38 KiB
38 KiB
AnalystAIPack Skill Catalog
Auto-generated index of all 118 skills. Regenerate with python tools/build-catalog.py.
| Subdomain | Skills |
|---|---|
| Lab Foundations | 12 |
| Malware Analysis | 38 |
| Reverse Engineering | 35 |
| Threat Hunting | 33 |
Lab Foundations
12 skills.
| Skill | What it does | ATT&CK |
|---|---|---|
building-a-sample-management-workflow |
Establishes a disciplined malware sample repository: content-addressed storage by hash, encrypted/password-protected archiving, consistent metadata records, and chain-of-custody tracking so samples are reproducible and safe to handle. | T1587 |
collecting-volatile-evidence-from-a-suspect-host |
Collects volatile evidence from a potentially compromised host in correct order of volatility: memory, network state, running processes, logged-on users, and open handles, while preserving integrity and minimizing footprint. | T1057, T1049 |
defanging-and-sharing-iocs |
Prepares indicators of compromise for safe sharing: defanging URLs, domains, IPs, and emails so they cannot be accidentally clicked or resolved, and formatting them into STIX/CSV/MISP-friendly output. | T1071 |
enriching-iocs-with-threat-intel-sources |
Enriches indicators with context from threat-intel sources: planning lookups against reputation, passive DNS, WHOIS, and sandbox/sample databases, scoring confidence, and avoiding operational-security mistakes that tip off adversaries. | T1583, T1071 |
extracting-iocs-from-analysis-output |
Extracts indicators of compromise from raw analysis artifacts: parsing strings dumps, sandbox reports, PCAP summaries, and logs for URLs, domains, IPs, hashes, mutexes, and file paths, then deduplicating and typing them. | T1071, T1583 |
handling-malware-samples-safely |
Establishes safe practices for acquiring, storing, transferring, and disposing of malware samples: password-protected archives, neutralized extensions, hashing for identity, and chain-of-custody. | T1027 |
hashing-and-fingerprinting-files |
Computes cryptographic and fuzzy fingerprints for malware samples: MD5/SHA-1/SHA-256 for exact identity, plus import hashing (imphash), section hashing, and fuzzy hashes (ssdeep, TLSH) to cluster related variants. | T1027 |
identifying-file-types-and-formats |
Identifies a sample's true file type independent of its extension: matching magic bytes and structural signatures, detecting container/archive formats, and flagging extension-content mismatches used to disguise malware. | T1036.008, T1036 |
scoping-an-incident-from-a-single-indicator |
Expands one indicator into the full scope of an incident: pivoting across data sources to find related hosts, accounts, and infrastructure, building a timeline, and bounding what is and is not affected. | T1071, T1078 |
setting-up-an-isolated-malware-analysis-lab |
Builds a safe, isolated environment for detonating and analyzing malware using virtualization, host-only or simulated networking, and snapshotting. | T1564, T1497 |
triaging-an-unknown-sample |
Performs fast first-pass triage of an unknown file to decide depth of analysis: file type identification, hashing, reputation lookup, packing/entropy check, and string review. | T1027, T1140 |
writing-a-malware-analysis-report |
Structures a clear, actionable malware analysis report covering summary, sample identity, capabilities, IOCs, ATT&CK mapping, and detection guidance for both technical and decision-making audiences. | T1587 |
Malware Analysis
38 skills.
