Deobfuscating Malicious Powershell
Deobfuscates malicious PowerShell by decoding -EncodedCommand, reversing string
Analyzing Rust Malware Internals
Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling
Analyzing Api Call Traces
Analyzes API call traces from a sandbox or API monitor (JSON) to group calls by
Building Config Extractors
Builds reusable malware configuration extractors by applying a declarative JSON spec
Analyzing Rat Command And Control
Analyzes remote access trojan command-and-control by mapping the RAT command set,
Analyzing Golang Malware Internals
Analyzes Go-compiled malware by recovering function names from the pclntab, detecting
Capturing And Analyzing Malware Network Traffic
Captures and analyzes malware network traffic from a detonation: extracting C2
Building A Threat Hunt Hypothesis
Frames a structured, testable threat-hunting hypothesis: grounding it in adversary
Analyzing Rich Header And Compiler Artifacts
Analyzes the PE Rich header and related compiler artifacts to fingerprint the build
Analyzing Mach O Binaries On Macos
Statically analyzes macOS Mach-O malware: parsing the header and load commands,
Analyzing Malicious Office Macros
Analyzes malicious Office documents by extracting and reviewing VBA macros and
Analyzing Malware In Memory With Volatility3
Analyzes a memory image with Volatility 3 to find malware: rogue processes,
Dissecting Boot And Kernel Rootkits
Analyzes bootkit and rootkit samples by identifying boot-process tampering (MBR/VBR/
Defanging And Sharing Iocs
Prepares indicators of compromise for safe sharing: defanging URLs, domains, IPs,
Analyzing Malicious Vbscript And Wsf
Analyzes malicious VBScript, WSF, and HTA scripts: parsing WSF/HTA containers,
Analyzing Malicious Lnk Files
Analyzes weaponized Windows shortcut (.lnk) files: parsing the shell link structure
Analyzing Malicious Pdfs
Analyzes malicious PDF documents: parsing the object structure for JavaScript,
Analyzing Malicious Onenote And Html Smuggling
Analyzes two modern delivery techniques: malicious OneNote (.one) attachments with
Analyzing Webshells
Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution
Deobfuscating Malicious Javascript
Deobfuscates malicious JavaScript from droppers, web pages, and HTA/scriptlets:
Bypassing Anti Vm And Sandbox Checks
Bypasses anti-VM and sandbox checks during analysis by locating the specific detection
Detecting Process Injection In Memory
Detects process injection in a memory image by identifying private executable regions
Defeating Control Flow Flattening
Defeats control-flow-flattening obfuscation by identifying the dispatcher/state-
Analyzing Compiled Python Malware
Analyzes Python-based malware packaged as PyInstaller/py2exe executables by detecting
Building Zeek Analytics For Hunting
Builds Zeek-based network hunting analytics by writing scripts and analyzing Zeek logs
Collecting Volatile Evidence From A Suspect Host
Collects volatile evidence from a potentially compromised host in correct order of
Building A Sample Management Workflow
Establishes a disciplined malware sample repository: content-addressed storage by
Debugging Malware With X64dbg
Uses x64dbg to dynamically debug Windows malware: setting strategic breakpoints
Dumping And Rebuilding A Pe From Memory
Rebuilds a usable PE file from a memory dump by fixing the section alignment
Analyzing Banking Trojan Webinjects
Analyzes banking trojan webinject configurations to extract targeted institutions,
Analyzing Loaders And Droppers
Analyzes loader and dropper samples by identifying staging behavior — embedded or
Analyzing Position Independent Code
Analyzes position-independent code and shellcode by identifying GetPC/PEB-walk
Analyzing Android Dex Malware
Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readable
Analyzing Infostealer Credential Theft
Analyzes infostealer samples by mapping the browser, credential store, wallet, and
Analyzing Java Jar Malware
Analyzes Java/JAR malware (such as Adwind/jRAT-class cross-platform RATs) by
Analyzing Dotnet Malware Internals
Reverses .NET/managed malware: decompiling MSIL back to C#, defeating common
Analyzing Pe Imports And Exports
Analyzes a PE file''s import and export tables to infer capability: mapping imported
Analyzing Ransomware Encryption Behavior
Analyzes how a ransomware sample encrypts files: identifying the crypto scheme
Defeating String And Api Obfuscation
Recovers obfuscated strings and resolves dynamically loaded APIs in malware:
Analyzing Wiper Malware
Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite
Diffing Malware Samples To Find Changes
Compares two related malware samples to surface what changed between variants using
Analyzing Malicious Iso And Container Files
Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads
Decrypting Embedded Configuration
Decrypts statically embedded malware configuration blobs by trying common schemes
Detecting Sandbox Evasion Behavior
Detects sandbox and analysis evasion techniques in a sample by scanning static
Analyzing Cryptominer Malware
Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints
Automating Analysis With R2pipe
Automates radare2/rizin analysis through r2pipe to script function enumeration, string
Analyzing Windows Driver Malware
Analyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE for
Analyzing Excel 4 Macro Malware
Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet
Analyzing Authenticode Signatures
Analyzes Windows Authenticode signatures on PE files: checking for a signature,
Analyzing Elf Binaries On Linux
Statically analyzes Linux ELF malware: ELF header and sections, dynamic symbols