[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73FHC694PFWN54W0V8QHS6R":3,"skill-same:01M73FHC694PFWN54W0V8QHS6R":102},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":53,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M73FHC694PFWN54W0V8QHS6R","reverse-engineering-rust-malware",null,"Reverse engineer Rust-compiled malware using IDA Pro and Ghidra with techniques for handling non-null-terminated strings, crate dependency extraction, and Rust-specific control flow analysis.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Freverse-engineering-rust-malware\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Freverse-engineering-rust-malware\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: reverse-engineering-rust-malware\ndescription: Reverse engineer Rust-compiled malware using IDA Pro and Ghidra with\n  techniques for handling non-null-terminated strings, crate dependency extraction,\n  and Rust-specific control flow analysis.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- rust\n- reverse-engineering\n- malware-analysis\n- ghidra\n- ida-pro\n- binary-analysis\n- rust-malware\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1027\n- T1055\n- T1140\n- T1497\nsource: https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\nsource_commit: 04450304b12645cb2b974ab96d28c0664758a88d\n---\n# Reverse Engineering Rust Malware\n\n## Overview\n\nRust has become increasingly popular for malware development due to its cross-compilation, memory safety guarantees, and the complexity it introduces for reverse engineers. Rust binaries contain the entire standard library statically linked, producing large binaries with extensive boilerplate code. Key challenges include non-null-terminated strings (Rust uses fat pointers with pointer+length), monomorphization generating duplicated generic code, complex error handling (Result\u002FOption unwrap chains), and unfamiliar calling conventions. Decompiling Rust to C produces unhelpful output compared to C\u002FC++ binaries. Tools like Ghidra scripts for crate extraction, and training focused on Rust-specific patterns (2024-2025) help address these challenges. Notable Rust malware includes BlackCat\u002FALPHV ransomware, Hive ransomware variants, and Buer Loader.\n\n\n## When to Use\n\n- When performing authorized security testing that involves reverse engineering rust malware\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- IDA Pro 8.0+ or Ghidra 11.0+\n- Rust toolchain for reference compilation\n- Python 3.9+ for helper scripts\n- Understanding of Rust memory model (ownership, borrowing)\n- Familiarity with Rust string types (String, &str, CString)\n\n## Workflow\n\n### Step 1: Identify and Parse Rust Binary Metadata\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Analyze Rust malware binary metadata and extract crate dependencies.\"\"\"\nimport re\nimport sys\nimport json\n\n\ndef identify_rust_binary(data):\n    \"\"\"Check if binary is Rust-compiled and extract version info.\"\"\"\n    indicators = {\n        \"rust_panic_strings\": bool(re.search(rb'panicked at', data)),\n        \"rust_unwrap\": bool(re.search(rb'called.*unwrap.*on.*None', data)),\n        \"core_panic\": bool(re.search(rb'core::panicking', data)),\n        \"std_rt\": bool(re.search(rb'std::rt::lang_start', data)),\n        \"cargo_path\": bool(re.search(rb'\\.cargo[\u002F\\\\]registry', data)),\n        \"rustc_version\": None,\n    }\n\n    version = re.search(rb'rustc\\s+(\\d+\\.\\d+\\.\\d+)', data)\n    if version:\n        indicators[\"rustc_version\"] = version.group(1).decode()\n\n    is_rust = sum(1 for v in indicators.values() if v) >= 2\n    return is_rust, indicators\n\n\ndef extract_crates(data):\n    \"\"\"Extract Rust crate (dependency) names from binary strings.\"\"\"\n    crate_pattern = re.compile(\n        rb'(?:crates\\.io-[a-f0-9]+\u002F|\\.cargo\u002Fregistry\u002Fsrc\u002F[^\u002F]+\u002F)'\n        rb'([\\w-]+)-(\\d+\\.\\d+\\.