| Skill | What it does | ATT&CK |
|---|---|---|
analyzing-api-call-traces |
Analyzes API call traces from a sandbox or API monitor (JSON) to group calls by category, reconstruct high-level behaviors (process injection, file drops, network, crypto), and flag suspicious call sequences. | T1106, T1055, T1027 |
analyzing-authenticode-signatures |
Analyzes Windows Authenticode signatures on PE files: checking for a signature, reading the signer certificate chain, detecting revoked/expired/stolen certs, and recognizing signature-stripping and catalog-signing abuse. | T1553.002, T1036.001 |
analyzing-banking-trojan-webinjects |
Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. | T1185, T1557, T1056.001 |
analyzing-cryptominer-malware |
Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints (stratum), wallet addresses, algorithm and miner identifiers (XMRig and forks), and persistence or resource-control settings from static strings and config. | T1496, T1543, T1027 |
analyzing-elf-binaries-on-linux |
Statically analyzes Linux ELF malware: ELF header and sections, dynamic symbols and imports, segment permissions, embedded strings, and packing indicators to infer capability without execution. | T1027, T1059.004, T1129 |
analyzing-excel-4-macro-malware |
Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet formulas for auto-executing names, obfuscation (FORMULA.FILL, CHAR concatenation), and download or execution primitives (EXEC, CALL, REGISTER). | T1059.005, T1204.002, T1027 |
analyzing-infostealer-credential-theft |
Analyzes infostealer samples by mapping the browser, credential store, wallet, and application paths they target, and the exfiltration channel used, from static strings and behavior. | T1555.003, T1539, T1005 |
analyzing-loaders-and-droppers |
Analyzes loader and dropper samples by identifying staging behavior — embedded or downloaded next-stage payloads, decode/decrypt routines, and the execution mechanism used to run the next stage. | T1105, T1140, T1574 |
analyzing-mach-o-binaries-on-macos |
Statically analyzes macOS Mach-O malware: parsing the header and load commands, handling fat/universal binaries, reading linked dylibs and entitlements, and checking code signatures to infer capability and trust. | T1027, T1059.002 |
analyzing-malicious-iso-and-container-files |
Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads past email and mark-of-the-web defenses by enumerating contents and flagging hidden executables, LNKs, and scripts. | T1553.005, T1204.002, T1027 |
analyzing-malicious-lnk-files |
Analyzes weaponized Windows shortcut (.lnk) files: parsing the shell link structure for the target command, arguments, icon, and working directory, and recovering hidden PowerShell/cmd payloads and embedded content used in phishing. | T1204.002, T1059.001, T1059.003 |
analyzing-malicious-office-macros |
Analyzes malicious Office documents by extracting and reviewing VBA macros and OLE/OOXML structure: auto-exec triggers, obfuscation, dropped payloads, and shell/PowerShell invocation. | T1566.001, T1059.005, T1204.002 |
analyzing-malicious-onenote-and-html-smuggling |
Analyzes two modern delivery techniques: malicious OneNote (.one) attachments with embedded payloads behind fake buttons, and HTML smuggling pages that reconstruct payloads in the browser from embedded blobs. | T1027.006, T1204.002, T1566.001 |
analyzing-malicious-pdfs |
Analyzes malicious PDF documents: parsing the object structure for JavaScript, OpenAction/launch triggers, embedded files, and URIs, then extracting and decoding suspicious streams without opening the document in a reader. | T1204.002, T1059.007, T1027 |
analyzing-malicious-vbscript-and-wsf |
Analyzes malicious VBScript, WSF, and HTA scripts: parsing WSF/HTA containers, decoding VBScript.Encode (#@~^) and string obfuscation, and identifying WScript.Shell/ActiveX abuse to recover dropper behavior. | T1059.005, T1059.003, T1027 |
analyzing-malware-in-memory-with-volatility3 |
Analyzes a memory image with Volatility 3 to find malware: rogue processes, injected code, suspicious network connections, loaded modules, and persistence, then extracts artifacts for further analysis. | T1055, T1057, T1003, T1056 |
analyzing-pe-imports-and-exports |
Analyzes a PE file's import and export tables to infer capability: mapping imported APIs to behaviors (networking, crypto, injection, persistence), spotting dynamic-resolution stubs, and reading exports of malicious DLLs. | T1106, T1027 |
analyzing-ransomware-encryption-behavior |
Analyzes how a ransomware sample encrypts files: identifying the crypto scheme (symmetric/asymmetric/hybrid), key handling, file targeting and extension/marker changes, shadow-copy deletion, and ransom-note artifacts. | T1486, T1490, T1083, T1027 |
analyzing-rat-command-and-control |
Analyzes remote access trojan command-and-control by mapping the RAT command set, identifying the C2 transport and beacon parameters, and cataloging operator capabilities from static strings and config. | T1219, T1071, T1105 |
