Results for “yara”
23 skills
trailofbits Yara Rule Authoring
Write high-quality YARA-X detection rules for malware identification, covering naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction.
6k · bundle
mukul975 Performing Threat Hunting With Yara Rules
Scan files, directories, and memory dumps using YARA rules to identify malware families, suspicious patterns, and IOC matches.
24.6k · bundle
mukul975 Performing Malware Triage With Yara
Rapidly classify malware samples against known family signatures using YARA rules, covering rule writing, scanning, and integration with analysis pipelines.
24.6k · bundle
mukul975 Performing Yara Rule Development For Detection
Develop precise YARA rules for malware detection by identifying unique byte patterns, strings, and behavioral indicators in executable files while minimizing false positives.
24.6k · bundle
zhaoxuya520 Malware Analysis
Analyze suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior detection.
12.8k · bundle
mukul975 Analyzing Malware Family Relationships With Malpedia
Query the Malpedia API to research malware family relationships, track variant evolution, link families to threat actors, and integrate YARA rules for detection across malware lineages.
24.6k · bundle
More results
mukul975 Performing Malware Hash Enrichment With Virustotal
Enrich malware file hashes using the VirusTotal API to retrieve detection rates, behavioral analysis, YARA matches, and contextual threat intelligence for incident triage and IOC validation.
24.6k · bundle
zhaoxuya520 Threat Hunting
Guides blue-team threat hunting and detection engineering with hypothesis-driven workflows, Sigma/YARA rule creation, SIEM query design, and validation using Atomic Red Team in authorized environments.
12.8k · bundle
google Detection Engineering Coverage Evaluation
Automates detection engineering workflows in Google SecOps by extracting threat intelligence, generating detection opportunities, simulating attacker behavior with synthetic events, evaluating rule coverage, and creating new YARA-L 2.0 rules to close gaps.
14.4k
mukul975 Hunting Bootkits In Efi System Partition
Baseline the EFI System Partition and hunt malicious EFI binaries (ESPecter, BlackLotus, Bootkitty, Glupteba) by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and detecting anomalous non-EFI files.
24.6k · bundle
mukul975 Eradicating Malware From Infected Systems
Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.
24.6k · bundle
mukul975 Conducting Malware Incident Response
Responds to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing eradication procedures.
24.6k · bundle
mukul975 Performing Malware Persistence Investigation
Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.
24.6k · bundle
mukul975 Conducting Memory Forensics With Volatility
Analyze RAM dumps with Volatility 3 to detect malware, process injection, network connections, and credential theft during incident response.
24.6k · bundle
mukul975 Performing Memory Forensics With Volatility3
Analyze volatile memory dumps using Volatility 3 to extract running processes, network connections, loaded modules, and evidence of malicious activity.
24.6k · bundle
mukul975 Performing Memory Forensics With Volatility3 Plugins
Analyze memory dumps using Volatility3 plugins to detect injected code, rootkits, credential theft, and malware artifacts in Windows, Linux, and macOS memory images.
24.6k · bundle
mukul975 Performing Malware Ioc Extraction
Analyze malicious software to extract actionable indicators of compromise including file hashes, network indicators, registry modifications, and embedded strings, formatted as STIX 2.1 indicators.
24.6k · bundle
mukul975 Analyzing Uefi Bootkit Persistence
Analyzes UEFI bootkit persistence mechanisms including firmware implants, ESP modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families, forensic inspection, and integrity verification.
24.6k · bundle
mukul975 Analyzing Memory Dumps With Volatility
Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials.
24.6k · bundle
mukul975 Extracting Iocs From Malware Samples
Extracts indicators of compromise (IOCs) from malware samples, including file hashes, network indicators, host artifacts, and behavioral patterns for threat intelligence sharing and detection rule creation.
24.6k · bundle
mukul975 Reverse Engineering Malware With Ghidra
Reverse engineer malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level.
24.6k · bundle
mukul975 Building Attack Pattern Library From Cti Reports
Extract and catalog attack patterns from cyber threat intelligence reports into a structured STIX-based library mapped to MITRE ATT&CK for detection engineering and threat-informed defense.
24.6k · bundle
mukul975 Analyzing PDF Malware With Pdfid
Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis.
24.6k · bundle