activates for requests to extract IOCs from analysis output, pull indicators from a report, or harvest atomic indicators.

日本語の概要は準備中です。原文の説明を表示しています。

Extracts structure and indicators from a Windows PE file without executing it: headers, sections, imports/exports, resources, entropy, and embedded strings to infer capability and packing. Activates for requests to statically analyze a PE, EXE, or DLL, or inspect imports and headers.

日本語の概要は準備中です。原文の説明を表示しています。

Runs a sample in an instrumented sandbox to observe behavior: process tree, file and registry changes, network activity, and persistence, then summarizes the behavioral report into capabilities and IOCs. Activates for requests to detonate a sample, do dynamic or behavioral analysis, or interpret sandbox output.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for Cobalt Strike beacon traffic by detecting default stager URI checksum8 values, default Malleable C2 profile artifacts, and default ports/named pipes in HTTP and process telemetry. Activates for requests to hunt Cobalt Strike, detect beacon stager URIs, or find default Malleable C2 indicators.

日本語の概要は準備中です。原文の説明を表示しています。

Detects packing and encryption by measuring Shannon entropy across a binary's sections and regions: flagging high-entropy executable sections, entropy spikes, and size/raw-vs-virtual anomalies that indicate compression or encryption. Activates for requests to measure entropy, detect packing, or assess whether a sample is compressed/encrypted.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for credential dumping by detecting LSASS process access with suspicious access masks, known dumping tool signatures, and comsvcs.exe MiniDump abuse in Sysmon Event ID 10 and process-creation telemetry. Activates for requests to hunt credential dumping, detect LSASS access, or find Mimikatz/comsvcs MiniDump activity.

日本語の概要は準備中です。原文の説明を表示しています。

Operationalizes a threat intelligence report into hunts: extracting IOCs and TTPs, mapping behaviors to ATT&CK and available telemetry, prioritizing durable behavioral indicators over volatile atomic ones, and producing concrete hunt queries. Activates for requests to hunt from a threat report, operationalize CTI, or turn an intel report into detections.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for malicious WMI permanent event subscription persistence by correlating __EventFilter, CommandLineEventConsumer/ActiveScriptEventConsumer, and FilterToConsumerBinding records from Sysmon Event IDs 19/20/21 or WMI repository exports. Activates for requests to hunt WMI persistence, detect event consumer backdoors, or analyze WMI subscription telemetry.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for Kerberoasting and related ticket attacks by analyzing Kerberos service ticket request events (4769) for weak encryption types, abnormal request volume per account, and non-machine accounts requesting many SPNs. Activates for requests to hunt Kerberoasting, detect RC4 ticket requests, or find SPN-targeting credential attacks.

日本語の概要は準備中です。原文の説明を表示しています。

Manually unpacks a runtime-packed Windows binary by finding the original entry point (OEP) through tail-jump and entropy analysis, then guiding a memory dump at OEP. Activates for requests to manually unpack a sample, find the OEP, or unpack a custom/unknown packer that generic tools cannot handle.

日本語の概要は準備中です。原文の説明を表示しています。