analyzing-rich-header-and-compiler-artifacts |
Analyzes the PE Rich header and related compiler artifacts to fingerprint the build toolchain, cluster related samples, and detect inconsistencies that suggest tampering. | T1027, T1587.001, T1036 |
analyzing-webshells |
Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution sinks, input-to-sink data flow, and common encoder/obfuscation chains, then decoding obvious layers to reveal the command interface. | T1505.003, T1059, T1027 |
analyzing-wiper-malware |
Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite primitives, boot-record tampering, mass-deletion and backup-destruction behavior, and distinguishing wipers from ransomware. | T1485, T1561.002, T1561.001 |
capturing-and-analyzing-malware-network-traffic |
Captures and analyzes malware network traffic from a detonation: extracting C2 endpoints, HTTP/DNS patterns, TLS metadata (JA3/SNI), and beaconing from a PCAP to build network IOCs and detection. | T1071.001, T1071.004, T1571, T1095 |
deobfuscating-malicious-javascript |
Deobfuscates malicious JavaScript from droppers, web pages, and HTA/scriptlets: unrolling string-array and char-code encodings, resolving eval/Function chains, and statically recovering payloads and URLs without executing untrusted code. | T1059.007, T1027, T1140 |
deobfuscating-malicious-powershell |
Deobfuscates malicious PowerShell by decoding -EncodedCommand, reversing string and format obfuscation, resolving base64/gzip/IEX layers, and recovering the final payload and IOCs. | T1059.001, T1027, T1140 |
detecting-process-injection-in-memory |
Detects process injection in a memory image by identifying private executable regions with no file backing, RWX protections, and modified entry points using Volatility 3 malfind-style analysis. | T1055, T1055.001, T1055.012 |
detecting-sandbox-evasion-behavior |
Detects sandbox and analysis evasion techniques in a sample by scanning static strings, imports, and API traces for VM artifact checks, timing/sleep stalls, anti-debug calls, and environment fingerprinting. | T1497, T1497.001, T1622 |
dissecting-boot-and-kernel-rootkits |
Analyzes bootkit and rootkit samples by identifying boot-process tampering (MBR/VBR/ UEFI), kernel-mode components, and stealth hooking techniques from static indicators. | T1542.003, T1014, T1547.006 |
extracting-and-classifying-strings |
Extracts ASCII and Unicode strings from a binary and classifies them into investigative categories: URLs, IPs, file paths, registry keys, mutexes, commands, and API names, prioritizing the analyst's attention. | T1027 |
extracting-cobalt-strike-beacon-config |
Extracts and interprets a Cobalt Strike Beacon configuration: decoding the encoded config block, recovering C2 servers, malleable profile fields, sleep/jitter, watermark, and pipe names to build IOCs and attribution leads. | T1071.001, T1573, T1027, T1090 |
extracting-config-from-a-running-sample |
Extracts an embedded malware configuration (C2 hosts, ports, campaign IDs, keys) from a process memory dump by locating decrypted config structures and decoding common obfuscation layers. | T1027, T1140, T1071 |
generating-capability-reports-with-capa |
Uses capa to identify malware capabilities from a binary: running rule-based detection over disassembly, mapping matched capabilities to MITRE ATT&CK and MBC, and interpreting results to focus deeper analysis. | T1059, T1106, T1027 |
measuring-section-entropy-to-detect-packing |
Detects packing and encryption by measuring Shannon entropy across a binary's sections and regions: flagging high-entropy executable sections, entropy spikes, and size/raw-vs-virtual anomalies that indicate compression or encryption. | T1027.002, T1027 |
monitoring-process-and-file-behavior |
Summarizes runtime behavior of a sample from Procmon-style operation logs — process and thread creation, file and registry writes, and network-related operations — to build a behavioral profile. | T1106, T1112, T1059 |
performing-dynamic-analysis-in-a-sandbox |
Runs a sample in an instrumented sandbox to observe behavior: process tree, file and registry changes, network activity, and persistence, then summarizes the behavioral report into capabilities and IOCs. | T1055, T1071, T1547, T1497 |
performing-static-pe-analysis |
Extracts structure and indicators from a Windows PE file without executing it: headers, sections, imports/exports, resources, entropy, and embedded strings to infer capability and packing. | T1027, T1129, T1140 |
recovering-injected-code-and-shellcode |
Carves injected PE images and position-independent shellcode from a memory dump or carved region, identifies the payload type, and prepares it for disassembly or emulation. | T1055, T1620, T1027 |
scanning-samples-with-yara |
Uses YARA to classify and triage samples at scale: applying rule sets, reading matches and string offsets, tuning for false positives, and organizing rules for malware family identification. | T1027, T1587.001 |
Reverse Engineering
35 skills.
