[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-labs-stage-5-correlation":3,"mdc-vw4gia-key":36,"related-org-aws-labs-stage-5-correlation":2200,"related-repo-aws-labs-stage-5-correlation":2382},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":32,"sourceUrl":34,"mdContent":35},"stage-5-correlation","correlate dynamic findings with threat intelligence","Cross-reference dynamic findings against threat intel (MISP, VT, web reporting) + MITRE ATT&CK to derive family + TTPs + campaign linkage. Use this skill whenever you have Stage 4 dynamic observations (C2 IPs, mutexes, injection targets) and want to link them to known campaigns, confirm Stage 2's hypothesis, or produce MITRE TTP IDs with specific per-stage evidence. Runs after Stage 4, or after Stage 3 if Stage 4 was unavailable — can work with partial data. Skip on Stage 2 short-circuit.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"aws-labs","AWS Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws-labs.png","awslabs",[13,17,20,23],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Audit","audit",{"name":21,"slug":22,"type":16},"Threat Modeling","threat-modeling",{"name":24,"slug":25,"type":16},"Code Analysis","code-analysis",1,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentic-developer-platform","2026-08-04T05:59:09.270695",null,0,[],{"repoUrl":27,"stars":26,"forks":30,"topics":33,"description":29},[],"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentic-developer-platform\u002Ftree\u002FHEAD\u002Fmodules\u002Fdomain-apps\u002Fcyber\u002Fagent\u002Fskills\u002Fstage-5-correlation","---\nname: stage-5-correlation\ndescription: Cross-reference dynamic findings against threat intel (MISP, VT, web reporting) + MITRE ATT&CK to derive family + TTPs + campaign linkage. Use this skill whenever you have Stage 4 dynamic observations (C2 IPs, mutexes, injection targets) and want to link them to known campaigns, confirm Stage 2's hypothesis, or produce MITRE TTP IDs with specific per-stage evidence. Runs after Stage 4, or after Stage 3 if Stage 4 was unavailable — can work with partial data. Skip on Stage 2 short-circuit.\n---\n\n# Stage 5 — Correlation & attribution\n\nRuns in the main cluster. Reuses the OSINT query patterns from Stage 2, but feeds them **dynamic-behavior observations** (actual C2 IPs seen, mutexes created, processes injected) rather than just static fingerprints.\n\nIf Stage 4 failed entirely, run Stage 5 with only static + OSINT data — attribution is weaker but still useful.\n\n## Inputs\n\n| Var | Source |\n|---|---|\n| Stages 1-4 envelopes | DDB |\n| OSINT credentials | Secrets Manager (same prefixes as Stage 2) |\n\n## Outputs\n\n```json\n{\n  \"stage\": 5,\n  \"stage_name\": \"correlation\",\n  \"findings\": {\n    \"c2_matches\": [\n      {\"ioc\": \"1.2.3.4\", \"source\": \"MISP\", \"feed\": \"c2-tracker\", \"confidence\": \"high\", \"first_observed\": \"2026-03-01\"}\n    ],\n    \"mitre_ttps_confirmed\": [\n      {\"id\": \"T1055.002\", \"name\": \"Portable Executable Injection\", \"evidence\": \"VirtualAllocEx+WriteProcessMemory+CreateRemoteThread chain in Stage 3 + observed injection into explorer.exe in Stage 4\"}\n    ],\n    \"family\": {\"name\": \"Qakbot\", \"confidence\": \"high\", \"version\": \"5.x\"},\n    \"campaign_overlap\": [\n      {\"campaign\": \"Mandiant FIN7-2026-Q1\", \"shared_iocs\": [\"1.2.3.4\", \"mutex:QBOT_V5_MUTEX\"], \"confidence\": \"medium\"}\n    ],\n    \"hypothesis_outcome\": \"confirmed | revised | rejected\",\n    \"revised_hypothesis\": \"null if confirmed, else updated statement\"\n  }\n}\n```\n\n## Steps\n\n### 1. Re-query OSINT with fresh IOCs from Stage 4\n\nStage 4 produced live C2 IPs, DNS lookups, dropped-file hashes. Run these through the same sources:\n\n```bash\n# Each C2 IP from Stage 4 → Shodan, VT, MISP (if available)\nfor IP in $(jq -r '.findings.network.c2_callbacks[].host' \u003C\u003C\u003C \"$STAGE4\"); do\n  # Shodan live check\n  curl -sS \"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002F$IP?key=$SHODAN_KEY\"\n  # VT IP reputation\n  curl -sS -H \"x-apikey: $VT_KEY\" \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Fip_addresses\u002F$IP\"\n  # MISP (if configured)\n  [ -n \"$MISP_URL\" ] && curl -sS -H \"Authorization: $MISP_KEY\" \\\n    \"$MISP_URL\u002Fattributes\u002FrestSearch\" -d \"{\\\"value\\\":\\\"$IP\\\"}\"\ndone\n\n# Each dropped-file hash from Stage 4 → VT, MalwareBazaar\nfor HASH in $(jq -r '.findings.dropped_payloads[].hash' \u003C\u003C\u003C \"$STAGE4\"); do\n  curl -sS -H \"x-apikey: $VT_KEY\" \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F$HASH\"\ndone\n```\n\n### 2. MITRE ATT&CK mapping — map observed behavior to techniques\n\nUse the local matrix data + behavioral patterns:\n\n- `VirtualAllocEx + WriteProcessMemory + CreateRemoteThread` → T1055.002\n- Registry write to `Run\\*` key → T1547.001\n- HTTPS C2 with JA3 fingerprint matching known family → T1071.001\n- Process hollowing markers → T1055.012\n\nProduce a list of `mitre_ttps_confirmed` with evidence pointing back to specific Stage 3 \u002F Stage 4 findings.\n\n### 3. Family identification\n\nGiven:\n- Stage 2's `prior_hypothesis`\n- Stage 3's YARA hits + family_extraction\n- Stage 4's behavioral signatures\n\nCompare. One of three outcomes:\n- **confirmed**: all signals agree → high confidence, family name + version\n- **revised**: Stage 2 said Qakbot but Stage 4 behavior matches IcedID → note the revision + reasoning\n- **rejected**: Stage 2 hypothesis had no corroborating behavior → drop it, mark family `unknown`\n\n### 4. Campaign correlation (best-effort)\n\nCheck if observed IOCs appear in recent campaign reporting:\n\n```bash\n# Web search for exact IOCs in recent vendor posts\nfor IOC in \"${CORE_IOCS[@]}\"; do\n  # use platform web-search skill\n  echo \"Query: $IOC recent campaign site:mandiant.com OR site:crowdstrike.com OR site:cisa.gov\"\ndone\n```\n\nNote any overlap with 3-source+ reporting (single-source hits are noise).\n\n### 5. Write envelope + publish comment\n\n```markdown\n## Stage 5 — Correlation & attribution\n\n**Stage 2 hypothesis outcome**: ✅ confirmed | 🔄 revised | ❌ rejected\n\n### Family\n`Qakbot v5.x` — **high confidence**. Static (Stage 3) config-block decode matches v5.1.3 schema; dynamic (Stage 4) C2 pattern + mutex match.\n\n### MITRE ATT&CK TTPs confirmed\n- **T1055.002** — Portable Executable Injection. Evidence: `VirtualAllocEx+WriteProcessMemory+CreateRemoteThread` (Stage 3) + actual injection into explorer.exe (Stage 4).\n- **T1547.001** — Registry Run Keys. Evidence: Write to `HKCU\\...\\Run\\\u003Crandom>` (Stage 4).\n- **T1071.001** — Web Protocols C2. Evidence: HTTPS callback to `1.2.3.4:443` (Stage 4), JA3=`abc123...` matches Qakbot v5 fingerprint.\n\n### C2 infrastructure matches\n- `1.2.3.4`: MISP feed `c2-tracker` (first seen 2026-03-01, confidence high) + Shodan shows Cobalt-Strike default cert\n- Overlaps with Mandiant 2026-04-15 Qakbot campaign (shared mutex + C2)\n\n\u003Cdetails>Full JSON...\u003C\u002Fdetails>\n```\n\n## Failure handling\n\n- Same as Stage 2 — degrade gracefully on missing creds. If all OSINT sources are unavailable, correlation becomes \"local reasoning\" (match Stage 3 YARA hits against a bundled MITRE table).\n\n## Guardrails\n\n- Attribution requires 2+ independent corroborating sources. A single VT family tag or one YARA hit isn't attribution — it's a suggestion. Wrong attribution gets quoted in incident reports and amplified; downstream IR teams end up chasing the wrong actor. \"Unattributed\" is a better answer than speculative.\n- Calibrate confidence to source count. High = 3+ corroborating. Medium = 2. Low = 1 + circumstantial signal. Below that it's `unknown`. The verdict in Stage 6 will inherit these values directly.\n- If you don't find prior reporting, say so plainly. Inventing a campaign name to sound confident is worse than admitting the sample is novel or unreported.\n",{"data":37,"body":38},{"name":4,"description":6},{"type":39,"children":40},"root",[41,50,64,69,76,130,136,1002,1008,1015,1020,1516,1522,1527,1566,1578,1584,1589,1613,1618,1657,1663,1668,1770,1775,1781,2149,2155,2163,2169,2194],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"stage-5-correlation-attribution",[47],{"type":48,"value":49},"text","Stage 5 — Correlation & attribution",{"type":42,"tag":51,"props":52,"children":53},"p",{},[54,56,62],{"type":48,"value":55},"Runs in the main cluster. Reuses the OSINT query patterns from Stage 2, but feeds them ",{"type":42,"tag":57,"props":58,"children":59},"strong",{},[60],{"type":48,"value":61},"dynamic-behavior observations",{"type":48,"value":63}," (actual C2 IPs seen, mutexes created, processes injected) rather than just static fingerprints.",{"type":42,"tag":51,"props":65,"children":66},{},[67],{"type":48,"value":68},"If Stage 4 failed entirely, run Stage 5 with only static + OSINT data — attribution is weaker but still useful.",{"type":42,"tag":70,"props":71,"children":73},"h2",{"id":72},"inputs",[74],{"type":48,"value":75},"Inputs",{"type":42,"tag":77,"props":78,"children":79},"table",{},[80,99],{"type":42,"tag":81,"props":82,"children":83},"thead",{},[84],{"type":42,"tag":85,"props":86,"children":87},"tr",{},[88,94],{"type":42,"tag":89,"props":90,"children":91},"th",{},[92],{"type":48,"value":93},"Var",{"type":42,"tag":89,"props":95,"children":96},{},[97],{"type":48,"value":98},"Source",{"type":42,"tag":100,"props":101,"children":102},"tbody",{},[103,117],{"type":42,"tag":85,"props":104,"children":105},{},[106,112],{"type":42,"tag":107,"props":108,"children":109},"td",{},[110],{"type":48,"value":111},"Stages 