Mikaru0Mystic
- 28 skills
- 0 followers
- 1 day ago last updated
- ▌ Cybersecurity · mikaru0mystic bundleUltimate AI-powered cybersecurity code review skill. Performs comprehensive security audit across 8 dimensions: vulnerability detection (OWASP Top 10:2021, CWE Top 25:2024), secret scanning, dependency/supply chain analysis, IaC security, threat intelligence (malware/backdoor/C2 detection, MITRE ATT&CK mapping), authorization verification, AI-generated code audit, and compliance mapping. Spawns 8 parallel specialist agents with weighted scoring (0-100). Framework-aware false-positive suppression. STRIDE threat modeling. Complements GitHub Advanced Security. Use when user says "security audit", "security review", "cybersecurity", "check for vulnerabilities", "OWASP check", "secure this code", "find security issues", "pentest review", "threat model", "security scan", "check security", "vulnerability scan", "code security", "appsec review", "supply chain check", "secret scan", "hardcoded credentials".
- ▌ Analyzing Linux Kernel Rootkits · mikaru0mystic bundleDetect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.
- ▌ Analyzing Indicators Of Compromise · mikaru0mystic bundleAnalyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.
- ▌ Performing User Behavior Analytics · mikaru0mystic bundlePerforms User and Entity Behavior Analytics (UEBA) to detect anomalous user activities including impossible travel, unusual access patterns, privilege abuse, and insider threats using SIEM-based behavioral baselines and statistical analysis. Use when SOC teams need to identify compromised accounts or insider threats through deviation from established behavioral norms.
- ▌ Analyzing Dns Logs For Exfiltration · mikaru0mystic bundleAnalyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.
- ▌ Analyzing Windows Amcache Artifacts · mikaru0mystic bundleParses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application installation, and driver loading for digital forensics investigations. Uses Eric Zimmerman's AmcacheParser and Timeline Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and timeline reconstruction. Activates for requests involving Amcache forensics, program execution evidence, Windows artifact analysis, or application compatibility cache investigation.
- ▌ Analyzing Active Directory Acl Abuse · mikaru0mystic bundleDetect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths
- ▌ Analyzing Docker Container Forensics · mikaru0mystic bundleInvestigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.
- ▌ Analyzing Windows Shellbag Artifacts · mikaru0mystic bundleAnalyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.
- ▌ Performing Container Escape Detection · mikaru0mystic bundleDetects container escape attempts by analyzing namespace configurations, privileged container checks, dangerous capability assignments, and host path mounts using the kubernetes Python client. Identifies CVE-2022-0492 style escapes via cgroup abuse. Use when auditing container security posture or investigating escape attempts.
- ▌ Analyzing Windows Prefetch With Python · mikaru0mystic bundleParse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
- ▌ Recovering Deleted Files With Photorec · mikaru0mystic bundleRecover deleted files from disk images and storage media using PhotoRec's file signature-based carving engine regardless of file system damage.
- ▌ Reverse Engineering IOS App With Frida · mikaru0mystic bundleReverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing authorized iOS penetration testing, analyzing proprietary protocols, understanding obfuscated logic, or extracting runtime secrets from iOS binaries. Activates for requests involving iOS reverse engineering, Frida iOS hooking, Objective-C/Swift method tracing, or iOS binary analysis.
- ▌ Analyzing Cloud Storage Access Patterns · mikaru0mystic bundleDetect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetObject spikes), and potential data exfiltration using statistical baselines and time-series anomaly detection.
- ▌ Analyzing Usb Device Connection History · mikaru0mystic bundleInvestigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable media usage and potential data exfiltration.
- ▌ Analyzing Network Flow Data With Netflow · mikaru0mystic bundleParse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and periodic timing patterns.
- ▌ Analyzing Windows Registry For Artifacts · mikaru0mystic bundleExtract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
- ▌ Conducting Post Incident Lessons Learned · mikaru0mystic bundleFacilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.
- ▌ Analyzing Azure Activity Logs For Threats · mikaru0mystic bundleQueries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.
- ▌ Analyzing Outlook Pst For Email Forensics · mikaru0mystic bundleAnalyze Microsoft Outlook PST and OST files for email forensic evidence including message content, headers, attachments, deleted items, and metadata using libpff, pst-utils, and forensic email analysis tools for legal investigations and incident response.
- ▌ Analyzing Powershell Script Block Logging · mikaru0mystic bundleParse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.
- ▌ Analyzing Browser Forensics With Hindsight · mikaru0mystic bundleAnalyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.
- ▌ Performing Access Review And Certification · mikaru0mystic bundleConduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles. This skill covers review campaign design, reviewer selection, risk-based p
- ▌ Performing Privileged Account Access Review · mikaru0mystic bundleConduct systematic reviews of privileged accounts to validate access rights, identify excessive permissions, and enforce least privilege across PAM infrastructure.
- ▌ Analyzing Prefetch Files For Execution History · mikaru0mystic bundleParse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.
- ▌ Analyzing Slack Space And File System Artifacts · mikaru0mystic bundleExamine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.
- ▌ Analyzing Memory Forensics With Lime And Volatility · mikaru0mystic bundlePerforms Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems.
- ▌ Analyzing IOS App Security With Objection · mikaru0mystic bundleRuntime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.