| Skill | What it does | ATT&CK |
|---|---|---|
analyzing-android-dex-malware |
Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readable Java, auditing the manifest for abused permissions and components, and locating dynamically loaded or native payloads. | T1059, T1406, T1577 |
analyzing-compiled-python-malware |
Analyzes Python-based malware packaged as PyInstaller/py2exe executables by detecting the packer, locating the embedded archive, and identifying bundled .pyc modules for extraction and decompilation. | T1027, T1059.006, T1587.001 |
analyzing-dotnet-malware-internals |
Reverses .NET/managed malware: decompiling MSIL back to C#, defeating common .NET protectors and string encryptors, and tracing reflection-based loaders to recover the real payload. | T1027, T1620, T1055 |
analyzing-golang-malware-internals |
Analyzes Go-compiled malware by recovering function names from the pclntab, detecting the Go build/version string, and listing embedded package paths to overcome stripped symbols. | T1027, T1587.001, T1059 |
analyzing-java-jar-malware |
Analyzes Java/JAR malware (such as Adwind/jRAT-class cross-platform RATs) by inventorying the archive, reading the manifest entry point, detecting obfuscators and string encryption, and flagging suspicious runtime, reflection, and networking class usage. | T1059, T1027, T1620 |
analyzing-position-independent-code |
Analyzes position-independent code and shellcode by identifying GetPC/PEB-walk techniques, API-hash resolution loops, and relocation-free addressing so the payload can be disassembled at the right base. | T1027, T1027.007, T1620 |
analyzing-rust-malware-internals |
Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling Rust v0/legacy symbol names, and identifying crate dependencies from embedded paths. | T1027, T1587.001, T1059 |
analyzing-windows-driver-malware |
Analyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE for the native subsystem, identifying DriverEntry/IRP dispatch and IOCTL handlers, and flagging BYOVD and kernel-callback abuse. | T1068, T1014, T1547.006 |
automating-analysis-with-r2pipe |
Automates radare2/rizin analysis through r2pipe to script function enumeration, string and import extraction, and cross-reference queries across samples programmatically. | T1027, T1059, T1587.001 |
building-config-extractors |
Builds reusable malware configuration extractors by applying a declarative JSON spec (offsets, decode layers, field definitions) to a sample to produce structured, defanged config. | T1140, T1027, T1071 |
bypassing-anti-vm-and-sandbox-checks |
Bypasses anti-VM and sandbox checks during analysis by locating the specific detection routines (artifact strings, timing, CPUID/hypervisor bit) and planning patches or environment hardening so the sample detonates. | T1497, T1497.001, T1497.003 |
debugging-malware-with-x64dbg |
Uses x64dbg to dynamically debug Windows malware: setting strategic breakpoints on APIs, stepping through unpacking and decryption, dumping memory at the right moment, and manipulating execution to reach hidden code. | T1027, T1140, T1497, T1055 |
decrypting-embedded-configuration |
Decrypts statically embedded malware configuration blobs by trying common schemes (single-byte and multi-byte XOR, RC4, base64 layers) and scoring decoded output for config-like content. | T1140, T1027, T1071 |
defeating-control-flow-flattening |
Defeats control-flow-flattening obfuscation by identifying the dispatcher/state- variable structure and reconstructing the original control flow so the logic becomes readable. | T1027, T1027.013, T1140 |
defeating-string-and-api-obfuscation |
Recovers obfuscated strings and resolves dynamically loaded APIs in malware: reversing XOR/stack-string/encoding schemes and mapping API-hash lookups back to function names. | T1027, T1140, T1106 |
diffing-malware-samples-to-find-changes |
Compares two related malware samples to surface what changed between variants using section-level hashing, import-set differences, and fuzzy similarity scoring. | T1587.001, T1027, T1588.001 |
dumping-and-rebuilding-a-pe-from-memory |
Rebuilds a usable PE file from a memory dump by fixing the section alignment (virtual-to-raw), correcting the entry point, and preparing for import table reconstruction. | T1027.002, T1620, T1055.012 |
emulating-shellcode-with-unicorn |
