Results for “malfind”

Query the Malpedia API to research malware family relationships, track variant evolution, link families to threat actors, and integrate YARA rules for detection across malware lineages.

Lint and format Python code for Megatron-LM using ruff, black, isort, pylint, and mypy, with commands for autoformatting and import ordering.

Analyzes malicious Linux ELF binaries including botnets, cryptominers, ransomware, and rootkits targeting servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples.

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.

Bulk-load text files into MariaDB tables using the mariadb-import client, covering table-name-from-filename rules, TAB defaults, --local vs server-side reads, duplicate handling, and parallel loads.

Convert chemical structures (SMILES or RDKit molecules) into numerical representations for machine learning using 100+ featurizers, including ECFP, MACCS, descriptors, and pretrained models like ChemBERTa.

Guides authorized macOS and Mach-O reverse engineering covering codesign analysis, Objective-C/Swift symbol recovery, endpoint security surfaces, and Apple platform malware analysis.

Recover metadata and content of deleted files from NTFS volumes by analyzing the Master File Table, $LogFile, $UsnJrnl, and MFT slack space using forensic tools like MFTECmd and analyzeMFT.

Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis.

Molecular featurization for ML (100+ featurizers). ECFP, MACCS, descriptors, pretrained models (ChemBERTa), convert SMILES to features, for QSAR and molecular ML.

Molecular featurization for ML (100+ featurizers). ECFP, MACCS, descriptors, pretrained models (ChemBERTa), convert SMILES to features, for QSAR and molecular ML.

Extracts and analyzes malicious VBA macros, XLM macros, DDE, and remote template injections in Microsoft Office documents using olevba, oledump, and deobfuscation techniques to identify download cradles, payload execution, and persistence mechanisms.

Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.

Generate one high-value follow-up workflow proposal when MoonMind execution quality issues are detected in a run.

Featurização molecular para ML (100+ featurizadores). ECFP, MACCS, descritores, modelos pré-treinados (ChemBERTa), converter SMILES em features, para QSAR e ML molecular.

Analyzes firmware images for embedded malware, backdoors, and unauthorized modifications targeting routers, IoT devices, UEFI/BIOS, and embedded systems. Covers firmware extraction, filesystem analysis, binary reverse engineering, and bootkit detection.

Local hybrid search for markdown notes and docs. Use when searching notes, finding related content, or retrieving documents from indexed collections.

Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.

Use when performing multiple sequence alignment on nucleotide or protein sequences, such as preparing alignments for phylogenetic analysis or comparative genomics.

Molecular featurization for ML (100+ featurizers). ECFP, MACCS, descriptors, pretrained models (ChemBERTa), convert SMILES to features, for QSAR and molecular ML.

Convert chemical structures (SMILES or RDKit molecules) into numerical representations for machine learning, covering 100+ featurizers including ECFP, MACCS, descriptors, and pretrained models like ChemBERTa, with support for QSAR modeling and virtual screening.

Molecular featurization for ML (100+ featurizers). ECFP, MACCS, descriptors, pretrained models (ChemBERTa), convert SMILES to features, for QSAR and molecular ML.

SLURM EDF job must use marker names from CHANNELNAMES.txt for output files. Trigger: EDF output naming, SLURM job producing CH#_edf.tif instead of marker names, downstream _find_edf_file failures

Conduct authorized red team initial access using EvilGinx3 adversary-in-the-middle phishing to capture session tokens and bypass multi-factor authentication.

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk.

Use when running HMMER master or worker daemon services that front `phmmer`, `hmmsearch`, and `hmmscan` against cached databases.

Analyze suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior detection.

Conduct passive OSINT reconnaissance on target organizations using a MITRE ATT&CK framework. Discovers employees, email patterns, subdomains, infrastructure, leaked credentials, and cloud assets with confidence-scored findings.

Local search/indexing CLI (BM25 + vectors + rerank) with MCP mode.

Indexes local files and searches them with BM25, vector, and hybrid queries, plus MCP mode.

Optional low-priority poller that inventories Worklink tool pins from <home>/worklink.yaml and files/reuses Chainlink bump issues when upstream versions drift. Opt-in: copy this directory into <home>/skills/worklink-tool-pins/ and configure tool_pins in worklink.yaml.

Maps a codebase into feature-grouped flowcharts, identifies duplicated concerns across features, and proposes a unified architecture with handoff prompts for refactoring.

Systems ML and hardware-aware optimization specialist. Use when the user asks to talk to Killjoy, requests the systems researcher, or needs compute-aware architecture tradeoffs, distributed training, and inference optimization.

Use when annotating VCF files with flanking sequence information (INFO/FS tag) or masking regions/variants in flanking sequences.

Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.