Vulnerability Scanning Agent Skills

Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate network detection signatures.

Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports.

Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, and protocol abuse for C2 and data exfiltration.

Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity, publish date heuristics, and download count anomalies.

Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.

Configure Cloudflare DDoS protection with managed rulesets, rate limiting, WAF rules, Bot Management, and origin protection to mitigate volumetric, protocol, and application-layer attacks.

Enumerate DNS records, attempt zone transfers, brute-force subdomains, and map DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.

Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance, scanning, exploitation, and reporting.

Analyze volatile memory dumps using Volatility 3 to extract running processes, network connections, loaded modules, and evidence of malicious activity.

Analyze Siemens S7comm and S7CommPlus protocol traffic to identify vulnerabilities such as replay attacks, integrity bypass, unauthorized CPU stop commands, and program download manipulation in SIMATIC S7 PLCs.

Scan open-source dependencies for known vulnerabilities using Snyk, including CI/CD integration, automated fix PRs, license compliance, and continuous monitoring.

Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.

Detect typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations and identify registered lookalike domains targeting your organization.

Track vulnerability aging and SLA compliance with severity-based remediation timelines, automated escalations, and compliance metrics.

Installs, configures, and tunes Snort 3 intrusion detection system to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins on authorized network segments.

Detects defense evasion techniques in endpoint logs, including log tampering, timestomping, process injection, and security tool disabling, using Sysmon, EDR telemetry, and SIEM queries.

Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.

Exploits the MS17-010 (EternalBlue) vulnerability in Microsoft's SMBv1 implementation for authorized security testing, red team exercises, and penetration testing engagements.

Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.

Systematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services, startup folders, and WMI subscriptions.

Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.

Configure Proofpoint Targeted Attack Protection (TAP) to detonate suspicious attachments and URLs in isolated sandboxes, integrate with email flow, analyze reports, and tune detection policies.

Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.

Detects and exploits ransomware kill switch mechanisms including mutex-based execution guards, domain-based kill switches, and registry-based termination checks. Implements proactive mutex vaccination and kill switch domain monitoring to prevent ransomware from executing.

Detect brand impersonation attacks across domains, social media, mobile apps, and dark web channels to identify phishing campaigns, fake sites, and unauthorized brand usage.

Systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardcoded keys, insufficient entropy, and protocol misconfigurations.

Prioritizes and remediates endpoint vulnerabilities by importing scan results, applying patches via WSUS/SCCM/Intune, making configuration changes, and validating fixes.

Enrich IP addresses with Shodan API data to identify open ports, running services, known vulnerabilities, and hosting context for threat intelligence and incident triage.

Deploy Zeek network security monitor to capture, parse, and analyze network traffic metadata for threat detection, anomaly identification, and forensic investigation.

Conduct authenticated and unauthenticated vulnerability scans using Tenable Nessus to identify known vulnerabilities, misconfigurations, and missing patches, with prioritized remediation guidance.

Reverse engineer malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify malicious functionality including data theft, C2 communication, privilege escalation, and overlay attacks.

Executes malware samples in Cuckoo Sandbox to observe runtime behavior including process creation, file system modifications, registry changes, network communications, and API calls. Generates comprehensive behavioral reports for malware classification and IOC extraction.

Audit Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.

Automates the collection of suspicious files from endpoints and email gateways, submission to sandbox and multi-engine scanners, and generation of verdicts with IOCs for SIEM integration.

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.

Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.