Emulates position-independent shellcode in a controlled CPU emulator (Unicorn) to trace executed instructions, memory writes, and decoded second stages without running it on a real host. | T1027, T1620, T1055 |
extracting-encryption-keys-from-binaries |
Locates candidate encryption keys in a binary by finding high-entropy fixed-size regions (16/24/32 bytes) near cryptographic constants or crypto API references, and surfacing printable key/passphrase strings. | T1027, T1573, T1486 |
identifying-anti-debugging-techniques |
Identifies and bypasses anti-debugging and anti-analysis checks in malware: PEB flags, debugger-detection APIs, timing checks, and exception tricks, then neutralizes them to continue analysis. | T1622, T1497.001, T1027 |
identifying-cryptographic-routines-in-binaries |
Identifies cryptographic algorithms embedded in a binary by scanning for well-known constants and tables (AES S-box, SHA-256/MD5 init constants, ChaCha sigma, CRC32 table, base64 alphabet). | T1027, T1486, T1573 |
manually-unpacking-a-packed-binary |
Manually unpacks a runtime-packed Windows binary by finding the original entry point (OEP) through tail-jump and entropy analysis, then guiding a memory dump at OEP. | T1027.002, T1140, T1620 |
resolving-dynamic-api-hashing |
Resolves dynamically hashed Windows API names by brute-forcing observed hash constants against a wordlist of API/DLL names using common malware hashing algorithms (ROR13, djb2, FNV, CRC32). | T1027.007, T1106, T1140 |
reverse-engineering-arm-binaries |
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. | T1027, T1059, T1587.001 |
reverse-engineering-binaries-with-binary-ninja |
Reverse engineers binaries with Binary Ninja using its analysis stack and Python API to enumerate functions, navigate IL levels (LLIL/MLIL/HLIL), and automate annotation and extraction. | T1027, T1059, T1587.001 |
reverse-engineering-binaries-with-ghidra |
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. | T1027, T1140, T1480 |
reverse-engineering-binaries-with-radare2-rizin |
Reverse engineers binaries using radare2/rizin interactively, covering analysis initialization, navigation, disassembly and graph views, patching, and the visual mode workflow. | T1027, T1059, T1587.001 |
reverse-engineering-custom-c2-protocols |
Reverses proprietary command-and-control protocols: locating send/recv routines, recovering the message framing and encryption/encoding, and reconstructing the command set to build a decoder or emulator. | T1071, T1095, T1573 |
reverse-engineering-nim-and-other-exotic-binaries |
Reverse engineers malware written in less-common compiled languages (Nim, Crystal, V, Zig, D) by detecting language-specific runtime signatures, name-mangling, and runtime strings to orient analysis. | T1027, T1587.001, T1059 |
reverse-engineering-shellcode |
Analyzes position-independent shellcode: disassembling raw bytes at the right architecture, recognizing PEB-walk API resolution and egg hunters, and emulating execution to recover behavior and payloads. | T1055, T1106, T1027 |
scripting-ghidra-headless-analysis |
Automates batch reverse engineering by generating Ghidra analyzeHeadless commands and post-analysis script skeletons to import, auto-analyze, and export results for many samples without the GUI. | T1027, T1059, T1587.001 |
scripting-ida-with-idapython |
Automates IDA Pro analysis with IDAPython by generating scripts that enumerate functions, decode strings, rename by signature, and export analysis results, and by documenting the headless idat batch invocation. | T1027, T1059, T1620 |
solving-malware-with-symbolic-execution |
Uses symbolic execution (angr) to solve constraint-based malware problems — finding inputs that reach a target branch, recovering keys/passwords from a check routine, and brute-forcing opaque predicates — by generating a ready-to-edit angr harness. | T1027, T1480, T1140 |
unpacking-upx-and-common-packers |
Identifies and unpacks packed binaries: detecting packers from section names and entropy, automatically unpacking UPX, and manually unpacking custom packers by finding the OEP and dumping. | T1027.002, T1140, T1480 |
writing-yara-rules-from-reversed-code |
Turns reverse-engineering findings into durable YARA detections: selecting stable code constructs and constants over volatile strings, extracting opcode/byte patterns with wildcards, and validating rules for low false positives. | T1027.001, T1587.001 |
Threat Hunting
33 skills.
