89 skills · sorted by relevance
Review Cuckoo or AnyRun behavior reports for signs that malware is avoiding an analysis environment. Identify timing checks, virtual machine detection, and user activity checks, then produce a JSON report with evidence, technique mappings, and an evasion sophistication score.
Examine Windows endpoint logs for attempts to avoid security detection, including log clearing, altered file timestamps, injected code, and disabled protection. Correlate events to investigate suspicious behavior and develop detection rules with context for legitimate activity.
GitHub 解封 — 账号封禁/限制/恢复的领域操作系统。覆盖：(a) GitHub 官方政策体系 (TOS / 可接受使用政策 / Trust & Safety 执行模式 / 公开申诉路径 / 受制裁地区解读)；(b) 封号原因诊断学 (spam / abuse / 制裁误标 / 2FA 丢失 / ToS 违规 / 账号劫持误判 / ban evasion 等子类型 + 症状→原因映射 + 自我分诊压测)；(c) 申诉实操 craft (写一封能让 T&S 快速判误伤的英文申诉信 + 升级阶梯 + 法务介入边界 + Don'ts)；(d) 制裁与合规硬边界 (OFAC SDN 名单 / 哪些国家或地区真不可达 / VPN 误判路径 / 中国大陆不是美国制裁地区的反复重申)；(e) 中国大陆开发者特别处境 (sanctioned region 误标 + SMS 验证不支持 +86/+852 + Gitee/GitLab/Codeberg/JihuLab 备用迁移 + 私有自托管 Gitea/Forgejo)；(f) 真实案例库 (~30+ 公开案例分类拆解：误伤 / 真违规 / 制裁误标三类各自赔率与申诉成功路径)。伦理锚绝不软化：不教 ban evasion / 不教撒谎式申诉 / 真违规承认改进 / 丢 2FA 无恢复因子则诚实告知 / 中国制裁误标靠申诉不靠换 VPN / 申诉 6 个月窗口必算清 / 约 3% (业内估) 真违规恢复 vs 约 79% (业内估) 误伤申诉成功率分层标。 (GitHub Account Reinstatement — the domain operating system for GitHub (and analogous platform) account suspension, restriction, appeal, and recovery. Covers: (a) GitHub official policy architecture (TOS / Acceptable Use Policies / Trust & Safety enforcement patterns / public appeals pathways / sanctioned-region interpretation); (b) suspension-cause diagnostics (spam / abuse / sanctions mis-flag / 2FA loss / ToS violation / account hijack false-positive / ban evasion taxonomy + symptom→cause mapping + self-triage pressure test); (c) appeal craft (writing an English appeal letter that gets T&S to fast-track a false-positive ruling + escalation ladder + legal-engagement boundary + Don'ts); (d) sanctions and compliance hard boundaries (OFAC SDN list / which countries/regions are truly unreachable / VPN false-positive paths / China is NOT a US-sanctioned region — repeated emphasis); (e) mainland China developer special circumstances (sanctioned-region mis-flag + SMS verification does not support +86/+852 + Gitee/GitLab/Codeberg/JihuLab fallback migration + self-hosted Gitea/Forgejo); (f) real-case library (~30+ public cases with categorized analysis: false-positive / genuine violation / sanctions mis-flag, each with win-rate and appeal success path). Ethical anchors absolutely not softened: do NOT teach ban evasion (creating new accounts turns a temp ban into a permanent one — the single biggest mistake); do NOT teach social engineering or lying in appeals (misuse + actually confirms violation); genuine violations: admit + improve beats denial; lost 2FA + no recovery factor → do not pretend recovery is possible; China sanctioned-region mis-flag → fix via appeal, not repeated VPN switching; appeal form 6-month window must be counted carefully; historical 约 3% (业内估) genuine-violation recovery vs 约 79% (业内估) false-positive appeal success rate stratification must be honestly labeled. Anti-samples (explicitly describe harm, never endorse): developer permabanned for ban evasion / open-source team org-banned for personal attacks in public issues / cases where repeated VPN switching escalated risk-control severity.) Master OS — automated mastery of GitHub Account Reinstatement — the domain operating system for GitHub (and analogous platform) account suspension, restriction, appeal, and recovery. Covers: (a) GitHub official policy architecture (TOS / Acceptable Use Policies / Trust & Safety enforcement patterns / public appeals pathways / sanctioned-region interpretation); (b) suspension-cause diagnostics (spam / abuse / sanctions mis-flag / 2FA loss / ToS violation / account hijack false-positive / ban evasion taxonomy + symptom→cause mapping + self-triage pressure test); (c) appeal craft (writing an English appeal letter that gets T&S to fast-track a false-positive ruling + escalation ladder + legal-engagement boundary + Don'ts); (d) sanctions and compliance hard boundaries (OFAC SDN list / which countries/regions are truly unreachable / VPN false-positive paths / China is NOT a US-sanctioned region — repeated emphasis); (e) mainland China developer special circumstances (sanctioned-region mis-flag + SMS verification does not support +86/+852 + Gitee/GitLab/Codeberg/JihuLab fallback migration + self-hosted Gitea/Forgejo); (f) real-case library (~30+ public cases with categorized analysis: fa
The English summary is being prepared. Showing the original description.
Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.
The English summary is being prepared. Showing the original description.
Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.
The English summary is being prepared. Showing the original description.
Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.
The English summary is being prepared. Showing the original description.
Domain routing and boundary guidance for authorized defense evasion and bypass testing, including WAF bypass, AV/EDR evasion, logging considerations, and traffic obfuscation. Use when a task belongs to the evasion domain and needs scope, evidence, pivot, or exit criteria.
The English summary is being prepared. Showing the original description.
Detects sandbox and analysis evasion techniques in a sample by scanning static strings, imports, and API traces for VM artifact checks, timing/sleep stalls, anti-debug calls, and environment fingerprinting. Activates for requests to detect sandbox evasion, find anti-VM or anti-debug checks, or explain why a sample did not detonate.
The English summary is being prepared. Showing the original description.
EDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques.
The English summary is being prepared. Showing the original description.
Execute advanced evasion by injecting malicious code into the memory space of a legitimate, suspended process (Process Hollowing). This skill details techniques to bypass static and dynamic analysis by masking malicious activity behind trusted processes like svchost.exe or explorer.exe.
The English summary is being prepared. Showing the original description.
Bypass antivirus and Endpoint Detection & Response solutions during red team operations using payload obfuscation, process injection, AMSI bypass, ETW patching, and custom loaders. Use this skill when AV/EDR is blocking your payloads, tooling, or post-exploitation activities. Covers shellcode encryption, syscall-based injection, unhooking techniques, and living-off-the-land approaches for opsec-safe red team operations.
The English summary is being prepared. Showing the original description.
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports
The English summary is being prepared. Showing the original description.
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports
The English summary is being prepared. Showing the original description.
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports
The English summary is being prepared. Showing the original description.
Analyze Sysmon logs to investigate process injection, where malicious code hides inside legitimate processes. Correlate remote thread creation, cross-process access, and unusual DLL loading, then organize findings by injection type, risk level, and ATT&CK technique.
Review how evidence can be altered during authorized security exercises on Windows and Linux. Covers logs, timestamps, memory, disk records, and network traces, alongside the signs defenders use to detect manipulation.
AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signature-based detection on Windows endpoints.
The English summary is being prepared. Showing the original description.
Use when bypassing EDR/AV to run a payload — hook unhooking, direct/indirect syscalls, PPID spoofing, process injection, AMSI bypass, ETW patching, memory/sleep encryption, behavioral evasion
The English summary is being prepared. Showing the original description.
