[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-labs-stage-6-verdict":3,"mdc--l5oicc-key":39,"related-org-aws-labs-stage-6-verdict":2616,"related-repo-aws-labs-stage-6-verdict":2797},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":29,"repoUrl":30,"updatedAt":31,"license":32,"forks":33,"topics":34,"repo":35,"sourceUrl":37,"mdContent":38},"stage-6-verdict","synthesize security verdicts and recommended actions","Synthesize severity (malicious\u002Fsuspicious\u002Fbenign), confidence (high\u002Fmedium\u002Flow), STIX 2.1 IOC bundle, CSV feed, and concrete recommended actions (host isolation, token revocation, perimeter blocks, fleet-wide hunt queries) from all prior stage envelopes. Use this skill whenever earlier stages have produced findings (or on a Stage 2 short-circuit to benign) and you need a machine-readable verdict that IR teams can ingest into Splunk\u002FElastic\u002FSentinel or block at the perimeter. Always runs — even short-circuits produce a minimal clean-sample verdict. Runs after all other analysis stages; Stage 7 depends on this output.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"aws-labs","AWS Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws-labs.png","awslabs",[13,17,20,23,26],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Compliance","compliance",{"name":21,"slug":22,"type":16},"Audit","audit",{"name":24,"slug":25,"type":16},"Incident Response","incident-response",{"name":27,"slug":28,"type":16},"Policy","policy",1,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentic-developer-platform","2026-08-04T05:59:08.753662",null,0,[],{"repoUrl":30,"stars":29,"forks":33,"topics":36,"description":32},[],"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentic-developer-platform\u002Ftree\u002FHEAD\u002Fmodules\u002Fdomain-apps\u002Fcyber\u002Fagent\u002Fskills\u002Fstage-6-verdict","---\nname: stage-6-verdict\ndescription: Synthesize severity (malicious\u002Fsuspicious\u002Fbenign), confidence (high\u002Fmedium\u002Flow), STIX 2.1 IOC bundle, CSV feed, and concrete recommended actions (host isolation, token revocation, perimeter blocks, fleet-wide hunt queries) from all prior stage envelopes. Use this skill whenever earlier stages have produced findings (or on a Stage 2 short-circuit to benign) and you need a machine-readable verdict that IR teams can ingest into Splunk\u002FElastic\u002FSentinel or block at the perimeter. Always runs — even short-circuits produce a minimal clean-sample verdict. Runs after all other analysis stages; Stage 7 depends on this output.\n---\n\n# Stage 6 — Verdict & IOCs\n\nPure synthesis. No external calls. Takes envelopes from Stages 1-5 (or just 1-2 if Stage 2 short-circuited), produces a machine-readable verdict + IOC bundle that IR teams can ingest.\n\n## Inputs\n\nAll prior stage envelopes from DDB. Query:\n\n```bash\naws dynamodb query --region us-east-1 \\\n  --table-name \"$CYBER_RESULTS_TABLE\" \\\n  --key-condition-expression \"artifact_id = :a\" \\\n  --expression-attribute-values '{\":a\":{\"S\":\"'\"$ARTIFACT_ID\"'\"}}' \\\n  --query 'Items' --output json\n```\n\n## Outputs\n\n```json\n{\n  \"stage\": 6,\n  \"stage_name\": \"verdict\",\n  \"verdict\": {\n    \"severity\": \"malicious | suspicious | benign\",\n    \"confidence\": \"high | medium | low\",\n    \"reasoning\": \"1-2 sentence synthesis\",\n    \"family\": \"Qakbot v5.x | null\",\n    \"short_circuit\": false\n  },\n  \"iocs_stix_2_1\": {\n    \"type\": \"bundle\",\n    \"id\": \"bundle--\u003Cuuid>\",\n    \"objects\": [\n      {\"type\": \"file\", \"hashes\": {\"SHA-256\": \"...