| Skill | What it does | ATT&CK |
|---|---|---|
building-a-threat-hunt-hypothesis |
Frames a structured, testable threat-hunting hypothesis: grounding it in adversary behavior and available telemetry, defining the data sources and detection logic, and setting success criteria and outcomes. | T1059, T1071 |
building-zeek-analytics-for-hunting |
Builds Zeek-based network hunting analytics by writing scripts and analyzing Zeek logs (conn, dns, http, ssl, files) to surface long connections, rare JA3s, suspicious downloads, and beaconing. | T1071, T1095, T1571 |
establishing-telemetry-baselines |
Establishes behavioral baselines from historical telemetry (process, network, or logon events) so hunts can flag rare and first-seen activity instead of relying on static signatures. | T1059, T1071, T1204 |
hunting-active-directory-attacks |
Hunts for Active Directory credential and replication attacks — DCSync, Golden/Silver Ticket, and DCShadow — by analyzing directory-service-access (4662), Kerberos TGS (4769), and logon (4624) events for replication abuse and forged-ticket anomalies. | T1003.006, T1558.001, T1207 |
hunting-anomalous-authentication-patterns |
Hunts for anomalous authentication such as password spraying, brute force, and impossible-travel logons by aggregating Windows logon success/failure events per account and source over time. | T1110.003, T1110, T1078 |
hunting-c2-beaconing-with-frequency-analysis |
Detects command-and-control beacons in network logs by analyzing connection timing: measuring inter-arrival intervals, accounting for jitter, and scoring regularity per source/destination pair to surface periodic callbacks. | T1071.001, T1071, T1573 |
hunting-cobalt-strike-traffic |
Hunts for Cobalt Strike beacon traffic by detecting default stager URI checksum8 values, default Malleable C2 profile artifacts, and default ports/named pipes in HTTP and process telemetry. | T1071.001, T1573, T1090 |
hunting-credential-dumping-activity |
Hunts for credential dumping by detecting LSASS process access with suspicious access masks, known dumping tool signatures, and comsvcs.exe MiniDump abuse in Sysmon Event ID 10 and process-creation telemetry. | T1003.001, T1003, T1003.002 |
hunting-data-staging-and-archiving |
Hunts for pre-exfiltration data staging and archiving by detecting archive-tool execution (rar, 7z, zip, tar), large compressed files written to staging directories, and collection into a single location before transfer. | T1074.001, T1560.001, T1560 |
hunting-dns-tunneling-and-exfiltration |
Detects DNS-based tunneling and data exfiltration in DNS logs: scoring high query volume to single domains, long/high-entropy subdomains, unusual record types, and encoded payload labels. | T1071.004, T1048.003, T1572 |
hunting-domain-fronting-and-cdn-abuse |
Hunts for domain fronting and CDN abuse by detecting TLS SNI versus HTTP Host header mismatches and high-reputation CDN domains carrying anomalous traffic in network telemetry. | T1090.004, T1071.001, T1573 |
hunting-fileless-and-in-memory-threats |
Hunts for fileless and in-memory threats by correlating PowerShell script-block logs, encoded-command usage, in-memory loading patterns, and registry-resident payloads from Windows telemetry. | T1059.001, T1620, T1112 |
hunting-from-a-threat-intel-report |
Operationalizes a threat intelligence report into hunts: extracting IOCs and TTPs, mapping behaviors to ATT&CK and available telemetry, prioritizing durable behavioral indicators over volatile atomic ones, and producing concrete hunt queries. | T1059, T1071, T1547 |
hunting-kerberoasting-and-ticket-attacks |
Hunts for Kerberoasting and related ticket attacks by analyzing Kerberos service ticket request events (4769) for weak encryption types, abnormal request volume per account, and non-machine accounts requesting many SPNs. | T1558.003, T1558, T1550.003 |
hunting-lateral-movement-over-smb-and-wmi |
Hunts for lateral movement via remote service creation, admin share writes, and remote WMI process creation by correlating Windows logon, service install, and process-creation events. | T1021.002, T1021.003, T1570 |
hunting-lolbin-abuse-on-windows |
Hunts for living-off-the-land binary (LOLBin) abuse in Windows process-creation telemetry by flagging trusted system binaries used with download, execution-proxy, or encoded-command arguments. | T1218, T1105, T1059 |
hunting-persistence-mechanisms-on-windows |
