straw-hat-kjones

Expert guidance for CrowdStrike LogScale CQL queries. Use for threat hunting, detection rules, security analytics, and incident response. Provides syntax rules, optimization techniques, event schemas, and hunting patterns.

Analyze suspicious files, executables, and samples for malicious behavior using the Practical Malware Analysis methodology (Sikorski & Honig), orchestrated through the REMnux MCP server. Use whenever the user asks to triage, reverse-engineer, analyze, investigate, unpack, or figure out what a binary does — PE (.exe/.dll/.sys), ELF, Mach-O, script, Office doc, PDF, archive, or raw shellcode. Covers the full four-layer methodology — basic static (hashes, strings, PE/ELF headers, imports, packing), basic dynamic (sandbox/Procmon/FakeNet), advanced static (Ghidra/IDA disassembly), and advanced dynamic (x64dbg debugging, unpacking, anti-analysis bypass). Produces IOC extraction, MITRE ATT&CK TTP mapping, host- and network-based detections, and analyst reports with STIX 2.1 output for OpenCTI ingestion. Trigger even for low-signal phrasings like 'what is this file', 'is this malicious', 'I got this dropper', or 'pulled this off a workstation'.