\\d+)'\n    )\n    crates = {}\n    for match in crate_pattern.finditer(data):\n        name = match.group(1).decode()\n        version = match.group(2).decode()\n        crates[name] = version\n\n    # Also check for common malware-relevant crates\n    suspicious_crates = {\n        \"reqwest\": \"HTTP client\",\n        \"hyper\": \"HTTP library\",\n        \"tokio\": \"Async runtime\",\n        \"aes\": \"AES encryption\",\n        \"chacha20\": \"ChaCha20 encryption\",\n        \"rsa\": \"RSA encryption\",\n        \"ring\": \"Crypto library\",\n        \"base64\": \"Base64 encoding\",\n        \"winapi\": \"Windows API bindings\",\n        \"winreg\": \"Registry access\",\n        \"sysinfo\": \"System information\",\n        \"screenshots\": \"Screen capture\",\n        \"clipboard\": \"Clipboard access\",\n        \"keylogger\": \"Key logging\",\n    }\n\n    capabilities = []\n    for crate_name, description in suspicious_crates.items():\n        if crate_name in crates:\n            capabilities.append({\n                \"crate\": crate_name,\n                \"version\": crates[crate_name],\n                \"capability\": description,\n            })\n\n    return crates, capabilities\n\n\ndef extract_rust_strings(data):\n    \"\"\"Extract strings handling Rust's non-null-terminated format.\"\"\"\n    # Rust strings are stored as pointer+length, but string literals\n    # are often in .rodata as contiguous sequences\n    strings = []\n    ascii_pattern = re.compile(rb'[\\x20-\\x7e]{8,500}')\n    for match in ascii_pattern.finditer(data):\n        s = match.group().decode('ascii')\n        # Filter for malware-relevant strings\n        keywords = ['http', 'socket', 'encrypt', 'decrypt', 'shell',\n                    'exec', 'cmd', 'upload', 'download', 'persist',\n                    'registry', 'mutex', 'pipe', 'inject']\n        if any(kw in s.lower() for kw in keywords):\n            strings.append(s)\n\n    return strings\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Crust_binary>\")\n        sys.exit(1)\n\n    with open(sys.argv[1], 'rb') as f:\n        data = f.read()\n\n    is_rust, indicators = identify_rust_binary(data)\n    print(f\"[{'+'if is_rust else '-'}] Rust binary: {is_rust}\")\n    print(json.dumps(indicators, indent=2, default=str))\n\n    crates, capabilities = extract_crates(data)\n    print(f\"\\n[+] Crates ({len(crates)}):\")\n    for name, ver in sorted(crates.items()):\n        print(f\"  {name} v{ver}\")\n\n    if capabilities:\n        print(f\"\\n[!] Suspicious capabilities:\")\n        for cap in capabilities:\n            print(f\"  {cap['crate']} -> {cap['capability']}\")\n\n    strings = extract_rust_strings(data)\n    if strings:\n        print(f\"\\n[+] Suspicious strings ({len(strings)}):\")\n        for s in strings[:20]:\n            print(f\"  {s}\")\n```\n\n## Validation Criteria\n\n- Binary correctly identified as Rust-compiled with version info\n- Crate dependencies extracted revealing malware capabilities\n- Rust-specific string extraction handles fat pointer format\n- Main entry point and core logic functions identified\n- Encryption, networking, and persistence code located\n\n## References\n\n- [Binary Defense - Extracting Secrets from Rust Malware](https:\u002F\u002Fbinarydefense.com\u002Fresources\u002Fblog\u002Fdigging-through-rust-to-find-gold-extracting-secrets-from-rust-malware)\n- [Ghidra Extension for Rust Analysis](https:\u002F\u002Fcir.nii.ac.jp\u002Fcrid\u002F1050302237609671296)\n- [Fuzzing Labs - Reversing Modern Binaries](https:\u002F\u002Ffuzzinglabs.com\u002Freversing-modern-binaries\u002F)\n- [Bishop Fox - Rust for Malware Development](https:\u002F\u002Fbishopfox.com\u002Fblog\u002Frust-for-malware-development)\n","# Reverse Engineering Rust Malware\n\n## Overview\n\nRust has become increasingly popular for malware development due to its cross-compilation, memory safety guarantees, and the complexity it introduces for reverse engineers. Rust binaries contain the entire standard library statically linked, producing large binaries with extensive boilerplate code. Key challenges include non-null-terminated strings (Rust uses fat pointers with pointer+length), monomorphization generating duplicated generic code, complex error handling (Result\u002FOption unwrap chains), and unfamiliar calling conventions. Decompiling Rust to C produces unhelpful output compared to C\u002FC++ binaries. Tools like Ghidra scripts for crate extraction, and training focused on Rust-specific patterns (2024-2025) help address these challenges. Notable Rust malware includes BlackCat\u002FALPHV ransomware, Hive ransomware variants, and Buer Loader.