[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-labs-stage-2-osint":3,"mdc--xq0qmv-key":36,"related-repo-aws-labs-stage-2-osint":2931,"related-org-aws-labs-stage-2-osint":3021},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":32,"sourceUrl":34,"mdContent":35},"stage-2-osint","synthesize OSINT data for threat analysis","Consult OSINT sources and synthesize a prior hypothesis that steers downstream analysis. M1 scope is MalwareBazaar (no auth, no vault dependency) + web search + MITRE ATT&CK; VirusTotal + Shodan + urlscan are commented out in the skill until vault credentials are provisioned. Use this skill whenever you have a sample's hashes + candidate IOCs (from Stage 1 triage) and want to check reputation, find prior reporting, or decide whether deeper analysis is worth the compute. Always run after Stage 1 and before Stage 3 — the hypothesis this produces narrows Stage 3's YARA scan and Stage 4's sandbox profile. Can short-circuit known-benign samples straight to a Stage 6 verdict.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"aws-labs","AWS Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws-labs.png","awslabs",[13,17,20,23],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Research","research",{"name":21,"slug":22,"type":16},"Analysis","analysis",{"name":24,"slug":25,"type":16},"Threat Modeling","threat-modeling",1,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentic-developer-platform","2026-08-07T05:03:41.222029",null,0,[],{"repoUrl":27,"stars":26,"forks":30,"topics":33,"description":29},[],"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentic-developer-platform\u002Ftree\u002FHEAD\u002Fmodules\u002Fdomain-apps\u002Fcyber\u002Fagent\u002Fskills\u002Fstage-2-osint","---\nname: stage-2-osint\ndescription: Consult OSINT sources and synthesize a prior hypothesis that steers downstream analysis. M1 scope is MalwareBazaar (no auth, no vault dependency) + web search + MITRE ATT&CK; VirusTotal + Shodan + urlscan are commented out in the skill until vault credentials are provisioned. Use this skill whenever you have a sample's hashes + candidate IOCs (from Stage 1 triage) and want to check reputation, find prior reporting, or decide whether deeper analysis is worth the compute. Always run after Stage 1 and before Stage 3 — the hypothesis this produces narrows Stage 3's YARA scan and Stage 4's sandbox profile. Can short-circuit known-benign samples straight to a Stage 6 verdict.\n---\n\n# Stage 2 — OSINT recon & prior-hypothesis\n\nYou run in the main ADP cluster with Bedrock, internet, and vault credentials. Sample bytes never reach you; you only see hashes + IOCs from Stage 1. Convert that raw fingerprint into an **informed investigation plan**.\n\nShort-circuit to Stage 6 with a benign verdict if OSINT returns a known-benign hit (EICAR, Microsoft-signed clean binary, VT 0\u002F70 malicious with high harmless consensus). Skipping Stages 3-5 on known-clean samples saves ~30 min of compute per analysis.\n\n## Inputs\n\n| Var | Source | Shape |\n|---|---|---|\n| `ARTIFACT_ID` | persistent | string |\n| Stage 1 envelope | DDB | hashes + candidate_iocs |\n| `VIRUSTOTAL_SECRET_PREFIX` | env | secretsmanager path prefix (per-org key) |\n| `SHODAN_SECRET_PREFIX` | env | secretsmanager path prefix |\n\n## Outputs\n\nStage envelope:\n\n```json\n{\n  \"artifact_id\": \"...\",\n  \"stage\": 2,\n  \"stage_name\": \"osint\",\n  \"status\": \"ok | partial | failed\",\n  \"findings\": {\n    \"vt_hits\": 42,\n    \"vt_families\": [\"Qakbot\", \"Qbot\"],\n    \"vt_first_seen\": \"2026-01-14\",\n    \"vt_last_seen\": \"2026-04-28\",\n    \"malwarebazaar_tags\": [\"qakbot\", \"banker\", \"loader\"],\n    \"c2_live_checks\": [\n      {\"ioc\": \"1.2.3.4\", \"live\": true, \"port\": 443, \"banner_snippet\": \"...\"}\n    ],\n    \"prior_reporting\": [\n      {\"source\": \"Mandiant\", \"url\": \"...\", \"summary\": \"...\"}\n    ],\n    \"mitre_ttps_suggested\": [\"T1055.002\", \"T1071.001\"],\n    \"prior_hypothesis\": \"Likely Qakbot v5.x based on VT family + recent Mandiant report\",\n    \"recommended_static_focus\": [\"config_block_extraction\", \"c2_pattern_confirmation\"],\n    \"recommended_yara_rules\": [\"qakbot_v5\", \"banking_trojan_generic\"],\n    \"short_circuit\": false\n  },\n  \"notes\": \"free text — especially note skipped sources due to missing creds\"\n}\n```\n\n## Steps\n\n> **M1 scope note**: for the first end-to-end pipeline tests, only MalwareBazaar is enabled (no auth, no vault dependency). VirusTotal, Shodan, and urlscan are documented below but commented out — re-enable them once the corresponding credentials are provisioned in vault.\n\n### 1. (M1 skip) Fetch OSINT credentials from vault\n\nCommented out until vault creds are configured. Re-enable this block when VT\u002FShodan keys land in Secrets Manager.\n\n```bash\n# VT_KEY=$(aws secretsmanager get-secret-value --region us-east-1 \\\n#   --secret-id \"${VIRUSTOTAL_SECRET_PREFIX}\u002Fpublic\" \\\n#   --query SecretString --output text 2>\u002Fdev\u002Fnull || echo \"\")\n#\n# SHODAN_KEY=$(aws secretsmanager get-secret-value --region us-east-1 \\\n#   --secret-id \"${SHODAN_SECRET_PREFIX}\u002Fpublic\" \\\n#   --query SecretString --output text 2>\u002Fdev\u002Fnull || echo \"\")\n```\n\n### 2. (M1 skip) VirusTotal hash lookup\n\nCommented out for M1 — no VT credentials yet. Re-enable alongside step 1. Note in `notes`: `\"vt skipped — no credentials provisioned (M1)\"`.\n\n```bash\n# if [ -n \"$VT_KEY\" ]; then\n#   SHA256=\"\u003Cfrom Stage 1>\"\n#   curl -sS -H \"x-apikey: $VT_KEY\" \\\n#     \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F$SHA256\" | tee \u002Ftmp\u002Fvt.json\n#\n#   jq '{\n#     malicious: .data.attributes.last_analysis_stats.malicious,\n#     total: (.data.attributes.last_analysis_stats | to_entries | map(.value) | add),\n#     family: .data.attributes.popular_threat_classification.suggested_threat_label,\n#     first_seen: .data.attributes.first_submission_date,\n#     last_seen: .data.attributes.last_analysis_date\n#   }' \u002Ftmp\u002Fvt.json\n# fi\n```\n\n### 3. MalwareBazaar (ENABLED — no auth, free) — the M1 primary source\n\n```bash\nSHA256=\"\u003Cfrom Stage 1 envelope>\"\ncurl -sS -X POST --data \"query=get_info&hash=$SHA256\" \\\n  https:\u002F\u002Fmb-api.abuse.ch\u002Fapi\u002Fv1\u002F > \u002Ftmp\u002Fmb.json\n\n# MalwareBazaar returns query_status = \"ok\" (hit) or \"hash_not_found\" (miss).\nSTATUS=$(jq -r '.query_status' \u002Ftmp\u002Fmb.json)\n\nif [ \"$STATUS\" = \"ok\" ]; then\n  jq '{\n    query_status: .query_status,\n    signature: .data[0].signature,\n    tags: .data[0].tags,\n    file_type: .data[0].file_type,\n    first_seen: .data[0].first_seen,\n    reporter: .data[0].reporter,\n    intelligence: .data[0].intelligence,\n    yara_rules: .data[0].yara_rules\n  }' \u002Ftmp\u002Fmb.json\nelse\n  # hash_not_found — unknown sample, no prior reporting\n  echo '{\"query_status\":\"hash_not_found\",\"note\":\"sample not in MalwareBazaar\"}'\nfi\n```\n\nShort-circuit check: if `signature` contains `EICAR` or if the hash matches the known EICAR signature (`275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f`), set `short_circuit: true` + verdict benign.\n\n### 4. (M1 skip) Shodan — for each candidate IP from Stage 1\n\nCommented out for M1 — no Shodan credentials yet.\n\n```bash\n# for IP in $(jq -r '.candidate_iocs.ips[]' \u003C\u003C\u003C \"$STAGE1\"); do\n#   curl -sS \"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002F$IP?key=$SHODAN_KEY\" | \\\n#     jq --arg ip \"$IP\" '{ioc:$ip, live:(.ip_str != null), ports:.ports, hostnames:.hostnames, tls:.ssl.cert.issuer}'\n# done\n```\n\n### 5. (M1 skip) urlscan.io — for each candidate domain\u002FURL\n\nCommented out for M1 — rate limit concerns with unauthenticated requests during testing. Re-enable post-M1.\n\n```bash\n# for TARGET in $(jq -r '.candidate_iocs.domains[], .candidate_iocs.urls[]' \u003C\u003C\u003C \"$STAGE1\"); do\n#   curl -sS \"https:\u002F\u002Furlscan.io\u002Fapi\u002Fv1\u002Fsearch\u002F?q=domain:$TARGET&size=3\" | \\\n#     jq '{results: [.results[] | {url:.page.url, verdict:.verdicts.malicious, scanned_at:.task.time}]}'\n# done\n```\n\n### 6. Web search — prior reporting\n\nIf VT\u002FMB returned a family name, search for it:\n\n```bash\n# Use the platform's web-search skill if available, else WebSearch tool directly\n# Queries to run:\n#   - \"\u003Cfamily_name> malware analysis\"\n#   - \"\u003Csha256_first_16> \u003Cfamily>\"\n#   - \"\u003Cc2_domain> threat intel\"\n# Fetch top 3 results each, extract title + URL + short excerpt\n```\n\n### 7. MITRE ATT&CK mapping\n\nIf a family name is known:\n\n```bash\n# Look up family in MITRE's known-software database\ncurl -sS \"https:\u002F\u002Fattack.mitre.org\u002Fapi.php?action=ask&query=[[Category:Software]][[Has+display+name::$FAMILY_NAME]]|?Has+technique&format=json\"\n# Or use the bundled enterprise-matrix.json if offline\n```\n\n### 8. Short-circuit check\n\nBefore synthesizing, check for known-benign:\n\n- Hash matches EICAR signature (`275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f`) → test file, benign (works without any OSINT)\n- MalwareBazaar returned `query_status = \"hash_not_found\"` AND Stage 1 showed a valid Authenticode signature → probably benign (but note: MB miss ≠ benign in general; only combine with signature check)\n- (Post-M1) VT `malicious` count = 0 AND `harmless` > 10 → benign\n- (Post-M1) Microsoft-signed with valid Authenticode + clean VT score → benign\n\nIf any triggers, set `short_circuit: true` and synthesize minimal findings. The persona will skip Stages 3-5 and jump to Stage 6.\n\n### 9. Synthesize prior_hypothesis\n\nThis is the reasoning step — use the LLM (you) to produce 1-2 sentences + recommended focus. Example:\n\n> \"Likely Qakbot v5.x — matches Mandiant 2026-04-15 report hash prefix AND C2 infrastructure from VT. Stage 3 should prioritize config-block extraction + Qakbot-family YARA rules, skip generic injection-signature scan.\"\n\n### 10. Write envelope + publish stage comment\n\nSame pattern as Stage 1: write DDB, post GH comment.\n\nComment format (M1 — MalwareBazaar only):\n\n```markdown\n## Stage 2 — OSINT recon\n\n**Status**: ✅ | **Short-circuit**: no\n**Scope (M1)**: MalwareBazaar only. VT \u002F Shodan \u002F urlscan deferred until credentials are provisioned.\n\n**Sources consulted:**\n- MalwareBazaar: `query_status=ok` — signature=`\u003Cfamily>`, tags=`[...]`, first_seen=`\u003Cdate>`, reporter=`\u003Cusername>`\n  _(or `query_status=hash_not_found` — sample unknown to MalwareBazaar)_\n- ~~VirusTotal~~ — deferred (no credentials)\n- ~~Shodan~~ — deferred\n- ~~urlscan.io~~ — deferred\n- Web search — `\u003Cn>` hits matching `\u003Cfamily>` \u002F hash prefix\n- MITRE ATT&CK: `\u003CT1055.002>`, `\u003CT1071.001>` (if family known)\n\n### Prior hypothesis\nLikely `\u003Cfamily>` based on MalwareBazaar signature + web reporting. _(If MB miss + no reporting: \"Unknown sample — no prior reporting; Stage 3 should run default YARA corpus.\")_\n\n### Recommended for Stage 3\n- Focus: `\u003Clist>`\n- YARA rules: `\u003Clist>` (or `default` if no hypothesis)\n\n\u003Cdetails>...full JSON...\u003C\u002Fdetails>\n```\n\n## Failure handling\n\n- Any individual source fails\u002Frate-limits → skip it, note in `notes`, continue with others\n- All sources fail → stage status `partial`, prior_hypothesis = \"unknown — no OSINT available\"\n- Don't block the pipeline. Stage 3 can run with an empty brief (generic YARA scan).\n\n## Rate limits\n\n- VirusTotal Public API: 4 req\u002Fmin, 500 req\u002Fday. Cache per-hash in DDB.\n- MalwareBazaar: no published limit, be polite (\u003C 1 req\u002Fsec).\n- Shodan free: 100 req\u002Fmonth. Only hit for IOCs likely to matter (skip private IPs, localhost).\n- urlscan: 100 req\u002Fday.\n\n## Guardrails\n\n- Degrade gracefully on missing credentials. A missing VT key isn't a stage failure — it's a reduced brief. Fail-hard on missing OSINT would make the pipeline unusable for tenants who haven't yet configured every intel source.\n- Short-circuit eagerly on known-benign. Running the full pipeline on EICAR or a signed Microsoft binary wastes compute and floods the issue with stage comments that all say \"clean.\"\n- Synthesize the hypothesis; don't dump raw API responses. Stage 3's YARA ruleset and Stage 4's sandbox profile depend on a crisp hypothesis — a wall of JSON teaches Stage 3 nothing.\n- Cache per-hash in DDB. VirusTotal's free tier is 4 req\u002Fmin; repeat lookups on the same hash in a single pipeline run will rate-limit you and slow every subsequent stage.