「hex」の検索結果

Identifies and unpacks packed binaries: detecting packers from section names and entropy, automatically unpacking UPX, and manually unpacking custom packers by finding the OEP and dumping. Activates for requests to unpack a packed sample, detect a packer, or recover the original binary from UPX or a custom packer.

日本語の概要は準備中です。原文の説明を表示しています。

Reverses proprietary command-and-control protocols: locating send/recv routines, recovering the message framing and encryption/encoding, and reconstructing the command set to build a decoder or emulator. Activates for requests to reverse a custom C2 protocol, decode beacon traffic, or document a malware command structure.

日本語の概要は準備中です。原文の説明を表示しています。

Analyzes position-independent shellcode: disassembling raw bytes at the right architecture, recognizing PEB-walk API resolution and egg hunters, and emulating execution to recover behavior and payloads. Activates for requests to analyze shellcode, disassemble raw position-independent code, or emulate a shellcode blob.

日本語の概要は準備中です。原文の説明を表示しています。

Expands one indicator into the full scope of an incident: pivoting across data sources to find related hosts, accounts, and infrastructure, building a timeline, and bounding what is and is not affected. Activates for requests to scope an incident, pivot from a single IOC, or determine the blast radius of a detection.

日本語の概要は準備中です。原文の説明を表示しています。

Validates detection coverage by mapping Atomic Red Team tests to ATT&CK techniques, checking which of your detections cover each tested technique, and reporting coverage gaps. Activates for requests to validate detections with atomic tests, map Atomic Red Team to coverage, or find detection gaps against tested techniques.

日本語の概要は準備中です。原文の説明を表示しています。

Structures a clear, actionable malware analysis report covering summary, sample identity, capabilities, IOCs, ATT&CK mapping, and detection guidance for both technical and decision-making audiences. Activates for requests to write, structure, or review a malware analysis or reverse-engineering report.

日本語の概要は準備中です。原文の説明を表示しています。

Converts hunt findings into portable Sigma detection rules: choosing the right logsource, expressing robust selection/filter logic, setting level and ATT&CK tags, and validating before converting to a SIEM query. Activates for requests to write a Sigma rule, convert a hunt to a detection, or create portable SIEM detection logic.

日本語の概要は準備中です。原文の説明を表示しています。

One to three sentences describing what this skill does and the conditions under which an agent should activate it. Start with a verb, name the tools and artifacts involved, and end with the trigger phrasing (e.g. "Activates for requests involving ...").

日本語の概要は準備中です。原文の説明を表示しています。

Writes and validates Suricata/Snort IDS rules for network-based malware detection, covering rule anatomy, content/pcre matching, flow and threshold options, and common mistakes that cause false positives or no matches. Activates for requests to write a Suricata rule, create Snort signatures, or build network detection rules from IOCs or C2 patterns.

日本語の概要は準備中です。原文の説明を表示しています。

Turns reverse-engineering findings into durable YARA detections: selecting stable code constructs and constants over volatile strings, extracting opcode/byte patterns with wildcards, and validating rules for low false positives. Activates for requests to write a YARA rule from reversed code, create a detection signature, or convert RE findings into hunting rules.

日本語の概要は準備中です。原文の説明を表示しています。

Identifies a sample's true file type independent of its extension: matching magic bytes and structural signatures, detecting container/archive formats, and flagging extension-content mismatches used to disguise malware. Activates for requests to identify a file type, check magic bytes, or detect a disguised/spoofed extension.

日本語の概要は準備中です。原文の説明を表示しています。

Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.

日本語の概要は準備中です。原文の説明を表示しています。

Manually unpacks a runtime-packed Windows binary by finding the original entry point (OEP) through tail-jump and entropy analysis, then guiding a memory dump at OEP. Activates for requests to manually unpack a sample, find the OEP, or unpack a custom/unknown packer that generic tools cannot handle.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts malicious PowerShell using script-block (EID 4104) and module logging: scoring encoded commands, download cradles, AMSI/logging bypass, and in-memory execution, then decoding payloads for triage. Activates for requests to hunt malicious PowerShell, analyze script-block logs, or detect encoded command abuse.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for process injection using Sysmon telemetry: correlating CreateRemoteThread (EID 8), suspicious cross-process access (EID 10), and RWX image-less memory to surface hollowing, shellcode injection, and APC abuse. Activates for requests to hunt process injection, analyze Sysmon EID 8/10, or detect code injection on Windows.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for credential dumping by detecting LSASS process access with suspicious access masks, known dumping tool signatures, and comsvcs.exe MiniDump abuse in Sysmon Event ID 10 and process-creation telemetry. Activates for requests to hunt credential dumping, detect LSASS access, or find Mimikatz/comsvcs MiniDump activity.

日本語の概要は準備中です。原文の説明を表示しています。

Enriches indicators with context from threat-intel sources: planning lookups against reputation, passive DNS, WHOIS, and sandbox/sample databases, scoring confidence, and avoiding operational-security mistakes that tip off adversaries. Activates for requests to enrich IOCs, add threat context, or plan indicator lookups safely.

日本語の概要は準備中です。原文の説明を表示しています。

Emulates position-independent shellcode in a controlled CPU emulator (Unicorn) to trace executed instructions, memory writes, and decoded second stages without running it on a real host. Activates for requests to emulate shellcode, trace a decoder stub, or recover a stage unpacked at runtime by shellcode.

日本語の概要は準備中です。原文の説明を表示しています。

Reverse engineers binaries using radare2/rizin interactively, covering analysis initialization, navigation, disassembly and graph views, patching, and the visual mode workflow. Activates for requests to reverse a binary with radare2 or rizin, learn r2 commands, or navigate and disassemble a sample in r2.

日本語の概要は準備中です。原文の説明を表示しています。

Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.

日本語の概要は準備中です。原文の説明を表示しています。

Reverse engineers binaries with Binary Ninja using its analysis stack and Python API to enumerate functions, navigate IL levels (LLIL/MLIL/HLIL), and automate annotation and extraction. Activates for requests to reverse a binary with Binary Ninja, script the Binary Ninja API, or work with its intermediate languages.

日本語の概要は準備中です。原文の説明を表示しています。

Resolves dynamically hashed Windows API names by brute-forcing observed hash constants against a wordlist of API/DLL names using common malware hashing algorithms (ROR13, djb2, FNV, CRC32). Activates for requests to resolve API hashes, identify hashed imports, or reverse an API hashing routine.

日本語の概要は準備中です。原文の説明を表示しています。

Carves injected PE images and position-independent shellcode from a memory dump or carved region, identifies the payload type, and prepares it for disassembly or emulation. Activates for requests to recover injected code, carve shellcode from memory, or reconstruct a dumped payload for analysis.

日本語の概要は準備中です。原文の説明を表示しています。

Profiles a threat actor by aggregating observed ATT&CK techniques into a TTP profile and comparing it against known-group technique sets to estimate similarity and candidate attribution. Activates for requests to profile a threat actor, compare observed TTPs to known groups, or estimate attribution from technique overlap.

日本語の概要は準備中です。原文の説明を表示しています。