'dll' 검색 결과

Investigate attacks that make legitimate Windows applications load malicious DLL files. This skill examines loading events, digital signatures, file hashes, and unusual locations, then checks process behavior to document suspicious cases and guide remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating alerts about unsigned DLL files
• Hunting for persistent threats using legitimate applications
• Checking suspicious DLL loading paths

Python 앱을 Windows에 배포하도록 Nuitka 컴파일, 불필요한 파일과 DLL 용량 분석, Inno Setup을 통한 가벼운 설치 프로그램 제작을 지원합니다.

• Python 앱을 Windows용으로 배포하기
• 배포 용량이 큰 의존성 조사하기
• 새 Windows 환경의 실행 오류 조사하기

Analyze Sysmon logs to investigate process injection, where malicious code hides inside legitimate processes. Correlate remote thread creation, cross-process access, and unusual DLL loading, then organize findings by injection type, risk level, and ATT&CK technique.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating EDR alerts about suspicious cross-process access
• Hunting for malicious code hidden inside legitimate processes
• Checking Sysmon coverage for process injection detection

Analyze executable files and libraries with IDA Pro. Inspect pseudocode, strings, function calls, and data flow, then add meaningful names and comments and produce a Markdown report documenting findings and analysis steps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating executable files and libraries
• Tracing processing from strings and function calls
• Organizing analysis with comments and meaningful names

Exploit local systems via DLL load order hijacking. This skill details how to identify applications on Windows that insecurely load Dynamic Link Libraries (DLLs) and how to substitute a legitimate DLL with a malicious one to achieve privilege escalation or persistent access.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze compiled .NET and C# programs by identifying managed files, removing obfuscation, inspecting intermediate instructions, and debugging runtime behavior. Save extracted configuration and code changes as evidence for further review.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspect compiled .NET program behavior
• Analyze obfuscated C# programs
• Extract malware configuration and communication destinations

Investigate malicious code placed inside legitimate Windows processes using memory analysis, event logs, and API monitoring. Identify injection methods, examine extracted code, and produce evidence reports and detection rules for suspicious process behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating unexpected connections from legitimate processes
• Finding injected code in memory dumps
• Classifying process hollowing and other injection methods

Support shellcode development for security testing: small machine-code programs executed in memory. The skill covers x86/x64 implementation, code that works regardless of its memory address, loaders, executable conversion, debugging, and platform-specific execution constraints.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Studying address-independent x86/x64 code
• Reviewing loader memory allocation and execution
• Comparing EXE and DLL conversion tools

Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Review Windows privilege escalation paths from a standard user session to Administrator or SYSTEM. Examine service permissions, token privileges, library loading, scheduled tasks, and stored credentials, with detection indicators for defensive validation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating privilege escalation in authorized Windows assessments
• Reviewing service and scheduled task permissions
• Checking detection coverage with attack and defense teams

用于配置 Visual Studio 属性表（.props），通过设置绝对路径解决项目引用后 DLL 运行时找不到的问题，且不修改全局环境变量，实现引入即用。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Generate and interpret security-research diffs between Windows versions or patch levels using this repo's WinDiff CLI and databases. Use when comparing Windows builds or binaries such as ntoskrnl.exe, ntdll.dll, win32k*.sys, ci.dll, or cng.sys to find changed syscalls, symbols, types, mitigation flags, callbacks, ETW/EtwTi telemetry, code-integrity behavior, drivers, or attack surface. Explain likely intent and security relevance with Windows-internals knowledge, and frame findings for anti-malware/EDR, anti-cheat, and vulnerability-research audiences rather than returning an uninterpreted symbol list.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or "reverse engineering". This includes requests like "看看这个exe", "分析这个dll", "帮我破解", "找一下密码", "这个软件怎么注册", etc. Use the bundled scripts (scripts/start.ps1, scripts/open.ps1) for deterministic server management and file opening — do NOT write ad-hoc PowerShell commands for these operations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

用于配置 Visual Studio 属性表（.props），通过设置绝对路径解决项目引用后 DLL 运行时找不到的问题，且不修改全局环境变量，实现引入即用。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze how EDR, software that monitors endpoint threats, and antivirus products detect activity. Support authorized exercises by examining monitoring mechanisms, assessing evasion approaches, and checking detection results in an isolated test environment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing EDR detection coverage in authorized exercises
• Examining internal monitoring mechanisms
• Testing an in-house implant against security products

Investigate process hollowing, where malicious code replaces a legitimate process in memory. Compare memory with disk files, examine process relationships, and correlate network activity to document suspicious processes and guide containment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating process injection alerts from EDR
• Examining suspicious behavior in legitimate Windows processes
• Finding threats that run in memory

Detect attacks that misuse legitimate Windows utilities such as certutil and mshta. Analyze process logs, command arguments, and parent-child relationships with Sigma detection rules, then report suspicious events with severity scores and supporting event details.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious use of built-in Windows utilities
• Creating Sigma rules for unusual command arguments
• Finding Office apps that launch unexpected system utilities

Analyze RAM dumps with Volatility 3 to investigate suspicious processes, network connections, injected code, and credential theft. Guides memory capture and evidence extraction, then organizes findings into a forensic report for incident response.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating malware that runs only in memory
• Checking suspicious processes and network connections
• Investigating signs of credential theft

Parse Windows Prefetch files, which store traces of program execution, to extract run counts, timestamps, and referenced files. Build execution timelines and compare findings with other forensic evidence when investigating suspicious software or tool usage.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether a suspicious program ran
• Building a timeline of investigative tool findings
• Investigating compression and file transfer tool usage

Plan persistence testing for authorized Windows and Linux security exercises, examining how access can survive logons or restarts. The skill compares mechanisms by privilege level and environment, with validation steps, detection indicators, and cleanup considerations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning persistence tests for authorized exercises
• Comparing methods by operating system and privilege
• Reviewing detection indicators for persistence

Analyze CLR activation logs to explain how .NET Framework selects and loads its runtime, the software that executes managed code. Diagnose loading failures, unexpected version choices, installation dialogs, and conflicting activation paths within a process.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating failures to load the .NET Framework runtime
• Explaining why an unexpected CLR version was selected
• Tracing .NET 3.5 installation dialogs or their absence