\n",{"data":37,"body":38},{"name":4,"description":6},{"type":39,"children":40},"root",[41,50,64,69,76,193,199,204,1244,1250,1264,1271,1276,1341,1347,1366,1476,1482,1854,1891,1897,1902,1941,1947,1952,1990,1996,2001,2056,2062,2067,2124,2130,2135,2191,2203,2209,2214,2222,2228,2233,2238,2828,2834,2867,2873,2896,2902,2925],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"stage-2-osint-recon-prior-hypothesis",[47],{"type":48,"value":49},"text","Stage 2 — OSINT recon & prior-hypothesis",{"type":42,"tag":51,"props":52,"children":53},"p",{},[54,56,62],{"type":48,"value":55},"You run in the main ADP cluster with Bedrock, internet, and vault credentials. Sample bytes never reach you; you only see hashes + IOCs from Stage 1. Convert that raw fingerprint into an ",{"type":42,"tag":57,"props":58,"children":59},"strong",{},[60],{"type":48,"value":61},"informed investigation plan",{"type":48,"value":63},".",{"type":42,"tag":51,"props":65,"children":66},{},[67],{"type":48,"value":68},"Short-circuit to Stage 6 with a benign verdict if OSINT returns a known-benign hit (EICAR, Microsoft-signed clean binary, VT 0\u002F70 malicious with high harmless consensus). Skipping Stages 3-5 on known-clean samples saves ~30 min of compute per analysis.",{"type":42,"tag":70,"props":71,"children":73},"h2",{"id":72},"inputs",[74],{"type":48,"value":75},"Inputs",{"type":42,"tag":77,"props":78,"children":79},"table",{},[80,104],{"type":42,"tag":81,"props":82,"children":83},"thead",{},[84],{"type":42,"tag":85,"props":86,"children":87},"tr",{},[88,94,99],{"type":42,"tag":89,"props":90,"children":91},"th",{},[92],{"type":48,"value":93},"Var",{"type":42,"tag":89,"props":95,"children":96},{},[97],{"type":48,"value":98},"Source",{"type":42,"tag":89,"props":100,"children":101},{},[102],{"type":48,"value":103},"Shape",{"type":42,"tag":105,"props":106,"children":107},"tbody",{},[108,132,150,172],{"type":42,"tag":85,"props":109,"children":110},{},[111,122,127],{"type":42,"tag":112,"props":113,"children":114},"td",{},[115],{"type":42,"tag":116,"props":117,"children":119},"code",{"className":118},[],[120],{"type":48,"value":121},"ARTIFACT_ID",{"type":42,"tag":112,"props":123,"children":124},{},[125],{"type":48,"value":126},"persistent",{"type":42,"tag":112,"props":128,"children":129},{},[130],{"type":48,"value":131},"string",{"type":42,"tag":85,"props":133,"children":134},{},[135,140,145],{"type":42,"tag":112,"props":136,"children":137},{},[138],{"type":48,"value":139},"Stage 1 envelope",{"type":42,"tag":112,"props":141,"children":142},{},[143],{"type":48,"value":144},"DDB",{"type":42,"tag":112,"props":146,"children":147},{},[148],{"type":48,"value":149},"hashes + candidate_iocs",{"type":42,"tag":85,"props":151,"children":152},{},[153,162,167],{"type":42,"tag":112,"props":154,"children":155},{},[156],{"type":42,"tag":116,"props":157,"children":159},{"className":158},[],[160],{"type":48,"value":161},"VIRUSTOTAL_SECRET_PREFIX",{"type":42,"tag":112,"props":163,"children":164},{},[165],{"type":48,"value":166},"env",{"type":42,"tag":112,"props":168,"children":169},{},[170],{"type":48,"value":171},"secretsmanager path prefix (per-org key)",{"type":42,"tag":85,"props":173,"children":174},{},[175,184,188],{"type":42,"tag":112,"props":176,"children":177},{},[178],{"type":42,"tag":116,"props":179,"children":181},{"className":180},[],[182],{"type":48,"value":183},"SHODAN_SECRET_PREFIX",{"type":42,"tag":112,"props":185,"children":186},{},[187],{"type":48,"value":166},{"type":42,"tag":112,"props":189,"children":190},{},[191],{"type":48,"value":192},"secretsmanager path prefix",{"type":42,"tag":70,"props":194,"children":196},{"id":195},"outputs",[197],{"type":48,"value":198},"Outputs",{"type":42,"tag":51,"props":200,"children":201},{},[202],{"type":48,"value":203},"Stage envelope:",{"type":42,"tag":205,"props":206,"children":211},"pre",{"className":207,"code":208,"language":209,"meta":210,"style":210},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"artifact_id\": \"...\",\n  \"stage\": 2,\n  \"stage_name\": \"osint\",\n  \"status\": \"ok | partial | failed\",\n  \"findings\": {\n    \"vt_hits\": 42,\n    \"vt_families\": [\"Qakbot\", \"Qbot\"],\n    \"vt_first_seen\": \"2026-01-14\",\n    \"vt_last_seen\": \"2026-04-28\",\n    \"malwarebazaar_tags\": [\"qakbot\", \"banker\", \"loader\"],\n    \"c2_live_checks\": [\n      {\"ioc\": \"1.2.3.4\", \"live\": true, \"port\": 443, \"banner_snippet\": \"...\"}\n    ],\n    \"prior_reporting\": [\n      {\"source\": \"Mandiant\", \"url\": \"...\", \"summary\": \"...\"}\n    ],\n    \"mitre_ttps_suggested\": [\"T1055.002\", \"T1071.001\"],\n    \"prior_hypothesis\": \"Likely Qakbot v5.x based on VT family + recent Mandiant report\",\n    \"recommended_static_focus\": [\"config_block_extraction\", \"c2_pattern_confirmation\"],\n    \"recommended_yara_rules\": [\"qakbot_v5\", \"banking_trojan_generic\"],\n    \"short_circuit\": false\n  },\n  \"notes\": \"free text — especially note skipped sources due to missing creds\"\n}\n","json","",[212],{"type":42,"tag":116,"props":213,"children":214},{"__ignoreMap":210},[215,226,271,302,340,378,404,436,498,536,574,650,676,801,810,835,943,951,1010,1048,1107,1166,1192,1201,1236],{"type":42,"tag":216,"props":217,"children":219},"span",{"class":218,"line":26},"line",[220],{"type":42,"tag":216,"props":221,"children":223},{"style":222},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[224],{"type":48,"value":225},"{\n",{"type":42,"tag":216,"props":227,"children":229},{"class":218,"line":228},2,[230,235,241,246,251,256,262,266],{"type":42,"tag":216,"props":231,"children":232},{"style":222},[233],{"type":48,"value":234},"  \"",{"type":42,"tag":216,"props":236,"children":238},{"style":237},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[239],{"type":48,"value":240},"artifact_id",{"type":42,"tag":216,"props":242,"children":243},{"style":222},[244],{"type":48,"value":245},"\"",{"type":42,"tag":216,"props":247,"children":248},{"style":222},[249],{"type":48,"value":250},":",{"type":42,"tag":216,"props":252,"children":253},{"style":222},[254],{"type":48,"value":255}," \"",{"type":42,"tag":216,"props":257,"children":259},{"style":258},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[260],{"type":48,"value":261},"...",{"type":42,"tag":216,"props":263,"children":264},{"style":222},[265],{"type":48,"value":245},{"type":42,"tag":216,"props":267,"children":268},{"style":222},[269],{"type":48,"value":270},",\n",{"type":42,"tag":216,"props":272,"children":274},{"class":218,"line":273},3,[275,279,284,288,292,298],{"type":42,"tag":216,"props":276,"children":277},{"style":222},[278],{"type":48,"value":234},{"type":42,"tag":216,"props":280,"children":281},{"style":237},[282],{"type":48,"value":283},"stage",{"type":42,"tag":216,"props":285,"children":286},{"style":222},[287],{"type":48,"value":245},{"type":42,"tag":216,"props":289,"children":290},{"style":222},[291],{"type":48,"value":250},{"type":42,"tag":216,"props":293,"children":295},{"style":294},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[296],{"type":48,"value":297}," 2",{"type":42,"tag":216,"props":299,"children":300},{"style":222},[301],{"type":48,"value":270},{"type":42,"tag":216,"props":303,"children":305},{"class":218,"line":304},4,[306,310,315,319,323,327,332,336],{"type":42,"tag":216,"props":307,"children":308},{"style":222},[309],{"type":48,"value":234},{"type":42,"tag":216,"props":311,"children":312},{"style":237},[313],{"type":48,"value":314},"stage_name",{"type":42,"tag":216,"props":316,"children":317},{"style":222},[318],{"type":48,"value":245},{"type":42,"tag":216,"props":320,"children":321},{"style":222},[322],{"type":48,"value":250},{"type":42,"tag":216,"props":324,"children":325},{"style":222},[326],{"type":48,"value":255},{"type":42,"tag":216,"props":328,"children":329},{"style":258},[330],{"type":48,"value":331},"osint",{"type":42,"tag":216,"props":333,"children":334},{"style":222},[335],{"type":48,"value":245},{"type":42,"tag":216,"props":337,"children":338},{"style":222},[339],{"type":48,"value":270},{"type":42,"tag":216,"props":341,"children":343},{"class":218,"line":342},5,[344,348,353,357,361,365,370,374],{"type":42,"tag":216,"props":345,"children":346},{"style":222},[347],{"type":48,"value":234},{"type":42,"tag":216,"props":349,"children":350},{"style":237},[351],{"type":48,"value":352},"status",{"type":42,"tag":216,"props":354,"children":355},{"style":222},[356],{"type":48,"value":245},{"type":42,"tag":216,"props":358,"children":359},{"style":222},[360],{"type":48,"value":250},{"type":42,"tag":216,"props":362,"children":363},{"style":222},[364],{"type":48,"value":255},{"type":42,"tag":216,"props":366,"children":367},{"style":258},[368],{"type":48,"value":369},"ok | partial | failed",{"type":42,"tag":216,"props":371,"children":372},{"style":222},[373],{"type":48,"value":245},{"type":42,"tag":216,"props":375,"children":376},{"style":222},[377],{"type":48,"value":270},{"type":42,"tag":216,"props":379,"children":381},{"class":218,"line":380},6,[382,386,391,395,399],{"type":42,"tag":216,"props":383,"children":384},{"style":222},[385],{"type":48,"value":234},{"type":42,"tag":216,"props":387,"children":388},{"style":237},[389],{"type":48,"value":390},"findings",{"type":42,"tag":216,"props":392,"children":393},{"style":222},[394],{"type":48,"value":245},{"type":42,"tag":216,"props":396,"children":397},{"style":222},[398],{"type":48,"value":250},{"type":42,"tag":216,"props":400,"children":401},{"style":222},[402],{"type":48,"value":403}," {\n",{"type":42,"tag":216,"props":405,"children":407},{"class":218,"line":406},7,[408,413,419,423,427,432],{"type":42,"tag":216,"props":409,"children":410},{"style":222},[411],{"type":48,"value":412},"    \"",{"type":42,"tag":216,"props":414,"children":416},{"style":415},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[417],{"type":48,"value":418},"vt_hits",{"type":42,"tag":216,"props":420,"children":421},{"style":222},[422],{"type":48,"value":245},{"type":42,"tag":216,"props":424,"children":425},{"style":222},[426],{"type":48,"value":250},{"type":42,"tag":216,"props":428,"children":429},{"style":294},[430],{"type":48,"value":431}," 42",{"type":42,"tag":216,"props":433,"children":434},{"style":222},[435],{"type":48,"value":270},{"type":42,"tag":216,"props":437,"children":439},{"class":218,"line":438},8,[440,444,449,453,457,462,466,471,475,480,484,489,493],{"type":42,"tag":216,"props":441,"children":442},{"style":222},[443],{"type":48,"value":412},{"type":42,"tag":216,"props":445,"children":446},{"style":415},[447],{"type":48,"value":448},"vt_families",{"type":42,"tag":216,"props":450,"children":451},{"style":222},[452],{"type":48,"value":245},{"type":42,"tag":216,"props":454,"children":455},{"style":222},[456],{"type":48,"value":250},{"type":42,"tag":216,"props":458,"children":459},{"style":222},[460],{"type":48,"value":461}," [",{"type":42,"tag":216,"props":463,"children":464},{"style":222},[465],{"type":48,"value":245},{"type":42,"tag":216,"props":467,"children":468},{"style":258},[469],{"type":48,"value":470},"Qakbot",{"type":42,"tag":216,"props":472,"children":473},{"style":222},[474],{"type":48,"value":245},{"type":42,"tag":216,"props":476,"children":477},{"style":222},[478],{"type":48,"value":479},",",{"type":42,"tag":216,"props":481,"children":482},{"style":222},[483],{"type":48,"value":255},{"type":42,"tag":216,"props":485,"children":486},{"style":258},[487],{"type":48,"value":488},"Qbot",{"type":42,"tag":216,"props":490,"children":491},{"style":222},[492],{"type":48,"value":245},{"type":42,"tag":216,"props":494,"children":495},{"style":222},[496],{"type":48,"value":497},"],\n",{"type":42,"tag":216,"props":499,"children":501},{"class":218,"line":500},9,[502,506,511,515,519,523,528,532],{"type":42,"tag":216,"props":503,"children":504},{"style":222},[505],{"type":48,"value":412},{"type":42,"tag":216,"props":507,"children":508},{"style":415},[509],{"type":48,"value":510},"vt_first_seen",{"type":42,"tag":216,"props":512,"children":513},{"style":222},[514],{"type":48,"value":245},{"type":42,"tag":216,"props":516,"children":517},{"style":222},[518],{"type":48,"value":250},{"type":42,"tag":216,"props":520,"children":521},{"style":222},[522],{"type":48,"value":255},{"type":42,"tag":216,"props":524,"children":525},{"style":258},[526],{"type":48,"value":527},"2026-01-14",{"type":42,"tag":216,"props":529,"children":530},{"style":222},[531],{"type":48,"value":245},{"type":42,"tag":216,"props":533,"children":534},{"style":222},[535],{"type":48,"value":270},{"type":42,"tag":216,"props":537,"children":539},{"class":218,"line":538},10,[540,544,549,553,557,561,566,570],{"type":42,"tag":216,"props":541,"children":542},{"style":222},[543],{"type":48,"value":412},{"type":42,"tag":216,"props":545,"children":546},{"style":415},[547],{"type":48,"value":548},"vt_last_seen",{"type":42,"tag":216,"props":550,"children":551},{"style":222},[552],{"type":48,"value":245},{"type":42,"tag":216,"props":554,"children":555},{"style":222},[556],{"type":48,"value":250},{"type":42,"tag":216,"props":558,"children":559},{"style":222},[560],{"type":48,"value":255},{"type":42,"tag":216,"props":562,"children":563},{"style":258},[564],{"type":48,"value":565},"2026-04-28",{"type":42,"tag":216,"props":567,"children":568},{"style":222},[569],{"type":48,"value":245},{"type":42,"tag":216,"props":571,"children":572},{"style":222},[573],{"type":48,"value":270},{"type":42,"tag":216,"props":575,"children":577},{"class":218,"line":576},11,[578,582,587,591,595,599,603,608,612,616,620,625,629,633,637,642,646],{"type":42,"tag":216,"props":579,"children":580},{"style":222},[581],{"type":48,"value":412},{"type":42,"tag":216,"props":583,"children":584},{"style":415},[585],{"type":48,"value":586},"malwarebazaar_tags",