\"}, \"name\": \"...\"},\n      {\"type\": \"ipv4-addr\", \"value\": \"1.2.3.4\"},\n      {\"type\": \"domain-name\", \"value\": \"evil.example\"},\n      {\"type\": \"indicator\", \"pattern\": \"[file:hashes.'SHA-256' = '...']\", \"valid_from\": \"...\"}\n    ]\n  },\n  \"iocs_csv\": \"indicator_type,value,source,confidence,first_seen\\nhash-sha256,abc123,static,high,2026-04-29\\n...\",\n  \"recommended_actions\": [\n    {\"action\": \"host_isolation\", \"priority\": \"immediate\", \"scope\": \"hosts with matching process-injection telemetry\"},\n    {\"action\": \"token_revocation\", \"priority\": \"immediate\", \"scope\": \"credentials accessed by injected explorer.exe\"},\n    {\"action\": \"perimeter_block\", \"priority\": \"high\", \"iocs\": [\"1.2.3.4\", \"evil.example\"]},\n    {\"action\": \"fleet_hunt\", \"priority\": \"high\", \"query\": \"hash:\u003Csha256> OR mutex:\u003Cmutex>\"}\n  ]\n}\n```\n\n## Steps\n\n### 1. Determine severity\n\nSimple rule engine:\n- **benign** — Stage 2 short-circuit, OR Stage 3 all-clean + Stage 4 all-clean + signed Microsoft binary\n- **malicious** — Any of: ≥3 VT hits + family identified (Stage 2), YARA family rule hit (Stage 3), observed C2 callback to known-bad IP (Stage 4\u002F5), ≥2 MITRE TTPs confirmed (Stage 5)\n- **suspicious** — In between: high entropy + no signature + ≥1 IOC match, but no strong malicious signal\n\n### 2. Determine confidence\n\n- **high** — severity = malicious AND ≥3 independent signals corroborate (e.g. VT + YARA + MITRE + MISP)\n- **medium** — 2 corroborating signals, OR family identified but no campaign attribution\n- **low** — 1 signal only, OR severity = suspicious, OR Stage 4 was skipped\u002Ffailed\n\n### 3. Build STIX 2.1 bundle\n\nOne Python one-liner or short script to emit a valid STIX bundle:\n\n```python\nimport json, uuid\nfrom datetime import datetime\n\nbundle = {\n    \"type\": \"bundle\",\n    \"id\": f\"bundle--{uuid.uuid4()}\",\n    \"objects\": []\n}\n\n# File observable\nbundle[\"objects\"].append({\n    \"type\": \"file\",\n    \"id\": f\"file--{uuid.uuid4()}\",\n    \"hashes\": {\"SHA-256\": sha256, \"SHA-1\": sha1, \"MD5\": md5}\n})\n\n# IP observables\nfor ip in c2_ips:\n    bundle[\"objects\"].append({\n        \"type\": \"ipv4-addr\",\n        \"id\": f\"ipv4-addr--{uuid.uuid4()}\",\n        \"value\": ip\n    })\n\n# Indicators (STIX indicators, pattern-based)\nbundle[\"objects\"].append({\n    \"type\": \"indicator\",\n    \"id\": f\"indicator--{uuid.uuid4()}\",\n    \"pattern\": f\"[file:hashes.'SHA-256' = '{sha256}']\",\n    \"pattern_type\": \"stix\",\n    \"valid_from\": datetime.utcnow().isoformat() + \"Z\"\n})\n\nprint(json.dumps(bundle, indent=2))\n```\n\n### 4. Build CSV\n\n```csv\nindicator_type,value,source,confidence,first_seen,notes\nhash-sha256,\u003Csha256>,triage,high,\u003Cdate>,\"Main sample\"\nhash-sha256,\u003Cdropped_hash>,dynamic,high,\u003Cdate>,\"Dropped payload\"\nipv4,\u003Cc2_ip>,dynamic+misp,high,\u003Cdate>,\"C2 callback + MISP feed\"\ndomain,\u003Cc2_domain>,static+dynamic,medium,\u003Cdate>,\"Seen in strings + DNS query\"\n```\n\n### 5. Generate recommended actions\n\nTailor to severity:\n\n- **benign** → no actions, short confirmation message\n- **suspicious** → 1 action: \"quarantine for further review\"\n- **malicious** → full action set: isolate, revoke tokens, perimeter block, fleet hunt\n\n### 6. Write envelope + publish comment\n\nComment format (lead with the verdict so on-call readers see it first):\n\n```markdown\n## Stage 6 — Verdict\n\n# 🔴 MALICIOUS — high confidence\n\n**Family**: Qakbot v5.x\n**Reasoning**: Confirmed across 4 signals: VT (42\u002F73, family match), YARA (qakbot_v5 rule), dynamic C2 callback (1.2.3.4 matches MISP feed), MITRE T1055.002 + T1071.001 confirmed.