43건 · 관련도순
Debug and emulate specific code fragments or functions using the Unicorn engine. Activate when the user wants to emulate a function with Unicorn, trace binary execution without running the full program, decrypt or decode data by emulating the algorithm, or bypass environment dependencies (JNI, syscalls, libc) during emulation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Syzkaller syzlang syntax basics for describing ioctl syscalls
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Full build workflow for adding new syscall descriptions to syzkaller
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use eBPF for deep kernel-level observability — trace syscalls, network flows, and application behavior without code changes using Cilium, Tetragon, and bpftrace.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when bypassing EDR/AV to run a payload — hook unhooking, direct/indirect syscalls, PPID spoofing, process injection, AMSI bypass, ETW patching, memory/sleep encryption, behavioral evasion
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Generate and interpret security-research diffs between Windows versions or patch levels using this repo's WinDiff CLI and databases. Use when comparing Windows builds or binaries such as ntoskrnl.exe, ntdll.dll, win32k*.sys, ci.dll, or cng.sys to find changed syscalls, symbols, types, mitigation flags, callbacks, ETW/EtwTi telemetry, code-integrity behavior, drivers, or attack surface. Explain likely intent and security relevance with Windows-internals knowledge, and frame findings for anti-malware/EDR, anti-cheat, and vulnerability-research audiences rather than returning an uninterpreted symbol list.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Think and work like an expert Embedded Systems Engineer. Use when a task calls for Embedded Systems Engineer judgment. Reasons from hardware timing, interrupt latency, memory maps, and deterministic WCET resource bounds through DWT CYCCNT and Saleae logic-analyzer timing proofs, SWD/JTAG (J-Link/OpenOCD) with CFSR/HFSR/BFAR fault decode, FreeRTOS/Zephyr respecting configMAX_SYSCALL_INTERRUPT_PRIORITY, MISRA C:2012 and ISO 26262 ASIL discipline, Nordic PPK2 power profiling, and MCUboot signed OTA while treating priority inversion, Cortex-M7 uncached-DMA D-cache incoherence, CAN bus-off, I2C NACK storms, and brownout-during-flash-write NVS corruption as first-class failure modes.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for kernel attack surface, namespace and cgroup boundaries, container isolation assumptions, syscall paths, and escape primitive verification. Use when the user asks to analyze container-to-host escape paths, kernel exploit prerequisites, namespace crossover, capability misuse, or prove whether an exploit primitive crosses the sandbox boundary. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when writing KUnit tests, adding kselftest cases, fuzzing syscalls with syzkaller and kcov, running LTP, or wiring CI for a kernel patch.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Bypass antivirus and Endpoint Detection & Response solutions during red team operations using payload obfuscation, process injection, AMSI bypass, ETW patching, and custom loaders. Use this skill when AV/EDR is blocking your payloads, tooling, or post-exploitation activities. Covers shellcode encryption, syscall-based injection, unhooking techniques, and living-off-the-land approaches for opsec-safe red team operations.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Review Yuzu C++ source changes for resource ownership, RAII, borrowed lifetimes, C ABI contexts, casts, process/syscall boundaries, callbacks, threads, and sanitizer coverage. Use for any governance Gate 3 review when C++ files change, paired with cpp-expert.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Uses Falco YAML rules for runtime threat Tespit in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use building yaparken container runtime security or investigating k8s cluster compromises.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
tespit etmeand prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
EDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and structured reporting with purple team debrief workflows. Covers assumed-breach, external-to-internal, insider threat, and hybrid physical-cyber engagement scenarios with MITRE ATT&CK mapping throughout. Targets operators planning or executing adversary simulation engagements against mature defenders.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Command and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profiles, Beacon types HTTP/HTTPS/DNS/SMB, Beacon Object Files for in-memory execution, sleep and jitter tuning, named pipe pivoting), Sliver (implant generation across mTLS/WireGuard/DNS transport, operator multiplayer mode, armory extensions), Mythic (agent ecosystem with Apollo/Poseidon/Medusa, C2 profile configuration, translation containers), Havoc (Demon agent with sleep obfuscation via Ekko/Zilean, indirect syscalls, dotnet inline execution), Metasploit (msfvenom payload generation, multi/handler staging, Meterpreter post-exploitation modules), redirector architecture using Apache mod_rewrite and Nginx, domain fronting through CDN providers, DNS-based C2 for restrictive network egress, and TLS certificate management for infrastructure OPSEC. Tools: Cobalt Strike, Sliver, Mythic, Havoc, Metasploit Framework. Aligns to MITRE ATT&CK T1071 (Application Layer P...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.