\n\n\n## When to Use\n\n- When performing authorized security testing that involves reverse engineering rust malware\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- IDA Pro 8.0+ or Ghidra 11.0+\n- Rust toolchain for reference compilation\n- Python 3.9+ for helper scripts\n- Understanding of Rust memory model (ownership, borrowing)\n- Familiarity with Rust string types (String, &str, CString)\n\n## Workflow\n\n### Step 1: Identify and Parse Rust Binary Metadata\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Analyze Rust malware binary metadata and extract crate dependencies.\"\"\"\nimport re\nimport sys\nimport json\n\n\ndef identify_rust_binary(data):\n    \"\"\"Check if binary is Rust-compiled and extract version info.\"\"\"\n    indicators = {\n        \"rust_panic_strings\": bool(re.search(rb'panicked at', data)),\n        \"rust_unwrap\": bool(re.search(rb'called.*unwrap.*on.*None', data)),\n        \"core_panic\": bool(re.search(rb'core::panicking', data)),\n        \"std_rt\": bool(re.search(rb'std::rt::lang_start', data)),\n        \"cargo_path\": bool(re.search(rb'\\.cargo[\u002F\\\\]registry', data)),\n        \"rustc_version\": None,\n    }\n\n    version = re.search(rb'rustc\\s+(\\d+\\.\\d+\\.\\d+)', data)\n    if version:\n        indicators[\"rustc_version\"] = version.group(1).decode()\n\n    is_rust = sum(1 for v in indicators.values() if v) >= 2\n    return is_rust, indicators\n\n\ndef extract_crates(data):\n    \"\"\"Extract Rust crate (dependency) names from binary strings.\"\"\"\n    crate_pattern = re.compile(\n        rb'(?:crates\\.io-[a-f0-9]+\u002F|\\.cargo\u002Fregistry\u002Fsrc\u002F[^\u002F]+\u002F)'\n        rb'([\\w-]+)-(\\d+\\.\\d+\\.\\d+)'\n    )\n    crates = {}\n    for match in crate_pattern.finditer(data):\n        name = match.group(1).decode()\n        version = match.group(2).decode()\n        crates[name] = version\n\n    # Also check for common malware-relevant crates\n    suspicious_crates = {\n        \"reqwest\": \"HTTP client\",\n        \"hyper\": \"HTTP library\",\n        \"tokio\": \"Async runtime\",\n        \"aes\": \"AES encryption\",\n        \"chacha20\": \"ChaCha20 encryption\",\n        \"rsa\": \"RSA encryption\",\n        \"ring\": \"Crypto library\",\n        \"base64\": \"Base64 encoding\",\n        \"winapi\": \"Windows API bindings\",\n        \"winreg\": \"Registry access\",\n        \"sysinfo\": \"System information\",\n        \"screenshots\": \"Screen capture\",\n        \"clipboard\": \"Clipboard access\",\n        \"keylogger\": \"Key logging\",\n    }\n\n    capabilities = []\n    for crate_name, description in suspicious_crates.items():\n        if crate_name in crates:\n            capabilities.append({\n                \"crate\": crate_name,\n                \"version\": crates[crate_name],\n                \"capability\": description,\n            })\n\n    return crates, capabilities\n\n\ndef extract_rust_strings(data):\n    \"\"\"Extract strings handling Rust's non-null-terminated format.\"\"\"\n    # Rust strings are stored as pointer+length, but string literals\n    # are often in .rodata as contiguous sequences\n    strings = []\n    ascii_pattern = re.compile(rb'[\\x20-\\x7e]{8,500}')\n    for match in ascii_pattern.finditer(data):\n        s = match.group().decode('ascii')\n        # Filter for malware-relevant strings\n        keywords = ['http', 'socket', 'encrypt', 'decrypt', 'shell',\n                    'exec', 'cmd', 'upload', 'download', 'persist',\n                    'registry', 'mutex', 'pipe', 'inject']\n        if any(kw in s.lower() for kw in keywords):\n            strings.append(s)\n\n    return strings\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Crust_binary>\")\n        sys.exit(1)\n\n    with open(sys.argv[1], 'rb') as f:\n        data = f.read()\n\n    is_rust, indicators = identify_rust_binary(data)\n    print(f\"[{'+'if is_rust else '-'}] Rust binary: {is_rust}\")\n    print(json.dumps(indicators, indent=2, default=str))\n\n    crates, capabilities = extract_crates(data)\n    print(f\"\\n[+] Crates ({len(crates)}):\")\n    