Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, and infrastructure (primary servers, fallback domains, dead drops). Use after reverse engineering reveals network traffic needing protocol analysis or when building…
A malware-analysis guide for bootkits and rootkits, malicious software that hides or persists below or alongside the operating system. It covers master boot records, volume boot records, UEFI firmware, and kernel-level evidence.
Analyzes a memory image with Volatility 3 to find malware: rogue processes, injected code, suspicious network connections, loaded modules, and persistence, then extracts artifacts for further analysis. Activates for requests to do memory forensics, analyze a RAM dump, or hunt malware in memory with Volatility.
Analyzes how a ransomware sample encrypts files: identifying the crypto scheme (symmetric/asymmetric/hybrid), key handling, file targeting and extension/marker changes, shadow-copy deletion, and ransom-note artifacts. Activates for requests to analyze ransomware encryption, assess decryptability, or study ransomware…
Create, validate, and structure CodeMachine AI orchestrator workflow packages. Use when the user asks to build a CodeMachine workflow, write a .workflow.js file, define agents for CodeMachine, scaffold a codemachine package, or create multi-agent pipelines with CodeMachine CLI. Also triggers for: codemachine template…
Assembly language patterns, calling conventions, and code structure for x86-64 and ARM64. Use when writing, reviewing, or generating .asm/.s/.S files; when implementing functions that interoperate with C/system code; or when establishing correct prologues, epilogues, stack management, SIMD loops, syscall stubs, or PIC…
Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and support recovery efforts. Covers AES, RSA, ChaCha20, and hybrid encryption schemes. Activates for requests involving ransomware…
Defensive malware analysis and reverse-engineering workflow. Use for authorized lab analysis of suspicious Windows executables, DLLs, shellcode, packed samples, malicious documents, indicators of compromise, static and dynamic triage, IDA/Ghidra/debugger reasoning, anti-analysis handling, unpacking, host/network…
Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon…