Results for “file-system”

Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral heuristics.

Deploys and configures host-based intrusion detection systems (Wazuh, OSSEC, AIDE) to monitor file integrity, system calls, and configuration changes across endpoints. Includes FIM policies, rootkit detection, custom alert rules, active response, and SIEM integration.

Baseline the EFI System Partition and hunt malicious EFI binaries (ESPecter, BlackLotus, Bootkitty, Glupteba) by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and detecting anomalous non-EFI files.

Conducts disk forensics investigations using forensic imaging, file system analysis, artifact recovery, and timeline reconstruction to support incident response cases.

Prevents destructive operations when working on production systems or running agents autonomously by intercepting risky commands and restricting file edits to a specified directory.

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring.

Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques.

Prevents destructive operations on production systems and restricts edits to a specified directory when running agents autonomously.

Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.

Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.

Systematically fuzz web applications for hidden content and input validation vulnerabilities across directories, files, parameters, and authentication bypasses.

Systematically audits a web application against the OWASP 2021 Top 10, producing severity-rated, file-level findings with fixes for each category.

Extracts and analyzes firmware images using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis, recursive extraction, filesystem mounting, and string analysis for credential and configuration discovery.

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

CLI interface for igf (Grapefruit) dynamic instrumentation server. Use to enumerate Frida devices, list apps, run hooks, query logs, access device file systems, inspect classes, dump memory, and perform mobile app security analysis.

Design the architecture for a multi-command skill system — the shared state schema, the command map, the router, and the boundary each command stops at — before any skill files get written. Use when the user wants to turn one skill into a system, combine several related or overlapping skills into a single coherent one, build a skill with subcommands (like `/thing audit`, `/thing polish`), design a suite, family, or collection of skills, or asks "how should I structure this skill set". Also trigger on "skill system", "skill architecture", "multi-command skill", "system of skills", "make these skills work together", "skill with slash commands", or complaints that their skills overlap, collide, duplicate each other, or never fire. Produces an architecture spec only — it never writes SKILL.md or reference files. Hand the finished spec to skill-creator to build from.

Detect unauthorized modifications to running containers by monitoring for binary execution drift, file system changes, and configuration deviations from the original container image.

Build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across file systems, logs, and artifacts into a unified chronological view.

Analyzes firmware images for embedded malware, backdoors, and unauthorized modifications targeting routers, IoT devices, UEFI/BIOS, and embedded systems. Covers firmware extraction, filesystem analysis, binary reverse engineering, and bootkit detection.

Executes malware samples in Cuckoo Sandbox to observe runtime behavior including process creation, file system modifications, registry changes, network communications, and API calls. Generates comprehensive behavioral reports for malware classification and IOC extraction.