Extracts indicators of compromise from raw analysis artifacts: parsing strings dumps, sandbox reports, PCAP summaries, and logs for URLs, domains, IPs, hashes, mutexes, and file paths, then deduplicating and typing them. Activates for requests to extract IOCs from analysis output, pull indicators from a report, or harvest atomic indicators.
The English summary is being prepared. Showing the original description.
Establishes safe practices for acquiring, storing, transferring, and disposing of malware samples: password-protected archives, neutralized extensions, hashing for identity, and chain-of-custody. Activates for requests about safely storing or sharing malware, sample handling hygiene, or defanging artifacts.
The English summary is being prepared. Showing the original description.
Uses capa to identify malware capabilities from a binary: running rule-based detection over disassembly, mapping matched capabilities to MITRE ATT&CK and MBC, and interpreting results to focus deeper analysis. Activates for requests to run capa, generate a capability report, or map a sample's behaviors to ATT&CK automatically.
The English summary is being prepared. Showing the original description.
Computes cryptographic and fuzzy fingerprints for malware samples: MD5/SHA-1/SHA-256 for exact identity, plus import hashing (imphash), section hashing, and fuzzy hashes (ssdeep, TLSH) to cluster related variants. Activates for requests to hash a sample, compute imphash, or fingerprint files for similarity clustering.
The English summary is being prepared. Showing the original description.
Hunts for Active Directory credential and replication attacks — DCSync, Golden/Silver Ticket, and DCShadow — by analyzing directory-service-access (4662), Kerberos TGS (4769), and logon (4624) events for replication abuse and forged-ticket anomalies. Activates for requests to hunt DCSync, detect golden/silver tickets, or find Active Directory replication abuse.
The English summary is being prepared. Showing the original description.
Hunts for anomalous authentication such as password spraying, brute force, and impossible-travel logons by aggregating Windows logon success/failure events per account and source over time. Activates for requests to hunt anomalous logons, detect password spraying or brute force, or find suspicious authentication patterns.
The English summary is being prepared. Showing the original description.
Detects command-and-control beacons in network logs by analyzing connection timing: measuring inter-arrival intervals, accounting for jitter, and scoring regularity per source/destination pair to surface periodic callbacks. Activates for requests to hunt C2 beaconing, find periodic callbacks, or analyze connection-interval regularity.
The English summary is being prepared. Showing the original description.
Hunts for pre-exfiltration data staging and archiving by detecting archive-tool execution (rar, 7z, zip, tar), large compressed files written to staging directories, and collection into a single location before transfer. Activates for requests to hunt data staging, detect pre-exfil archiving, or find collection and compression before exfiltration.
The English summary is being prepared. Showing the original description.
Detects DNS-based tunneling and data exfiltration in DNS logs: scoring high query volume to single domains, long/high-entropy subdomains, unusual record types, and encoded payload labels. Activates for requests to hunt DNS tunneling, detect DNS exfiltration, or analyze suspicious DNS query patterns.
The English summary is being prepared. Showing the original description.
Operationalizes a threat intelligence report into hunts: extracting IOCs and TTPs, mapping behaviors to ATT&CK and available telemetry, prioritizing durable behavioral indicators over volatile atomic ones, and producing concrete hunt queries. Activates for requests to hunt from a threat report, operationalize CTI, or turn an intel report into detections.
The English summary is being prepared. Showing the original description.
Hunts for Kerberoasting and related ticket attacks by analyzing Kerberos service ticket request events (4769) for weak encryption types, abnormal request volume per account, and non-machine accounts requesting many SPNs. Activates for requests to hunt Kerberoasting, detect RC4 ticket requests, or find SPN-targeting credential attacks.
The English summary is being prepared. Showing the original description.
Hunts for living-off-the-land binary (LOLBin) abuse in Windows process-creation telemetry by flagging trusted system binaries used with download, execution-proxy, or encoded-command arguments. Activates for requests to hunt LOLBins, detect signed-binary proxy execution, or find suspicious certutil/mshta/regsvr32 usage.
The English summary is being prepared. Showing the original description.