\n\n### Immediate actions\n1. **Host isolation** — any host with process-injection telemetry matching `VirtualAllocEx→explorer.exe`\n2. **Token revocation** — credentials cached by explorer.exe on suspect hosts\n3. **Perimeter block** — `1.2.3.4`, `evil.example` (both directions)\n4. **Fleet hunt** — Splunk query in Stage 7 report\n\n\u003Cdetails>\u003Csummary>IOCs (STIX 2.1)\u003C\u002Fsummary>\n\n```json\n{STIX bundle...}\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\u003Csummary>IOCs (CSV)\u003C\u002Fsummary>\n\n```csv\nindicator_type,value,source,confidence,first_seen\n...\n```\n\u003C\u002Fdetails>\n```\n\n## Failure handling\n\n- Missing prior stages → work with what's there. Minimum to produce a verdict: Stage 1 + Stage 2.\n- If only Stage 1 ran (Stage 2 failed completely + no OSINT) → verdict = `suspicious, low confidence` with a note that it needs a human review.\n\n## Guardrails\n\n- Lead with severity + confidence in the first line of the comment. On-call readers scan for the answer; burying it three paragraphs in costs minutes per sample across a shift.\n- Tag every IOC with its source stage. When an IR analyst blocks an IP and later asks \"how confident are we this is actually bad?\" the answer needs to be \"Stage 4 observed the callback plus Stage 5 matched the MISP feed\" — not a stripped list of numbers.\n- Use real STIX 2.1 object types (`file`, `ipv4-addr`, `ipv6-addr`, `domain-name`, `url`, `mutex`, `process`, `indicator`, `malware`). Invented types break downstream STIX consumers silently and look like a parser bug to the receiver.\n- Recommended actions must be executable. \"Investigate further\" is not a recommendation; \"Block 1.2.3.4 + evil.example at the perimeter, revoke tokens cached by explorer.exe on hosts with matching injection telemetry\" is.\n",{"data":40,"body":41},{"name":4,"description":6},{"type":42,"children":43},"root",[44,53,59,66,71,256,262,1649,1655,1662,1667,1703,1709,1741,1747,1752,2033,2039,2088,2094,2099,2129,2135,2140,2461,2494,2500,2521,2527,2610],{"type":45,"tag":46,"props":47,"children":49},"element","h1",{"id":48},"stage-6-verdict-iocs",[50],{"type":51,"value":52},"text","Stage 6 — Verdict & IOCs",{"type":45,"tag":54,"props":55,"children":56},"p",{},[57],{"type":51,"value":58},"Pure synthesis. No external calls. Takes envelopes from Stages 1-5 (or just 1-2 if Stage 2 short-circuited), produces a machine-readable verdict + IOC bundle that IR teams can ingest.",{"type":45,"tag":60,"props":61,"children":63},"h2",{"id":62},"inputs",[64],{"type":51,"value":65},"Inputs",{"type":45,"tag":54,"props":67,"children":68},{},[69],{"type":51,"value":70},"All prior stage envelopes from DDB. Query:",{"type":45,"tag":72,"props":73,"children":78},"pre",{"className":74,"code":75,"language":76,"meta":77,"style":77},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","aws dynamodb query --region us-east-1 \\\n  --table-name \"$CYBER_RESULTS_TABLE\" \\\n  --key-condition-expression \"artifact_id = :a\" \\\n  --expression-attribute-values '{\":a\":{\"S\":\"'\"$ARTIFACT_ID\"'\"}}' \\\n  --query 'Items' --output