Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, and infrastructure (primary (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →