Results for “memo”

Proactively hunts for Advanced Persistent Threat activity using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts.

Diagnose and fix SwiftUI performance issues like slow rendering, janky scrolling, and high CPU/memory usage through code review and profiling guidance.

CLI interface for igf (Grapefruit) dynamic instrumentation server. Use to enumerate Frida devices, list apps, run hooks, query logs, access device file systems, inspect classes, dump memory, and perform mobile app security analysis.

Perform coverage-guided fuzzing of compiled binaries using AFL++ to discover memory corruption, crashes, and security vulnerabilities.

Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

Orchestrates Gemini 3 Flash to audit Linux Kernel patches for memory safety, detect cost drifts in Terraform plans, and generate hardened Kubernetes security contexts.

Diagnoses Linux server issues across CPU, memory, disk, I/O, and network, and manages systemd services, SSH, and Fail2Ban on Ubuntu, Debian, and AlmaLinux.

Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency auditing, and a 60+ item security checklist.

Audits a codebase for scalability bottlenecks, flagging N+1 queries, missing indexes, unbounded result sets, blocking operations, and memory pressure, then outputs a prioritized fix list.

Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.

Analyze PLC firmware for security vulnerabilities including hardcoded credentials, insecure updates, backdoors, memory corruption, and undocumented debug interfaces using static and dynamic analysis techniques.

Extract Kerberos tickets from LSASS memory, inject them into an attacker session, and perform lateral movement to access remote systems as the impersonated user.

Extract embedded configuration from Agent Tesla RAT samples including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints using .NET decompilation and memory analysis.

Analyzes bootkit and rootkit malware that infects MBR, VBR, or UEFI firmware for pre-OS persistence, covering boot sector analysis, UEFI module inspection, and anti-rootkit detection.

Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.

Integrate AFL++ coverage-guided fuzz testing into CI/CD pipelines to discover memory corruption, input handling, and logic vulnerabilities in C/C++ and compiled applications.

Code review specialist for quality standards, design patterns, security review, and constructive feedbackUse when "code review, pull request, PR review, code quality, refactor, technical debt, design pattern, best practice, code-review, quality, patterns, security, refactoring, best-practices, pull-request, review, ml-memory" mentioned.

Perform runtime iOS app security assessments using Objection and Frida to inspect keychain, filesystem, and memory, bypass client-side protections, and evaluate data storage, network, and authentication controls during authorized penetration tests.

Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Provides detection rules for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware.

Executes malware samples in Cuckoo Sandbox to observe runtime behavior including process creation, file system modifications, registry changes, network communications, and API calls. Generates comprehensive behavioral reports for malware classification and IOC extraction.

Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.

Blog and web-content system for agency work — plan topics, interview the author for their real take, brief the angle, draft the article, plan images, verify claims, score drafts for quality and AI tells, revise, publish, and refresh aging posts. Shorthand "wltbo" also triggers it. Commands share a per-client memory of brand voice, the author's positions and stories, verified facts with expiry dates, and every published post. Use for blog posts, articles, long-form content, refreshes, keyword targeting, search intent, titles and H1s, meta descriptions, internal linking, cannibalization checks, E-E-A-T, and information gain. Also use when the complaint is "it doesn't sound like us", "it reads AI-written", "it's generic", "we already wrote this one", "the facts are made up", "there are no images", "it's too thin", or "nobody thought this through". Not for social posts, emails, internal comms, case studies (case-study-builder), site audits (website-audit), or content calendars (content-strategy).