json\n","bash","",[79],{"type":45,"tag":80,"props":81,"children":82},"code",{"__ignoreMap":77},[83,121,150,176,224],{"type":45,"tag":84,"props":85,"children":87},"span",{"class":86,"line":29},"line",[88,94,100,105,110,115],{"type":45,"tag":84,"props":89,"children":91},{"style":90},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[92],{"type":51,"value":93},"aws",{"type":45,"tag":84,"props":95,"children":97},{"style":96},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[98],{"type":51,"value":99}," dynamodb",{"type":45,"tag":84,"props":101,"children":102},{"style":96},[103],{"type":51,"value":104}," query",{"type":45,"tag":84,"props":106,"children":107},{"style":96},[108],{"type":51,"value":109}," --region",{"type":45,"tag":84,"props":111,"children":112},{"style":96},[113],{"type":51,"value":114}," us-east-1",{"type":45,"tag":84,"props":116,"children":118},{"style":117},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[119],{"type":51,"value":120}," \\\n",{"type":45,"tag":84,"props":122,"children":124},{"class":86,"line":123},2,[125,130,136,141,146],{"type":45,"tag":84,"props":126,"children":127},{"style":96},[128],{"type":51,"value":129},"  --table-name",{"type":45,"tag":84,"props":131,"children":133},{"style":132},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[134],{"type":51,"value":135}," \"",{"type":45,"tag":84,"props":137,"children":138},{"style":117},[139],{"type":51,"value":140},"$CYBER_RESULTS_TABLE",{"type":45,"tag":84,"props":142,"children":143},{"style":132},[144],{"type":51,"value":145},"\"",{"type":45,"tag":84,"props":147,"children":148},{"style":117},[149],{"type":51,"value":120},{"type":45,"tag":84,"props":151,"children":153},{"class":86,"line":152},3,[154,159,163,168,172],{"type":45,"tag":84,"props":155,"children":156},{"style":96},[157],{"type":51,"value":158},"  --key-condition-expression",{"type":45,"tag":84,"props":160,"children":161},{"style":132},[162],{"type":51,"value":135},{"type":45,"tag":84,"props":164,"children":165},{"style":96},[166],{"type":51,"value":167},"artifact_id = :a",{"type":45,"tag":84,"props":169,"children":170},{"style":132},[171],{"type":51,"value":145},{"type":45,"tag":84,"props":173,"children":174},{"style":117},[175],{"type":51,"value":120},{"type":45,"tag":84,"props":177,"children":179},{"class":86,"line":178},4,[180,185,190,195,200,205,210,215,220],{"type":45,"tag":84,"props":181,"children":182},{"style":96},[183],{"type":51,"value":184},"  --expression-attribute-values",{"type":45,"tag":84,"props":186,"children":187},{"style":132},[188],{"type":51,"value":189}," '",{"type":45,"tag":84,"props":191,"children":192},{"style":96},[193],{"type":51,"value":194},"{\":a\":{\"S\":\"",{"type":45,"tag":84,"props":196,"children":197},{"style":132},[198],{"type":51,"value":199},"'\"",{"type":45,"tag":84,"props":201,"children":202},{"style":117},[203],{"type":51,"value":204},"$ARTIFACT_ID",{"type":45,"tag":84,"props":206,"children":207},{"style":132},[208],{"type":51,"value":209},"\"'",{"type":45,"tag":84,"props":211,"children":212},{"style":96},[213],{"type":51,"value":214},"\"}}",{"type":45,"tag":84,"props":216,"children":217},{"style":132},[218],{"type":51,"value":219},"'",{"type":45,"tag":84,"props":221,"children":222},{"style":117},[223],{"type":51,"value":120},{"type":45,"tag":84,"props":225,"children":227},{"class":86,"line":226},5,[228,233,237,242,246,251],{"type":45,"tag":84,"props":229,"children":230},{"style":96},[231],{"type":51,"value":232},"  --query",{"type":45,"tag":84,"props":234,"children":235},{"style":132},[236],{"type":51,"value":189},{"type":45,"tag":84,"props":238,"children":239},{"style":96},[240],{"type":51,"value":241},"Items",{"type":45,"tag":84,"props":243,"children":244},{"style":132},[245],{"type":51,"value":219},{"type":45,"tag":84,"props":247,"children":248},{"style":96},[249],{"type":51,"value":250}," --output",{"type":45,"tag":84,"props":252,"children":253},{"style":96},[254],{"type":51,"value":255}," json\n",{"type":45,"tag":60,"props":257,"children":259},{"id":258},"outputs",[260],{"type":51,"value":261},"Outputs",{"type":45,"tag":72,"props":263,"children":267},{"className":264,"code":265,"language":266,"meta":77,"style":77},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"stage\": 6,\n  \"stage_name\": \"verdict\",\n  \"verdict\": {\n    \"severity\": \"malicious | suspicious | benign\",\n    \"confidence\": \"high | medium | low\",\n    \"reasoning\": \"1-2 sentence synthesis\",\n    \"family\": \"Qakbot v5.x | null\",\n    \"short_circuit\": false\n  },\n  \"iocs_stix_2_1\": {\n    \"type\": \"bundle\",\n    \"id\": \"bundle--\u003Cuuid>\",\n    \"objects\": [\n      {\"type\": \"file\", \"hashes\": {\"SHA-256\": \"...\"}, \"name\": \"...\"},\n      {\"type\": \"ipv4-addr\", \"value\": \"1.2.3.4\"},\n      {\"type\": \"domain-name\", \"value\": \"evil.example\"},\n      {\"type\": \"indicator\", \"pattern\": \"[file:hashes.'SHA-256' = '...']\", \"valid_from\": \"...\"}\n    ]\n  },\n  \"iocs_csv\": \"indicator_type,value,source,confidence,first_seen\\nhash-sha256,abc123,static,high,2026-04-29\\n...\",\n  \"recommended_actions\": [\n    {\"action\": \"host_isolation\", \"priority\": \"immediate\", \"scope\": \"hosts with matching process-injection telemetry\"},\n    {\"action\": \"token_revocation\", \"priority\": \"immediate\", \"scope\": \"credentials accessed by injected explorer.exe\"},\n    {\"action\": \"perimeter_block\", \"priority\": \"high\", \"iocs\": [\"1.2.3.4\", \"evil.example\"]},\n    {\"action\": \"fleet_hunt\", \"priority\": \"high\", \"query\": \"hash:\u003Csha256> OR mutex:\u003Cmutex>\"}\n  ]\n}\n","json",[268],{"type":45,"tag":80,"props":269,"children":270},{"__ignoreMap":77},[271,279,313,350,374,412,450,488,526,552,561,586,624,662,688,823,898,972,1081,1090,1098,1154,1179,1290,1396,1525,1632,1641],{"type":45,"tag":84,"props":272,"children":273},{"class":86,"line":29},[274],{"type":45,"tag":84,"props":275,"children":276},{"style":132},[277],{"type":51,"value":278},"{\n",{"type":45,"tag":84,"props":280,"children":281},{"class":86,"line":123},[282,287,293,297,302,308],{"type":45,"tag":84,"props":283,"children":284},{"style":132},[285],{"type":51,"value":286},"  \"",{"type":45,"tag":84,"props":288,"children":290},{"style":289},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[291],{"type":51,"value":292},"stage",{"type":45,"tag":84,"props":294,"children":295},{"style":132},[296],{"type":51,"value":145},{"type":45,"tag":84,"props":298,"children":299},{"style":132},[300],{"type":51,"value":301},":",{"type":45,"tag":84,"props":303,"children":305},{"style":304},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[306],{"type":51,"value":307}," 