{"type":42,"tag":216,"props":588,"children":589},{"style":222},[590],{"type":48,"value":245},{"type":42,"tag":216,"props":592,"children":593},{"style":222},[594],{"type":48,"value":250},{"type":42,"tag":216,"props":596,"children":597},{"style":222},[598],{"type":48,"value":461},{"type":42,"tag":216,"props":600,"children":601},{"style":222},[602],{"type":48,"value":245},{"type":42,"tag":216,"props":604,"children":605},{"style":258},[606],{"type":48,"value":607},"qakbot",{"type":42,"tag":216,"props":609,"children":610},{"style":222},[611],{"type":48,"value":245},{"type":42,"tag":216,"props":613,"children":614},{"style":222},[615],{"type":48,"value":479},{"type":42,"tag":216,"props":617,"children":618},{"style":222},[619],{"type":48,"value":255},{"type":42,"tag":216,"props":621,"children":622},{"style":258},[623],{"type":48,"value":624},"banker",{"type":42,"tag":216,"props":626,"children":627},{"style":222},[628],{"type":48,"value":245},{"type":42,"tag":216,"props":630,"children":631},{"style":222},[632],{"type":48,"value":479},{"type":42,"tag":216,"props":634,"children":635},{"style":222},[636],{"type":48,"value":255},{"type":42,"tag":216,"props":638,"children":639},{"style":258},[640],{"type":48,"value":641},"loader",{"type":42,"tag":216,"props":643,"children":644},{"style":222},[645],{"type":48,"value":245},{"type":42,"tag":216,"props":647,"children":648},{"style":222},[649],{"type":48,"value":497},{"type":42,"tag":216,"props":651,"children":653},{"class":218,"line":652},12,[654,658,663,667,671],{"type":42,"tag":216,"props":655,"children":656},{"style":222},[657],{"type":48,"value":412},{"type":42,"tag":216,"props":659,"children":660},{"style":415},[661],{"type":48,"value":662},"c2_live_checks",{"type":42,"tag":216,"props":664,"children":665},{"style":222},[666],{"type":48,"value":245},{"type":42,"tag":216,"props":668,"children":669},{"style":222},[670],{"type":48,"value":250},{"type":42,"tag":216,"props":672,"children":673},{"style":222},[674],{"type":48,"value":675}," [\n",{"type":42,"tag":216,"props":677,"children":679},{"class":218,"line":678},13,[680,685,689,694,698,702,706,711,715,719,723,728,732,736,741,745,750,754,758,763,767,771,776,780,784,788,792,796],{"type":42,"tag":216,"props":681,"children":682},{"style":222},[683],{"type":48,"value":684},"      {",{"type":42,"tag":216,"props":686,"children":687},{"style":222},[688],{"type":48,"value":245},{"type":42,"tag":216,"props":690,"children":691},{"style":294},[692],{"type":48,"value":693},"ioc",{"type":42,"tag":216,"props":695,"children":696},{"style":222},[697],{"type":48,"value":245},{"type":42,"tag":216,"props":699,"children":700},{"style":222},[701],{"type":48,"value":250},{"type":42,"tag":216,"props":703,"children":704},{"style":222},[705],{"type":48,"value":255},{"type":42,"tag":216,"props":707,"children":708},{"style":258},[709],{"type":48,"value":710},"1.2.3.4",{"type":42,"tag":216,"props":712,"children":713},{"style":222},[714],{"type":48,"value":245},{"type":42,"tag":216,"props":716,"children":717},{"style":222},[718],{"type":48,"value":479},{"type":42,"tag":216,"props":720,"children":721},{"style":222},[722],{"type":48,"value":255},{"type":42,"tag":216,"props":724,"children":725},{"style":294},[726],{"type":48,"value":727},"live",{"type":42,"tag":216,"props":729,"children":730},{"style":222},[731],{"type":48,"value":245},{"type":42,"tag":216,"props":733,"children":734},{"style":222},[735],{"type":48,"value":250},{"type":42,"tag":216,"props":737,"children":738},{"style":222},[739],{"type":48,"value":740}," true,",{"type":42,"tag":216,"props":742,"children":743},{"style":222},[744],{"type":48,"value":255},{"type":42,"tag":216,"props":746,"children":747},{"style":294},[748],{"type":48,"value":749},"port",{"type":42,"tag":216,"props":751,"children":752},{"style":222},[753],{"type":48,"value":245},{"type":42,"tag":216,"props":755,"children":756},{"style":222},[757],{"type":48,"value":250},{"type":42,"tag":216,"props":759,"children":760},{"style":294},[761],{"type":48,"value":762}," 443",{"type":42,"tag":216,"props":764,"children":765},{"style":222},[766],{"type":48,"value":479},{"type":42,"tag":216,"props":768,"children":769},{"style":222},[770],{"type":48,"value":255},{"type":42,"tag":216,"props":772,"children":773},{"style":294},[774],{"type":48,"value":775},"banner_snippet",{"type":42,"tag":216,"props":777,"children":778},{"style":222},[779],{"type":48,"value":245},{"type":42,"tag":216,"props":781,"children":782},{"style":222},[783],{"type":48,"value":250},{"type":42,"tag":216,"props":785,"children":786},{"style":222},[787],{"type":48,"value":255},{"type":42,"tag":216,"props":789,"children":790},{"style":258},[791],{"type":48,"value":261},{"type":42,"tag":216,"props":793,"children":794},{"style":222},[795],{"type":48,"value":245},{"type":42,"tag":216,"props":797,"children":798},{"style":222},[799],{"type":48,"value":800},"}\n",{"type":42,"tag":216,"props":802,"children":804},{"class":218,"line":803},14,[805],{"type":42,"tag":216,"props":806,"children":807},{"style":222},[808],{"type":48,"value":809},"    ],\n",{"type":42,"tag":216,"props":811,"children":813},{"class":218,"line":812},15,[814,818,823,827,831],{"type":42,"tag":216,"props":815,"children":816},{"style":222},[817],{"type":48,"value":412},{"type":42,"tag":216,"props":819,"children":820},{"style":415},[821],{"type":48,"value":822},"prior_reporting",{"type":42,"tag":216,"props":824,"children":825},{"style":222},[826],{"type":48,"value":245},{"type":42,"tag":216,"props":828,"children":829},{"style":222},[830],{"type":48,"value":250},{"type":42,"tag":216,"props":832,"children":833},{"style":222},[834],{"type":48,"value":675},{"type":42,"tag":216,"props":836,"children":838},{"class":218,"line":837},16,[839,843,847,852,856,860,864,869,873,877,881,886,890,894,898,902,906,910,914,919,923,927,931,935,939],{"type":42,"tag":216,"props":840,"children":841},{"style":222},[842],{"type":48,"value":684},{"type":42,"tag":216,"props":844,"children":845},{"style":222},[846],{"type":48,"value":245},{"type":42,"tag":216,"props":848,"children":849},{"style":294},[850],{"type":48,"value":851},"source",{"type":42,"tag":216,"props":853,"children":854},{"style":222},[855],{"type":48,"value":245},{"type":42,"tag":216,"props":857,"children":858},{"style":222},[859],{"type":48,"value":250},{"type":42,"tag":216,"props":861,"children":862},{"style":222},[863],{"type":48,"value":255},{"type":42,"tag":216,"props":865,"children":866},{"style":258},[867],{"type":48,"value":868},"Mandiant",{"type":42,"tag":216,"props":870,"children":871},{"style":222},[872],{"type":48,"value":245},{"type":42,"tag":216,"props":874,"children":875},{"style":222},[876],{"type":48,"value":479},{"type":42,"tag":216,"props":878,"children":879},{"style":222},[880],{"type":48,"value":255},{"type":42,"tag":216,"props":882,"children":883},{"style":294},[884],{"type":48,"value":885},"url",{"type":42,"tag":216,"props":887,"children":888},{"style":222},[889],{"type":48,"value":245},{"type":42,"tag":216,"props":891,"children":892},{"style":222},[893],{"type":48,"value":250},{"type":42,"tag":216,"props":895,"children":896},{"style":222},[897],{"type":48,"value":255},{"type":42,"tag":216,"props":899,"children":900},{"style":258},[901],{"type":48,"value":261},{"type":42,"tag":216,"props":903,"children":904},{"style":222},[905],{"type":48,"value":245},{"type":42,"tag":216,"props":907,"children":908},{"style":222},[909],{"type":48,"value":479},{"type":42,"tag":216,"props":911,"children":912},{"style":222},[913],{"type":48,"value":255},{"type":42,"tag":216,"props":915,"children":916},{"style":294},[917],{"type":48,"value":918},"summary",{"type":42,"tag":216,"props":920,"children":921},{"style":222},[922],{"type":48,"value":245},{"type":42,"tag":216,"props":924,"children":925},{"style":222},[926],{"type":48,"value":250},{"type":42,"tag":216,"props":928,"children":929},{"style":222},[930],{"type":48,"value":255},{"type":42,"tag":216,"props":932,"children":933},{"style":258},[934],{"type":48,"value":261},{"type":42,"tag":216,"props":936,"children":937},{"style":222},[938],{"type":48,"value":245},{"type":42,"tag":216,"props":940,"children":941},{"style":222},[942],{"type":48,"value":800},{"type":42,"tag":216,"props":944,"children":946},{"class":218,"line":945},17,[947],{"type":42,"tag":216,"props":948,"children":949},{"style":222},[950],{"type":48,"value":809},{"type":42,"tag":216,"props":952,"children":954},{"class":218,"line":953},18,[955,959,964,968,972,976,980,985,989,993,997,1002,1006],{"type":42,"tag":216,"props":956,"children":957},{"style":222},[958],{"type":48,"value":412},{"type":42,"tag":216,"props":960,"children":961},{"style":415},[962],{"type":48,"value":963},"mitre_ttps_suggested",{"type":42,"tag":216,"props":965,"children":966},{"style":222},[967],{"type":48,"value":245},{"type":42,"tag":216,"props":969,"children":970},{"style":222},[971],{"type":48,"value":250},{"type":42,"tag":216,"props":973,"children":974},{"style":222},[975],{"type":48,"value":461},{"type":42,"tag":216,"props":977,"children":978},{"style":222},[979],{"type":48,"value":245},{"type":42,"tag":216,"props":981,"children":982},{"style":258},[983],{"type":48,"value":984},"T1055.002",{"type":42,"tag":216,"props":986,"children":987},{"style":222},[988],{"type":48,"value":245},{"type":42,"tag":216,"props":990,"children":991},{"style":222},[992],{"type":48,"value":479},{"type":42,"tag":216,"props":994,"children":995},{"style":222},[996],{"type":48,"value":255},{"type":42,"tag":216,"props":998,"children":999},{"style":258},[1000],{"type":48,"value":1001},"T1071.001",{"type":42,"tag":216,"props":1003,"children":1004},{"style":222},[1005],{"type":48,"value":245},{"type":42,"tag":216,"props":1007,"children":1008},{"style":222},[1009],{"type":48,"value":497},{"type":42,"tag":216,"props":1011,"children":1013},{"class":218,"line":1012},19,[1014,1018,1023,1027,1031,1035,1040,1044],{"type":42,"tag":216,"props":1015,"children":1016},{"style":222},[1017],{"type":48,"value":412},{"type":42,"tag":216,"props":1019,"children":1020},{"style":415},[1021],{"type":48,"value":1022},"prior_hypothesis",{"type":42,"tag":216,"props":1024,"children":1025},{"style":222},[1026],{"type":48,"value":245},{"type":42,"tag":216,"props":1028,"children":1029},{"style":222},[1030],{"type":48,"value":250},{"type":42,"tag":216,"props":1032,"children":1033},{"style":222},[1034],{"type":48,"value":255},{"type":42,"tag":216,"props":1036,"children":1037},{"style":258},[1038],{"type":48,"value":1039},"Likely Qakbot v5.x based on VT family + recent Mandiant report",{"type":42,"tag":216,"props":1041,"children":1042},{"style":222},[1043],{"type":48,"value":245},{"type":42,"tag":216,"props":1045,"children":1046},{"style":222},[1047],{"type":48,"value":270},{"type":42,"tag":216,"props":1049,"children":1051},{"class":218,"line":1050},20,[1052,1056,1061,1065,1069,1073,1077,1082,1086,1090,1094,1099,1103],{"type":42,"tag":216,"props":1053,"children":1054},{"style":222},[1055],{"type":48,"value":412},{"type":42,"tag":216,"props":1057,"children":1058},{"style":415},[1059],{"type":48,"value":1060},"recommended_static_focus",{"type":42,"tag":216,"props":1062,"children":1063},{"style":222},[1064],{"type":48,"value":245},{"type":42,"tag":216,"props":1066,"children":1067},{"style":222},[1068],{"type":48,"value":250},{"type":42,"tag":216,"props":1070,"children":1071},{"style":222},[1072],{"type":48,"value":461},{"type":42,"tag":216,"props":1074,"children":1075},{"style":222},[1076],{"type":48,"value":245},{"type":42,"tag":216,"props":1078,"children":1079},{"style":258},[1080],{"type":48,"value":1081},"config_block_extraction",{"type":42,"tag":216,"props":1083,"children":1084},{"style":222},[1085],{"type":48,"value":245},{"type":42,"tag":216,"props":1087,"children":1088},{"style":222},[1089],{"type":48,"value":479},{"type":42,"tag":216,"props":1091,"children":1092},{"style":222},[1093],{"type":48,"value":255},{"type":42,"tag":216,"props":1095,"children":1096},{"style":258},[1097],{"type":48,"value":1098},"c2_pattern_confirmation",{"type":42,"tag":216,"props":1100,"children":1101},{"style":222},[1102],{"type":48,"value":245},{"type":42,"tag":216,"props":1104,"children":1105},{"style":222},[1106],{"type":48,"value":497},{"type":42,"tag":216,"props":1108,"children":1110},{"class":218,"line":1109},21,[1111,1115,1120,1124,1128,1132,1136,1141,1145,1149,1153,1158,1162],{"type":42,"tag":216,"props":1112,"children":1113},{"style":222},[1114],{"type":48,"value":412},{"type":42,"tag":216,"props":1116,"children":1117},{"style":415},[1118],{"type":48,"value":1119},"recommended_yara_rules",{"type":42,"tag":216,"props":1121,"children":1122},{"style":222},[1123],{"type":48,"value":245},{"type":42,"tag":216,"props":1125,"children":1126},{"style":222},[1127],{"type":48,"value":250},{"type":42,"tag":216,"props":1129,"children":1130},{"style":222},[1131],{"type":48,"value":461},{"type":42,"tag":216,"props":1133,"children":1134},{"style":222},[1135],{"type":48,"value":245},{"type":42,"tag":216,"props":1137,"children":1138},{"style":258},[1139],{"type":48,"value":1140},"qakbot_v5",{"type":42,"tag":216,"props":1142,"children":1143},{"style":222},[1144],{"type":48,"value":245},{"type":42,"tag":216,"props":1146,"children":1147},{"style":222},[1148],{"type":48,"value":479},{"type":42,"tag":216,"props":1150,"children":1151},{"style":222},[1152],{"type":48,"value":255},{"type":42,"tag":216,"props":1154,"children":1155},{"style":258},[1156],{"type":48,"value":1157},"banking_trojan_generic",{"type":42,"tag":216,"props":1159,"children":1160},{"style":222},[1161],{"type":48,"value":245},{"type":42,"tag":216,"props":1163,"children":1164},{"style":222},[1165],{"type":48,"value":497},{"type":42,"tag":216,"props":1167,"children":1169},{"class":218,"line":1168},22,[1170,1174,1179,1183,1187],{"type":42,"tag":216,"props":1171,"children":1172},{"style":222},[1173],{"type":48,"value":412},{"type":42,"tag":216,"props":1175,"children":1176},{"style":415},[1177],{"type":48,"value":1178},"short_circuit",{"type":42,"tag":216,"props":1180,"children":1181},{"style":222},[1182],{"type":48,"value":245},{"type":42,"tag":216,"props":1184,"children":1185},{"style":222},[1186],{"type":48,"value":250},{"type":42,"tag":216,"props":1188,"children":1189},{"style":222},[1190],{"type":48,"value":1191}," false\n",{"type":42,"tag":216,"props":1193,"children":1195},{"class":218,"line":1194},23,[1196],{"type":42,"tag":216,"props":1197,"children":1198},{"style":222},[1199],{"type":48,"value":1200},"  },\n",{"type":42,"tag":216,"props":1202,"children":1204},{"class":218,"line":1203},24,[1205,1209,1214,1218,1222,1226,1231],{"type":42,"tag":216,"props":1206,"children":1207},{"style":222},[1208],{"type":48,"value":234},{"type":42,"tag":216,"props":1210,"children":1211},{"style":237},[1212],{"type":48,"value":1213},"notes",{"type":42,"tag":216,"props":1215,"children":1216},{"style":222},[1217],{"type":48,"value":245},{"type":42,"tag":216,"props":1219,"children":1220},{"style":222},[1221],{"type":48,"value":250},{"type":42,"tag":216,"props":1223,"children":1224},{"style":222},[1225],{"type":48,"value":255},{"type":42,"tag":216,"props":1227,"children":1228},{"style":258},[1229],{"type":48,"value":1230},"free text — especially note skipped sources due to missing creds",{"type":42,"tag":216,"props":1232,"children":1233},{"style":222},[1234],{"type":48,"value":1235},"\"\n",{"type":42,"tag":216,"props":1237,"children":1239},{"class":218,"line":1238},25,[1240],{"type":42,"tag":216,"props":1241,"children":1242},{"style":222},[1243],{"type":48,"value":800},{"type":42,"tag":70,"props":1245,"children":1247},{"id":1246},"steps",[1248],{"type":48,"value":1249},"Steps",{"type":42,"tag":1251,"props":1252,"children":1253},"blockquote",{},[1254],{"type":42,"tag":51,"props":1255,"children":1256},{},[1257,1262],{"type":42,"tag":57,"props":1258,"children":1259},{},[1260],{"type":48,"value":1261},"M1 scope note",{"type":48,"value":1263},": for the first end-to-end pipeline tests, only MalwareBazaar is enabled (no auth, no vault dependency). VirusTotal, Shodan, and urlscan are documented below but commented out — re-enable them once the corresponding credentials are provisioned in vault.",{"type":42,"tag":1265,"props":1266,"children":1268},"h3",{"id":1267},"_1-m1-skip-fetch-osint-credentials-from-vault",[1269],{"type":48,"value":1270},"1. (M1 skip) Fetch OSINT credentials from vault",{"type":42,"tag":51,"props":1272,"children":1273},{},[1274],{"type":48,"value":1275},"Commented out until vault creds are configured. Re-enable this block when VT\u002FShodan keys land in Secrets Manager.",{"type":42,"tag":205,"props":1277,"children":1281},{"className":1278,"code":1279,"language":1280,"meta":210,"style":210},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# VT_KEY=$(aws secretsmanager get-secret-value --region us-east-1 \\\n#   --secret-id \"${VIRUSTOTAL_SECRET_PREFIX}\u002Fpublic\" \\\n#   --query SecretString --output text 2>\u002Fdev\u002Fnull || echo \"\")\n#\n# SHODAN_KEY=$(aws secretsmanager get-secret-value --region us-east-1 \\\n#   --secret-id \"${SHODAN_SECRET_PREFIX}\u002Fpublic\" \\\n#   --query SecretString --output text 2>\u002Fdev\u002Fnull || echo \"\")\n","bash",[1282],{"type":42,"tag":116,"props":1283,"children":1284},{"__ignoreMap":210},[1285,1294,1302,1310,1318,1326,1334],{"type":42,"tag":216,"props":1286,"children":1287},{"class":218,"line":26},[1288],{"type":42,"tag":216,"props":1289,"children":1291},{"style":1290},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1292],{"type":48,"value":1293},"# VT_KEY=$(aws secretsmanager get-secret-value --region us-east-1 \\\n",{"type":42,"tag":216,"props":1295,"children":1296},{"class":218,"line":228},[1297],{"type":42,"tag":216,"props":1298,"children":1299},{"style":1290},[1300],{"type":48,"value":1301},"#   --secret-id \"${VIRUSTOTAL_SECRET_PREFIX}\u002Fpublic\" \\\n",{"type":42,"tag":216,"props":1303,"children":1304},{"class":218,"line":273},[1305],{"type":42,"tag":216,"props":1306,"children":1307},{"style":1290},[1308],{"type":48,"value":1309},"#   --query SecretString --output text 2>\u002Fdev\u002Fnull || echo \"\")\n",{"type":42,"tag":216,"props":1311,"children":1312},{"class":218,"line":304},[1313],{"type":42,"tag":216,"props":1314,"children":1315},{"style":1290},[1316],{"type":48,"value":1317},"#\n",{"type":42,"tag":216,"props":1319,"children":1320},{"class":218,"line":342},[1321],{"type":42,"tag":216,"props":1322,"children":1323},{"style":1290},[1324],{"type":48,"value":1325},"# SHODAN_KEY=$(aws secretsmanager get-secret-value --region us-east-1 \\\n",{"type":42,"tag":216,"props":1327,"children":1328},{"class":218,"line":380},[1329],{"type":42,"tag":216,"props":1330,"children":1331},{"style":1290},[1332],{"type":48,"value":1333},"#   --secret-id \"${SHODAN_SECRET_PREFIX}\u002Fpublic\" \\\n",{"type":42,"tag":216,"props":1335,"children":1336},{"class":218,"line":406},[1337],{"type":42,"tag":216,"props":1338,"children":1339},{"style":1290},[1340],{"type":48,"value":1309},{"type":42,"tag":1265,"props":1342,"children":1344},{"id":1343},"_2-m1-skip-virustotal-hash-lookup",[1345],{"type":48,"value":1346},"2. (M1 skip) VirusTotal hash lookup",{"type":42,"tag":51,"props":1348,"children":1349},{},[1350,1352,1357,1359,1365],{"type":48,"value":1351},"Commented out for M1 — no VT credentials yet. Re-enable alongside step 1. Note in ",{"type":42,"tag":116,"props":1353,"children":1355},{"className":1354},[],[1356],{"type":48,"value":1213},{"type":48,"value":1358},": ",{"type":42,"tag":116,"props":1360,"children":1362},{"className":1361},[],[1363],{"type":48,"value":1364},"\"vt skipped — no credentials provisioned (M1)\"",{"type":48,"value":63},{"type":42,"tag":205,"props":1367,"children":1369},{"className":1278,"code":1368,"language":1280,"meta":210,"style":210},"# if [ -n \"$VT_KEY\" ]; then\n#   SHA256=\"\u003Cfrom Stage 1>\"\n#   curl -sS -H \"x-apikey: $VT_KEY\" \\\n#     \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F$SHA256\" | tee \u002Ftmp\u002Fvt.json\n#\n#   jq '{\n#     malicious: .data.attributes.last_analysis_stats.malicious,\n#     total: (.data.attributes.last_analysis_stats | to_entries | map(.value) | add),\n#     family: .data.attributes.popular_threat_classification.suggested_threat_label,\n#     first_seen: .data.attributes.first_submission_date,\n#     last_seen: .data.attributes.last_analysis_date\n#   }' \u002Ftmp\u002Fvt.json\n# fi\n",[1370],{"type":42,"tag":116,"props":1371,"children":1372},{"__ignoreMap":210},[1373,1381,1389,1397,1405,1412,1420,1428,1436,1444,1452,1460,1468],{"type":42,"tag":216,"props":1374,"children":1375},{"class":218,"line":26},[1376],{"type":42,"tag":216,"props":1377,"children":1378},{"style":1290},[1379],{"type":48,"value":1380},"# if [ -n \"$VT_KEY\" ]; then\n",{"type":42,"tag":216,"props":1382,"children":1383},{"class":218,"line":228},[1384],{"type":42,"tag":216,"props":1385,"children":1386},{"style":1290},[1387],{"type":48,"value":1388},"#   SHA256=\"\u003Cfrom Stage 1>\"\n",{"type":42,"tag":216,"props":1390,"children":1391},{"class":218,"line":273},[1392],{"type":42,"tag":216,"props":1393,"children":1394},{"style":1290},[1395],{"type":48,"value":1396},"#   curl -sS -H \"x-apikey: $VT_KEY\" \\\n",{"type":42,"tag":216,"props":1398,"children":1399},{"class":218,"line":304},[1400],{"type":42,"tag":216,"props":1401,"children":1402},{"style":1290},[1403],{"type":48,"value":1404},"#     \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F$SHA256\" | tee \u002Ftmp\u002Fvt.json\n",{"type":42,"tag":216,"props":1406,"children":1407},{"class":218,"line":342},[1408],{"type":42,"tag":216,"props":1409,"children":1410},{"style":1290},[1411],{"type":48,"value":1317},{"type":42,"tag":216,"props":1413,"children":1414},{"class":218,"line":380},[1415],{"type":42,"tag":216,"props":1416,"children":1417},{"style":1290},[1418],{"type":48,"value":1419},"#   jq '{\n",{"type":42,"tag":216,"props":1421,"children":1422},{"class":218,"line":406},[1423],{"type":42,"tag":216,"props":1424,"children":1425},{"style":1290},[1426],{"type":48,"value":1427},"#     malicious: .data.attributes.last_analysis_stats.malicious,\n",{"type":42,"tag":216,"props":1429,"children":1430},{"class":218,"line":438},[1431],{"type":42,"tag":216,"props":1432,"children":1433},{"style":1290},[1434],{"type":48,"value":1435},"#     total: (.data.attributes.last_analysis_stats | to_entries | map(.value) | add),\n",{"type":42,"tag":216,"props":1437,"children":1438},{"class":218,"line":500},[1439],{"type":42,"tag":216,"props":1440,"children":1441},{"style":1290},[1442],{"type":48,"value":1443},"#     family: .data.attributes.popular_threat_classification.suggested_threat_label,\n",{"type":42,"tag":216,"props":1445,"children":1446},{"class":218,"line":538},[1447],{"type":42,"tag":216,"props":1448,"children":1449},{"style":1290},[1450],{"type":48,"value":1451},"#     first_seen: .data.attributes.first_submission_date,\n",{"type":42,"tag":216,"props":1453,"children":1454},{"class":218,"line":576},[1455],{"type":42,"tag":216,"props":1456,"children":1457},{"style":1290},[1458],{"type":48,"value":1459},"#     last_seen: .data.attributes.last_analysis_date\n",{"type":42,"tag":216,"props":1461,"children":1462},{"class":218,"line":652},[1463],{"type":42,"tag":216,"props":1464,"children":1465},{"style":1290},[1466],{"type":48,"value":1467},"#   }' \u002Ftmp\u002Fvt.json\n",{"type":42,"tag":216,"props":1469,"children":1470},{"class":218,"line":678},[1471],{"type":42,"tag":216,"props":1472,"children":1473},{"style":1290},[1474],{"type":48,"value":1475},"# fi\n",{"type":42,"tag":1265,"props":1477,"children":1479},{"id":1478},"_3-malwarebazaar-enabled-no-auth-free-the-m1-primary-source",[1480],{"type":48,"value":1481},"3. MalwareBazaar (ENABLED — no auth, free) — the M1 primary source",{"type":42,"tag":205,"props":1483,"children":1485},{"className":1278,"code":1484,"language":1280,"meta":210,"style":210},"SHA256=\"\u003Cfrom Stage 1 envelope>\"\ncurl -sS -X POST --data \"query=get_info&hash=$SHA256\" \\\n  https:\u002F\u002Fmb-api.abuse.ch\u002Fapi\u002Fv1\u002F > \u002Ftmp\u002Fmb.json\n\n# MalwareBazaar returns query_status = \"ok\" (hit) or \"hash_not_found\" (miss).\nSTATUS=$(jq -r '.query_status' \u002Ftmp\u002Fmb.json)\n\nif [ \"$STATUS\" = \"ok\" ]; then\n  jq '{\n    query_status: .query_status,\n    signature: .data[0].signature,\n    tags: .data[0].tags,\n    file_type: .data[0].file_type,\n    first_seen: .data[0].first_seen,\n    reporter: .data[0].reporter,\n    intelligence: .data[0].intelligence,\n    yara_rules: .data[0].yara_rules\n  }' \u002Ftmp\u002Fmb.json\nelse\n  # hash_not_found — unknown sample, no prior reporting\n  echo '{\"query_status\":\"hash_not_found\",\"note\":\"sample not in MalwareBazaar\"}'\nfi\n",[1486],{"type":42,"tag":116,"props":1487,"children":1488},{"__ignoreMap":210},[1489,1516,1567,1585,1594,1602,1650,1657,1711,1727,1735,1743,1751,1759,1767,1775,1783,1791,1807,1815,1823,1846],{"type":42,"tag":216,"props":1490,"children":1491},{"class":218,"line":26},[1492,1498,1503,1507,1512],{"type":42,"tag":216,"props":1493,"children":1495},{"style":1494},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1496],{"type":48,"value":1497},"SHA256",{"type":42,"tag":216,"props":1499,"children":1500},{"style":222},[1501],{"type":48,"value":1502},"=",{"type":42,"tag":216,"props":1504,"children":1505},{"style":222},[1506],{"type":48,"value":245},{"type":42,"tag":216,"props":1508,"children":1509},{"style":258},[1510],{"type":48,"value":1511},"\u003Cfrom Stage 1 envelope>",{"type":42,"tag":216,"props":1513,"children":1514},{"style":222},[1515],{"type":48,"value":1235},{"type":42,"tag":216,"props":1517,"children":1518},{"class":218,"line":228},[1519,1524,1529,1534,1539,1544,1548,1553,1558,1562],{"type":42,"tag":216,"props":1520,"children":1521},{"style":415},[1522],{"type":48,"value":1523},"curl",{"type":42,"tag":216,"props":1525,"children":1526},{"style":258},[1527],{"type":48,"value":1528}," -sS",{"type":42,"tag":216,"props":1530,"children":1531},{"style":258},[1532],{"type":48,"value":1533}," -X",{"type":42,"tag":216,"props":1535,"children":1536},{"style":258},[1537],{"type":48,"value":1538}," POST",{"type":42,"tag":216,"props":1540,"children":1541},{"style":258},[1542],{"type":48,"value":1543}," --data",{"type":42,"tag":216,"props":1545,"children":1546},{"style":222},[1547],{"type":48,"value":255},{"type":42,"tag":216,"props":1549,"children":1550},{"style":258},[1551],{"type":48,"value":1552},"query=get_info&hash=",{"type":42,"tag":216,"props":1554,"children":1555},{"style":1494},[1556],{"type":48,"value":1557},"$SHA256",{"type":42,"tag":216,"props":1559,"children":1560},{"style":222},[1561],{"type":48,"value":245},{"type":42,"tag":216,"props":1563,"children":1564},{"style":1494},[1565],{"type":48,"value":1566}," \\\n",{"type":42,"tag":216,"props":1568,"children":1569},{"class":218,"line":273},[1570,1575,1580],{"type":42,"tag":216,"props":1571,"children":1572},{"style":258},[1573],{"type":48,"value":1574},"  https:\u002F\u002Fmb-api.abuse.ch\u002Fapi\u002Fv1\u002F",{"type":42,"tag":216,"props":1576,"children":1577},{"style":222},[1578],{"type":48,"value":1579}," >",{"type":42,"tag":216,"props":1581,"children":1582},{"style":258},[1583],{"type":48,"value":1584}," \u002Ftmp\u002Fmb.json\n",{"type":42,"tag":216,"props":1586,"children":1587},{"class":218,"line":304},[1588],{"type":42,"tag":216,"props":1589,"children":1591},{"emptyLinePlaceholder":1590},true,[1592],{"type":48,"value":1593},"\n",{"type":42,"tag":216,"props":1595,"children":1596},{"class":218,"line":342},[1597],{"type":42,"tag":216,"props":1598,"children":1599},{"style":1290},[1600],{"type":48,"value":1601},"# MalwareBazaar returns query_status = \"ok\" (hit) or \"hash_not_found\" (miss).