Trending Skills
The hottest skills gaining momentum in the community right now.
analyzing-packed-malware-with-upx-unpacker
by mukul975
'Identifies and unpacks UPX-packed and other packed malware samples to expose the original executable code for
analyzing-certificate-transparency-for-phishing
by mukul975
Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates,
analyzing-malware-sandbox-evasion-techniques
by mukul975
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction
analyzing-api-gateway-access-logs
by mukul975
'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass,
analyzing-windows-registry-for-artifacts
by mukul975
Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
analyzing-ios-app-security-with-objection
by mukul975
'Performs runtime mobile security exploration of iOS applications using Objection, a Frida-powered toolkit that
analyzing-slack-space-and-file-system-artifacts
by mukul975
Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.
analyzing-windows-lnk-files-for-artifacts
by mukul975
Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.
auditing-aws-s3-bucket-permissions
by mukul975
Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.
analyzing-android-malware-with-apktool
by mukul975
Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source
analyzing-command-and-control-communication
by mukul975
Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse engineering, or command-and-control infrastructure mapping.
analyzing-browser-forensics-with-hindsight
by mukul975
Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached
analyzing-ethereum-smart-contract-vulnerabilities
by mukul975
Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy,
analyzing-malware-persistence-with-autoruns
by mukul975
Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry
analyzing-campaign-attribution-evidence
by mukul975
Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or
analyzing-dns-logs-for-exfiltration
by mukul975
'Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert
analyzing-azure-activity-logs-for-threats
by mukul975
'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative
analyzing-linux-elf-malware
by mukul975
Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.
analyzing-threat-intelligence-feeds
by mukul975
Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.
auditing-azure-active-directory-configuration
by mukul975
Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.
analyzing-apt-group-with-mitre-navigator
by mukul975
Analyze advanced persistent threat (APT) group techniques using MITRE ATT&CK Navigator to create layered heatmaps
analyzing-macro-malware-in-office-documents
by mukul975
'Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download
analyzing-linux-system-artifacts
by mukul975
Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover
analyzing-bootkit-and-rootkit-samples
by mukul975
Analyzes bootkit and advanced rootkit malware that infects the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware to gain persistence below the operating system. Covers boot sector analysis, UEFI module inspection, and anti-rootkit detection techniques. Activates for requests involving bootkit analysis, MBR malware investigation, UEFI persistence analysis, or pre-OS malware detection.