查找技能

Builds reusable malware configuration extractors by applying a declarative JSON spec (offsets, decode layers, field definitions) to a sample to produce structured, defanged config. Activates for requests to build a config extractor, write a reusable family config parser, or run a spec-driven configuration extraction.

中文简介正在准备中。当前显示原文说明。

Builds Zeek-based network hunting analytics by writing scripts and analyzing Zeek logs (conn, dns, http, ssl, files) to surface long connections, rare JA3s, suspicious downloads, and beaconing. Activates for requests to build Zeek analytics, write a Zeek hunting script, or analyze Zeek logs for threats.

中文简介正在准备中。当前显示原文说明。

Captures and analyzes malware network traffic from a detonation: extracting C2 endpoints, HTTP/DNS patterns, TLS metadata (JA3/SNI), and beaconing from a PCAP to build network IOCs and detection. Activates for requests to analyze malware PCAP, extract C2 from traffic, or study network behavior.

中文简介正在准备中。当前显示原文说明。

Collects volatile evidence from a potentially compromised host in correct order of volatility: memory, network state, running processes, logged-on users, and open handles, while preserving integrity and minimizing footprint. Activates for requests to collect volatile evidence, perform live response, or capture host state before shutdown.

中文简介正在准备中。当前显示原文说明。

Uses x64dbg to dynamically debug Windows malware: setting strategic breakpoints on APIs, stepping through unpacking and decryption, dumping memory at the right moment, and manipulating execution to reach hidden code. Activates for requests to debug malware with x64dbg, set API breakpoints, or step through unpacking in a debugger.

中文简介正在准备中。当前显示原文说明。

Decrypts statically embedded malware configuration blobs by trying common schemes (single-byte and multi-byte XOR, RC4, base64 layers) and scoring decoded output for config-like content. Activates for requests to decrypt an embedded config, recover hardcoded settings from a blob, or brute-force a configuration encryption scheme.

中文简介正在准备中。当前显示原文说明。

Prepares indicators of compromise for safe sharing: defanging URLs, domains, IPs, and emails so they cannot be accidentally clicked or resolved, and formatting them into STIX/CSV/MISP-friendly output. Activates for requests to defang IOCs, sanitize indicators for a report, or export indicators for sharing.

中文简介正在准备中。当前显示原文说明。

Defeats control-flow-flattening obfuscation by identifying the dispatcher/state- variable structure and reconstructing the original control flow so the logic becomes readable. Activates for requests to defeat control-flow flattening, deobfuscate an OLLVM-flattened function, or recover original control flow from a dispatcher loop.

中文简介正在准备中。当前显示原文说明。

Deobfuscates malicious JavaScript from droppers, web pages, and HTA/scriptlets: unrolling string-array and char-code encodings, resolving eval/Function chains, and statically recovering payloads and URLs without executing untrusted code. Activates for requests to deobfuscate JavaScript, decode obfuscated JS, or analyze a malicious script dropper.

中文简介正在准备中。当前显示原文说明。

Detects process injection in a memory image by identifying private executable regions with no file backing, RWX protections, and modified entry points using Volatility 3 malfind-style analysis. Activates for requests to detect process injection, find injected code in memory, or triage suspicious executable regions in a memory image.

中文简介正在准备中。当前显示原文说明。

Detects sandbox and analysis evasion techniques in a sample by scanning static strings, imports, and API traces for VM artifact checks, timing/sleep stalls, anti-debug calls, and environment fingerprinting. Activates for requests to detect sandbox evasion, find anti-VM or anti-debug checks, or explain why a sample did not detonate.

中文简介正在准备中。当前显示原文说明。

Rebuilds a usable PE file from a memory dump by fixing the section alignment (virtual-to-raw), correcting the entry point, and preparing for import table reconstruction. Activates for requests to rebuild a dumped PE, fix a memory-dumped executable, or convert a process dump into an analyzable file.

中文简介正在准备中。当前显示原文说明。

Analyzes bootkit and rootkit samples by identifying boot-process tampering (MBR/VBR/ UEFI), kernel-mode components, and stealth hooking techniques from static indicators. Activates for requests to analyze a bootkit or rootkit, examine MBR/UEFI tampering, or identify kernel-mode stealth components.

中文简介正在准备中。当前显示原文说明。

Compares two related malware samples to surface what changed between variants using section-level hashing, import-set differences, and fuzzy similarity scoring. Activates for requests to diff two samples, compare malware variants, or measure similarity between two binaries for variant tracking.

中文简介正在准备中。当前显示原文说明。

Deobfuscates malicious PowerShell by decoding -EncodedCommand, reversing string and format obfuscation, resolving base64/gzip/IEX layers, and recovering the final payload and IOCs. Activates for requests to deobfuscate, decode, or analyze obfuscated PowerShell commands or scripts.

中文简介正在准备中。当前显示原文说明。

Bypasses anti-VM and sandbox checks during analysis by locating the specific detection routines (artifact strings, timing, CPUID/hypervisor bit) and planning patches or environment hardening so the sample detonates. Activates for requests to bypass anti-VM checks, defeat sandbox detection, or make an evasive sample run for analysis.

中文简介正在准备中。当前显示原文说明。

Analyzes API call traces from a sandbox or API monitor (JSON) to group calls by category, reconstruct high-level behaviors (process injection, file drops, network, crypto), and flag suspicious call sequences. Activates for requests to analyze an API trace, interpret sandbox API logs, or identify behavior from Win32/Native API calls.

中文简介正在准备中。当前显示原文说明。

Analyzes malicious Office documents by extracting and reviewing VBA macros and OLE/OOXML structure: auto-exec triggers, obfuscation, dropped payloads, and shell/PowerShell invocation. Activates for requests to analyze a malicious Word/Excel document, VBA macro, or maldoc.

中文简介正在准备中。当前显示原文说明。

Statically analyzes Linux ELF malware: ELF header and sections, dynamic symbols and imports, segment permissions, embedded strings, and packing indicators to infer capability without execution. Activates for requests to analyze an ELF binary, Linux malware, or shared object.

中文简介正在准备中。当前显示原文说明。

Analyzes loader and dropper samples by identifying staging behavior — embedded or downloaded next-stage payloads, decode/decrypt routines, and the execution mechanism used to run the next stage. Activates for requests to analyze a loader or dropper, find a staged payload, or map multi-stage delivery behavior.

中文简介正在准备中。当前显示原文说明。

Statically analyzes macOS Mach-O malware: parsing the header and load commands, handling fat/universal binaries, reading linked dylibs and entitlements, and checking code signatures to infer capability and trust. Activates for requests to analyze a Mach-O binary, inspect macOS malware, or parse load commands and entitlements.

中文简介正在准备中。当前显示原文说明。

Analyzes remote access trojan command-and-control by mapping the RAT command set, identifying the C2 transport and beacon parameters, and cataloging operator capabilities from static strings and config. Activates for requests to analyze RAT C2, map a trojan command handler, or identify remote-access capabilities and C2 transport.

中文简介正在准备中。当前显示原文说明。

Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution sinks, input-to-sink data flow, and common encoder/obfuscation chains, then decoding obvious layers to reveal the command interface. Activates for requests to analyze a webshell, identify a PHP/ASPX/JSP backdoor, or deobfuscate server-side malicious scripts.

中文简介正在准备中。当前显示原文说明。