\n",{"type":42,"tag":216,"props":1603,"children":1604},{"class":218,"line":380},[1605,1610,1615,1620,1625,1630,1635,1640,1645],{"type":42,"tag":216,"props":1606,"children":1607},{"style":1494},[1608],{"type":48,"value":1609},"STATUS",{"type":42,"tag":216,"props":1611,"children":1612},{"style":222},[1613],{"type":48,"value":1614},"=$(",{"type":42,"tag":216,"props":1616,"children":1617},{"style":415},[1618],{"type":48,"value":1619},"jq",{"type":42,"tag":216,"props":1621,"children":1622},{"style":258},[1623],{"type":48,"value":1624}," -r",{"type":42,"tag":216,"props":1626,"children":1627},{"style":222},[1628],{"type":48,"value":1629}," '",{"type":42,"tag":216,"props":1631,"children":1632},{"style":258},[1633],{"type":48,"value":1634},".query_status",{"type":42,"tag":216,"props":1636,"children":1637},{"style":222},[1638],{"type":48,"value":1639},"'",{"type":42,"tag":216,"props":1641,"children":1642},{"style":258},[1643],{"type":48,"value":1644}," \u002Ftmp\u002Fmb.json",{"type":42,"tag":216,"props":1646,"children":1647},{"style":222},[1648],{"type":48,"value":1649},")\n",{"type":42,"tag":216,"props":1651,"children":1652},{"class":218,"line":406},[1653],{"type":42,"tag":216,"props":1654,"children":1655},{"emptyLinePlaceholder":1590},[1656],{"type":48,"value":1593},{"type":42,"tag":216,"props":1658,"children":1659},{"class":218,"line":438},[1660,1666,1670,1674,1679,1683,1688,1692,1697,1701,1706],{"type":42,"tag":216,"props":1661,"children":1663},{"style":1662},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[1664],{"type":48,"value":1665},"if",{"type":42,"tag":216,"props":1667,"children":1668},{"style":222},[1669],{"type":48,"value":461},{"type":42,"tag":216,"props":1671,"children":1672},{"style":222},[1673],{"type":48,"value":255},{"type":42,"tag":216,"props":1675,"children":1676},{"style":1494},[1677],{"type":48,"value":1678},"$STATUS",{"type":42,"tag":216,"props":1680,"children":1681},{"style":222},[1682],{"type":48,"value":245},{"type":42,"tag":216,"props":1684,"children":1685},{"style":222},[1686],{"type":48,"value":1687}," =",{"type":42,"tag":216,"props":1689,"children":1690},{"style":222},[1691],{"type":48,"value":255},{"type":42,"tag":216,"props":1693,"children":1694},{"style":258},[1695],{"type":48,"value":1696},"ok",{"type":42,"tag":216,"props":1698,"children":1699},{"style":222},[1700],{"type":48,"value":245},{"type":42,"tag":216,"props":1702,"children":1703},{"style":222},[1704],{"type":48,"value":1705}," ];",{"type":42,"tag":216,"props":1707,"children":1708},{"style":1662},[1709],{"type":48,"value":1710}," then\n",{"type":42,"tag":216,"props":1712,"children":1713},{"class":218,"line":500},[1714,1719,1723],{"type":42,"tag":216,"props":1715,"children":1716},{"style":415},[1717],{"type":48,"value":1718},"  jq",{"type":42,"tag":216,"props":1720,"children":1721},{"style":222},[1722],{"type":48,"value":1629},{"type":42,"tag":216,"props":1724,"children":1725},{"style":258},[1726],{"type":48,"value":225},{"type":42,"tag":216,"props":1728,"children":1729},{"class":218,"line":538},[1730],{"type":42,"tag":216,"props":1731,"children":1732},{"style":258},[1733],{"type":48,"value":1734},"    query_status: .query_status,\n",{"type":42,"tag":216,"props":1736,"children":1737},{"class":218,"line":576},[1738],{"type":42,"tag":216,"props":1739,"children":1740},{"style":258},[1741],{"type":48,"value":1742},"    signature: .data[0].signature,\n",{"type":42,"tag":216,"props":1744,"children":1745},{"class":218,"line":652},[1746],{"type":42,"tag":216,"props":1747,"children":1748},{"style":258},[1749],{"type":48,"value":1750},"    tags: .data[0].tags,\n",{"type":42,"tag":216,"props":1752,"children":1753},{"class":218,"line":678},[1754],{"type":42,"tag":216,"props":1755,"children":1756},{"style":258},[1757],{"type":48,"value":1758},"    file_type: .data[0].file_type,\n",{"type":42,"tag":216,"props":1760,"children":1761},{"class":218,"line":803},[1762],{"type":42,"tag":216,"props":1763,"children":1764},{"style":258},[1765],{"type":48,"value":1766},"    first_seen: .data[0].first_seen,\n",{"type":42,"tag":216,"props":1768,"children":1769},{"class":218,"line":812},[1770],{"type":42,"tag":216,"props":1771,"children":1772},{"style":258},[1773],{"type":48,"value":1774},"    reporter: .data[0].reporter,\n",{"type":42,"tag":216,"props":1776,"children":1777},{"class":218,"line":837},[1778],{"type":42,"tag":216,"props":1779,"children":1780},{"style":258},[1781],{"type":48,"value":1782},"    intelligence: .data[0].intelligence,\n",{"type":42,"tag":216,"props":1784,"children":1785},{"class":218,"line":945},[1786],{"type":42,"tag":216,"props":1787,"children":1788},{"style":258},[1789],{"type":48,"value":1790},"    yara_rules: .data[0].yara_rules\n",{"type":42,"tag":216,"props":1792,"children":1793},{"class":218,"line":953},[1794,1799,1803],{"type":42,"tag":216,"props":1795,"children":1796},{"style":258},[1797],{"type":48,"value":1798},"  }",{"type":42,"tag":216,"props":1800,"children":1801},{"style":222},[1802],{"type":48,"value":1639},{"type":42,"tag":216,"props":1804,"children":1805},{"style":258},[1806],{"type":48,"value":1584},{"type":42,"tag":216,"props":1808,"children":1809},{"class":218,"line":1012},[1810],{"type":42,"tag":216,"props":1811,"children":1812},{"style":1662},[1813],{"type":48,"value":1814},"else\n",{"type":42,"tag":216,"props":1816,"children":1817},{"class":218,"line":1050},[1818],{"type":42,"tag":216,"props":1819,"children":1820},{"style":1290},[1821],{"type":48,"value":1822},"  # hash_not_found — unknown sample, no prior reporting\n",{"type":42,"tag":216,"props":1824,"children":1825},{"class":218,"line":1109},[1826,1832,1836,1841],{"type":42,"tag":216,"props":1827,"children":1829},{"style":1828},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[1830],{"type":48,"value":1831},"  echo",{"type":42,"tag":216,"props":1833,"children":1834},{"style":222},[1835],{"type":48,"value":1629},{"type":42,"tag":216,"props":1837,"children":1838},{"style":258},[1839],{"type":48,"value":1840},"{\"query_status\":\"hash_not_found\",\"note\":\"sample not in MalwareBazaar\"}",{"type":42,"tag":216,"props":1842,"children":1843},{"style":222},[1844],{"type":48,"value":1845},"'\n",{"type":42,"tag":216,"props":1847,"children":1848},{"class":218,"line":1168},[1849],{"type":42,"tag":216,"props":1850,"children":1851},{"style":1662},[1852],{"type":48,"value":1853},"fi\n",{"type":42,"tag":51,"props":1855,"children":1856},{},[1857,1859,1865,1867,1873,1875,1881,1883,1889],{"type":48,"value":1858},"Short-circuit check: if ",{"type":42,"tag":116,"props":1860,"children":1862},{"className":1861},[],[1863],{"type":48,"value":1864},"signature",{"type":48,"value":1866}," contains ",{"type":42,"tag":116,"props":1868,"children":1870},{"className":1869},[],[1871],{"type":48,"value":1872},"EICAR",{"type":48,"value":1874}," or if the hash matches the known EICAR signature (",{"type":42,"tag":116,"props":1876,"children":1878},{"className":1877},[],[1879],{"type":48,"value":1880},"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",{"type":48,"value":1882},"), set ",{"type":42,"tag":116,"props":1884,"children":1886},{"className":1885},[],[1887],{"type":48,"value":1888},"short_circuit: true",{"type":48,"value":1890}," + verdict benign.",{"type":42,"tag":1265,"props":1892,"children":1894},{"id":1893},"_4-m1-skip-shodan-for-each-candidate-ip-from-stage-1",[1895],{"type":48,"value":1896},"4. (M1 skip) Shodan — for each candidate IP from Stage 1",{"type":42,"tag":51,"props":1898,"children":1899},{},[1900],{"type":48,"value":1901},"Commented out for M1 — no Shodan credentials yet.",{"type":42,"tag":205,"props":1903,"children":1905},{"className":1278,"code":1904,"language":1280,"meta":210,"style":210},"# for IP in $(jq -r '.candidate_iocs.ips[]' \u003C\u003C\u003C \"$STAGE1\"); do\n#   curl -sS \"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002F$IP?key=$SHODAN_KEY\" | \\\n#     jq --arg ip \"$IP\" '{ioc:$ip, live:(.ip_str != null), ports:.ports, hostnames:.hostnames, tls:.ssl.cert.issuer}'\n# done\n",[1906],{"type":42,"tag":116,"props":1907,"children":1908},{"__ignoreMap":210},[1909,1917,1925,1933],{"type":42,"tag":216,"props":1910,"children":1911},{"class":218,"line":26},[1912],{"type":42,"tag":216,"props":1913,"children":1914},{"style":1290},[1915],{"type":48,"value":1916},"# for IP in $(jq -r '.candidate_iocs.ips[]' \u003C\u003C\u003C \"$STAGE1\"); do\n",{"type":42,"tag":216,"props":1918,"children":1919},{"class":218,"line":228},[1920],{"type":42,"tag":216,"props":1921,"children":1922},{"style":1290},[1923],{"type":48,"value":1924},"#   curl -sS \"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002F$IP?key=$SHODAN_KEY\" | \\\n",{"type":42,"tag":216,"props":1926,"children":1927},{"class":218,"line":273},[1928],{"type":42,"tag":216,"props":1929,"children":1930},{"style":1290},[1931],{"type":48,"value":1932},"#     jq --arg ip \"$IP\" '{ioc:$ip, live:(.ip_str != null), ports:.ports, hostnames:.hostnames, tls:.ssl.cert.issuer}'\n",{"type":42,"tag":216,"props":1934,"children":1935},{"class":218,"line":304},[1936],{"type":42,"tag":216,"props":1937,"children":1938},{"style":1290},[1939],{"type":48,"value":1940},"# done\n",{"type":42,"tag":1265,"props":1942,"children":1944},{"id":1943},"_5-m1-skip-urlscanio-for-each-candidate-domainurl",[1945],{"type":48,"value":1946},"5. (M1 skip) urlscan.io — for each candidate domain\u002FURL",{"type":42,"tag":51,"props":1948,"children":1949},{},[1950],{"type":48,"value":1951},"Commented out for M1 — rate limit concerns with unauthenticated requests during testing. Re-enable post-M1.",{"type":42,"tag":205,"props":1953,"children":1955},{"className":1278,"code":1954,"language":1280,"meta":210,"style":210},"# for TARGET in $(jq -r '.candidate_iocs.domains[], .candidate_iocs.urls[]' \u003C\u003C\u003C \"$STAGE1\"); do\n#   curl -sS \"https:\u002F\u002Furlscan.io\u002Fapi\u002Fv1\u002Fsearch\u002F?q=domain:$TARGET&size=3\" | \\\n#     jq '{results: [.results[] | {url:.page.url, verdict:.verdicts.malicious, scanned_at:.task.time}]}'\n# done\n",[1956],{"type":42,"tag":116,"props":1957,"children":1958},{"__ignoreMap":210},[1959,1967,1975,1983],{"type":42,"tag":216,"props":1960,"children":1961},{"class":218,"line":26},[1962],{"type":42,"tag":216,"props":1963,"children":1964},{"style":1290},[1965],{"type":48,"value":1966},"# for TARGET in $(jq -r '.candidate_iocs.domains[], .candidate_iocs.urls[]' \u003C\u003C\u003C \"$STAGE1\"); do\n",{"type":42,"tag":216,"props":1968,"children":1969},{"class":218,"line":228},[1970],{"type":42,"tag":216,"props":1971,"children":1972},{"style":1290},[1973],{"type":48,"value":1974},"#   curl -sS \"https:\u002F\u002Furlscan.io\u002Fapi\u002Fv1\u002Fsearch\u002F?q=domain:$TARGET&size=3\" | \\\n",{"type":42,"tag":216,"props":1976,"children":1977},{"class":218,"line":273},[1978],{"type":42,"tag":216,"props":1979,"children":1980},{"style":1290},[1981],{"type":48,"value":1982},"#     jq '{results: [.results[] | {url:.page.url, verdict:.verdicts.malicious, scanned_at:.task.time}]}'\n",{"type":42,"tag":216,"props":1984,"children":1985},{"class":218,"line":304},[1986],{"type":42,"tag":216,"props":1987,"children":1988},{"style":1290},[1989],{"type":48,"value":1940},{"type":42,"tag":1265,"props":1991,"children":1993},{"id":1992},"_6-web-search-prior-reporting",[1994],{"type":48,"value":1995},"6. Web search — prior reporting",{"type":42,"tag":51,"props":1997,"children":1998},{},[1999],{"type":48,"value":2000},"If VT\u002FMB returned a family name, search for it:",{"type":42,"tag":205,"props":2002,"children":2004},{"className":1278,"code":2003,"language":1280,"meta":210,"style":210},"# Use the platform's web-search skill if available, else WebSearch tool directly\n# Queries to run:\n#   - \"\u003Cfamily_name> malware analysis\"\n#   - \"\u003Csha256_first_16> \u003Cfamily>\"\n#   - \"\u003Cc2_domain> threat intel\"\n# Fetch top 3 results each, extract title + URL + short