Hunts for Windows persistence across autostart locations: Run keys, services, scheduled tasks, WMI event subscriptions, and startup folders, baselining them to surface anomalous or recently added entries. | T1547.001, T1543.003, T1053.005, T1546.003 |
hunting-persistence-on-linux |
Hunts for Linux persistence by inspecting cron, systemd units, shell rc files, SSH authorized_keys, and common autostart locations for attacker-added entries. | T1053.003, T1543.002, T1098.004 |
hunting-process-injection-with-sysmon |
Hunts for process injection using Sysmon telemetry: correlating CreateRemoteThread (EID 8), suspicious cross-process access (EID 10), and RWX image-less memory to surface hollowing, shellcode injection, and APC abuse. | T1055, T1055.001, T1055.012 |
hunting-ransomware-precursor-behavior |
Hunts for ransomware precursor behavior that precedes encryption — shadow-copy and backup deletion, recovery disabling, security-tool tampering, and mass file modification — so the attack can be stopped before payload detonation. | T1490, T1489, T1486 |
hunting-scheduled-task-abuse |
Hunts for malicious scheduled task persistence by analyzing task registration events (4698) and schtasks process creation for suspicious actions, triggers, and hidden tasks. | T1053.005, T1053, T1059 |
hunting-suspicious-powershell-execution |
Hunts malicious PowerShell using script-block (EID 4104) and module logging: scoring encoded commands, download cradles, AMSI/logging bypass, and in-memory execution, then decoding payloads for triage. | T1059.001, T1027, T1562.001 |
hunting-unusual-outbound-connections |
Hunts for unusual outbound network connections by flagging direct-to-IP traffic, uncommon ports, rare destinations, high data-egress ratios, and connections from unexpected processes in network telemetry. | T1071, T1048, T1571 |
hunting-wmi-event-subscription-persistence |
Hunts for malicious WMI permanent event subscription persistence by correlating __EventFilter, CommandLineEventConsumer/ActiveScriptEventConsumer, and FilterToConsumerBinding records from Sysmon Event IDs 19/20/21 or WMI repository exports. | T1546.003, T1047, T1059 |
mapping-hunts-to-mitre-attack |
Maps hunts and detections to MITRE ATT&CK for coverage analysis: tagging hypotheses with techniques, building a coverage matrix from completed hunts, and identifying high-risk gaps to prioritize next. | T1059, T1047, T1071 |
operationalizing-a-hunt-into-a-detection |
Converts a successful threat hunt into a durable detection by extracting the discriminating logic, defining data sources and thresholds, and emitting a Sigma rule plus a test and tuning plan. | T1059, T1071, T1053 |
pivoting-on-iocs-across-data-sources |
Pivots on indicators of compromise across multiple data sources by correlating a seed set of IOCs against logs to find co-occurring indicators, hosts, and timeframes that expand the investigation. | T1071, T1041, T1105 |
profiling-a-threat-actor-from-ttps |
Profiles a threat actor by aggregating observed ATT&CK techniques into a TTP profile and comparing it against known-group technique sets to estimate similarity and candidate attribution. | T1059, T1071, T1583 |
tracking-adversary-infrastructure |
Tracks adversary C2 and staging infrastructure by clustering indicators on shared attributes (TLS/JARM, certificate fields, favicon hashes, ASN, registration patterns) to find related hosts. | T1583, T1583.001, T1071 |
tuning-detections-to-reduce-false-positives |
Tunes noisy detections by analyzing historical alert data to quantify false-positive sources, recommend allow-list filters and threshold adjustments, and measure precision impact. | T1059, T1071, T1053 |
validating-detections-with-atomic-tests |
Validates detection coverage by mapping Atomic Red Team tests to ATT&CK techniques, checking which of your detections cover each tested technique, and reporting coverage gaps. | T1059, T1003, T1053 |
writing-sigma-detection-rules |
Converts hunt findings into portable Sigma detection rules: choosing the right logsource, expressing robust selection/filter logic, setting level and ATT&CK tags, and validating before converting to a SIEM query. | T1059.001, T1547.001 |
writing-suricata-and-snort-rules |
Writes and validates Suricata/Snort IDS rules for network-based malware detection, covering rule anatomy, content/pcre matching, flow and threshold options, and common mistakes that cause false positives or no matches. | T1071.001, T1095, T1571 |