All authors
Claude Skills by meltedinhex
github.com/meltedinhex119 skills3 installs349 views
- Emulating Shellcode With Unicorn'Emulates position-independent shellcode in a controlled CPU emulator (Unicorn) toVotes: 0GitHub stars: 22
- Enriching Iocs With Threat Intel Sources'Enriches indicators with context from threat-intel sources: planning lookups againstVotes: 0GitHub stars: 22
- Establishing Telemetry Baselines'Establishes behavioral baselines from historical telemetry (process, network, orVotes: 0GitHub stars: 22
- Extracting And Classifying Strings'Extracts ASCII and Unicode strings from a binary and classifies them intoVotes: 0GitHub stars: 22
- Extracting Cobalt Strike Beacon Config'Extracts and interprets a Cobalt Strike Beacon configuration: decoding theVotes: 0GitHub stars: 22
- Extracting Config From A Running Sample'Extracts an embedded malware configuration (C2 hosts, ports, campaign IDs, keys) fromVotes: 0GitHub stars: 22
- Extracting Encryption Keys From Binaries'Locates candidate encryption keys in a binary by finding high-entropy fixed-sizeVotes: 0GitHub stars: 22
- Extracting Iocs From Analysis Output'Extracts indicators of compromise from raw analysis artifacts: parsing stringsVotes: 0GitHub stars: 22
- Generating Capability Reports With Capa'Uses capa to identify malware capabilities from a binary: running rule-basedVotes: 0GitHub stars: 22
- Handling Malware Samples Safely'Establishes safe practices for acquiring, storing, transferring, and disposingVotes: 0GitHub stars: 22
- Hashing And Fingerprinting Files'Computes cryptographic and fuzzy fingerprints for malware samples: MD5/SHA-1/SHA-256Votes: 0GitHub stars: 22
- Hunting Active Directory Attacks'Hunts for Active Directory credential and replication attacks — DCSync, Golden/SilverVotes: 0GitHub stars: 22
- Hunting Anomalous Authentication Patterns'Hunts for anomalous authentication such as password spraying, brute force, andVotes: 0GitHub stars: 22
- Hunting C2 Beaconing With Frequency Analysis'Detects command-and-control beacons in network logs by analyzing connectionVotes: 0GitHub stars: 22
- Hunting Cobalt Strike Traffic'Hunts for Cobalt Strike beacon traffic by detecting default stager URI checksum8Votes: 0GitHub stars: 22
- Hunting Credential Dumping Activity'Hunts for credential dumping by detecting LSASS process access with suspicious accessVotes: 0GitHub stars: 22
- Hunting Data Staging And Archiving'Hunts for pre-exfiltration data staging and archiving by detecting archive-toolVotes: 0GitHub stars: 22
- Hunting Dns Tunneling And Exfiltration'Detects DNS-based tunneling and data exfiltration in DNS logs: scoring high queryVotes: 0GitHub stars: 22
- Hunting Domain Fronting And Cdn Abuse'Hunts for domain fronting and CDN abuse by detecting TLS SNI versus HTTP Host headerVotes: 0GitHub stars: 22
- Hunting Fileless And In Memory Threats'Hunts for fileless and in-memory threats by correlating PowerShell script-block logs,Votes: 0GitHub stars: 22
- Hunting From A Threat Intel Report'Operationalizes a threat intelligence report into hunts: extracting IOCs and TTPs,Votes: 0GitHub stars: 22
- Hunting Kerberoasting And Ticket Attacks'Hunts for Kerberoasting and related ticket attacks by analyzing Kerberos serviceVotes: 0GitHub stars: 22
- Hunting Lateral Movement Over Smb And Wmi'Hunts for lateral movement via remote service creation, admin share writes, andVotes: 0GitHub stars: 22
- Hunting Lolbin Abuse On Windows'Hunts for living-off-the-land binary (LOLBin) abuse in Windows process-creationVotes: 0GitHub stars: 22
- Hunting Persistence Mechanisms On Windows'Hunts for Windows persistence across autostart locations: Run keys, services,Votes: 0GitHub stars: 22