6",{"type":45,"tag":84,"props":309,"children":310},{"style":132},[311],{"type":51,"value":312},",\n",{"type":45,"tag":84,"props":314,"children":315},{"class":86,"line":152},[316,320,325,329,333,337,342,346],{"type":45,"tag":84,"props":317,"children":318},{"style":132},[319],{"type":51,"value":286},{"type":45,"tag":84,"props":321,"children":322},{"style":289},[323],{"type":51,"value":324},"stage_name",{"type":45,"tag":84,"props":326,"children":327},{"style":132},[328],{"type":51,"value":145},{"type":45,"tag":84,"props":330,"children":331},{"style":132},[332],{"type":51,"value":301},{"type":45,"tag":84,"props":334,"children":335},{"style":132},[336],{"type":51,"value":135},{"type":45,"tag":84,"props":338,"children":339},{"style":96},[340],{"type":51,"value":341},"verdict",{"type":45,"tag":84,"props":343,"children":344},{"style":132},[345],{"type":51,"value":145},{"type":45,"tag":84,"props":347,"children":348},{"style":132},[349],{"type":51,"value":312},{"type":45,"tag":84,"props":351,"children":352},{"class":86,"line":178},[353,357,361,365,369],{"type":45,"tag":84,"props":354,"children":355},{"style":132},[356],{"type":51,"value":286},{"type":45,"tag":84,"props":358,"children":359},{"style":289},[360],{"type":51,"value":341},{"type":45,"tag":84,"props":362,"children":363},{"style":132},[364],{"type":51,"value":145},{"type":45,"tag":84,"props":366,"children":367},{"style":132},[368],{"type":51,"value":301},{"type":45,"tag":84,"props":370,"children":371},{"style":132},[372],{"type":51,"value":373}," {\n",{"type":45,"tag":84,"props":375,"children":376},{"class":86,"line":226},[377,382,387,391,395,399,404,408],{"type":45,"tag":84,"props":378,"children":379},{"style":132},[380],{"type":51,"value":381},"    \"",{"type":45,"tag":84,"props":383,"children":384},{"style":90},[385],{"type":51,"value":386},"severity",{"type":45,"tag":84,"props":388,"children":389},{"style":132},[390],{"type":51,"value":145},{"type":45,"tag":84,"props":392,"children":393},{"style":132},[394],{"type":51,"value":301},{"type":45,"tag":84,"props":396,"children":397},{"style":132},[398],{"type":51,"value":135},{"type":45,"tag":84,"props":400,"children":401},{"style":96},[402],{"type":51,"value":403},"malicious | suspicious | benign",{"type":45,"tag":84,"props":405,"children":406},{"style":132},[407],{"type":51,"value":145},{"type":45,"tag":84,"props":409,"children":410},{"style":132},[411],{"type":51,"value":312},{"type":45,"tag":84,"props":413,"children":415},{"class":86,"line":414},6,[416,420,425,429,433,437,442,446],{"type":45,"tag":84,"props":417,"children":418},{"style":132},[419],{"type":51,"value":381},{"type":45,"tag":84,"props":421,"children":422},{"style":90},[423],{"type":51,"value":424},"confidence",{"type":45,"tag":84,"props":426,"children":427},{"style":132},[428],{"type":51,"value":145},{"type":45,"tag":84,"props":430,"children":431},{"style":132},[432],{"type":51,"value":301},{"type":45,"tag":84,"props":434,"children":435},{"style":132},[436],{"type":51,"value":135},{"type":45,"tag":84,"props":438,"children":439},{"style":96},[440],{"type":51,"value":441},"high | medium | low",{"type":45,"tag":84,"props":443,"children":444},{"style":132},[445],{"type":51,"value":145},{"type":45,"tag":84,"props":447,"children":448},{"style":132},[449],{"type":51,"value":312},{"type":45,"tag":84,"props":451,"children":453},{"class":86,"line":452},7,[454,458,463,467,471,475,480,484],{"type":45,"tag":84,"props":455,"children":456},{"style":132},[457],{"type":51,"value":381},{"type":45,"tag":84,"props":459,"children":460},{"style":90},[461],{"type":51,"value":462},"reasoning",{"type":45,"tag":84,"props":464,"children":465},{"style":132},[466],{"type":51,"value":145},{"type":45,"tag":84,"props":468,"children":469},{"style":132},[470],{"type":51,"value":301},{"type":45,"tag":84,"props":472,"children":473},{"style":132},[474],{"type":51,"value":135},{"type":45,"tag":84,"props":476,"children":477},{"style":96},[478],{"type":51,"value":479},"1-2 