excerpt\n",[2005],{"type":42,"tag":116,"props":2006,"children":2007},{"__ignoreMap":210},[2008,2016,2024,2032,2040,2048],{"type":42,"tag":216,"props":2009,"children":2010},{"class":218,"line":26},[2011],{"type":42,"tag":216,"props":2012,"children":2013},{"style":1290},[2014],{"type":48,"value":2015},"# Use the platform's web-search skill if available, else WebSearch tool directly\n",{"type":42,"tag":216,"props":2017,"children":2018},{"class":218,"line":228},[2019],{"type":42,"tag":216,"props":2020,"children":2021},{"style":1290},[2022],{"type":48,"value":2023},"# Queries to run:\n",{"type":42,"tag":216,"props":2025,"children":2026},{"class":218,"line":273},[2027],{"type":42,"tag":216,"props":2028,"children":2029},{"style":1290},[2030],{"type":48,"value":2031},"#   - \"\u003Cfamily_name> malware analysis\"\n",{"type":42,"tag":216,"props":2033,"children":2034},{"class":218,"line":304},[2035],{"type":42,"tag":216,"props":2036,"children":2037},{"style":1290},[2038],{"type":48,"value":2039},"#   - \"\u003Csha256_first_16> \u003Cfamily>\"\n",{"type":42,"tag":216,"props":2041,"children":2042},{"class":218,"line":342},[2043],{"type":42,"tag":216,"props":2044,"children":2045},{"style":1290},[2046],{"type":48,"value":2047},"#   - \"\u003Cc2_domain> threat intel\"\n",{"type":42,"tag":216,"props":2049,"children":2050},{"class":218,"line":380},[2051],{"type":42,"tag":216,"props":2052,"children":2053},{"style":1290},[2054],{"type":48,"value":2055},"# Fetch top 3 results each, extract title + URL + short excerpt\n",{"type":42,"tag":1265,"props":2057,"children":2059},{"id":2058},"_7-mitre-attck-mapping",[2060],{"type":48,"value":2061},"7. MITRE ATT&CK mapping",{"type":42,"tag":51,"props":2063,"children":2064},{},[2065],{"type":48,"value":2066},"If a family name is known:",{"type":42,"tag":205,"props":2068,"children":2070},{"className":1278,"code":2069,"language":1280,"meta":210,"style":210},"# Look up family in MITRE's known-software database\ncurl -sS \"https:\u002F\u002Fattack.mitre.org\u002Fapi.php?action=ask&query=[[Category:Software]][[Has+display+name::$FAMILY_NAME]]|?Has+technique&format=json\"\n# Or use the bundled enterprise-matrix.json if offline\n",[2071],{"type":42,"tag":116,"props":2072,"children":2073},{"__ignoreMap":210},[2074,2082,2116],{"type":42,"tag":216,"props":2075,"children":2076},{"class":218,"line":26},[2077],{"type":42,"tag":216,"props":2078,"children":2079},{"style":1290},[2080],{"type":48,"value":2081},"# Look up family in MITRE's known-software database\n",{"type":42,"tag":216,"props":2083,"children":2084},{"class":218,"line":228},[2085,2089,2093,2097,2102,2107,2112],{"type":42,"tag":216,"props":2086,"children":2087},{"style":415},[2088],{"type":48,"value":1523},{"type":42,"tag":216,"props":2090,"children":2091},{"style":258},[2092],{"type":48,"value":1528},{"type":42,"tag":216,"props":2094,"children":2095},{"style":222},[2096],{"type":48,"value":255},{"type":42,"tag":216,"props":2098,"children":2099},{"style":258},[2100],{"type":48,"value":2101},"https:\u002F\u002Fattack.mitre.org\u002Fapi.php?action=ask&query=[[Category:Software]][[Has+display+name::",{"type":42,"tag":216,"props":2103,"children":2104},{"style":1494},[2105],{"type":48,"value":2106},"$FAMILY_NAME",{"type":42,"tag":216,"props":2108,"children":2109},{"style":258},[2110],{"type":48,"value":2111},"]]|?Has+technique&format=json",{"type":42,"tag":216,"props":2113,"children":2114},{"style":222},[2115],{"type":48,"value":1235},{"type":42,"tag":216,"props":2117,"children":2118},{"class":218,"line":273},[2119],{"type":42,"tag":216,"props":2120,"children":2121},{"style":1290},[2122],{"type":48,"value":2123},"# Or use the bundled enterprise-matrix.json if offline\n",{"type":42,"tag":1265,"props":2125,"children":2127},{"id":2126},"_8-short-circuit-check",[2128],{"type":48,"value":2129},"8. Short-circuit check",{"type":42,"tag":51,"props":2131,"children":2132},{},[2133],{"type":48,"value":2134},"Before synthesizing, check for known-benign:",{"type":42,"tag":2136,"props":2137,"children":2138},"ul",{},[2139,2152,2165,2186],{"type":42,"tag":2140,"props":2141,"children":2142},"li",{},[2143,2145,2150],{"type":48,"value":2144},"Hash matches EICAR signature (",{"type":42,"tag":116,"props":2146,"children":2148},{"className":2147},[],[2149],{"type":48,"value":1880},{"type":48,"value":2151},") → test file, benign (works without any OSINT)",{"type":42,"tag":2140,"props":2153,"children":2154},{},[2155,2157,2163],{"type":48,"value":2156},"MalwareBazaar returned ",{"type":42,"tag":116,"props":2158,"children":2160},{"className":2159},[],[2161],{"type":48,"value":2162},"query_status = \"hash_not_found\"",{"type":48,"value":2164}," AND Stage 1 showed a valid Authenticode signature → probably benign (but note: MB miss ≠ benign in general; only combine with signature check)",{"type":42,"tag":2140,"props":2166,"children":2167},{},[2168,2170,2176,2178,2184],{"type":48,"value":2169},"(Post-M1) VT ",{"type":42,"tag":116,"props":2171,"children":2173},{"className":2172},[],[2174],{"type":48,"value":2175},"malicious",{"type":48,"value":2177}," count = 0 AND ",{"type":42,"tag":116,"props":2179,"children":2181},{"className":2180},[],[2182],{"type":48,"value":2183},"harmless",{"type":48,"value":2185}," > 10 → benign",{"type":42,"tag":2140,"props":2187,"children":2188},{},[2189],{"type":48,"value":2190},"(Post-M1) Microsoft-signed with valid Authenticode + clean VT score → benign",{"type":42,"tag":51,"props":2192,"children":2193},{},[2194,2196,2201],{"type":48,"value":2195},"If any triggers, set ",{"type":42,"tag":116,"props":2197,"children":2199},{"className":2198},[],[2200],{"type":48,"value":1888},{"type":48,"value":2202}," and synthesize minimal findings. The persona will skip Stages 3-5 and jump to Stage 6.",{"type":42,"tag":1265,"props":2204,"children":2206},{"id":2205},"_9-synthesize-prior_hypothesis",[2207],{"type":48,"value":2208},"9. Synthesize prior_hypothesis",{"type":42,"tag":51,"props":2210,"children":2211},{},[2212],{"type":48,"value":2213},"This is the reasoning step — use the LLM (you) to produce 1-2 sentences + recommended focus. Example:",{"type":42,"tag":1251,"props":2215,"children":2216},{},[2217],{"type":42,"tag":51,"props":2218,"children":2219},{},[2220],{"type":48,"value":2221},"\"Likely Qakbot v5.x — matches Mandiant 2026-04-15 report hash prefix AND C2 infrastructure from VT. Stage 3 should prioritize config-block extraction + Qakbot-family YARA rules, skip generic injection-signature scan.\"",{"type":42,"tag":1265,"props":2223,"children":2225},{"id":2224},"_10-write-envelope-publish-stage-comment",[2226],{"type":48,"value":2227},"10. Write envelope + publish stage comment",{"type":42,"tag":51,"props":2229,"children":2230},{},[2231],{"type":48,"value":2232},"Same pattern as Stage 1: write DDB, post GH comment.",{"type":42,"tag":51,"props":2234,"children":2235},{},[2236],{"type":48,"value":2237},"Comment format (M1 — MalwareBazaar only):",{"type":42,"tag":205,"props":2239,"children":2243},{"className":2240,"code":2241,"language":2242,"meta":210,"style":210},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","## Stage 2 — OSINT recon\n\n**Status**: ✅ | **Short-circuit**: no\n**Scope (M1)**: MalwareBazaar only. VT \u002F Shodan \u002F urlscan deferred until credentials are provisioned.\n\n**Sources consulted:**\n- MalwareBazaar: `query_status=ok` — signature=`\u003Cfamily>`, tags=`[...]`, first_seen=`\u003Cdate>`, reporter=`\u003Cusername>`\n  _(or `query_status=hash_not_found` — sample unknown to MalwareBazaar)_\n- ~~VirusTotal~~ — deferred (no credentials)\n- ~~Shodan~~ — deferred\n- ~~urlscan.io~~ — deferred\n- Web search — `\u003Cn>` hits matching `\u003Cfamily>` \u002F hash prefix\n- MITRE ATT&CK: `\u003CT1055.002>`, `\u003CT1071.001>` (if family known)\n\n### Prior hypothesis\nLikely `\u003Cfamily>` based on MalwareBazaar signature + web reporting. _(If MB miss + no reporting: \"Unknown sample — no prior reporting; Stage 3 should run default YARA corpus.\")_\n\n### Recommended for Stage 3\n- Focus: `\u003Clist>`\n- YARA rules: `\u003Clist>` (or `default` if no hypothesis)\n\n\u003Cdetails>...full JSON...\u003C\u002Fdetails>\n","markdown",[2244],{"type":42,"tag":116,"props":2245,"children":2246},{"__ignoreMap":210},[2247,2260,2267,2309,2330,2337,2354,2454,2492,2519,2544,2568,2615,2663,2670,2683,2722,2729,2741,2766,2813,2820],{"type":42,"tag":216,"props":2248,"children":2249},{"class":218,"line":26},[2250,2255],{"type":42,"tag":216,"props":2251,"children":2252},{"style":222},[2253],{"type":48,"value":2254},"## ",{"type":42,"tag":216,"props":2256,"children":2257},{"style":415},[2258],{"type":48,"value":2259},"Stage 2 — OSINT recon\n",{"type":42,"tag":216,"props":2261,"children":2262},{"class":218,"line":228},[2263],{"type":42,"tag":216,"props":2264,"children":2265},{"emptyLinePlaceholder":1590},[2266],{"type":48,"value":1593},{"type":42,"tag":216,"props":2268,"children":2269},{"class":218,"line":273},[2270,2276,2282,2286,2291,2295,2300,2304],{"type":42,"tag":216,"props":2271,"children":2273},{"style":2272},"--shiki-light:#39ADB5;--shiki-light-font-weight:bold;--shiki-default:#89DDFF;--shiki-default-font-weight:bold;--shiki-dark:#89DDFF;--shiki-dark-font-weight:bold",[2274],{"type":48,"value":2275},"**",{"type":42,"tag":216,"props":2277,"children":2279},{"style":2278},"--shiki-light:#E53935;--shiki-light-font-weight:bold;--shiki-default:#F07178;--shiki-default-font-weight:bold;--shiki-dark:#F07178;--shiki-dark-font-weight:bold",[2280],{"type":48,"value":2281},"Status",{"type":42,"tag":216,"props":2283,"children":2284},{"style":2272},[2285],{"type":48,"value":2275},{"type":42,"tag":216,"props":2287,"children":2288},{"style":1494},[2289],{"type":48,"value":2290},": ✅ | ",{"type":42,"tag":216,"props":2292,"children":2293},{"style":2272},[2294],{"type":48,"value":2275},{"type":42,"tag":216,"props":2296,"children":2297},{"style":2278},[2298],{"type":48,"value":2299},"Short-circuit",{"type":42,"tag":216,"props":2301,"children":2302},{"style":2272},[2303],{"type":48,"value":2275},{"type":42,"tag":216,"props":2305,"children":2306},{"style":1494},[2307],{"type":48,"value":2308},": no\n",{"type":42,"tag":216,"props":2310,"children":2311},{"class":218,"line":304},[2312,2316,2321,2325],{"type":42,"tag":216,"props":2313,"children":2314},{"style":2272},[2315],{"type":48,"value":2275},{"type":42,"tag":216,"props":2317,"children":2318},{"style":2278},[2319],{"type":48,"value":2320},"Scope (M1)",{"type":42,"tag":216,"props":2322,"children":2323},{"style":2272},[2324],{"type":48,"value":2275},{"type":42,"tag":216,"props":2326,"children":2327},{"style":1494},[2328],{"type":48,"value":2329},": MalwareBazaar only. VT \u002F Shodan \u002F urlscan deferred until credentials are provisioned.\n",{"type":42,"tag":216,"props":2331,"children":2332},{"class":218,"line":342},[2333],{"type":42,"tag":216,"props":2334,"children":2335},{"emptyLinePlaceholder":1590},[2336],{"type":48,"value":1593},{"type":42,"tag":216,"props":2338,"children":2339},{"class":218,"line":380},[2340,2344,2349],{"type":42,"tag":216,"props":2341,"children":2342},{"style":2272},[2343],{"type":48,"value":2275},{"type":42,"tag":216,"props":2345,"children":2346},{"style":2278},[2347],{"type":48,"value":2348},"Sources consulted:",{"type":42,"tag":216,"props":2350,"children":2351},{"style":2272},[2352],{"type":48,"value":2353},"**\n",{"type":42,"tag":216,"props":2355,"children":2356},{"class":218,"line":406},[2357,2362,2367,2372,2377,2381,2386,2390,2395,2399,2404,2408,2413,2417,2422,2426,2431,2435,2440,2444,2449],{"type":42,"tag":216,"props":2358,"children":2359},{"style":222},[2360],{"type":48,"value":2361},"-",{"type":42,"tag":216,"props":2363,"children":2364},{"style":1494},[2365],{"type":48,"value":2366}," MalwareBazaar: ",{"type":42,"tag":216,"props":2368,"children":2369},{"style":222},[2370],{"type":48,"value":2371},"`",{"type":42,"tag":216,"props":2373,"children":2374},{"style":258},[2375],{"type":48,"value":2376},"query_status=ok",{"type":42,"tag":216,"props":2378,"children":2379},{"style":222},[2380],{"type":48,"value":2371},{"type":42,"tag":216,"props":2382,"children":2383},{"style":1494},[2384],{"type":48,"value":2385}," — signature=",{"type":42,"tag":216,"props":2387,"children":2388},{"style":222},[2389],{"type":48,"value":2371},{"type":42,"tag":216,"props":2391,"children":2392},{"style":258},[2393],{"type":48,"value":2394},"\u003Cfamily>",{"type":42,"tag":216,"props":2396,"children":2397},{"style":222},[2398],{"type":48,"value":2371},{"type":42,"tag":216,"props":2400,"children":2401},{"style":1494},[2402],{"type":48,"value":2403},", tags=",{"type":42,"tag":216,"props":2405,"children":2406},{"style":222},[2407],{"type":48,"value":2371},{"type":42,"tag":216,"props":2409,"children":2410},{"style":258},[2411],{"type":48,"value":2412},"[...]",{"type":42,"tag":216,"props":2414,"children":2415},{"style":222},[2416],{"type":48,"value":2371},{"type":42,"tag":216,"props":2418,"children":2419},{"style":1494},[2420],{"type":48,"value":2421},", first_seen=",{"type":42,"tag":216,"props":2423,"children":2424},{"style":222},[2425],{"type":48,"value":2371},{"type":42,"tag":216,"props":2427,"children":2428},{"style":258},[2429],{"type":48,"value":2430},"\u003Cdate>",{"type":42,"tag":216,"props":2432,"children":2433},{"style":222},[2434],{"type":48,"value":2371},{"type":42,"tag":216,"props":2436,"children":2437},{"style":1494},[2438],{"type":48,"value":2439},", reporter=",{"type":42,"tag":216,"props":2441,"children":2442},{"style":222},[2443],{"type":48,"value":2371},{"type":42,"tag":216,"props":2445,"children":2446},{"style":258},[2447],{"type":48,"value":2448},"\u003Cusername>",{"type":42,"tag":216,"props":2450,"children":2451},{"style":222},[2452],{"type":48,"value":2453},"`\n",{"type":42,"tag":216,"props":2455,"children":2456},{"class":218,"line":438},[2457,2462,2468,2472,2478,2482,2487],{"type":42,"tag":216,"props":2458,"children":2459},{"style":1662},[2460],{"type":48,"value":2461},"  _",{"type":42,"tag":216,"props":2463,"children":2465},{"style":2464},"--shiki-light:#E53935;--shiki-light-font-style:italic;--shiki-default:#F07178;--shiki-default-font-style:italic;--shiki-dark:#F07178;--shiki-dark-font-style:italic",[2466],{"type":48,"value":2467},"(or ",{"type":42,"tag":216,"props":2469,"children":2470},{"style":1662},[2471],{"type":48,"value":2371},{"type":42,"tag":216,"props":2473,"children":2475},{"style":2474},"--shiki-light:#91B859;--shiki-light-font-style:italic;--shiki-default:#C3E88D;--shiki-default-font-style:italic;--shiki-dark:#C3E88D;--shiki-dark-font-style:italic",[2476],{"type":48,"value":2477},"query_status=hash_not_found",{"type":42,"tag":216,"props":2479,"children":2480},{"style":1662},[2481],{"type":48,"value":2371},{"type":42,"tag":216,"props":2483,"children":2484},{"style":2464},[2485],{"type":48,"value":2486}," — sample unknown to MalwareBazaar)",{"type":42,"tag":216,"props":2488,"children":2489},{"style":1662},[2490],{"type":48,"value":2491},"_\n",{"type":42,"tag":216,"props":2493,"children":2494},{"class":218,"line":500},[2495,2499,2504,2509,2514],{"type":42,"tag":216,"props":2496,"children":2497},{"style":222},[2498],{"type":48,"value":2361},{"type":42,"tag":216,"props":2500,"children":2501},{"style":222},[2502],{"type":48,"value":2503}," ~~",{"type":42,"tag":216,"props":2505,"children":2506},{"style":1494},[2507],{"type":48,"value":2508},"VirusTotal",{"type":42,"tag":216,"props":2510,"children":2511},{"style":222},[2512],{"type":48,"value":2513},"~~",{"type":42,"tag":216,"props":2515,"children":2516},{"style":1494},[2517],{"type":48,"value":2518}," — deferred (no credentials)\n",{"type":42,"tag":216,"props":2520,"children":2521},{"class":218,"line":538},[2522,2526,2530,2535,2539],{"type":42,"tag":216,"props":2523,"children":2524},{"style":222},[2525],{"type":48,"value":2361},{"type":42,"tag":216,"props":2527,"children":2528},{"style":222},[2529],{"type":48,"value":2503},{"type":42,"tag":216,"props":2531,"children":2532},{"style":1494},[2533],{"type":48,"value":2534},"Shodan",{"type":42,"tag":216,"props":2536,"children":2537},{"style":222},[2538],{"type":48,"value":2513},{"type":42,"tag":216,"props":2540,"children":2541},{"style":1494},[2542],{"type":48,"value":2543}," — deferred\n",{"type":42,"tag":216,"props":2545,"children":2546},{"class":218,"line":576},[2547,2551,2555,2560,2564],{"type":42,"tag":216,"props":2548,"children":2549},{"style":222},[2550],{"type":48,"value":2361},{"type":42,"tag":216,"props":2552,"children":2553},{"style":222},[2554],{"type":48,"value":2503},{"type":42,"tag":216,"props":2556,"children":2557},{"style":1494},[2558],{"type":48,"value":2559},"urlscan.io",{"type":42,"tag":216,"props":2561,"children":2562},{"style":222},[2563],{"type":48,"value":2513},{"type":42,"tag":216,"props":2565,"children":2566},{"style":1494},[2567],{"type":48,"value":2543},{"type":42,"tag":216,"props":2569,"children":2570},{"class":218,"line":652},[2571,2575,2580,2584,2589,2593,2598,2602,2606,2610],{"type":42,"tag":216,"props":2572,"children":2573},{"style":222},[2574],{"type":48,"value":2361},{"type":42,"tag":216,"props":2576,"children":2577},{"style":1494},[2578],{"type":48,"value":2579}," Web search — ",{"type":42,"tag":216,"props":2581,"children":2582},{"style":222},[2583],{"type":48,"value":2371},{"type":42,"tag":216,"props":2585,"children":2586},{"style":258},[2587],{"type":48,"value":2588},"\u003Cn>",{"type":42,"tag":216,"props":2590,"children":2591},{"style":222},[2592],{"type":48,"value":2371},{"type":42,"tag":216,"props":2594,"children":2595},{"style":1494},[2596],{"type":48,"value":2597}," hits matching ",{"type":42,"tag":216,"props":2599,"children":2600},{"style":222},[2601],{"type":48,"value":2371},{"type":42,"tag":216,"props":2603,"children":2604},{"style":258},[2605],{"type":48,"value":2394},{"type":42,"tag":216,"props":2607,"children":2608},{"style":222},[2609],{"type":48,"value":2371},{"type":42,"tag":216,"props":2611,"children":2612},{"style":1494},[2613],{"type":48,"value":2614}," \u002F hash prefix\n",{"type":42,"tag":216,"props":2616,"children":2617},{"class":218,"line":678},[2618,2622,2627,2631,2636,2640,2645,2649,2654,2658],{"type":42,"tag":216,"props":2619,"children":2620},{"style":222},[2621],{"type":48,"value":2361},{"type":42,"tag":216,"props":2623,"children":2624},{"style":1494},[2625],{"type":48,"value":2626}," MITRE ATT&CK: ",{"type":42,"tag":216,"props":2628,"children":2629},{"style":222},[2630],{"type":48,"value":2371},{"type":42,"tag":216,"props":2632,"children":2633},{"style":258},[2634],{"type":48,"value":2635},"\u003CT1055.002>",{"type":42,"tag":216,"props":2637,"children":2638},{"style":222},[2639],{"type":48,"value":2371},{"type":42,"tag":216,"props":2641,"children":2642},{"style":1494},[2643],{"type":48,"value":2644},", ",{"type":42,"tag":216,"props":2646,"children":2647},{"style":222},[2648],{"type":48,"value":2371},{"type":42,"tag":216,"props":2650,"children":2651},{"style":258},[2652],{"type":48,"value":2653},"\u003CT1071.001>",{"type":42,"tag":216,"props":2655,"children":2656},{"style":222},[2657],{"type":48,"value":2371},{"type":42,"tag":216,"props":2659,"children":2660},{"style":1494},[2661],{"type":48,"value":2662}," (if family known)\n",{"type":42,"tag":216,"props":2664,"children":2665},{"class":218,"line":803},[2666],{"type":42,"tag":216,"props":2667,"children":2668},{"emptyLinePlaceholder":1590},[2669],{"type":48,"value":1593},{"type":42,"tag":216,"props":2671,"children":2672},{"class":218,"line":812},[2673,2678],{"type":42,"tag":216,"props":2674,"children":2675},{"style":222},[2676],{"type":48,"value":2677},"### ",{"type":42,"tag":216,"props":2679,"children":2680},{"style":415},[2681],{"type":48,"value":2682},"Prior hypothesis\n",{"type":42,"tag":216,"props":2684,"children":2685},{"class":218,"line":837},[2686,2691,2695,2699,2703,2708,2713,2718],{"type":42,"tag":216,"props":2687,"children":2688},{"style":1494},[2689],{"type":48,"value":2690},"Likely ",{"type":42,"tag":216,"props":2692,"children":2693},{"style":222},[2694],{"type":48,"value":2371},{"type":42,"tag":216,"props":2696,"children":2697},{"style":258},[2698],{"type":48,"value":2394},{"type":42,"tag":216,"props":2700,"children":2701},{"style":222},[2702],{"type":48,"value":2371},{"type":42,"tag":216,"props":2704,"children":2705},{"style":1494},[2706],{"type":48,"value":2707}," based on MalwareBazaar signature + web reporting. ",{"type":42,"tag":216,"props":2709,"children":2710},{"style":1662},[2711],{"type":48,"value":2712},"_",{"type":42,"tag":216,"props":2714,"children":2715},{"style":2464},[2716],{"type":48,"value":2717},"(If MB miss + no reporting: \"Unknown sample — no prior reporting; Stage 3 should run default YARA corpus.\")",{"type":42,"tag":216,"props":2719,"children":2720},{"style":1662},[2721],{"type":48,"value":2491},{"type":42,"tag":216,"props":2723,"children":2724},{"class":218,"line":945},[2725],{"type":42,"tag":216,"props":2726,"children":2727},{"emptyLinePlaceholder":1590},[2728],{"type":48,"value":1593},{"type":42,"tag":216,"props":2730,"children":2731},{"class":218,"line":953},[2732,2736],{"type":42,"tag":216,"props":2733,"children":2734},{"style":222},[2735],{"type":48,"value":2677},{"type":42,"tag":216,"props":2737,"children":2738},{"style":415},[2739],{"type":48,"value":2740},"Recommended for Stage 3\n",{"type":42,"tag":216,"props":2742,"children":2743},{"class":218,"line":1012},[2744,2748,2753,2757,2762],{"type":42,"tag":216,"props":2745,"children":2746},{"style":222},[2747],{"type":48,"value":2361},{"type":42,"tag":216,"props":2749,"children":2750},{"style":1494},[2751],{"type":48,"value":2752}," Focus: ",{"type":42,"tag":216,"props":2754,"children":2755},{"style":222},[2756],{"type":48,"value":2371},{"type":42,"tag":216,"props":2758,"children":2759},{"style":258},[2760],{"type":48,"value":2761},"\u003Clist>",{"type":42,"tag":216,"props":2763,"children":2764},{"style":222},[2765],{"type":48,"value":2453},{"type":42,"tag":216,"props":2767,"children":2768},{"class":218,"line":1050},[2769,2773,2778,2782,2786,2790,2795,2799,2804,2808],{"type":42,"tag":216,"props":2770,"children":2771},{"style":222},[2772],{"type":48,"value":2361},{"type":42,"tag":216,"props":2774,"children":2775},{"style":1494},[2776],{"type":48,"value":2777}," YARA rules: ",{"type":42,"tag":216,"props":2779,"children":2780},{"style":222},[2781],{"type":48,"value":2371},{"type":42,"tag":216,"props":2783,"children":2784},{"style":258},[2785],{"type":48,"value":2761},{"type":42,"tag":216,"props":2787,"children":2788},{"style":222},[2789],{"type":48,"value":2371},{"type":42,"tag":216,"props":2791,"children":2792},{"style":1494},[2793],{"type":48,"value":2794}," (or ",{"type":42,"tag":216,"props":2796,"children":2797},{"style":222},[2798],{"type":48,"value":2371},{"type":42,"tag":216,"props":2800,"children":2801},{"style":258},[2802],{"type":48,"value":2803},"default",{"type":42,"tag":216,"props":2805,"children":2806},{"style":222},[2807],{"type":48,"value":2371},{"type":42,"tag":216,"props":2809,"children":2810},{"style":1494},[2811],{"type":48,"value":2812}," if no hypothesis)\n",{"type":42,"tag":216,"props":2814,"children":2815},{"class":218,"line":1109},[2816],{"type":42,"tag":216,"props":2817,"children":2818},{"emptyLinePlaceholder":1590},[2819],{"type":48,"value":1593},{"type":42,"tag":216,"props":2821,"children":2822},{"class":218,"line":1168},[2823],{"type":42,"tag":216,"props":2824,"children":2825},{"style":1494},[2826],{"type":48,"value":2827},"\u003Cdetails>...full JSON...\u003C\u002Fdetails>\n",{"type":42,"tag":70,"props":2829,"children":2831},{"id":2830},"failure-handling",[2832],{"type":48,"value":2833},"Failure handling",{"type":42,"tag":2136,"props":2835,"children":2836},{},[2837,2849,2862],{"type":42,"tag":2140,"props":2838,"children":2839},{},[2840,2842,2847],{"type":48,"value":2841},"Any individual source fails\u002Frate-limits → skip it, note in ",{"type":42,"tag":116,"props":2843,"children":2845},{"className":2844},[],[2846],{"type":48,"value":1213},{"type":48,"value":2848},", continue with others",{"type":42,"tag":2140,"props":2850,"children":2851},{},[2852,2854,2860],{"type":48,"value":2853},"All sources fail → stage status ",{"type":42,"tag":116,"props":2855,"children":2857},{"className":2856},[],[2858],{"type":48,"value":2859},"partial",{"type":48,"value":2861},", prior_hypothesis = \"unknown — no OSINT available\"",{"type":42,"tag":2140,"props":2863,"children":2864},{},[2865],{"type":48,"value":2866},"Don't block the pipeline. Stage 3 can run with an empty brief (generic YARA scan).",{"type":42,"tag":70,"props":2868,"children":2870},{"id":2869},"rate-limits",[2871],{"type":48,"value":2872},"Rate limits",{"type":42,"tag":2136,"props":2874,"children":2875},{},[2876,2881,2886,2891],{"type":42,"tag":2140,"props":2877,"children":2878},{},[2879],{"type":48,"value":2880},"VirusTotal Public API: 4 req\u002Fmin, 500 req\u002Fday. Cache per-hash in DDB.",{"type":42,"tag":2140,"props":2882,"children":2883},{},[2884],{"type":48,"value":2885},"MalwareBazaar: no published limit, be polite (\u003C 1 req\u002Fsec).",{"type":42,"tag":2140,"props":2887,"children":2888},{},[2889],{"type":48,"value":2890},"Shodan free: 100 req\u002Fmonth. Only hit for IOCs likely to matter (skip private IPs, localhost).",{"type":42,"tag":2140,"props":2892,"children":2893},{},[2894],{"type":48,"value":2895},"urlscan: 100 req\u002Fday.",{"type":42,"tag":70,"props":2897,"children":2899},{"id":2898},"guardrails",[2900],{"type":48,"value":2901},"Guardrails",{"type":42,"tag":2136,"props":2903,"children":2904},{},[2905,2910,2915,2920],{"type":42,"tag":2140,"props":2906,"children":2907},{},[2908],{"type":48,"value":2909},"Degrade gracefully on missing credentials. A missing VT key isn't a stage failure — it's a reduced brief. Fail-hard on missing OSINT would make the pipeline unusable for tenants who haven't yet configured every intel source.",{"type":42,"tag":2140,"props":2911,"children":2912},{},[2913],{"type":48,"value":2914},"Short-circuit eagerly on known-benign. Running the full pipeline on EICAR or a signed Microsoft binary wastes compute and floods the issue with stage comments that all say \"clean.