红队渗透 / 攻防 — 受授权的红队作业者 + 渗透测试工程师 + 攻击型安全顾问的认知操作系统 (侦察 OSINT / 外网渗透 / 内网 AD 渗透 BloodHound + Kerberoasting + ADCS 利用 + 横向移动 / Web 应用渗透 OWASP WSTG / 移动 OWASP MASTG / 云渗透 AWS Azure GCP IAM 路径 + 容器逃逸 + K8s / C2 操作 Cobalt Strike Sliver Mythic Havoc + OPSEC / 初始访问 + AV EDR 绕过 (仅授权场景) / 无线 RF / 物理社工 / 报告与整改 / 框架 MITRE ATT&CK + D3FEND + PTES + OSSTMM + NIST 800-115 + Kill Chain / 法律伦理 CFAA + 网络安全法 + 刑法 285 286 + 数据安全法 + GDPR + 授权书 + 范围 + 交战规则 — 不含 黑产 / 未授权攻击 / 大规模 exploitation / 供应链投毒 / 未授权 DoS — 这是 重罪 + 行业封杀 + 律师吊销, 本 skill 严守 authorized-only 边界 — 也不含 蓝队 SOC + 恶意软件 即服务 / 僵尸网络 / 勒索软件作者 — 这是 cybercrime 不是 红队) (Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasion (phishing infrastructure, payload development, AV / EDR evasion, BYOVD, AMSI / ETW bypass — strictly for authorized engagements), (i) wireless / RF (WPA2/3, evil twin, Wi-Fi pivots), (j) physical / social engineering (badge cloning, pretexting, vishing — under engagement letter), (k) reporting & remediation (executive summary, technical findings, CVSS, MITRE ATT&CK mapping, retest), (l) frameworks & methodology (MITRE ATT&CK, MITRE D3FEND, PTES, OSSTMM, NIST SP 800-115, OWASP WSTG / MASTG, Cyber Kill Chain, Unified Kill Chain, Diamond Model), (m) law & ethics (CFAA US, Computer Misuse Act UK, 中国 刑法 285/286 + 网络安全法 + 数据安全法, GDPR for tested EU systems, engagement letter, scope, rules of engagement, safe harbor for bug bounty); NOT criminal hacking / 黑产 / unauthorized targeting / mass exploitation / supply-chain compromise / DoS against unconsented systems (这是 重罪 + 业内开除 + 律师执照吊销, 本 skill 严守 authorized-only 边界), NOT pure defensive blue team / SOC analyst tradecraft (是 平行学科, 仅做 边界标注 + ATT&CK 反推方向), NOT malware-as-a-service development / botnet ops / ransomware authoring (是 cybercrime 不是 红队), NOT 'ethical hacking' 在 'just curious 看看' 自我合理化的灰色操作 (违反 authorization 原则即不是 红队).) Master OS — automated mastery of Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasi
The English summary is being prepared. Showing the original description.
Create and implement Malleable C2 profiles in Cobalt Strike to evade network intrusion detection systems (NIDS/IPS) and endpoint detection architectures. This skill focuses on molding the Beacon's HTTP/HTTPS traffic to resemble legitimate network traffic like Amazon, Google, or jQuery.
The English summary is being prepared. Showing the original description.
Operate Cobalt Strike for red team engagements including Beacon deployment, C2 communication, post-exploitation, lateral movement, and evasion. Use this skill when conducting authorized red team operations that require a commercial C2 framework. Covers malleable C2 profiles, staged/stageless payloads, sleep and jitter configuration, SOCKS proxying, and advanced BOF (Beacon Object Files) usage for opsec-safe operations.
The English summary is being prepared. Showing the original description.
Bypass the Windows Antimalware Scan Interface (AMSI) using memory patching, reflection, and obfuscation techniques. Execute undetected PowerShell, VBScript, JScript, and .NET assemblies in-memory without triggering Microsoft Defender or third-party AV/EDR solutions. Use this skill during Red Team engagements when loading offensive tools (Mimikatz, Rubeus, SharpHound) in memory on defended Windows endpoints.
The English summary is being prepared. Showing the original description.
Identifies and bypasses anti-debugging and anti-analysis checks in malware: PEB flags, debugger-detection APIs, timing checks, and exception tricks, then neutralizes them to continue analysis. Activates for requests to identify anti-debugging, bypass anti-debug checks, or analyze evasion that blocks a debugger.
The English summary is being prepared. Showing the original description.
Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.
The English summary is being prepared. Showing the original description.