1-4 envelopes",{"type":42,"tag":107,"props":113,"children":114},{},[115],{"type":48,"value":116},"DDB",{"type":42,"tag":85,"props":118,"children":119},{},[120,125],{"type":42,"tag":107,"props":121,"children":122},{},[123],{"type":48,"value":124},"OSINT credentials",{"type":42,"tag":107,"props":126,"children":127},{},[128],{"type":48,"value":129},"Secrets Manager (same prefixes as Stage 2)",{"type":42,"tag":70,"props":131,"children":133},{"id":132},"outputs",[134],{"type":48,"value":135},"Outputs",{"type":42,"tag":137,"props":138,"children":143},"pre",{"className":139,"code":140,"language":141,"meta":142,"style":142},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"stage\": 5,\n  \"stage_name\": \"correlation\",\n  \"findings\": {\n    \"c2_matches\": [\n      {\"ioc\": \"1.2.3.4\", \"source\": \"MISP\", \"feed\": \"c2-tracker\", \"confidence\": \"high\", \"first_observed\": \"2026-03-01\"}\n    ],\n    \"mitre_ttps_confirmed\": [\n      {\"id\": \"T1055.002\", \"name\": \"Portable Executable Injection\", \"evidence\": \"VirtualAllocEx+WriteProcessMemory+CreateRemoteThread chain in Stage 3 + observed injection into explorer.exe in Stage 4\"}\n    ],\n    \"family\": {\"name\": \"Qakbot\", \"confidence\": \"high\", \"version\": \"5.x\"},\n    \"campaign_overlap\": [\n      {\"campaign\": \"Mandiant FIN7-2026-Q1\", \"shared_iocs\": [\"1.2.3.4\", \"mutex:QBOT_V5_MUTEX\"], \"confidence\": \"medium\"}\n    ],\n    \"hypothesis_outcome\": \"confirmed | revised | rejected\",\n    \"revised_hypothesis\": \"null if confirmed, else updated statement\"\n  }\n}\n","json","",[144],{"type":42,"tag":145,"props":146,"children":147},"code",{"__ignoreMap":142},[148,159,195,235,261,289,470,479,504,614,622,748,773,904,912,950,985,994],{"type":42,"tag":149,"props":150,"children":152},"span",{"class":151,"line":26},"line",[153],{"type":42,"tag":149,"props":154,"children":156},{"style":155},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[157],{"type":48,"value":158},"{\n",{"type":42,"tag":149,"props":160,"children":162},{"class":151,"line":161},2,[163,168,174,179,184,190],{"type":42,"tag":149,"props":164,"children":165},{"style":155},[166],{"type":48,"value":167},"  \"",{"type":42,"tag":149,"props":169,"children":171},{"style":170},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[172],{"type":48,"value":173},"stage",{"type":42,"tag":149,"props":175,"children":176},{"style":155},[177],{"type":48,"value":178},"\"",{"type":42,"tag":149,"props":180,"children":181},{"style":155},[182],{"type":48,"value":183},":",{"type":42,"tag":149,"props":185,"children":187},{"style":186},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[188],{"type":48,"value":189}," 5",{"type":42,"tag":149,"props":191,"children":192},{"style":155},[193],{"type":48,"value":194},",\n",{"type":42,"tag":149,"props":196,"children":198},{"class":151,"line":197},3,[199,203,208,212,216,221,227,231],{"type":42,"tag":149,"props":200,"children":201},{"style":155},[202],{"type":48,"value":167},{"type":42,"tag":149,"props":204,"children":205},{"style":170},[206],{"type":48,"value":207},"stage_name",{"type":42,"tag":149,"props":209,"children":210},{"style":155},[211],{"type":48,"value":178},{"type":42,"tag":149,"props":213,"children":214},{"style":155},[215],{"type":48,"value":183},{"type":42,"tag":149,"props":217,"children":218},{"style":155},[219],{"type":48,"value":220}," \"",{"type":42,"tag":149,"props":222,"children":224},{"style":223},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[225],{"type":48,"value":226},"correlation",{"type":42,"tag":149,"props":228,"children":229},{"style":155},[230],{"type":48,"value":178},{"type":42,"tag":149,"props":232,"children":233},{"style":155},[234],{"type":48,"value":194},{"type":42,"tag":149,"props":236,"children":238},{"class":151,"line":237},4,[239,243,248,252,256],{"type":42,"tag":149,"props":240,"children":241},{"style":155},[242],{"type":48,"value":167},{"type":42,"tag":149,"props":244,"children":245},{"style":170},[246],{"type":48,"value":247},"findings",{"type":42,"tag":149,"props":249,"children":250},{"style":155},[251],{"type":48,"value":178},{"type":42,"tag":149,"props":253,"children":254},{"style":155},[255],{"type":48,"value":183},{"type":42,"tag":149,"props":257,"children":258},{"style":155},[259],{"type":48,"value":260}," {\n",{"type":42,"tag":149,"props":262,"children":264},{"class":151,"line":263},5,[265,270,276,280,284],{"type":42,"tag":149,"props":266,"children":267},{"style":155},[268],{"type":48,"value":269},"    \"",{"type":42,"tag":149,"props":271,"children":273},{"style":272},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[274],{"type":48,"value":275},"c2_matches",{"type":42,"tag":149,"props":277,"children":278},{"style":155},[279],{"type":48,"value":178},{"type":42,"tag":149,"props":281,"children":282},{"style":155},[283],{"type":48,"value":183},{"type":42,"tag":149,"props":285,"children":286},{"style":155},[287],{"type":48,"value":288}," [\n",{"type":42,"tag":149,"props":290,"children":292},{"class":151,"line":291},6,[293,298,302,307,311,315,319,324,328,333,337,342,346,350,354,359,363,367,371,376,380,384,388,393,397,401,405,410,414,418,422,427,431,435,439,444,448,452,456,461,465],{"type":42,"tag":149,"props":294,"children":295},{"style":155},[296],{"type":48,"value":297},"      {",{"type":42,"tag":149,"props":299,"children":300},{"style":155},[301],{"type":48,"value":178},{"type":42,"tag":149,"props":303,"children":304},{"style":186},[305],{"type":48,"value":306},"ioc",{"type":42,"tag":149,"props":308,"children":309},{"style":155},[310],{"type":48,"value":178},{"type":42,"tag":149,"props":312,"children":313},{"style":155},[314],{"type":48,"value":183},{"type":42,"tag":149,"props":316,"children":317},{"style":155},[318],{"type":48,"value":220},{"type":42,"tag":149,"props":320,"children":321},{"style":223},[322],{"type":48,"value":323},"1.2.3.4",{"type":42,"tag":149,"props":325,"children":326},{"style":155},[327],{"type":48,"value":178},{"type":42,"tag":149,"props":329,"children":330},{"style":155},[331],{"type":48,"value":332},",",{"type":42,"tag":149,"props":334,"children":335},{"style":155},[336],{"type":48,"value":220},{"type":42,"tag":149,"props":338,"children":339},{"style":186},[340],{"type":48,"value":341},"source",{"type":42,"tag":149,"props":343,"children":344},{"style":155},[345],{"type":48,"value":178},{"type":42,"tag":149,"props":347,"children":348},{"style":155},[349],{"type":48,"value":183},{"type":42,"tag":149,"props":351,"children":352},{"style":155},[353],{"type":48,"value":220},{"type":42,"tag":149,"props":355,"children":356},{"style":223},[357],{"type":48,"value":358},"MISP",{"type":42,"tag":149,"props":360,"children":361},{"style":155},[362],{"type":48,"value":178},{"type":42,"tag":149,"props":364,"children":365},{"style":155},[366],{"type":48,"value":332},{"type":42,"tag":149,"props":368,"children":369},{"style":155},[370],{"type":48,"value":220},{"type":42,"tag":149,"props":372,"children":373},{"style":186},[374],{"type":48,"value":375},"feed",{"type":42,"tag":149,"props":377,"children":378},{"style":155},[379],{"type":48,"value":178},{"type":42,"tag":149,"props":381,"children":382},{"style":155},[383],{"type":48,"value":183},{"type":42,"tag":149,"props":385,"children":386},{"style":155},[387],{"type":48,"value":220},{"type":42,"tag":149,"props":389,"children":390},{"style":223},[391],{"type":48,"value":392},"c2-tracker",{"type":42,"tag":149,"props":394,"children":395},{"style":155},[396],{"type":48,"value":178},{"type":42,"tag":149,"props":398,"children":399},{"style":155},[400],{"type":48,"value":332},{"type":42,"tag":149,"props":402,"children":403},{"style":155},[404],{"type":48,"value":220},{"type":42,"tag":149,"props":406,"children":407},{"style":186},[408],{"type":48,"value":409},"confidence",{"type":42,"tag":149,"props":411,"children":412},{"style":155},[413],{"type":48,"value":178},{"type":42,"tag":149,"props":415,"children":416},{"style":155},[417],{"type":48,"value":183},{"type":42,"tag":149,"props":419,"children":420},{"style":155},[421],{"type":48,"value":220},{"type":42,"tag":149,"props":423,"children":424},{"style":223},[425],{"type":48,"value":426},"high",{"type":42,"tag":149,"props":428,"children":429},{"style":155},[430],{"type":48,"value":178},{"type":42,"tag":149,"props":432,"children":433},{"style":155},[434],{"type":48,"value":332},{"type":42,"tag":149,"props":436,"children":437},{"style":155},[438],{"type":48,"value":220},{"type":42,"tag":149,"props":440,"children":441},{"style":186},[442],{"type":48,"value":443},"first_observed",{"type":42,"tag":149,"props":445,"children":446},{"style":155},[447],{"type":48,"value":178},{"type":42,"tag":149,"props":449,"children":450},{"style":155},[451],{"type":48,"value":183},{"type":42,"tag":149,"props":453,"children":454},{"style":155},[455],{"type":48,"value":220},{"type":42,"tag":149,"props":457,"children":458},{"style":223},[459],{"type":48,"value":460},"2026-03-01",{"type":42,"tag":149,"props":462,"children":463},{"style":155},[464],{"type":48,"value":178},{"type":42,"tag":149,"props":466,"children":467},{"style":155},[468],{"type":48,"value":469},"}\n",{"type":42,"tag":149,"props":471,"children":473},{"class":151,"line":472},7,[474],{"type":42,"tag":149,"props":475,"children":476},{"style":155},[477],{"type":48,"value":478},"    ],\n",{"type":42,"tag":149,"props":480,"children":482},{"class":151,"line":481},8,[483,487,492,496,500],{"type":42,"tag":149,"props":484,"children":485},{"style":155},[486],{"type":48,"value":269},{"type":42,"tag":149,"props":488,"children":489},{"style":272},[490],{"type":48,"value":491},"mitre_ttps_confirmed",{"type":42,"tag":149,"props":493,"children":494},{"style":155},[495],{"type":48,"value":178},{"type":42,"tag":149,"props":497,"children":498},{"style":155},[499],{"type":48,"value":183},{"type":42,"tag":149,"props":501,"children":502},{"style":155},[503],{"type":48,"value":288},{"type":42,"tag":149,"props":505,"children":507},{"class":151,"line":506},9,[508,512,516,521,525,529,533,538,542,546,550,555,559,563,567,572,576,580,584,589,593,597,601,606,610],{"type":42,"tag":149,"props":509,"children":510},{"style":155},[511],{"type":48,"value":297},{"type":42,"tag":149,"props":513,"children":514},{"style":155},[515],{"type":48,"value":178},{"type":42,"tag":149,"props":517,"children":518},{"style":186},[519],{"type":48,"value":520},"id",{"type":42,"tag":149,"props":522,"children":523},{"style":155},[524],{"type":48,"value":178},{"type":42,"tag":149,"props":526,"children":527},{"style":155},[528],{"type":48,"value":183},{"type":42,"tag":149,"props":530,"children":531},{"style":155},[532],{"type":48,"value":220},{"type":42,"tag":149,"props":534,"children":535},{"style":223},[536],{"type":48,"value":537},"T1055.002",{"type":42,"tag":149,"props":539,"children":540},{"style":155},[541],{"type":48,"value":178},{"type":42,"tag":149,"props":543,"children":544},{"style":155},[545],{"type":48,"value":332},{"type":42,"tag":149,"props":547,"children":548},{"style":155},[549],{"type":48,"value":220},{"type":42,"tag":149,"props":551,"children":552},{"style":186},[553],{"type":48,"value":554},"name",{"type":42,"tag":149,"props":556,"children":557},{"style":155},[558],{"type":48,"value":178},{"type":42,"tag":149,"props":560,"children":561},{"style":155},[562],{"type":48,"value":183},{"type":42,"tag":149,"props":564,"children":565},{"style":155},[566],{"type":48,"value":220},{"type":42,"tag":149,"props":568,"children":569},{"style":223},[570],{"type":48,"value":571},"Portable Executable Injection",{"type":42,"tag":149,"props":573,"children":574},{"style":155},[575],{"type":48,"value":178},{"type":42,"tag":149,"props":577,"children":578},{"style":155},[579],{"type":48,"value":332},{"type":42,"tag":149,"props":581,"children":582},{"style":155},[583],{"type":48,"value":220},{"type":42,"tag":149,"props":585,"children":586},{"style":186},[587],{"type":48,"value":588},"evidence",{"type":42,"tag":149,"props":590,"children":591},{"style":155},[592],{"type":48,"value":178},{"type":42,"tag":149,"props":594,"children":595},{"style":155},[596],{"type":48,"value":183},{"type":42,"tag":149,"props":598,"children":599},{"style":155},[600],{"type":48,"value":220},{"type":42,"tag":149,"props":602,"children":603},{"style":223},[604],{"type":48,"value":605},"VirtualAllocEx+WriteProcessMemory+CreateRemoteThread chain in Stage 3 + observed injection into explorer.exe in Stage 4",{"type":42,"tag":149,"props":607,"children":608},{"style":155},[609],{"type":48,"value":178},{"type":42,"tag":149,"props":611,"children":612},{"style":155},[613],{"type":48,"value":469},{"type":42,"tag":149,"props":615,"children":617},{"class":151,"line":616},10,[618],{"type":42,"tag":149,"props":619,"children":620},{"style":155},[621],{"type":48,"value":478},{"type":42,"tag":149,"props":623,"children":625},{"class":151,"line":624},11,[626,630,635,639,643,648,652,656,660,664,668,673,677,681,685,689,693,697,701,705,709,713,717,722,726,730,734,739,743],{"type":42,"tag":149,"props":627,"children":628},{"style":155},[629],{"type":48,"value":269},{"type":42,"tag":149,"props":631,"children":632},{"style":272},[633],{"type":48,"value":634},"family",{"type":42,"tag":149,"props":636,"children":637},{"style":155},[638],{"type":48,"value":178},{"type":42,"tag":149,"props":640,"children":641},{"style":155},[642],{"type":48,"value":183},{"type":42,"tag":149,"props":644,"children":645},{"style":155},[646],{"type":48,"value":647}," {",{"type":42,"tag":149,"props":649,"children":650},{"style":155},[651],{"type":48,"value":178},{"type":42,"tag":149,"props":653,"children":654},{"style":186},[655],{"type":48,"value":554},{"type":42,"tag":149,"props":657,"children":658},{"style":155},[659],{"type":48,"value":178},{"type":42,"tag":149,"props":661,"children":662},{"style":155},[663],{"type":48,"value":183},{"type":42,"tag":149,"props":665,"children":666},{"style":155},[667],{"type":48,"value":220},{"type":42,"tag":149,"props":669,"children":670},{"style":223},[671],{"type":48,"value":672},"Qakbot",{"type":42,"tag":149,"props":674,"children":675},{"style":155},[676],{"type":48,"value":178},{"type":42,"tag":149,"props":678,"children":679},{"style":155},[680],{"type":48,"value":332},{"type":42,"tag":149,"props":682,"children":683},{"style":155},[684],{"type":48,"value":220},{"type":42,"tag":149,"props":686,"children":687},{"style":186},[688],{"type":48,"value":409},{"type":42,"tag":149,"props":690,"children":691},{"style":155},[692],{"type":48,"value":178},{"type":42,"tag":149,"props":694,"children":695},{"style":155},[696],{"type":48,"value":183},{"type":42,"tag":149,"props":698,"children":699},{"style":155},[700],{"type":48,"value":220},{"type":42,"tag":149,"props":702,"children":703},{"style":223},[704],{"type":48,"value":426},{"type":42,"tag":149,"props":706,"children":707},{"style":155},[708],{"type":48,"value":178},{"type":42,"tag":149,"props":710,"children":711},{"style":155},[712],{"type":48,"value":332},{"type":42,"tag":149,"props":714,"children":715},{"style":155},[716],{"type":48,"value":220},{"type":42,"tag":149,"props":718,"children":719},{"style":186},[720],{"type":48,"value":721},"version",{"type":42,"tag":149,"props":723,"children":724},{"style":155},[725],{"type":48,"value":178},{"type":42,"tag":149,"props":727,"children":728},{"style":155},[729],{"type":48,"value":183},{"type":42,"tag":149,"props":731,"children":732},{"style":155},[733],{"type":48,"value":220},{"type":42,"tag":149,"props":735,"children":736},{"style":223},[737],{"type":48,"value":738},"5.x",{"type":42,"tag":149,"props":740,"children":741},{"style":155},[742],{"type":48,"value":178},{"type":42,"tag":149,"props":744,"children":745},{"style":155},[746],{"type":48,"value":747},"},\n",{"type":42,"tag":149,"props":749,"children":751},{"class":151,"line":750},12,[752,756,761,765,769],{"type":42,"tag":149,"props":753,"children":754},{"style":155},[755],{"type":48,"value":269},{"type":42,"tag":149,"props":757,"children":758},{"style":272},[759],{"type":48,"value":760},"campaign_overlap",{"type":42,"tag":149,"props":762,"children":763},{"style":155},[764],{"type":48,"value":178},{"type":42,"tag":149,"props":766,"children":767},{"style":155},[768],{"type":48,"value":183},{"type":42,"tag":149,"props":770,"children":771},{"style":155},[772],{"type":48,"value":288},{"type":42,"tag":149,"props":774,"children":776},{"class":151,"line":775},13,[777,781,785,790,794,798,802,807,811,815,819,824,828,832,837,841,845,849,853,857,862,866,871,875,879,883,887,891,896,900],{"type":42,"tag":149,"props":778,"children":779},{"style":155},[780],{"type":48,"value":297},{"type":42,"tag":149,"props":782,"children":783},{"style":155},[784],{"type":48,"value":178},{"type":42,"tag":149,"props":786,"children":787},{"style":186},[788],{"type":48,"value":789},"campaign",{"type":42,"tag":149,"props":791,"children":792},{"style":155},[793],{"type":48,"value":178},{"type":42,"tag":149,"props":795,"children":796},{"style":155},[797],{"type":48,"value":183},{"type":42,"tag":149,"props":799,"children":800},{"style":155},[801],{"type":48,"value":220},{"type":42,"tag":149,"props":803,"children":804},{"style":223},[805],{"type":48,"value":806},"Mandiant FIN7-2026-Q1",{"type":42,"tag":149,"props":808,"children":809},{"style":155},[810],{"type":48,"value":178},{"type":42,"tag":149,"props":812,"children":813},{"style":155},[814],{"type":48,"value":332},{"type":42,"tag":149,"props":816,"children":817},{"style":155},[818],{"type":48,"value":220},{"type":42,"tag":149,"props":820,"children":821},{"style":186},[822],{"type":48,"value":823},"shared_iocs",{"type":42,"tag":149,"props":825,"children":826},{"style":155},[827],{"type":48,"value":178},{"type":42,"tag":149,"props":829,"children":830},{"style":155},[831],{"type":48,"value":183},{"type":42,"tag":149,"props":833,"children":834},{"style":155},[835],{"type":48,"value":836}," [",{"type":42,"tag":149,"props":838,"children":839},{"style":155},[840],{"type":48,"value":178},{"type":42,"tag":149,"props":842,"children":843},{"style":223},[844],{"type":48,"value":323},{"type":42,"tag":149,"props":846,"children":847},{"style":155},[848],{"type":48,"value":178},{"type":42,"tag":149,"props":850,"children":851},{"style":155},[852],{"type":48,"value":332},{"type":42,"tag":149,"props":854,"children":855},{"style":155},[856],{"type":48,"value":220},{"type":42,"tag":149,"props":858,"children":859},{"style":223},[860],{"type":48,"value":861},"mutex:QBOT_V5_MUTEX",{"type":42,"tag":149,"props":863,"children":864},{"style":155},[865],{"type":48,"value":178},{"type":42,"tag":149,"props":867,"children":868},{"style":155},[869],{"type":48,"value":870},"],",{"type":42,"tag":149,"props":872,"children":873},{"style":155},[874],{"type":48,"value":220},{"type":42,"tag":149,"props":876,"children":877},{"style":186},[878],{"type":48,"value":409},{"type":42,"tag":149,"props":880,"children":881},{"style":155},[882],{"type":48,"value":178},{"type":42,"tag":149,"props":884,"children":885},{"style":155},[886],{"type":48,"value":183},{"type":42,"tag":149,"props":888,"children":889},{"style":155},[890],{"type":48,"value":220},{"type":42,"tag":149,"props":892,"children":893},{"style":223},[894],{"type":48,"value":895},"medium",{"type":42,"tag":149,"props":897,"children":898},{"style":155},[899],{"type":48,"value":178},{"type":42,"tag":149,"props":901,"children":902},{"style":155},[903],{"type":48,"value":469},{"type":42,"tag":149,"props":905,"children":907},{"class":151,"line":906},14,[908],{"type":42,"tag":149,"props":909,"children":910},{"style":155},[911],{"type":48,"value":478},{"type":42,"tag":149,"props":913,"children":915},{"class":151,"line":914},15,[916,920,925,929,933,937,942,946],{"type":42,"tag":149,"props":917,"children":918},{"style":155},[919],{"type":48,"value":269},{"type":42,"tag":149,"props":921,"children":922},{"style":272},[923],{"type":48,"value":924},"hypothesis_outcome",{"type":42,"tag":149,"props":926,"children":927},{"style":155},[928],{"type":48,"value":178},{"type":42,"tag":149,"props":930,"children":931},{"style":155},[932],{"type":48,"value":183},{"type":42,"tag":149,"props":934,"children":935},{"style":155},[936],{"type":48,"value":220},{"type":42,"tag":149,"props":938,"children":939},{"style":223},[940],{"type":48,"value":941},"confirmed | revised | rejected",{"type":42,"tag":149,"props":943,"children":944},{"style":155},[945],{"type":48,"value":178},{"type":42,"tag":149,"props":947,"children":948},{"style":155},[949],{"type":48,"value":194},{"type":42,"tag":149,"props":951,"children":953},{"class":151,"line":952},16,[954,958,963,967,971,975,980],{"type":42,"tag":149,"props":955,"children":956},{"style":155},[957],{"type":48,"value":269},{"type":42,"tag":149,"props":959,"children":960},{"style":272},[961],{"type":48,"value":962},"revised_hypothesis",{"type":42,"tag":149,"props":964,"children":965},{"style":155},[966],{"type":48,"value":178},{"type":42,"tag":149,"props":968,"children":969},{"style":155},[970],{"type":48,"value":183},{"type":42,"tag":149,"props":972,"children":973},{"style":155},[974],{"type":48,"value":220},{"type":42,"tag":149,"props":976,"children":977},{"style":223},[978],{"type":48,"value":979},"null if confirmed, else updated statement",{"type":42,"tag":149,"props":981,"children":982},{"style":155},[983],{"type":48,"value":984},"\"\n",{"type":42,"tag":149,"props":986,"children":988},{"class":151,"line":987},17,[989],{"type":42,"tag":149,"props":990,"children":991},{"style":155},[992],{"type":48,"value":993},"  }\n",{"type":42,"tag":149,"props":995,"children":997},{"class":151,"line":996},18,[998],{"type":42,"tag":149,"props":999,"children":1000},{"style":155},[1001],{"type":48,"value":469},{"type":42,"tag":70,"props":1003,"children":1005},{"id":1004},"steps",[1006],{"type":48,"value":1007},"Steps",{"type":42,"tag":1009,"props":1010,"children":1012},"h3",{"id":1011},"_1-re-query-osint-with-fresh-iocs-from-stage-4",[1013],{"type":48,"value":1014},"1. Re-query OSINT with fresh IOCs from Stage 4",{"type":42,"tag":51,"props":1016,"children":1017},{},[1018],{"type":48,"value":1019},"Stage 4 produced live C2 IPs, DNS lookups, dropped-file hashes. Run these through the same sources:",{"type":42,"tag":137,"props":1021,"children":1025},{"className":1022,"code":1023,"language":1024,"meta":142,"style":142},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Each C2 IP from Stage 4 → Shodan, VT, MISP (if available)\nfor IP in $(jq -r '.findings.network.c2_callbacks[].host' \u003C\u003C\u003C \"$STAGE4\"); do\n  # Shodan live check\n  curl -sS \"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002F$IP?key=$SHODAN_KEY\"\n  # VT IP reputation\n  curl -sS -H \"x-apikey: $VT_KEY\" \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Fip_addresses\u002F$IP\"\n  # MISP (if configured)\n  [ -n \"$MISP_URL\" ] && curl -sS -H \"Authorization: $MISP_KEY\" \\\n    \"$MISP_URL\u002Fattributes\u002FrestSearch\" -d \"{\\\"value\\\":\\\"$IP\\\"}\"\ndone\n\n# Each dropped-file hash from Stage 4 → VT, MalwareBazaar\nfor HASH in $(jq -r '.findings.dropped_payloads[].hash' \u003C\u003C\u003C \"$STAGE4\"); do\n  curl -sS -H \"x-apikey: $VT_KEY\" \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F$HASH\"\ndone\n","bash",[1026],{"type":42,"tag":145,"props":1027,"children":1028},{"__ignoreMap":142},[1029,1038,1116,1124,1165,1173,1224,1232,1304,1370,1378,1387,1395,1460,1509],{"type":42,"tag":149,"props":1030,"children":1031},{"class":151,"line":26},[1032],{"type":42,"tag":149,"props":1033,"children":1035},{"style":1034},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1036],{"type":48,"value":1037},"# Each C2 IP from Stage 4 → Shodan, VT, MISP (if available)\n",{"type":42,"tag":149,"props":1039,"children":1040},{"class":151,"line":161},[1041,1047,1053,1058,1063,1068,1073,1078,1083,1088,1093,1097,1102,1106,1111],{"type":42,"tag":149,"props":1042,"children":1044},{"style":1043},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[1045],{"type":48,"value":1046},"for",{"type":42,"tag":149,"props":1048,"children":1050},{"style":1049},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1051],{"type":48,"value":1052}," IP ",{"type":42,"tag":149,"props":1054,"children":1055},{"style":1043},[1056],{"type":48,"value":1057},"in",{"type":42,"tag":149,"props":1059,"children":1060},{"style":155},[1061],{"type":48,"value":1062}," $(",{"type":42,"tag":149,"props":1064,"children":1065},{"style":272},[1066],{"type":48,"value":1067},"jq",{"type":42,"tag":149,"props":1069,"children":1070},{"style":223},[1071],{"type":48,"value":1072}," -r",{"type":42,"tag":149,"props":1074,"children":1075},{"style":155},[1076],{"type":48,"value":1077}," '",{"type":42,"tag":149,"props":1079,"children":1080},{"style":223},[1081],{"type":48,"value":1082},".findings.network.c2_callbacks[].host",{"type":42,"tag":149,"props":1084,"children":1085},{"style":155},[1086],{"type":48,"value":1087},"'",{"type":42,"tag":149,"props":1089,"children":1090},{"style":155},[1091],{"type":48,"value":1092}," \u003C\u003C\u003C",{"type":42,"tag":149,"props":1094,"children":1095},{"style":155},[1096],{"type":48,"value":220},{"type":42,"tag":149,"props":1098,"children":1099},{"style":1049},[1100],{"type":48,"value":1101},"$STAGE4",{"type":42,"tag":149,"props":1103,"children":1104},{"style":155},[1105],{"type":48,"value":178},{"type":42,"tag":149,"props":1107,"children":1108},{"style":155},[1109],{"type":48,"value":1110},");",{"type":42,"tag":149,"props":1112,"children":1113},{"style":1043},[1114],{"type":48,"value":1115}," do\n",{"type":42,"tag":149,"props":1117,"children":1118},{"class":151,"line":197},[1119],{"type":42,"tag":149,"props":1120,"children":1121},{"style":1034},[1122],{"type":48,"value":1123},"  # Shodan live check\n",{"type":42,"tag":149,"props":1125,"children":1126},{"class":151,"line":237},[1127,1132,1137,1141,1146,1151,1156,1161],{"type":42,"tag":149,"props":1128,"children":1129},{"style":272},[1130],{"type":48,"value":1131},"  curl",{"type":42,"tag":149,"props":1133,"children":1134},{"style":223},[1135],{"type":48,"value":1136}," -sS",{"type":42,"tag":149,"props":1138,"children":1139},{"style":155},[1140],{"type":48,"value":220},{"type":42,"tag":149,"props":1142,"children":1143},{"style":223},[1144],{"type":48,"value":1145},"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002F",{"type":42,"tag":149,"props":1147,"children":1148},{"style":1049},[1149],{"type":48,"value":1150},"$IP",{"type":42,"tag":149,"props":1152,"children":1153},{"style":223},[1154],{"type":48,"value":1155},"?key=",{"type":42,"tag":149,"props":1157,"children":1158},{"style":1049},[1159],{"type":48,"value":1160},"$SHODAN_KEY",{"type":42,"tag":149,"props":1162,"children":1163},{"style":155},[1164],{"type":48,"value":984},{"type":42,"tag":149,"props":1166,"children":1167},{"class":151,"line":263},[1168],{"type":42,"tag":149,"props":1169,"children":1170},{"style":1034},[1171],{"type":48,"value":1172},"  # VT IP reputation\n",{"type":42,"tag":149,"props":1174,"children":1175},{"class":151,"line":291},[1176,1180,1184,1189,1193,1198,1203,1207,1211,1216,1220],{"type":42,"tag":149,"props":1177,"children":1178},{"style":272},[1179],{"type":48,"value":1131},{"type":42,"tag":149,"props":1181,"children":1182},{"style":223},[1183],{"type":48,"value":1136},{"type":42,"tag":149,"props":1185,"children":1186},{"style":223},[1187],{"type":48,"value":1188}," -H",{"type":42,"tag":149,"props":1190,"children":1191},{"style":155},[1192],{"type":48,"value":220},{"type":42,"tag":149,"props":1194,"children":1195},{"style":223},[1196],{"type":48,"value":1197},"x-apikey: ",{"type":42,"tag":149,"props":1199,"children":1200},{"style":1049},[1201],{"type":48,"value":1202},"$VT_KEY",{"type":42,"tag":149,"props":1204,"children":1205},{"style":155},[1206],{"type":48,"value":178},{"type":42,"tag":149,"props":1208,"children":1209},{"style":155},[1210],{"type":48,"value":220},{"type":42,"tag":149,"props":1212,"children":1213},{"style":223},[1214],{"type":48,"value":1215},"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Fip_addresses\u002F",{"type":42,"tag":149,"props":1217,"children":1218},{"style":1049},[1219],{"type":48,"value":1150},{"type":42,"tag":149,"props":1221,"children":1222},{"style":155},[1223],{"type":48,"value":984},{"type":42,"tag":149,"props":1225,"children":1226},{"class":151,"line":472},[1227],{"type":42,"tag":149,"props":1228,"children":1229},{"style":1034},[1230],{"type":48,"value":1231},"  # MISP (if configured)\n",{"type":42,"tag":149,"props":1233,"children":1234},{"class":151,"line":481},[1235,1240,1245,1249,1254,1258,1263,1268,1273,1277,1281,1285,1290,1295,1299],{"type":42,"tag":149,"props":1236,"children":1237},{"style":155},[1238],{"type":48,"value":1239},"  [",{"type":42,"tag":149,"props":1241,"children":1242},{"style":155},[1243],{"type":48,"value":1244}," -n",{"type":42,"tag":149,"props":1246,"children":1247},{"style":155},[1248],{"type":48,"value":220},{"type":42,"tag":149,"props":1250,"children":1251},{"style":1049},[1252],{"type":48,"value":1253},"$MISP_URL",{"type":42,"tag":149,"props":1255,"children":1256},{"style":155},[1257],{"type":48,"value":178},{"type":42,"tag":149,"props":1259,"children":1260},{"style":155},[1261],{"type":48,"value":1262}," ]",{"type":42,"tag":149,"props":1264,"children":1265},{"style":155},[1266],{"type":48,"value":1267}," &&",{"type":42,"tag":149,"props":1269,"children":1270},{"style":272},[1271],{"type":48,"value":1272}," curl",{"type":42,"tag":149,"props":1274,"children":1275},{"style":223},[1276],{"type":48,"value":1136},{"type":42,"tag":149,"props":1278,"children":1279},{"style":223},[1280],{"type":48,"value":1188},{"type":42,"tag":149,"props":1282,"children":1283},{"style":155},[1284],{"type":48,"value":220},{"type":42,"tag":149,"props":1286,"children":1287},{"style":223},[1288],{"type":48,"value":1289},"Authorization: ",{"type":42,"tag":149,"props":1291,"children":1292},{"style":1049},[1293],{"type":48,"value":1294},"$MISP_KEY",{"type":42,"tag":149,"props":1296,"children":1297},{"style":155},[1298],{"type":48,"value":178},{"type":42,"tag":149,"props":1300,"children":1301},{"style":1049},[1302],{"type":48,"value":1303}," \\\n",{"type":42,"tag":149,"props":1305,"children":1306},{"class":151,"line":506},[1307,1311,1315,1320,1324,1329,1333,1338,1343,1348,1352,1356,1361,1366],{"type":42,"tag":149,"props":1308,"children":1309},{"style":155},[1310],{"type":48,"value":269},{"type":42,"tag":149,"props":1312,"children":1313},{"style":1049},[1314],{"type":48,"value":1253},{"type":42,"tag":149,"props":1316,"children":1317},{"style":223},[1318],{"type":48,"value":1319},"\u002Fattributes\u002FrestSearch",{"type":42,"tag":149,"props":1321,"children":1322},{"style":155},[1323],{"type":48,"value":178},{"type":42,"tag":149,"props":1325,"children":1326},{"style":223},[1327],{"type":48,"value":1328}," -d",{"type":42,"tag":149,"props":1330,"children":1331},{"style":155},[1332],{"type":48,"value":220},{"type":42,"tag":149,"props":1334,"children":1335},{"style":223},[1336],{"type":48,"value":1337},"{",{"type":42,"tag":149,"props":1339,"children":1340},{"style":1049},[1341],{"type":48,"value":1342},"\\\"",{"type":42,"tag":149,"props":1344,"children":1345},{"style":223},[1346],{"type":48,"value":1347},"value",{"type":42,"tag":149,"props":1349,"children":1350},{"style":1049},[1351],{"type":48,"value":1342},{"type":42,"tag":149,"props":1353,"children":1354},{"style":223},[1355],{"type":48,"value":183},{"type":42,"tag":149,"props":1357,"children":1358},{"style":1049},[1359],{"type":48,"value":1360},"\\\"$IP\\\"",{"type":42,"tag":149,"props":1362,"children":1363},{"style":223},[1364],{"type":48,"value":1365},"}",{"type":42,"tag":149,"props":1367,"children":1368},{"style":155},[1369],{"type":48,"value":984},{"type":42,"tag":149,"props":1371,"children":1372},{"class":151,"line":616},[1373],{"type":42,"tag":149,"props":1374,"children":1375},{"style":1043},[1376],{"type":48,"value":1377},"done\n",{"type":42,"tag":149,"props":1379,"children":1380},{"class":151,"line":624},[1381],{"type":42,"tag":149,"props":1382,"children":1384},{"emptyLinePlaceholder":1383},true,[1385],{"type":48,"value":1386},"\n",{"type":42,"tag":149,"props":1388,"children":1389},{"class":151,"line":750},[1390],{"type":42,"tag":149,"props":1391,"children":1392},{"style":1034},[1393],{"type":48,"value":1394},"# Each dropped-file hash from Stage 4 → VT, MalwareBazaar\n",{"type":42,"tag":149,"props":1396,"children":1397},{"class":151,"line":775},[1398,1402,1407,1411,1415,1419,1423,1427,1432,1436,1440,1444,1448,1452,1456],{"type":42,"tag":149,"props":1399,"children":1400},{"style":1043},[1401],{"type":48,"value":1046},{"type":42,"tag":149,"props":1403,"children":1404},{"style":1049},[1405],{"type":48,"value":1406}," HASH ",{"type":42,"tag":149,"props":1408,"children":1409},{"style":1043},[1410],{"type":48,"value":1057},{"type":42,"tag":149,"props":1412,"children":1413},{"style":155},[1414],{"type":48,"value":1062},{"type":42,"tag":149,"props":1416,"children":1417},{"style":272},[1418],{"type":48,"value":1067},{"type":42,"tag":149,"props":1420,"children":1421},{"style":223},[1422],{"type":48,"value":1072},{"type":42,"tag":149,"props":1424,"children":1425},{"style":155},[1426],{"type":48,"value":1077},{"type":42,"tag":149,"props":1428,"children":1429},{"style":223},[1430],{"type":48,"value":1431},".findings.dropped_payloads[].hash",{"type":42,"tag":149,"props":1433,"children":1434},{"style":155},[1435],{"type":48,"value":1087},{"type":42,"tag":149,"props":1437,"children":1438},{"style":155},[1439],{"type":48,"value":1092},{"type":42,"tag":149,"props":1441,"children":1442},{"style":155},[1443],{"type":48,"value":220},{"type":42,"tag":149,"props":1445,"children":1446},{"style":1049},[1447],{"type":48,"value":1101},{"type":42,"tag":149,"props":1449,"children":1450},{"style":155},[1451],{"type":48,"value":178},{"type":42,"tag":149,"props":1453,"children":1454},{"style":155},[1455],{"type":48,"value":1110},{"type":42,"tag":149,"props":1457,"children":1458},{"style":1043},[1459],{"type":48,"value":1115},{"type":42,"tag":149,"props":1461,"children":1462},{"class":151,"line":906},[1463,1467,1471,1475,1479,1483,1487,1491,1495,1500,1505],{"type":42,"tag":149,"props":1464,"children":1465},{"style":272},[1466],{"type":48,"value":1131},{"type":42,"tag":149,"props":1468,"children":1469},{"style":223},[1470],{"type":48,"value":1136},{"type":42,"tag":149,"props":1472,"children":1473},{"style":223},[1474],{"type":48,"value":1188},{"type":42,"tag":149,"props":1476,"children":1477},{"style":155},[1478],{"type":48,"value":220},{"type":42,"tag":149,"props":1480,"children":1481},{"style":223},[1482],{"type":48,"value":1197},{"type":42,"tag":149,"props":1484,"children":1485},{"style":1049},[1486],{"type":48,"value":1202},{"type":42,"tag":149,"props":1488,"children":1489},{"style":155},[1490],{"type":48,"value":178},{"type":42,"tag":149,"props":1492,"children":1493},{"style":155},[1494],{"type":48,"value":220},{"type":42,"tag":149,"props":1496,"children":1497},{"style":223},[1498],{"type":48,"value":1499},"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F",{"type":42,"tag":149,"props":1501,"children":1502},{"style":1049},[1503],{"type":48,"value":1504},"$HASH",{"type":42,"tag":149,"props":1506,"children":1507},{"style":155},[1508],{"type":48,"value":984},{"type":42,"tag":149,"props":1510,"children":1511},{"class":151,"line":914},[1512],{"type":42,"tag":149,"props":1513,"children":1514},{"style":1043},[1515],{"type":48,"value":1377},{"type":42,"tag":1009,"props":1517,"children":1519},{"id":1518},"_2-mitre-attck-mapping-map-observed-behavior-to-techniques",[1520],{"type":48,"value":1521},"2. MITRE ATT&CK mapping — map observed behavior to techniques",{"type":42,"tag":51,"props":1523,"children":1524},{},[1525],{"type":48,"value":1526},"Use the local matrix data + behavioral patterns:",{"type":42,"tag":1528,"props":1529,"children":1530},"ul",{},[1531,1543,1556,1561],{"type":42,"tag":1532,"props":1533,"children":1534},"li",{},[1535,1541],{"type":42,"tag":145,"props":1536,"children":1538},{"className":1537},[],[1539],{"type":48,"value":1540},"VirtualAllocEx + WriteProcessMemory + CreateRemoteThread",{"type":48,"value":1542}," → T1055.002",{"type":42,"tag":1532,"props":1544,"children":1545},{},[1546,1548,1554],{"type":48,"value":1547},"Registry write to ",{"type":42,"tag":145,"props":1549,"children":1551},{"className":1550},[],[1552],{"type":48,"value":1553},"Run\\*",{"type":48,"value":1555}," key → T1547.001",{"type":42,"tag":1532,"props":1557,"children":1558},{},[1559],{"type":48,"value":1560},"HTTPS C2 with JA3 fingerprint matching known family → T1071.001",{"type":42,"tag":1532,"props":1562,"children":1563},{},[1564],{"type":48,"value":1565},"Process hollowing markers → T1055.012",{"type":42,"tag":51,"props":1567,"children":1568},{},[1569,1571,1576],{"type":48,"value":1570},"Produce a list of ",{"type":42,"tag":145,"props":1572,"children":1574},{"className":1573},[],[1575],{"type":48,"value":491},{"type":48,"value":1577}," with evidence pointing back to specific Stage 3 \u002F Stage 4 findings.",{"type":42,"tag":1009,"props":1579,"children":1581},{"id":1580},"_3-family-identification",[1582],{"type":48,"value":1583},"3. Family identification",{"type":42,"tag":51,"props":1585,"children":1586},{},[1587],{"type":48,"value":1588},"Given:",{"type":42,"tag":1528,"props":1590,"children":1591},{},[1592,1603,1608],{"type":42,"tag":1532,"props":1593,"children":1594},{},[1595,1597],{"type":48,"value":1596},"Stage 2's ",{"type":42,"tag":145,"props":1598,"children":1600},{"className":1599},[],[1601],{"type":48,"value":1602},"prior_hypothesis",{"type":42,"tag":1532,"props":1604,"children":1605},{},[1606],{"type":48,"value":1607},"Stage 3's YARA hits + family_extraction",{"type":42,"tag":1532,"props":1609,"children":1610},{},[1611],{"type":48,"value":1612},"Stage 4's behavioral signatures",{"type":42,"tag":51,"props":1614,"children":1615},{},[1616],{"type":48,"value":1617},"Compare. One of three outcomes:",{"type":42,"tag":1528,"props":1619,"children":1620},{},[1621,1631,1641],{"type":42,"tag":1532,"props":1622,"children":1623},{},[1624,1629],{"type":42,"tag":57,"props":1625,"children":1626},{},[1627],{"type":48,"value":1628},"confirmed",{"type":48,"value":1630},": all signals agree → high confidence, family name + version",{"type":42,"tag":1532,"props":1632,"children":1633},{},[1634,1639],{"type":42,"tag":57,"props":1635,"children":1636},{},[1637],{"type":48,"value":1638},"revised",{"type":48,"value":1640},": Stage 