Claude Skills by meltedinhex

'Emulates position-independent shellcode in a controlled CPU emulator (Unicorn) to

'Enriches indicators with context from threat-intel sources: planning lookups against

'Establishes behavioral baselines from historical telemetry (process, network, or

'Extracts ASCII and Unicode strings from a binary and classifies them into

'Extracts and interprets a Cobalt Strike Beacon configuration: decoding the

'Extracts an embedded malware configuration (C2 hosts, ports, campaign IDs, keys) from

'Locates candidate encryption keys in a binary by finding high-entropy fixed-size

'Extracts indicators of compromise from raw analysis artifacts: parsing strings

'Uses capa to identify malware capabilities from a binary: running rule-based

'Establishes safe practices for acquiring, storing, transferring, and disposing

'Computes cryptographic and fuzzy fingerprints for malware samples: MD5/SHA-1/SHA-256

'Hunts for Active Directory credential and replication attacks — DCSync, Golden/Silver

'Hunts for anomalous authentication such as password spraying, brute force, and

'Detects command-and-control beacons in network logs by analyzing connection

'Hunts for Cobalt Strike beacon traffic by detecting default stager URI checksum8

'Hunts for credential dumping by detecting LSASS process access with suspicious access

'Hunts for pre-exfiltration data staging and archiving by detecting archive-tool

'Detects DNS-based tunneling and data exfiltration in DNS logs: scoring high query

'Hunts for domain fronting and CDN abuse by detecting TLS SNI versus HTTP Host header

'Hunts for fileless and in-memory threats by correlating PowerShell script-block logs,

'Operationalizes a threat intelligence report into hunts: extracting IOCs and TTPs,

'Hunts for Kerberoasting and related ticket attacks by analyzing Kerberos service

'Hunts for lateral movement via remote service creation, admin share writes, and

'Hunts for living-off-the-land binary (LOLBin) abuse in Windows process-creation

'Hunts for Windows persistence across autostart locations: Run keys, services,

'Hunts for Linux persistence by inspecting cron, systemd units, shell rc files, SSH

'Hunts for process injection using Sysmon telemetry: correlating CreateRemoteThread

'Hunts for ransomware precursor behavior that precedes encryption — shadow-copy and

'Hunts for malicious scheduled task persistence by analyzing task registration events

'Hunts malicious PowerShell using script-block (EID 4104) and module logging:

'Hunts for unusual outbound network connections by flagging direct-to-IP traffic,

'Hunts for malicious WMI permanent event subscription persistence by correlating

'Identifies and bypasses anti-debugging and anti-analysis checks in malware: PEB

'Identifies cryptographic algorithms embedded in a binary by scanning for well-known

'Identifies a sample''s true file type independent of its extension: matching magic

'Manually unpacks a runtime-packed Windows binary by finding the original entry point

'Maps hunts and detections to MITRE ATT&CK for coverage analysis: tagging hypotheses

'Detects packing and encryption by measuring Shannon entropy across a binary''s

'Summarizes runtime behavior of a sample from Procmon-style operation logs — process

'Converts a successful threat hunt into a durable detection by extracting the

'Runs a sample in an instrumented sandbox to observe behavior: process tree, file

'Extracts structure and indicators from a Windows PE file without executing it:

'Pivots on indicators of compromise across multiple data sources by correlating a seed

'Profiles a threat actor by aggregating observed ATT&CK techniques into a TTP profile

'Carves injected PE images and position-independent shellcode from a memory dump or

'Resolves dynamically hashed Windows API names by brute-forcing observed hash constants

'Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction

'Reverse engineers binaries with Binary Ninja using its analysis stack and Python API

'Uses Ghidra to disassemble and decompile a binary, navigate to key routines via

'Reverse engineers binaries using radare2/rizin interactively, covering analysis