\"",{"type":42,"tag":2140,"props":2916,"children":2917},{},[2918],{"type":48,"value":2919},"Synthesize the hypothesis; don't dump raw API responses. Stage 3's YARA ruleset and Stage 4's sandbox profile depend on a crisp hypothesis — a wall of JSON teaches Stage 3 nothing.",{"type":42,"tag":2140,"props":2921,"children":2922},{},[2923],{"type":48,"value":2924},"Cache per-hash in DDB. VirusTotal's free tier is 4 req\u002Fmin; repeat lookups on the same hash in a single pipeline run will rate-limit you and slow every subsequent stage.",{"type":42,"tag":2926,"props":2927,"children":2928},"style",{},[2929],{"type":48,"value":2930},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2932,"total":380},[2933,2950,2957,2970,2988,3007],{"slug":2934,"name":2934,"fn":2935,"description":2936,"org":2937,"tags":2938,"stars":26,"repoUrl":27,"updatedAt":2949},"stage-1-triage","perform initial malware sample triage","Lightweight fingerprinting of a malware sample — hashes, file type, entropy, strings, candidate IOCs. Use this skill whenever you start a 7-stage malware analysis pipeline, need a quick file identification before deeper analysis, or want to check a sample against known-hash databases before committing compute. This is always the first stage and must run before Stage 2 (OSINT), Stage 3 (static), or Stage 4 (dynamic).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2939,2942,2945,2946],{"name":2940,"slug":2941,"type":16},"Code Analysis","code-analysis",{"name":2943,"slug":2944,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":2947,"slug":2948,"type":16},"Triage","triage","2026-08-04T05:58:50.852669",{"slug":4,"name":4,"fn":5,"description":6,"org":2951,"tags":2952,"stars":26,"repoUrl":27,"updatedAt":28},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2953,2954,2955,2956],{"name":21,"slug":22,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":24,"slug":25,"type":16},{"slug":2958,"name":2958,"fn":2959,"description":2960,"org":2961,"tags":2962,"stars":26,"repoUrl":27,"updatedAt":2969},"stage-5-correlation","correlate dynamic findings with threat intelligence","Cross-reference dynamic findings against threat intel (MISP, VT, web reporting) + MITRE ATT&CK to derive family + TTPs + campaign linkage. Use this skill whenever you have Stage 4 dynamic observations (C2 IPs, mutexes, injection targets) and want to link them to known campaigns, confirm Stage 2's hypothesis, or produce MITRE TTP IDs with specific per-stage evidence. Runs after Stage 4, or after Stage 3 if Stage 4 was unavailable — can work with partial data. Skip on Stage 2 short-circuit.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2963,2966,2967,2968],{"name":2964,"slug":2965,"type":16},"Audit","audit",{"name":2940,"slug":2941,"type":16},{"name":14,"slug":15,"type":16},{"name":24,"slug":25,"type":16},"2026-08-04T05:59:09.270695",{"slug":2971,"name":2971,"fn":2972,"description":2973,"org":2974,"tags":2975,"stars":26,"repoUrl":27,"updatedAt":2987},"stage-6-verdict","synthesize security verdicts and recommended actions","Synthesize severity (malicious\u002Fsuspicious\u002Fbenign), confidence (high\u002Fmedium\u002Flow), STIX 2.1 IOC bundle, CSV feed, and concrete recommended actions (host isolation, token revocation, perimeter blocks, fleet-wide hunt queries) from all prior stage envelopes. Use this skill whenever earlier stages have produced findings (or on a Stage 2 short-circuit to benign) and you need a machine-readable verdict that IR teams can ingest into Splunk\u002FElastic\u002FSentinel or block at the perimeter. Always runs — even short-circuits produce a minimal clean-sample verdict. Runs after all other analysis stages; Stage 7 depends on this output.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2976,2977,2980,2983,2986],{"name":2964,"slug":2965,"type":16},{"name":2978,"slug":2979,"type":16},"Compliance","compliance",{"name":2981,"slug":2982,"type":16},"Incident Response","incident-response",{"name":2984,"slug":2985,"type":16},"Policy","policy",{"name":14,"slug":15,"type":16},"2026-08-04T05:59:08.753662",{"slug":2989,"name":2989,"fn":2990,"description":2991,"org":2992,"tags":2993,"stars":26,"repoUrl":27,"updatedAt":3006},"stage-7-report","generate security incident reports and IOC feeds","Produce the final deliverables — executive summary (for leadership), structured technical report (for IR), STIX 2.1 + CSV IOC feeds (for SIEM\u002Ffirewall), copy-pasteable Splunk\u002FElastic\u002FSentinel hunt queries — upload them all to S3 with presigned URLs, and post a single consolidated comment linking everything. Use this skill whenever the pipeline has reached a verdict (Stage 6 done) and the issue needs a handoff-ready set of artifacts for IR follow-up. Always the last stage; runs on benign short-circuits too (produces a concise clean-sample report).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2994,2995,2996,2999,3002,3003],{"name":2964,"slug":2965,"type":16},{"name":2978,"slug":2979,"type":16},{"name":2997,"slug":2998,"type":16},"Elastic","elastic",{"name":3000,"slug":3001,"type":16},"Reporting","reporting",{"name":14,"slug":15,"type":16},{"name":3004,"slug":3005,"type":16},"Splunk","splunk","2026-08-04T05:59:08.226613",{"slug":3008,"name":3008,"fn":3009,"description":3010,"org":3011,"tags":3012,"stars":26,"repoUrl":27,"updatedAt":3020},"url-analysis","analyze suspicious URLs in isolated browser sessions","Analyze a suspicious URL by visiting it in an isolated AgentCore Browser\nsession. Captures screenshots, DOM, network requests, redirects, and\nextracted IOCs. Use for phishing triage, suspicious-link investigation,\nand malicious-site fingerprinting.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3013,3016,3017,3018,3019],{"name":3014,"slug":3015,"type":16},"Browser Automation","browser-automation",{"name":2940,"slug":2941,"type":16},{"name":2943,"slug":2944,"type":16},{"name":14,"slug":15,"type":16},{"name":2947,"slug":2948,"type":16},"2026-08-04T05:58:51.393402",{"items":3022,"total":3198},[3023,3042,3063,3073,3086,3099,3109,3119,3140,3153,3168,3183],{"slug":3024,"name":3024,"fn":3025,"description":3026,"org":3027,"tags":3028,"stars":3039,"repoUrl":3040,"updatedAt":3041},"agentcore-investigation","investigate Bedrock AgentCore runtime sessions","Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3029,3032,3033,3036],{"name":3030,"slug":3031,"type":16},"AWS","aws",{"name":2943,"slug":2944,"type":16},{"name":3034,"slug":3035,"type":16},"Logs","logs",{"name":3037,"slug":3038,"type":16},"Observability","observability",9427,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp","2026-07-12T08:37:22.601527",{"slug":3043,"name":3044,"fn":3045,"description":3046,"org":3047,"tags":3048,"stars":3039,"repoUrl":3040,"updatedAt":3062},"amazon-aurora-dsql","amazon aurora dsql","build applications with Aurora DSQL","Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django\u002FHibernate\u002FRails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3049,3052,3053,3056,3059],{"name":3050,"slug":3051,"type":16},"Aurora","aurora",{"name":3030,"slug":3031,"type":16},{"name":3054,"slug":3055,"type":16},"Database","database",{"name":3057,"slug":3058,"type":16},"Serverless","serverless",{"name":3060,"slug":3061,"type":16},"SQL","sql","2026-08-04T05:35:10.770847",{"slug":3064,"name":3065,"fn":3045,"description":3046,"org":3066,"tags":3067,"stars":3039,"repoUrl":3040,"updatedAt":3072},"aurora-dsql","aurora dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3068,3069,3070,3071],{"name":3030,"slug":3031,"type":16},{"name":3054,"slug":3055,"type":16},{"name":3057,"slug":3058,"type":16},{"name":3060,"slug":3061,"type":16},"2026-08-04T05:35:05.694395",{"slug":3074,"name":3075,"fn":3045,"description":3046,"org":3076,"tags":3077,"stars":3039,"repoUrl":3040,"updatedAt":3085},"aws-dsql","aws dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3078,3079,3080,3083,3084],{"name":3030,"slug":3031,"type":16},{"name":3054,"slug":3055,"type":16},{"name":3081,"slug":3082,"type":16},"Migration","migration",{"name":3057,"slug":3058,"type":16},{"name":3060,"slug":3061,"type":16},"2026-08-04T05:35:08.749669",{"slug":3087,"name":3088,"fn":3045,"description":3046,"org":3089,"tags":3090,"stars":3039,"repoUrl":3040,"updatedAt":3098},"distributed-postgres","distributed postgres",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3091,3092,3093,3096,3097],{"name":3030,"slug":3031,"type":16},{"name":3054,"slug":3055,"type":16},{"name":3094,"slug":3095,"type":16},"PostgreSQL","postgresql",{"name":3057,"slug":3058,"type":16},{"name":3060,"slug":3061,"type":16},"2026-08-04T05:35:06.713102",{"slug":3100,"name":3101,"fn":3045,"description":3046,"org":3102,"tags":3103,"stars":3039,"repoUrl":3040,"updatedAt":3108},"distributed-sql","distributed sql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3104,3105,3106,3107],{"name":3030,"slug":3031,"type":16},{"name":3054,"slug":3055,"type":16},{"name":3057,"slug":3058,"type":16},{"name":3060,"slug":3061,"type":16},"2026-08-04T05:35:10.086942",{"slug":3110,"name":3110,"fn":3045,"description":3046,"org":3111,"tags":3112,"stars":3039,"repoUrl":3040,"updatedAt":3118},"dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3113,3114,3115,3116,3117],{"name":3030,"slug":3031,"type":16},{"name":3054,"slug":3055,"type":16},{"name":3081,"slug":3082,"type":16},{"name":3057,"slug":3058,"type":16},{"name":3060,"slug":3061,"type":16},"2026-08-04T05:35:07.751779",{"slug":3120,"name":3120,"fn":3121,"description":3122,"org":3123,"tags":3124,"stars":3137,"repoUrl":3138,"updatedAt":3139},"cost-efficiency-analyzer","analyze cost efficiency and expenses","Analyzes cost structure, cost efficiency, and expense management from P&L data. Use when the user asks about costs, expenses, COGS, operating expenses, cost ratios, cost control, spending efficiency, margin compression from cost side, or wants to understand where money is going. Also use for \"are we spending too much\", \"cost breakdown\", \"expense analysis\", or \"how efficient are our operations\". NOT for revenue or top-line analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3125,3128,3131,3134],{"name":3126,"slug":3127,"type":16},"Accounting","accounting",{"name":3129,"slug":3130,"type":16},"Analytics","analytics",{"name":3132,"slug":3133,"type":16},"Cost Optimization","cost-optimization",{"name":3135,"slug":3136,"type":16},"Finance","finance",3176,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentcore-samples","2026-07-12T08:40:03.29555",{"slug":3141,"name":3141,"fn":3142,"description":3143,"org":3144,"tags":3145,"stars":3137,"repoUrl":3138,"updatedAt":3152},"executive-financial-briefing","generate executive financial briefings","Generates a concise executive-level financial briefing or summary suitable for a CEO, CFO, or board presentation. Use when the user asks for a summary, briefing, executive summary, board update, financial overview, financial health check, or \"how is the business doing\". Covers the full P&L picture in one page. Also use for \"give me the highlights\", \"what do I need to know\", or \"quick financial update\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3146,3147,3148,3151],{"name":3030,"slug":3031,"type":16},{"name":3135,"slug":3136,"type":16},{"name":3149,"slug":3150,"type":16},"Management","management",{"name":3000,"slug":3001,"type":16},"2026-07-12T08:40:02.066471",{"slug":3154,"name":3154,"fn":3155,"description":3156,"org":3157,"tags":3158,"stars":3137,"repoUrl":3138,"updatedAt":3167},"multi-quarter-trend-analysis","analyze multi-quarter financial trends","Analyzes financial trends across multiple quarters by comparing P&L metrics over time. Use when the user wants to see trends, patterns, trajectories, or directional movement across 3 or more quarters. Also use for \"how are we trending\", \"show me the trend\", \"track performance over time\", \"quarter over quarter comparison across all quarters\", or any multi-period longitudinal analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3159,3160,3161,3164],{"name":3129,"slug":3130,"type":16},{"name":3135,"slug":3136,"type":16},{"name":3162,"slug":3163,"type":16},"Financial Statements","financial-statements",{"name":3165,"slug":3166,"type":16},"Variance Analysis","variance-analysis","2026-07-12T08:40:00.79141",{"slug":3169,"name":3169,"fn":3170,"description":3171,"org":3172,"tags":3173,"stars":3137,"repoUrl":3138,"updatedAt":3182},"pdf","process and manipulate PDF documents","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3174,3177,3180],{"name":3175,"slug":3176,"type":16},"Automation","automation",{"name":3178,"slug":3179,"type":16},"Documents","documents",{"name":3181,"slug":3169,"type":16},"PDF","2026-07-12T08:41:44.135656",{"slug":3184,"name":3184,"fn":3185,"description":3186,"org":3187,"tags":3188,"stars":3137,"repoUrl":3138,"updatedAt":3197},"quarterly-kpi-calculator","calculate quarterly financial KPIs","Calculates quarterly financial KPIs from P&L data. P&L figures can be provided directly by the user or fetched from the financial data MCP server. Use when the user wants KPI calculations such as Gross Margin %, EBITDA Margin %, Operating Expense Ratio, or Revenue Growth % QoQ. Also use for quarterly performance review, P&L analysis, or interpreting financial ratios against benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3189,3190,3193,3194],{"name":3126,"slug":3127,"type":16},{"name":3191,"slug":3192,"type":16},"Data Analysis","data-analysis",{"name":3135,"slug":3136,"type":16},{"name":3195,"slug":3196,"type":16},"KPI","kpi","2026-07-12T08:39:59.54971",159]