Agent skills by mukul975

Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,

Detect and analyze covert communication channels used by malware, including

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets. Use when performing authorized…

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

Analyzes network traffic generated by malware during sandbox execution

Captures and analyzes network packet data using Wireshark and tshark

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect

Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder. Use…

Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a…

Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to

Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded…

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX

Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced…

Analyzes encryption algorithms, key management, and file encryption

Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk…

Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when…

Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers…

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON

Leverages Splunk Enterprise Security and SPL (Search Processing Language)

Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change…

Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence…

Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to…

Analyzes structured and unstructured threat intelligence feeds to extract