Video & Animation

Query the Malpedia API to look up malware family aliases and naming

Perform static analysis of malicious PDF documents using peepdf, pdfid,

URLScan.io is a free service for scanning and analyzing suspicious URLs.

Examine Linux system artifacts (auth logs, cron/systemd persistence,

Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware,

Detect kernel-level rootkits in Linux memory dumps using Volatility3

Analyze Windows LNK shortcut files and Jump List artifacts with LECmd,

Uses the Linux Audit framework (auditd) with ausearch and aureport utilities

>-

Analyzes indicators of compromise (IOCs) including IP addresses, domains,

Analyzes malicious VBA macros embedded in Microsoft Office documents

Detonate malware samples in Cuckoo Sandbox to observe runtime behavior

Perform static and symbolic analysis of Solidity smart contracts using

Parse and analyze email headers (Received chain, Return-Path, Message-ID)

>-

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo

Investigate compromised Docker containers by analyzing images, layers,

Detect and analyze heap spray attacks in memory dumps using Volatility3

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.

Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

Monitor Certificate Transparency logs using crt.sh and Certstream to

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.

Extract and analyze Cobalt Strike beacon configuration from PE files