2 said Qakbot but Stage 4 behavior matches IcedID → note the revision + reasoning",{"type":42,"tag":1532,"props":1642,"children":1643},{},[1644,1649,1651],{"type":42,"tag":57,"props":1645,"children":1646},{},[1647],{"type":48,"value":1648},"rejected",{"type":48,"value":1650},": Stage 2 hypothesis had no corroborating behavior → drop it, mark family ",{"type":42,"tag":145,"props":1652,"children":1654},{"className":1653},[],[1655],{"type":48,"value":1656},"unknown",{"type":42,"tag":1009,"props":1658,"children":1660},{"id":1659},"_4-campaign-correlation-best-effort",[1661],{"type":48,"value":1662},"4. Campaign correlation (best-effort)",{"type":42,"tag":51,"props":1664,"children":1665},{},[1666],{"type":48,"value":1667},"Check if observed IOCs appear in recent campaign reporting:",{"type":42,"tag":137,"props":1669,"children":1671},{"className":1022,"code":1670,"language":1024,"meta":142,"style":142},"# Web search for exact IOCs in recent vendor posts\nfor IOC in \"${CORE_IOCS[@]}\"; do\n  # use platform web-search skill\n  echo \"Query: $IOC recent campaign site:mandiant.com OR site:crowdstrike.com OR site:cisa.gov\"\ndone\n",[1672],{"type":42,"tag":145,"props":1673,"children":1674},{"__ignoreMap":142},[1675,1683,1723,1731,1763],{"type":42,"tag":149,"props":1676,"children":1677},{"class":151,"line":26},[1678],{"type":42,"tag":149,"props":1679,"children":1680},{"style":1034},[1681],{"type":48,"value":1682},"# Web search for exact IOCs in recent vendor posts\n",{"type":42,"tag":149,"props":1684,"children":1685},{"class":151,"line":161},[1686,1690,1695,1699,1704,1709,1714,1719],{"type":42,"tag":149,"props":1687,"children":1688},{"style":1043},[1689],{"type":48,"value":1046},{"type":42,"tag":149,"props":1691,"children":1692},{"style":1049},[1693],{"type":48,"value":1694}," IOC ",{"type":42,"tag":149,"props":1696,"children":1697},{"style":1043},[1698],{"type":48,"value":1057},{"type":42,"tag":149,"props":1700,"children":1701},{"style":155},[1702],{"type":48,"value":1703}," \"${",{"type":42,"tag":149,"props":1705,"children":1706},{"style":1049},[1707],{"type":48,"value":1708},"CORE_IOCS",{"type":42,"tag":149,"props":1710,"children":1711},{"style":155},[1712],{"type":48,"value":1713},"[@]}\"",{"type":42,"tag":149,"props":1715,"children":1716},{"style":155},[1717],{"type":48,"value":1718},";",{"type":42,"tag":149,"props":1720,"children":1721},{"style":1043},[1722],{"type":48,"value":1115},{"type":42,"tag":149,"props":1724,"children":1725},{"class":151,"line":197},[1726],{"type":42,"tag":149,"props":1727,"children":1728},{"style":1034},[1729],{"type":48,"value":1730},"  # use platform web-search skill\n",{"type":42,"tag":149,"props":1732,"children":1733},{"class":151,"line":237},[1734,1740,1744,1749,1754,1759],{"type":42,"tag":149,"props":1735,"children":1737},{"style":1736},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[1738],{"type":48,"value":1739},"  echo",{"type":42,"tag":149,"props":1741,"children":1742},{"style":155},[1743],{"type":48,"value":220},{"type":42,"tag":149,"props":1745,"children":1746},{"style":223},[1747],{"type":48,"value":1748},"Query: ",{"type":42,"tag":149,"props":1750,"children":1751},{"style":1049},[1752],{"type":48,"value":1753},"$IOC",{"type":42,"tag":149,"props":1755,"children":1756},{"style":223},[1757],{"type":48,"value":1758}," recent campaign site:mandiant.com OR site:crowdstrike.com OR site:cisa.gov",{"type":42,"tag":149,"props":1760,"children":1761},{"style":155},[1762],{"type":48,"value":984},{"type":42,"tag":149,"props":1764,"children":1765},{"class":151,"line":263},[1766],{"type":42,"tag":149,"props":1767,"children":1768},{"style":1043},[1769],{"type":48,"value":1377},{"type":42,"tag":51,"props":1771,"children":1772},{},[1773],{"type":48,"value":1774},"Note any overlap with 3-source+ reporting (single-source hits are noise).",{"type":42,"tag":1009,"props":1776,"children":1778},{"id":1777},"_5-write-envelope-publish-comment",[1779],{"type":48,"value":1780},"5. Write envelope + publish comment",{"type":42,"tag":137,"props":1782,"children":1786},{"className":1783,"code":1784,"language":1785,"meta":142,"style":142},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","## Stage 5 — Correlation & attribution\n\n**Stage 2 hypothesis outcome**: ✅ confirmed | 🔄 revised | ❌ rejected\n\n### Family\n`Qakbot v5.x` — **high confidence**. Static (Stage 3) config-block decode matches v5.1.3 schema; dynamic (Stage 4) C2 pattern + mutex match.\n\n### MITRE ATT&CK TTPs confirmed\n- **T1055.002** — Portable Executable Injection. Evidence: `VirtualAllocEx+WriteProcessMemory+CreateRemoteThread` (Stage 3) + actual injection into explorer.exe (Stage 4).\n- **T1547.001** — Registry Run Keys. Evidence: Write to `HKCU\\...\\Run\\\u003Crandom>` (Stage 4).\n- **T1071.001** — Web Protocols C2. Evidence: HTTPS callback to `1.2.3.4:443` (Stage 4), JA3=`abc123...` matches Qakbot v5 fingerprint.\n\n### C2 infrastructure matches\n- `1.2.3.4`: MISP feed `c2-tracker` (first seen 2026-03-01, confidence high) + Shodan shows Cobalt-Strike default cert\n- Overlaps with Mandiant 2026-04-15 Qakbot campaign (shared mutex + C2)\n\n\u003Cdetails>Full JSON...\u003C\u002Fdetails>\n","markdown",[1787],{"type":42,"tag":145,"props":1788,"children":1789},{"__ignoreMap":142},[1790,1803,1810,1834,1841,1854,1894,1901,1913,1957,2000,2061,2068,2080,2122,2134,2141],{"type":42,"tag":149,"props":1791,"children":1792},{"class":151,"line":26},[1793,1798],{"type":42,"tag":149,"props":1794,"children":1795},{"style":155},[1796],{"type":48,"value":1797},"## ",{"type":42,"tag":149,"props":1799,"children":1800},{"style":272},[1801],{"type":48,"value":1802},"Stage 5 — Correlation & attribution\n",{"type":42,"tag":149,"props":1804,"children":1805},{"class":151,"line":161},[1806],{"type":42,"tag":149,"props":1807,"children":1808},{"emptyLinePlaceholder":1383},[1809],{"type":48,"value":1386},{"type":42,"tag":149,"props":1811,"children":1812},{"class":151,"line":197},[1813,1819,1825,1829],{"type":42,"tag":149,"props":1814,"children":1816},{"style":1815},"--shiki-light:#39ADB5;--shiki-light-font-weight:bold;--shiki-default:#89DDFF;--shiki-default-font-weight:bold;--shiki-dark:#89DDFF;--shiki-dark-font-weight:bold",[1817],{"type":48,"value":1818},"**",{"type":42,"tag":149,"props":1820,"children":1822},{"style":1821},"--shiki-light:#E53935;--shiki-light-font-weight:bold;--shiki-default:#F07178;--shiki-default-font-weight:bold;--shiki-dark:#F07178;--shiki-dark-font-weight:bold",[1823],{"type":48,"value":1824},"Stage 2 hypothesis outcome",{"type":42,"tag":149,"props":1826,"children":1827},{"style":1815},[1828],{"type":48,"value":1818},{"type":42,"tag":149,"props":1830,"children":1831},{"style":1049},[1832],{"type":48,"value":1833},": ✅ confirmed | 🔄 revised | ❌ rejected\n",{"type":42,"tag":149,"props":1835,"children":1836},{"class":151,"line":237},[1837],{"type":42,"tag":149,"props":1838,"children":1839},{"emptyLinePlaceholder":1383},[1840],{"type":48,"value":1386},{"type":42,"tag":149,"props":1842,"children":1843},{"class":151,"line":263},[1844,1849],{"type":42,"tag":149,"props":1845,"children":1846},{"style":155},[1847],{"type":48,"value":1848},"### ",{"type":42,"tag":149,"props":1850,"children":1851},{"style":272},[1852],{"type":48,"value":1853},"Family\n",{"type":42,"tag":149,"props":1855,"children":1856},{"class":151,"line":291},[1857,1862,1867,1871,1876,1880,1885,1889],{"type":42,"tag":149,"props":1858,"children":1859},{"style":155},[1860],{"type":48,"value":1861},"`",{"type":42,"tag":149,"props":1863,"children":1864},{"style":223},[1865],{"type":48,"value":1866},"Qakbot v5.x",{"type":42,"tag":149,"props":1868,"children":1869},{"style":155},[1870],{"type":48,"value":1861},{"type":42,"tag":149,"props":1872,"children":1873},{"style":1049},[1874],{"type":48,"value":1875}," — ",{"type":42,"tag":149,"props":1877,"children":1878},{"style":1815},[1879],{"type":48,"value":1818},{"type":42,"tag":149,"props":1881,"children":1882},{"style":1821},[1883],{"type":48,"value":1884},"high confidence",{"type":42,"tag":149,"props":1886,"children":1887},{"style":1815},[1888],{"type":48,"value":1818},{"type":42,"tag":149,"props":1890,"children":1891},{"style":1049},[1892],{"type":48,"value":1893},". Static (Stage 3) config-block decode matches v5.1.3 schema; dynamic (Stage 4) C2 pattern + mutex match.\n",{"type":42,"tag":149,"props":1895,"children":1896},{"class":151,"line":472},[1897],{"type":42,"tag":149,"props":1898,"children":1899},{"emptyLinePlaceholder":1383},[1900],{"type":48,"value":1386},{"type":42,"tag":149,"props":1902,"children":1903},{"class":151,"line":481},[1904,1908],{"type":42,"tag":149,"props":1905,"children":1906},{"style":155},[1907],{"type":48,"value":1848},{"type":42,"tag":149,"props":1909,"children":1910},{"style":272},[1911],{"type":48,"value":1912},"MITRE ATT&CK TTPs confirmed\n",{"type":42,"tag":149,"props":1914,"children":1915},{"class":151,"line":506},[1916,1921,1926,1930,1934,1939,1943,1948,1952],{"type":42,"tag":149,"props":1917,"children":1918},{"style":155},[1919],{"type":48,"value":1920},"-",{"type":42,"tag":149,"props":1922,"children":1923},{"style":1815},[1924],{"type":48,"value":1925}," **",{"type":42,"tag":149,"props":1927,"children":1928},{"style":1821},[1929],{"type":48,"value":537},{"type":42,"tag":149,"props":1931,"children":1932},{"style":1815},[1933],{"type":48,"value":1818},{"type":42,"tag":149,"props":1935,"children":1936},{"style":1049},[1937],{"type":48,"value":1938}," — Portable Executable Injection. Evidence: ",{"type":42,"tag":149,"props":1940,"children":1941},{"style":155},[1942],{"type":48,"value":1861},{"type":42,"tag":149,"props":1944,"children":1945},{"style":223},[1946],{"type":48,"value":1947},"VirtualAllocEx+WriteProcessMemory+CreateRemoteThread",{"type":42,"tag":149,"props":1949,"children":1950},{"style":155},[1951],{"type":48,"value":1861},{"type":42,"tag":149,"props":1953,"children":1954},{"style":1049},[1955],{"type":48,"value":1956}," (Stage 3) + actual injection into explorer.exe (Stage 4).