9 skills · sorted by relevance
Investigate Windows malware that runs in memory or abuses legitimate system tools. Use logs, registry entries, and memory dumps to trace persistence, identify suspicious activity, and produce detection rules and an analysis report.
对 msMemScope 显存数据做全链路处理：根据用户的显存问题诉求（OOM、显存泄漏、显存占比拆解、Step 间对比等），指导并帮助用户以最合适的 msMemScope 采集配置完成显存数据采集（支持命令行、Python 接口、mstx 打点三种采集方式，覆盖训练、推理 vLLM-Ascend、FSDP、强化学习 verl 等场景）；对已采集的 memscope_dump_*.csv/db 数据做系统性解读与问题诊断（整体显存曲线趋势分析、显存使用大头按模块/组件拆解分析、显存峰值点各模块与流程占比分析，以及对显存泄漏、OOM 等典型问题的根因定位与原因分析）。
The English summary is being prepared. Showing the original description.
Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.
The English summary is being prepared. Showing the original description.
Expert en forensique numérique (disk imaging, memory analysis, network forensics, chain of custody)
The English summary is being prepared. Showing the original description.
Digital forensics v3 — disk imaging, memory analysis, network forensics, chain of custody, legal
The English summary is being prepared. Showing the original description.
Expert en forensique numérique avancée (disk imaging, memory analysis, network forensics, reporting, chain of custody, incident response)
The English summary is being prepared. Showing the original description.
Windows/Linux memory dump, hiberfil.sys analizi — volatility3 ile process, credential, env var çıkarma, DPAPI master key kurtarma ve pypykatz entegrasyonu.
The English summary is being prepared. Showing the original description.
Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.
The English summary is being prepared. Showing the original description.
Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.
The English summary is being prepared. Showing the original description.