'malware' 검색 결과

Examine Windows shortcut files to recover target paths, timestamps, drive identifiers, and machine details. Organize these traces into an investigation timeline covering local documents, USB devices, network shares, and suspicious startup shortcuts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reconstruct document access history from Windows shortcuts
• Trace references to files on USB devices
• Investigate access to network shares

Analyze how ransomware encrypts files and manages keys to assess whether decryption is feasible. Examine implementation weaknesses, check existing decryptors, and document recovery options with technical reasons for the assessment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing whether ransomware-encrypted files can be decrypted
• Examining encryption routines and key management
• Investigating key recovery from memory dumps

Extract Cobalt Strike Beacon settings from executable files and memory dumps to identify command-and-control servers, communication patterns, and identifying markers. Use the findings to compare samples, investigate incidents, and develop file and network detection rules.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Extract Beacon settings from suspicious files
• Identify command-and-control servers and traffic patterns
• Compare samples using watermark identifiers

Analyze DNS query logs for signs of hidden data transfers and attacker command channels. This skill uses unusual name lengths, randomness, and traffic volumes, then correlates findings with endpoint processes and estimates possible data loss.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected data theft through DNS
• Finding algorithmically generated domains used by malware
• Reviewing hosts with unusually high DNS query volumes

Analyze memory dumps with Volatility3 to find heap spraying, an attack that fills memory with attacker-controlled data. Examine suspicious allocations and repeated byte patterns, extract suspicious code, and report affected processes and memory regions in JSON.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected heap spraying in a memory dump
• Extracting suspicious code from memory
• Organizing evidence for detection rule development

Inspect suspicious PDFs without opening them in a document viewer. Use peepdf, pdfid, and pdf-parser to examine internal objects, extract embedded code and files, and report threat indicators such as URLs and hashes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Triaging suspicious PDF email attachments
• Investigating PDF exploit documents
• Extracting embedded JavaScript and files

Analyze disk images with Autopsy and The Sleuth Kit to recover deleted files, search content, and examine recorded activity. Build investigation timelines and visual reports that help stakeholders understand evidence from one or multiple disk images.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Recovering deleted files from a disk image
• Searching evidence for confidential files and keywords
• Reconstructing activity around a malware infection

Guides security testing of Android and iOS apps through file inspection and observation while the app runs. Covers network traffic, stored secrets, external app interfaces, authentication, and backend APIs, with tool examples and a testing checklist.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting APK or IPA files for endpoints and embedded secrets
• Observing app behavior and traffic with Frida
• Reviewing deep links and externally accessible components

Guides security scanning across networks, web applications, wireless systems, and cloud environments. Helps select and configure tools, check findings for false positives, prioritize risks, and prepare reports with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Discovering hosts, open ports, and services
• Assessing web application vulnerabilities
• Reviewing cloud security settings

Provides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode tricks, esoteric languages, QR or audio puzzles, constraint solving, game theory, unusual sandbox escapes, and hybrid logic puzzles. Prefer a more specific skill first when the challenge is mainly web, pwn, reverse, forensics, malware, OSINT, or crypto. Treat this as the fallback skill for genuine cross-category or edge-case challenges, not the default starting point.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Provides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Test skill containing EICAR test file for malware detection

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response timeline reconstruction.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert CIS Controls v8 (CIS Top 18) advisor — implementation group scoping (IG1/IG2/IG3), control gap assessments, safeguard-level guidance, asset inventory, software inventory, data protection, secure configuration, account management, access control, continuous vulnerability management, audit log management, email and web browser protections, malware defenses, network infrastructure management, network monitoring and defense, application software security, incident response, penetration testing, and CIS Controls mapping to NIST CSF, ISO 27001, SOC 2, and CMMC. Use for any question about CIS Controls, CIS Benchmarks, Implementation Groups, or prioritized cyber hygiene for any organization size.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert UK Cyber Essentials and Cyber Essentials Plus advisor — the NCSC-owned, IASME-delivered baseline certification. Covers the current Danzell question set (Requirements for IT Infrastructure v3.3, mandatory for assessment accounts from April 27, 2026) and the Willow transition, the five control themes (firewalls, secure configuration, security update management, user access control, malware protection), scoping rules for cloud services, BYOD and home working, the 14-day critical-update rule, mandatory MFA for cloud services and the new auto-fail questions, CE Plus technical audits, pricing, annual renewal, the included cyber liability insurance, and procurement mandates (PPN 014, MoD Defence Cyber Certification, NHS). Use this skill whenever a user mentions Cyber Essentials, CE Plus, IASME, the UK government cyber certification, Danzell or Willow question sets, UK public-sector or MoD supply-chain security requirements, or wants a readiness gap assessment.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert CIS Controls v8 (CIS Top 18) advisor — implementation group scoping (IG1/IG2/IG3), control gap assessments, safeguard-level guidance, asset inventory, software inventory, data protection, secure configuration, account management, access control, continuous vulnerability management, audit log management, email and web browser protections, malware defenses, network infrastructure management, network monitoring and defense, application software security, incident response, penetration testing, and CIS Controls mapping to NIST CSF, ISO 27001, SOC 2, and CMMC. Use for any question about CIS Controls, CIS Benchmarks, Implementation Groups, or prioritized cyber hygiene for any organization size.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Static analysis of UEFI/BIOS firmware dumps using Intel's chipsec framework. Decode firmware structure, detect known malware and rootkits (LoJax, ThinkPwn, HackingTeam, MosaicRegressor), generate EFI executable inventories with hashes, extract NVRAM variables, and parse SPI flash descriptors. Use when analyzing firmware .bin/.rom/.fd/.cap files offline without requiring hardware access.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

用于混淆脚本、恶意样本、自定义加密协议、C2 流量、PE/.NET 二进制、RC4/AES 通信、YARA、shellcode、进程注入与反分析等恶意软件类 CTF 题;触发名:ctf-malware

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

.NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 reverse-engineering / ida-reverse）。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert knowledge for Azure Security development including best practices, decision making, security, configuration, integrations & coding patterns, and deployment. Use when configuring Azure antimalware, container SBOM/signing, CMK encryption, AKS/VM hardening, or Key Vault keys, and other Azure Security related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Information Protection (use azure-information-protection), Azure DDoS Protection (use azure-ddos-protection), Azure Web Application Firewall (use azure-web-application-firewall).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Conducts hypothesis-driven, evidence-preserving threat hunts with bounded negative conclusions and telemetry-gap handling. Use for hunt hypotheses, scoped offline analysis, or analytic follow-up; not unscoped scanning, malware execution, or generic intelligence summaries.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.