\n",{"type":42,"tag":149,"props":1958,"children":1959},{"class":151,"line":616},[1960,1964,1968,1973,1977,1982,1986,1991,1995],{"type":42,"tag":149,"props":1961,"children":1962},{"style":155},[1963],{"type":48,"value":1920},{"type":42,"tag":149,"props":1965,"children":1966},{"style":1815},[1967],{"type":48,"value":1925},{"type":42,"tag":149,"props":1969,"children":1970},{"style":1821},[1971],{"type":48,"value":1972},"T1547.001",{"type":42,"tag":149,"props":1974,"children":1975},{"style":1815},[1976],{"type":48,"value":1818},{"type":42,"tag":149,"props":1978,"children":1979},{"style":1049},[1980],{"type":48,"value":1981}," — Registry Run Keys. Evidence: Write to ",{"type":42,"tag":149,"props":1983,"children":1984},{"style":155},[1985],{"type":48,"value":1861},{"type":42,"tag":149,"props":1987,"children":1988},{"style":223},[1989],{"type":48,"value":1990},"HKCU\\...\\Run\\\u003Crandom>",{"type":42,"tag":149,"props":1992,"children":1993},{"style":155},[1994],{"type":48,"value":1861},{"type":42,"tag":149,"props":1996,"children":1997},{"style":1049},[1998],{"type":48,"value":1999}," (Stage 4).\n",{"type":42,"tag":149,"props":2001,"children":2002},{"class":151,"line":624},[2003,2007,2011,2016,2020,2025,2029,2034,2038,2043,2047,2052,2056],{"type":42,"tag":149,"props":2004,"children":2005},{"style":155},[2006],{"type":48,"value":1920},{"type":42,"tag":149,"props":2008,"children":2009},{"style":1815},[2010],{"type":48,"value":1925},{"type":42,"tag":149,"props":2012,"children":2013},{"style":1821},[2014],{"type":48,"value":2015},"T1071.001",{"type":42,"tag":149,"props":2017,"children":2018},{"style":1815},[2019],{"type":48,"value":1818},{"type":42,"tag":149,"props":2021,"children":2022},{"style":1049},[2023],{"type":48,"value":2024}," — Web Protocols C2. Evidence: HTTPS callback to ",{"type":42,"tag":149,"props":2026,"children":2027},{"style":155},[2028],{"type":48,"value":1861},{"type":42,"tag":149,"props":2030,"children":2031},{"style":223},[2032],{"type":48,"value":2033},"1.2.3.4:443",{"type":42,"tag":149,"props":2035,"children":2036},{"style":155},[2037],{"type":48,"value":1861},{"type":42,"tag":149,"props":2039,"children":2040},{"style":1049},[2041],{"type":48,"value":2042}," (Stage 4), JA3=",{"type":42,"tag":149,"props":2044,"children":2045},{"style":155},[2046],{"type":48,"value":1861},{"type":42,"tag":149,"props":2048,"children":2049},{"style":223},[2050],{"type":48,"value":2051},"abc123...",{"type":42,"tag":149,"props":2053,"children":2054},{"style":155},[2055],{"type":48,"value":1861},{"type":42,"tag":149,"props":2057,"children":2058},{"style":1049},[2059],{"type":48,"value":2060}," matches Qakbot v5 fingerprint.\n",{"type":42,"tag":149,"props":2062,"children":2063},{"class":151,"line":750},[2064],{"type":42,"tag":149,"props":2065,"children":2066},{"emptyLinePlaceholder":1383},[2067],{"type":48,"value":1386},{"type":42,"tag":149,"props":2069,"children":2070},{"class":151,"line":775},[2071,2075],{"type":42,"tag":149,"props":2072,"children":2073},{"style":155},[2074],{"type":48,"value":1848},{"type":42,"tag":149,"props":2076,"children":2077},{"style":272},[2078],{"type":48,"value":2079},"C2 infrastructure matches\n",{"type":42,"tag":149,"props":2081,"children":2082},{"class":151,"line":906},[2083,2087,2092,2096,2100,2105,2109,2113,2117],{"type":42,"tag":149,"props":2084,"children":2085},{"style":155},[2086],{"type":48,"value":1920},{"type":42,"tag":149,"props":2088,"children":2089},{"style":155},[2090],{"type":48,"value":2091}," `",{"type":42,"tag":149,"props":2093,"children":2094},{"style":223},[2095],{"type":48,"value":323},{"type":42,"tag":149,"props":2097,"children":2098},{"style":155},[2099],{"type":48,"value":1861},{"type":42,"tag":149,"props":2101,"children":2102},{"style":1049},[2103],{"type":48,"value":2104},": MISP feed ",{"type":42,"tag":149,"props":2106,"children":2107},{"style":155},[2108],{"type":48,"value":1861},{"type":42,"tag":149,"props":2110,"children":2111},{"style":223},[2112],{"type":48,"value":392},{"type":42,"tag":149,"props":2114,"children":2115},{"style":155},[2116],{"type":48,"value":1861},{"type":42,"tag":149,"props":2118,"children":2119},{"style":1049},[2120],{"type":48,"value":2121}," (first seen 2026-03-01, confidence high) + Shodan shows Cobalt-Strike default cert\n",{"type":42,"tag":149,"props":2123,"children":2124},{"class":151,"line":914},[2125,2129],{"type":42,"tag":149,"props":2126,"children":2127},{"style":155},[2128],{"type":48,"value":1920},{"type":42,"tag":149,"props":2130,"children":2131},{"style":1049},[2132],{"type":48,"value":2133}," Overlaps with Mandiant 2026-04-15 Qakbot campaign (shared mutex + C2)\n",{"type":42,"tag":149,"props":2135,"children":2136},{"class":151,"line":952},[2137],{"type":42,"tag":149,"props":2138,"children":2139},{"emptyLinePlaceholder":1383},[2140],{"type":48,"value":1386},{"type":42,"tag":149,"props":2142,"children":2143},{"class":151,"line":987},[2144],{"type":42,"tag":149,"props":2145,"children":2146},{"style":1049},[2147],{"type":48,"value":2148},"\u003Cdetails>Full JSON...\u003C\u002Fdetails>\n",{"type":42,"tag":70,"props":2150,"children":2152},{"id":2151},"failure-handling",[2153],{"type":48,"value":2154},"Failure handling",{"type":42,"tag":1528,"props":2156,"children":2157},{},[2158],{"type":42,"tag":1532,"props":2159,"children":2160},{},[2161],{"type":48,"value":2162},"Same as Stage 2 — degrade gracefully on missing creds. If all OSINT sources are unavailable, correlation becomes \"local reasoning\" (match Stage 3 YARA hits against a bundled MITRE table).",{"type":42,"tag":70,"props":2164,"children":2166},{"id":2165},"guardrails",[2167],{"type":48,"value":2168},"Guardrails",{"type":42,"tag":1528,"props":2170,"children":2171},{},[2172,2177,2189],{"type":42,"tag":1532,"props":2173,"children":2174},{},[2175],{"type":48,"value":2176},"Attribution requires 2+ independent corroborating sources. A single VT family tag or one YARA hit isn't attribution — it's a suggestion. Wrong attribution gets quoted in incident reports and amplified; downstream IR teams end up chasing the wrong actor. \"Unattributed\" is a better answer than speculative.",{"type":42,"tag":1532,"props":2178,"children":2179},{},[2180,2182,2187],{"type":48,"value":2181},"Calibrate confidence to source count. High = 3+ corroborating. Medium = 2. Low = 1 + circumstantial signal. Below that it's ",{"type":42,"tag":145,"props":2183,"children":2185},{"className":2184},[],[2186],{"type":48,"value":1656},{"type":48,"value":2188},". The verdict in Stage 6 will inherit these values directly.",{"type":42,"tag":1532,"props":2190,"children":2191},{},[2192],{"type":48,"value":2193},"If you don't find prior reporting, say so plainly. Inventing a campaign name to sound confident is worse than admitting the sample is novel or unreported.",{"type":42,"tag":2195,"props":2196,"children":2197},"style",{},[2198],{"type":48,"value":2199},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2201,"total":2381},[2202,2223,2244,2254,2267,2280,2290,2300,2321,2336,2351,2366],{"slug":2203,"name":2203,"fn":2204,"description":2205,"org":2206,"tags":2207,"stars":2220,"repoUrl":2221,"updatedAt":2222},"agentcore-investigation","investigate Bedrock AgentCore runtime sessions","Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2208,2211,2214,2217],{"name":2209,"slug":2210,"type":16},"AWS","aws",{"name":2212,"slug":2213,"type":16},"Debugging","debugging",{"name":2215,"slug":2216,"type":16},"Logs","logs",{"name":2218,"slug":2219,"type":16},"Observability","observability",9427,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp","2026-07-12T08:37:22.601527",{"slug":2224,"name":2225,"fn":2226,"description":2227,"org":2228,"tags":2229,"stars":2220,"repoUrl":2221,"updatedAt":2243},"amazon-aurora-dsql","amazon aurora dsql","build applications with Aurora DSQL","Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django\u002FHibernate\u002FRails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2230,2233,2234,2237,2240],{"name":2231,"slug":2232,"type":16},"Aurora","aurora",{"name":2209,"slug":2210,"type":16},{"name":2235,"slug":2236,"type":16},"Database","database",{"name":2238,"slug":2239,"type":16},"Serverless","serverless",{"name":2241,"slug":2242,"type":16},"SQL","sql","2026-08-04T05:35:10.770847",{"slug":2245,"name":2246,"fn":2226,"description":2227,"org":2247,"tags":2248,"stars":2220,"repoUrl":2221,"updatedAt":2253},"aurora-dsql","aurora dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2249,2250,2251,2252],{"name":2209,"slug":2210,"type":16},{"name":2235,"slug":2236,"type":16},{"name":2238,"slug":2239,"type":16},{"name":2241,"slug":2242,"type":16},"2026-08-04T05:35:05.694395",{"slug":2255,"name":2256,"fn":2226,"description":2227,"org":2257,"tags":2258,"stars":2220,"repoUrl":2221,"updatedAt":2266},"aws-dsql","aws dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2259,2260,2261,2264,2265],{"name":2209,"slug":2210,"type":16},{"name":2235,"slug":2236,"type":16},{"name":2262,"slug":2263,"type":16},"Migration","migration",{"name":2238,"slug":2239,"type":16},{"name":2241,"slug":2242,"type":16},"2026-08-04T05:35:08.749669",{"slug":2268,"name":2269,"fn":2226,"description":2227,"org":2270,"tags":2271,"stars":2220,"repoUrl":2221,"updatedAt":2279},"distributed-postgres","distributed