Results for “analysis”

Automates packet capture analysis using tshark and pyshark to extract protocol statistics, detect suspicious flows, identify IOCs, and analyze DNS anomalies from PCAP files.

Provides a command-line workflow for binary analysis with radare2, covering reconnaissance, disassembly, function analysis, string and import inspection, patching, binary diffing, and r2pipe scripting across PE, ELF, Mach-O, DEX, and WASM formats.

Projects external audit findings from SARIF static analysis results and weAudit annotation files onto Trailmark code graphs as annotations and subgraphs, enabling cross-referencing with pre-analysis data like blast radius and taint.

Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure for detection development and threat intelligence.

Deploy Nozomi Networks Guardian sensors for passive OT network traffic analysis to achieve asset visibility, threat detection, and vulnerability assessment across industrial control systems.

Ports existing Semgrep rules to new target languages with applicability analysis and test-driven validation.

Detect Cobalt Strike beacon network activity using TLS certificate signatures, JA3/JA3S/JARM fingerprints, HTTP C2 profile matching, beacon jitter analysis, and named pipe detection via Zeek, Suricata, and Python PCAP analysis.

Conducts HIPAA risk analysis per 45 CFR §164.308(a)(1) following OCR guidance methodology. Covers threat identification, vulnerability assessment, likelihood and impact determination, risk scoring, and mitigation planning for electronic protected health information. Keywords: HIPAA risk analysis, OCR guidance, threat assessment, vulnerability, risk management, ePHI.

Build a comprehensive catalog of API endpoints including documented, undocumented, shadow, zombie, and deprecated APIs using passive traffic analysis, active scanning, DNS enumeration, JavaScript analysis, and cloud resource inventory.

Extracts and analyzes firmware images using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis, recursive extraction, filesystem mounting, and string analysis for credential and configuration discovery.

Automates static analysis of Android APK/AAB files using MobSF to identify hardcoded secrets, insecure permissions, vulnerable components, and weak cryptography for pre-deployment security assessments or CI/CD integration.

Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.

Analyze text and images for harmful content using Azure AI Content Safety, with customizable blocklists and severity thresholds.

Guides authorized RF/SDR security research for signal identification, demodulation analysis, and replay feasibility studies in shielded lab environments.

Reverse engineers stripped Go and Rust binaries by recovering runtime metadata, symbols, panic strings, and idiomatic decompilation patterns.

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns with proper testing and validation.

Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral heuristics.

Analyzes code for logical errors, race conditions, security vulnerabilities, and algorithmic flaws using structured reasoning across 9 risk categories.

Automate VirusTotal threat intelligence operations through Composio's toolkit via Rube MCP, including file scanning, URL analysis, and report retrieval.

Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.

Parse, analyze, and process SARIF files from static analysis tools like CodeQL and Semgrep, including filtering, deduplication, aggregation, and CI/CD integration.

Runs Semgrep static analysis with custom YAML rules, supporting taint tracking, metavariable comparisons, and pattern-not-inside exclusions for precise vulnerability detection.

Performs structured code reviews of git branches, tracking findings in a living document and optionally running deep architectural analysis with subagents.

Evaluate industry dynamics and market attractiveness by analyzing competitive rivalry, supplier power, buyer power, threat of substitutes, and threat of new entrants.

Analyze a project's past sessions, memory files, and existing local skills to recommend the highest-value skills to create or update.

Identifies and unpacks UPX-packed and other packed malware samples to expose the original executable code for static analysis.

Capture and analyze network traffic using Wireshark and tshark to reconstruct network events, extract artifacts, and identify malicious communications.

Guides authorized macOS and Mach-O reverse engineering covering codesign analysis, Objective-C/Swift symbol recovery, endpoint security surfaces, and Apple platform malware analysis.

Runs Semgrep static analysis to find bugs and security vulnerabilities, with guidance on installation, rule selection, custom rule writing, and CI/CD integration.

Provides a complete workflow for IDA Pro reverse engineering of binaries (PE, ELF, APK, DLL, SO, firmware) using bundled PowerShell scripts to manage the MCP server and open files, then leverages 72 MCP tools for survey, decompilation, cross-references, data-flow tracing, patching, and reporting.

Builds and queries multi-language source code graphs for security analysis, including blast radius, taint propagation, privilege boundaries, and entry point enumeration.

Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.

Identify AWS IAM privilege escalation paths by analyzing policies for dangerous permission combinations and least-privilege violations using boto3 and Cloudsplaining-style analysis.

Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability detection across repositories at enterprise scale.

Guides authorized digital forensics and incident response workflows including memory dump analysis, disk timeline creation, PCAP investigation, and artifact triage with evidence preservation.

Audits .NET test mock usage by tracing each mock setup through the production code's execution path to find dead, unreachable, redundant, or replaceable mocks.