- Hunting Persistence On Linux'Hunts for Linux persistence by inspecting cron, systemd units, shell rc files, SSHVotes: 0GitHub stars: 22
- Hunting Process Injection With Sysmon'Hunts for process injection using Sysmon telemetry: correlating CreateRemoteThreadVotes: 0GitHub stars: 22
- Hunting Ransomware Precursor Behavior'Hunts for ransomware precursor behavior that precedes encryption — shadow-copy andVotes: 0GitHub stars: 22
- Hunting Scheduled Task Abuse'Hunts for malicious scheduled task persistence by analyzing task registration eventsVotes: 0GitHub stars: 22
- Hunting Suspicious Powershell Execution'Hunts malicious PowerShell using script-block (EID 4104) and module logging:Votes: 0GitHub stars: 22
- Hunting Unusual Outbound Connections'Hunts for unusual outbound network connections by flagging direct-to-IP traffic,Votes: 0GitHub stars: 22
- Hunting Wmi Event Subscription Persistence'Hunts for malicious WMI permanent event subscription persistence by correlatingVotes: 0GitHub stars: 22
- Identifying Anti Debugging Techniques'Identifies and bypasses anti-debugging and anti-analysis checks in malware: PEBVotes: 0GitHub stars: 22
- Identifying Cryptographic Routines In Binaries'Identifies cryptographic algorithms embedded in a binary by scanning for well-knownVotes: 0GitHub stars: 22
- Identifying File Types And Formats'Identifies a sample''s true file type independent of its extension: matching magicVotes: 0GitHub stars: 22
- Manually Unpacking A Packed Binary'Manually unpacks a runtime-packed Windows binary by finding the original entry pointVotes: 0GitHub stars: 22
- Mapping Hunts To Mitre Attack'Maps hunts and detections to MITRE ATT&CK for coverage analysis: tagging hypothesesVotes: 0GitHub stars: 22
- Measuring Section Entropy To Detect Packing'Detects packing and encryption by measuring Shannon entropy across a binary''sVotes: 0GitHub stars: 22
- Monitoring Process And File Behavior'Summarizes runtime behavior of a sample from Procmon-style operation logs — processVotes: 0GitHub stars: 22
- Operationalizing A Hunt Into A Detection'Converts a successful threat hunt into a durable detection by extracting theVotes: 0GitHub stars: 22
- Performing Dynamic Analysis In A Sandbox'Runs a sample in an instrumented sandbox to observe behavior: process tree, fileVotes: 0GitHub stars: 22
- Performing Static Pe Analysis'Extracts structure and indicators from a Windows PE file without executing it:Votes: 0GitHub stars: 22
- Pivoting On Iocs Across Data Sources'Pivots on indicators of compromise across multiple data sources by correlating a seedVotes: 0GitHub stars: 22
- Profiling A Threat Actor From Ttps'Profiles a threat actor by aggregating observed ATT&CK techniques into a TTP profileVotes: 0GitHub stars: 22
- Recovering Injected Code And Shellcode'Carves injected PE images and position-independent shellcode from a memory dump orVotes: 0GitHub stars: 22
- Resolving Dynamic Api Hashing'Resolves dynamically hashed Windows API names by brute-forcing observed hash constantsVotes: 0GitHub stars: 22
- Reverse Engineering Arm Binaries'Reverse engineers ARM/AArch64 malware by identifying the architecture and instructionVotes: 0GitHub stars: 22
- Reverse Engineering Binaries With Binary Ninja'Reverse engineers binaries with Binary Ninja using its analysis stack and Python APIVotes: 0GitHub stars: 22
- Reverse Engineering Binaries With Ghidra'Uses Ghidra to disassemble and decompile a binary, navigate to key routines viaVotes: 0GitHub stars: 22
- Reverse Engineering Binaries With Radare2 Rizin'Reverse engineers binaries using radare2/rizin interactively, covering analysisVotes: 0GitHub stars: 22