postgres",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2272,2273,2274,2277,2278],{"name":2209,"slug":2210,"type":16},{"name":2235,"slug":2236,"type":16},{"name":2275,"slug":2276,"type":16},"PostgreSQL","postgresql",{"name":2238,"slug":2239,"type":16},{"name":2241,"slug":2242,"type":16},"2026-08-04T05:35:06.713102",{"slug":2281,"name":2282,"fn":2226,"description":2227,"org":2283,"tags":2284,"stars":2220,"repoUrl":2221,"updatedAt":2289},"distributed-sql","distributed sql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2285,2286,2287,2288],{"name":2209,"slug":2210,"type":16},{"name":2235,"slug":2236,"type":16},{"name":2238,"slug":2239,"type":16},{"name":2241,"slug":2242,"type":16},"2026-08-04T05:35:10.086942",{"slug":2291,"name":2291,"fn":2226,"description":2227,"org":2292,"tags":2293,"stars":2220,"repoUrl":2221,"updatedAt":2299},"dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2294,2295,2296,2297,2298],{"name":2209,"slug":2210,"type":16},{"name":2235,"slug":2236,"type":16},{"name":2262,"slug":2263,"type":16},{"name":2238,"slug":2239,"type":16},{"name":2241,"slug":2242,"type":16},"2026-08-04T05:35:07.751779",{"slug":2301,"name":2301,"fn":2302,"description":2303,"org":2304,"tags":2305,"stars":2318,"repoUrl":2319,"updatedAt":2320},"cost-efficiency-analyzer","analyze cost efficiency and expenses","Analyzes cost structure, cost efficiency, and expense management from P&L data. Use when the user asks about costs, expenses, COGS, operating expenses, cost ratios, cost control, spending efficiency, margin compression from cost side, or wants to understand where money is going. Also use for \"are we spending too much\", \"cost breakdown\", \"expense analysis\", or \"how efficient are our operations\". NOT for revenue or top-line analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2306,2309,2312,2315],{"name":2307,"slug":2308,"type":16},"Accounting","accounting",{"name":2310,"slug":2311,"type":16},"Analytics","analytics",{"name":2313,"slug":2314,"type":16},"Cost Optimization","cost-optimization",{"name":2316,"slug":2317,"type":16},"Finance","finance",3176,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentcore-samples","2026-07-12T08:40:03.29555",{"slug":2322,"name":2322,"fn":2323,"description":2324,"org":2325,"tags":2326,"stars":2318,"repoUrl":2319,"updatedAt":2335},"executive-financial-briefing","generate executive financial briefings","Generates a concise executive-level financial briefing or summary suitable for a CEO, CFO, or board presentation. Use when the user asks for a summary, briefing, executive summary, board update, financial overview, financial health check, or \"how is the business doing\". Covers the full P&L picture in one page. Also use for \"give me the highlights\", \"what do I need to know\", or \"quick financial update\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2327,2328,2329,2332],{"name":2209,"slug":2210,"type":16},{"name":2316,"slug":2317,"type":16},{"name":2330,"slug":2331,"type":16},"Management","management",{"name":2333,"slug":2334,"type":16},"Reporting","reporting","2026-07-12T08:40:02.066471",{"slug":2337,"name":2337,"fn":2338,"description":2339,"org":2340,"tags":2341,"stars":2318,"repoUrl":2319,"updatedAt":2350},"multi-quarter-trend-analysis","analyze multi-quarter financial trends","Analyzes financial trends across multiple quarters by comparing P&L metrics over time. Use when the user wants to see trends, patterns, trajectories, or directional movement across 3 or more quarters. Also use for \"how are we trending\", \"show me the trend\", \"track performance over time\", \"quarter over quarter comparison across all quarters\", or any multi-period longitudinal analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2342,2343,2344,2347],{"name":2310,"slug":2311,"type":16},{"name":2316,"slug":2317,"type":16},{"name":2345,"slug":2346,"type":16},"Financial Statements","financial-statements",{"name":2348,"slug":2349,"type":16},"Variance Analysis","variance-analysis","2026-07-12T08:40:00.79141",{"slug":2352,"name":2352,"fn":2353,"description":2354,"org":2355,"tags":2356,"stars":2318,"repoUrl":2319,"updatedAt":2365},"pdf","process and manipulate PDF documents","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2357,2360,2363],{"name":2358,"slug":2359,"type":16},"Automation","automation",{"name":2361,"slug":2362,"type":16},"Documents","documents",{"name":2364,"slug":2352,"type":16},"PDF","2026-07-12T08:41:44.135656",{"slug":2367,"name":2367,"fn":2368,"description":2369,"org":2370,"tags":2371,"stars":2318,"repoUrl":2319,"updatedAt":2380},"quarterly-kpi-calculator","calculate quarterly financial KPIs","Calculates quarterly financial KPIs from P&L data. P&L figures can be provided directly by the user or fetched from the financial data MCP server. Use when the user wants KPI calculations such as Gross Margin %, EBITDA Margin %, Operating Expense Ratio, or Revenue Growth % QoQ. Also use for quarterly performance review, P&L analysis, or interpreting financial ratios against benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2372,2373,2376,2377],{"name":2307,"slug":2308,"type":16},{"name":2374,"slug":2375,"type":16},"Data Analysis","data-analysis",{"name":2316,"slug":2317,"type":16},{"name":2378,"slug":2379,"type":16},"KPI","kpi","2026-07-12T08:39:59.54971",155,{"items":2383,"total":263},[2384,2397,2404,2422,2439],{"slug":2385,"name":2385,"fn":2386,"description":2387,"org":2388,"tags":2389,"stars":26,"repoUrl":27,"updatedAt":2396},"stage-1-triage","perform initial malware sample triage","Lightweight fingerprinting of a malware sample — hashes, file type, entropy, strings, candidate IOCs. Use this skill whenever you start a 7-stage malware analysis pipeline, need a quick file identification before deeper analysis, or want to check a sample against known-hash databases before committing compute. This is always the first stage and must run before Stage 2 (OSINT), Stage 3 (static), or Stage 4 (dynamic).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2390,2391,2392,2393],{"name":24,"slug":25,"type":16},{"name":2212,"slug":2213,"type":16},{"name":14,"slug":15,"type":16},{"name":2394,"slug":2395,"type":16},"Triage","triage","2026-08-04T05:58:50.852669",{"slug":4,"name":4,"fn":5,"description":6,"org":2398,"tags":2399,"stars":26,"repoUrl":27,"updatedAt":28},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2400,2401,2402,2403],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":2405,"name":2405,"fn":2406,"description":2407,"org":2408,"tags":2409,"stars":26,"repoUrl":27,"updatedAt":2421},"stage-6-verdict","synthesize security verdicts and recommended actions","Synthesize severity (malicious\u002Fsuspicious\u002Fbenign), confidence (high\u002Fmedium\u002Flow), STIX 2.1 IOC bundle, CSV feed, and concrete recommended actions (host isolation, token revocation, perimeter blocks, fleet-wide hunt queries) from all prior stage envelopes. Use this skill whenever earlier stages have produced findings (or on a Stage 2 short-circuit to benign) and you need a machine-readable verdict that IR teams can ingest into Splunk\u002FElastic\u002FSentinel or block at the perimeter. Always runs — even short-circuits produce a minimal clean-sample verdict. Runs after all other analysis stages; Stage 7 depends on this output.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2410,2411,2414,2417,2420],{"name":18,"slug":19,"type":16},{"name":2412,"slug":2413,"type":16},"Compliance","compliance",{"name":2415,"slug":2416,"type":16},"Incident Response","incident-response",{"name":2418,"slug":2419,"type":16},"Policy","policy",{"name":14,"slug":15,"type":16},"2026-08-04T05:59:08.753662",{"slug":2423,"name":2423,"fn":2424,"description":2425,"org":2426,"tags":2427,"stars":26,"repoUrl":27,"updatedAt":2438},"stage-7-report","generate security incident reports and IOC feeds","Produce the final deliverables — executive summary (for leadership), structured technical report (for IR), STIX 2.1 + CSV IOC feeds (for SIEM\u002Ffirewall), copy-pasteable Splunk\u002FElastic\u002FSentinel hunt queries — upload them all to S3 with presigned URLs, and post a single consolidated comment linking everything. Use this skill whenever the pipeline has reached a verdict (Stage 6 done) and the issue needs a handoff-ready set of artifacts for IR follow-up. Always the last stage; runs on benign short-circuits too (produces a concise clean-sample report).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2428,2429,2430,2433,2434,2435],{"name":18,"slug":19,"type":16},{"name":2412,"slug":2413,"type":16},{"name":2431,"slug":2432,"type":16},"Elastic","elastic",{"name":2333,"slug":2334,"type":16},{"name":14,"slug":15,"type":16},{"name":2436,"slug":2437,"type":16},"Splunk","splunk","2026-08-04T05:59:08.226613",{"slug":2440,"name":2440,"fn":2441,"description":2442,"org":2443,"tags":2444,"stars":26,"repoUrl":27,"updatedAt":2452},"url-analysis","analyze suspicious URLs in isolated browser sessions","Analyze a suspicious URL by visiting it in an isolated AgentCore Browser\nsession. Captures screenshots, DOM, network requests, redirects, and\nextracted IOCs. Use for phishing triage, suspicious-link investigation,\nand malicious-site fingerprinting.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2445,2448,2449,2450,2451],{"name":2446,"slug":2447,"type":16},"Browser Automation","browser-automation",{"name":24,"slug":25,"type":16},{"name":2212,"slug":2213,"type":16},{"name":14,"slug":15,"type":16},{"name":2394,"slug":2395,"type":16},"2026-08-04T05:58:51.393402"]