Hunts for Windows persistence across autostart locations: Run keys, services, scheduled tasks, WMI event subscriptions, and startup folders, baselining them to surface anomalous or recently added entries. Activates for requests to hunt persistence, audit autostart extensibility points, or find malware autoruns on Windows.
The English summary is being prepared. Showing the original description.
Hunts for process injection using Sysmon telemetry: correlating CreateRemoteThread (EID 8), suspicious cross-process access (EID 10), and RWX image-less memory to surface hollowing, shellcode injection, and APC abuse. Activates for requests to hunt process injection, analyze Sysmon EID 8/10, or detect code injection on Windows.
The English summary is being prepared. Showing the original description.
Hunts for ransomware precursor behavior that precedes encryption — shadow-copy and backup deletion, recovery disabling, security-tool tampering, and mass file modification — so the attack can be stopped before payload detonation. Activates for requests to hunt ransomware precursors, detect shadow-copy deletion, or find pre-encryption recovery sabotage.
The English summary is being prepared. Showing the original description.
Hunts for malicious scheduled task persistence by analyzing task registration events (4698) and schtasks process creation for suspicious actions, triggers, and hidden tasks. Activates for requests to hunt scheduled task abuse, detect malicious schtasks usage, or find persistence via the Task Scheduler.
The English summary is being prepared. Showing the original description.
Hunts malicious PowerShell using script-block (EID 4104) and module logging: scoring encoded commands, download cradles, AMSI/logging bypass, and in-memory execution, then decoding payloads for triage. Activates for requests to hunt malicious PowerShell, analyze script-block logs, or detect encoded command abuse.
The English summary is being prepared. Showing the original description.
Hunts for unusual outbound network connections by flagging direct-to-IP traffic, uncommon ports, rare destinations, high data-egress ratios, and connections from unexpected processes in network telemetry. Activates for requests to hunt unusual outbound traffic, detect suspicious egress, or find anomalous external connections.
The English summary is being prepared. Showing the original description.
Hunts for malicious WMI permanent event subscription persistence by correlating __EventFilter, CommandLineEventConsumer/ActiveScriptEventConsumer, and FilterToConsumerBinding records from Sysmon Event IDs 19/20/21 or WMI repository exports. Activates for requests to hunt WMI persistence, detect event consumer backdoors, or analyze WMI subscription telemetry.
The English summary is being prepared. Showing the original description.
Identifies and bypasses anti-debugging and anti-analysis checks in malware: PEB flags, debugger-detection APIs, timing checks, and exception tricks, then neutralizes them to continue analysis. Activates for requests to identify anti-debugging, bypass anti-debug checks, or analyze evasion that blocks a debugger.
The English summary is being prepared. Showing the original description.
Identifies cryptographic algorithms embedded in a binary by scanning for well-known constants and tables (AES S-box, SHA-256/MD5 init constants, ChaCha sigma, CRC32 table, base64 alphabet). Activates for requests to identify crypto in a binary, find AES/SHA constants, or detect which encryption algorithm a sample uses.
The English summary is being prepared. Showing the original description.
Detects sandbox and analysis evasion techniques in a sample by scanning static strings, imports, and API traces for VM artifact checks, timing/sleep stalls, anti-debug calls, and environment fingerprinting. Activates for requests to detect sandbox evasion, find anti-VM or anti-debug checks, or explain why a sample did not detonate.
The English summary is being prepared. Showing the original description.
Analyzes API call traces from a sandbox or API monitor (JSON) to group calls by category, reconstruct high-level behaviors (process injection, file drops, network, crypto), and flag suspicious call sequences. Activates for requests to analyze an API trace, interpret sandbox API logs, or identify behavior from Win32/Native API calls.
The English summary is being prepared. Showing the original description.
Analyzes Windows Authenticode signatures on PE files: checking for a signature, reading the signer certificate chain, detecting revoked/expired/stolen certs, and recognizing signature-stripping and catalog-signing abuse. Activates for requests to analyze a code signature, verify Authenticode, or assess signer trust on a PE.
The English summary is being prepared. Showing the original description.
Is this your account? Link GitHub to bring it onto your creator page (Japanese)