“malware”的搜索结果

Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.

中文简介正在准备中。当前显示原文说明。

Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

中文简介正在准备中。当前显示原文说明。

Build structured communication templates for malware incidents including stakeholder notifications, executive briefings, technical advisories, and regulatory disclosures with severity-based escalation procedures.

中文简介正在准备中。当前显示原文说明。

Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 and data exfiltration.

中文简介正在准备中。当前显示原文说明。

Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports

中文简介正在准备中。当前显示原文说明。

Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection.

中文简介正在准备中。当前显示原文说明。

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.

中文简介正在准备中。当前显示原文说明。

Analyze compiled .NET and C# programs by identifying managed files, removing obfuscation, inspecting intermediate instructions, and debugging runtime behavior. Save extracted configuration and code changes as evidence for further review.

中文简介正在准备中。当前显示英语简介。

• Inspect compiled .NET program behavior
• Analyze obfuscated C# programs
• Extract malware configuration and communication destinations

Analyze authorized macOS applications and Mach-O binaries, the executable format used on macOS. Examine signatures, dependencies, Objective-C and Swift symbols, and runtime behavior to produce findings tied to specific addresses or symbols.

中文简介正在准备中。当前显示英语简介。

• Examining macOS application signatures and dependencies
• Investigating Objective-C and Swift program structure
• Tracing application behavior with lldb or Frida

Investigate security incidents using memory dumps, saved copies of RAM. The skill guides memory acquisition, process and network analysis, suspicious code detection, and evidence extraction with Volatility and related tools, including checks for capture integrity.

中文简介正在准备中。当前显示英语简介。

• Capturing RAM before shutting down a system under investigation
• Finding suspicious processes and network connections in memory
• Extracting executables and strings for malware analysis

Identify software protections that hinder inspection, such as debugger detection and obfuscation that makes code harder to understand. Support authorized binary analysis and CTF security challenges with protection findings, bypass strategies, reports, and analysis scripts.

中文简介正在准备中。当前显示英语简介。

• Identify protections in an authorized malware sample
• Plan analysis of a packed executable
• Implement debugger detection for a CTF challenge

Investigate malicious code placed inside legitimate Windows processes using memory analysis, event logs, and API monitoring. Identify injection methods, examine extracted code, and produce evidence reports and detection rules for suspicious process behavior.

中文简介正在准备中。当前显示英语简介。

• Investigating unexpected connections from legitimate processes
• Finding injected code in memory dumps
• Classifying process hollowing and other injection methods

Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.

中文简介正在准备中。当前显示英语简介。

• Vetting a new npm dependency before adoption
• Reviewing dependency files during code review
• Checking lockfiles against known-malicious versions

Investigate suspected rootkits, malware that hides its presence, by comparing process lists, inspecting memory, and checking system integrity. Use Volatility and Windows or Linux scanners to identify hidden processes, suspicious drivers, altered system calls, and concealed connections.

中文简介正在准备中。当前显示英语简介。

• Investigating compromise when standard tools show no anomalies
• Comparing process lists to find hidden activity
• Examining suspicious drivers and concealed connections

Collect evidence from a compromised computer before shutdown or remediation erases it. Preserve memory, network connections, processes, and system state, then record integrity hashes and handling history to support incident investigation and evidence tracking.

中文简介正在准备中。当前显示英语简介。

• Preserving evidence before shutting down a compromised computer
• Collecting memory evidence for suspected fileless malware
• Recording active connections and processes during an intrusion

Investigate malware that survives OS reinstallation by checking UEFI firmware, boot files, and Secure Boot settings. Use chipsec and supporting tools to compare trusted baselines, identify bootkit indicators, and document findings.

中文简介正在准备中。当前显示英语简介。

• Investigating reinfection after OS reinstallation
• Checking unexpected Secure Boot changes
• Comparing firmware against a trusted vendor baseline

Analyze Windows Amcache records to investigate applications, deleted executable traces, and drivers. Extract file details, compare SHA-1 hashes with malware databases, and combine records into a timeline to support incident investigations.

中文简介正在准备中。当前显示英语简介。

• Investigating traces of deleted executables
• Checking software installed during an incident
• Comparing file hashes with malware databases

Investigate malicious software delivered through trusted updates or dependencies. Compare suspect files with legitimate versions, examine signing anomalies and injected code, and organize evidence to assess the infection path and downstream impact.

中文简介正在准备中。当前显示英语简介。

• Comparing suspicious updates with legitimate versions
• Investigating software signatures and injected code
• Tracing infection through build artifacts

Analyze threat intelligence stored in MISP, a platform for sharing security threat data. Summarize event counts, indicator types, attacker groups, and trends over time to create a threat landscape report for a chosen period.

中文简介正在准备中。当前显示英语简介。

• Create a threat landscape report for the past 90 days
• Summarize attacker activity and frequently tagged attack techniques
• Track changes in submitted threat indicator types and volumes

Compare evidence from cyber operations to assess which attacker may be responsible. Weigh shared infrastructure, attack methods, malware similarities, timing, and language clues against competing explanations, then report attribution findings with justified confidence levels.

中文简介正在准备中。当前显示英语简介。

• Assessing possible attackers during an incident investigation
• Comparing infrastructure and attack methods across campaigns
• Evaluating conflicting evidence against multiple hypotheses

Investigate Linux kernel rootkits, malware that hides inside the operating system's core. Analyze memory dumps with Volatility3, compare system views, and run live scans to identify hidden modules, altered calls, and suspicious inconsistencies.

中文简介正在准备中。当前显示英语简介。

• Investigate suspected Linux rootkit infections
• Find hidden kernel modules in memory dumps
• Compare module lists for signs of concealment

Use when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior.

中文简介正在准备中。当前显示原文说明。

Use when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction (Cobalt Strike/CAPE), C2 traffic detection (JA4+, beaconing)

中文简介正在准备中。当前显示原文说明。

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse engineering, malware, DFIR, firmware, pwnable, and native exploit challenges. Use when the user asks to reverse a binary, unpack a sample, inspect a memory dump or PCAP, recover malware behavior, debug a crash, or build or verify an exploit chain under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

中文简介正在准备中。当前显示原文说明。