for name, ver in sorted(crates.items()):\n        print(f\"  {name} v{ver}\")\n\n    if capabilities:\n        print(f\"\\n[!] Suspicious capabilities:\")\n        for cap in capabilities:\n            print(f\"  {cap['crate']} -> {cap['capability']}\")\n\n    strings = extract_rust_strings(data)\n    if strings:\n        print(f\"\\n[+] Suspicious strings ({len(strings)}):\")\n        for s in strings[:20]:\n            print(f\"  {s}\")\n```\n\n## Validation Criteria\n\n- Binary correctly identified as Rust-compiled with version info\n- Crate dependencies extracted revealing malware capabilities\n- Rust-specific string extraction handles fat pointer format\n- Main entry point and core logic functions identified\n- Encryption, networking, and persistence code located\n\n## References\n\n- [Binary Defense - Extracting Secrets from Rust Malware](https:\u002F\u002Fbinarydefense.com\u002Fresources\u002Fblog\u002Fdigging-through-rust-to-find-gold-extracting-secrets-from-rust-malware)\n- [Ghidra Extension for Rust Analysis](https:\u002F\u002Fcir.nii.ac.jp\u002Fcrid\u002F1050302237609671296)\n- [Fuzzing Labs - Reversing Modern Binaries](https:\u002F\u002Ffuzzinglabs.com\u002Freversing-modern-binaries\u002F)\n- [Bishop Fox - Rust for Malware Development](https:\u002F\u002Fbishopfox.com\u002Fblog\u002Frust-for-malware-development)\n",{"name":5,"tags":25,"author":33,"domain":34,"source":35,"license":15,"version":36,"nist_csf":37,"subdomain":28,"description":7,"mitre_attack":42,"source_commit":47},[26,27,28,29,30,31,32],"rust","reverse-engineering","malware-analysis","ghidra","ida-pro","binary-analysis","rust-malware","mahipal","cybersecurity","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","1.0",[38,39,40,41],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01",[43,44,45,46],"T1027","T1055","T1140","T1497","04450304b12645cb2b974ab96d28c0664758a88d","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Freverse-engineering-rust-malware",2,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-14 13:24:09",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill reverse-engineering-rust-malware",{"tool":64,"command":65},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill reverse-engineering-rust-malware",{"tool":67,"command":68},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill reverse-engineering-rust-malware","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Freverse-engineering-rust-malware\u002FSKILL.md",true,[72,78,82,88,92,96],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"assets\u002Ftemplate.md","ASSET","资产文件",413,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Freverse-engineering-rust-malware\u002Fassets\u002Ftemplate.md",{"path":79,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fapi-reference.md","REFERENCE","参考文档",1694,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Freverse-engineering-rust-malware\u002Freferences\u002Fapi-reference.md",{"path":89,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fstandards.md",301,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Freverse-engineering-rust-malware\u002Freferences\u002Fstandards.md",{"path":93,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fworkflows.md",460,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Freverse-engineering-rust-malware\u002Freferences\u002Fworkflows.md",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"scripts\u002Fagent.py","SCRIPT","脚本",6553,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Freverse-engineering-rust-malware\u002Fscripts\u002Fagent.py",[103,111,118,126,134,142],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":20},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":20},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":122,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":20},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":130,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":20},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":138,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":20},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":143,"name":144,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":20},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]