sentence synthesis",{"type":45,"tag":84,"props":481,"children":482},{"style":132},[483],{"type":51,"value":145},{"type":45,"tag":84,"props":485,"children":486},{"style":132},[487],{"type":51,"value":312},{"type":45,"tag":84,"props":489,"children":491},{"class":86,"line":490},8,[492,496,501,505,509,513,518,522],{"type":45,"tag":84,"props":493,"children":494},{"style":132},[495],{"type":51,"value":381},{"type":45,"tag":84,"props":497,"children":498},{"style":90},[499],{"type":51,"value":500},"family",{"type":45,"tag":84,"props":502,"children":503},{"style":132},[504],{"type":51,"value":145},{"type":45,"tag":84,"props":506,"children":507},{"style":132},[508],{"type":51,"value":301},{"type":45,"tag":84,"props":510,"children":511},{"style":132},[512],{"type":51,"value":135},{"type":45,"tag":84,"props":514,"children":515},{"style":96},[516],{"type":51,"value":517},"Qakbot v5.x | null",{"type":45,"tag":84,"props":519,"children":520},{"style":132},[521],{"type":51,"value":145},{"type":45,"tag":84,"props":523,"children":524},{"style":132},[525],{"type":51,"value":312},{"type":45,"tag":84,"props":527,"children":529},{"class":86,"line":528},9,[530,534,539,543,547],{"type":45,"tag":84,"props":531,"children":532},{"style":132},[533],{"type":51,"value":381},{"type":45,"tag":84,"props":535,"children":536},{"style":90},[537],{"type":51,"value":538},"short_circuit",{"type":45,"tag":84,"props":540,"children":541},{"style":132},[542],{"type":51,"value":145},{"type":45,"tag":84,"props":544,"children":545},{"style":132},[546],{"type":51,"value":301},{"type":45,"tag":84,"props":548,"children":549},{"style":132},[550],{"type":51,"value":551}," false\n",{"type":45,"tag":84,"props":553,"children":555},{"class":86,"line":554},10,[556],{"type":45,"tag":84,"props":557,"children":558},{"style":132},[559],{"type":51,"value":560},"  },\n",{"type":45,"tag":84,"props":562,"children":564},{"class":86,"line":563},11,[565,569,574,578,582],{"type":45,"tag":84,"props":566,"children":567},{"style":132},[568],{"type":51,"value":286},{"type":45,"tag":84,"props":570,"children":571},{"style":289},[572],{"type":51,"value":573},"iocs_stix_2_1",{"type":45,"tag":84,"props":575,"children":576},{"style":132},[577],{"type":51,"value":145},{"type":45,"tag":84,"props":579,"children":580},{"style":132},[581],{"type":51,"value":301},{"type":45,"tag":84,"props":583,"children":584},{"style":132},[585],{"type":51,"value":373},{"type":45,"tag":84,"props":587,"children":589},{"class":86,"line":588},12,[590,594,599,603,607,611,616,620],{"type":45,"tag":84,"props":591,"children":592},{"style":132},[593],{"type":51,"value":381},{"type":45,"tag":84,"props":595,"children":596},{"style":90},[597],{"type":51,"value":598},"type",{"type":45,"tag":84,"props":600,"children":601},{"style":132},[602],{"type":51,"value":145},{"type":45,"tag":84,"props":604,"children":605},{"style":132},[606],{"type":51,"value":301},{"type":45,"tag":84,"props":608,"children":609},{"style":132},[610],{"type":51,"value":135},{"type":45,"tag":84,"props":612,"children":613},{"style":96},[614],{"type":51,"value":615},"bundle",{"type":45,"tag":84,"props":617,"children":618},{"style":132},[619],{"type":51,"value":145},{"type":45,"tag":84,"props":621,"children":622},{"style":132},[623],{"type":51,"value":312},{"type":45,"tag":84,"props":625,"children":627},{"class":86,"line":626},13,[628,632,637,641,645,649,654,658],{"type":45,"tag":84,"props":629,"children":630},{"style":132},[631],{"type":51,"value":381},{"type":45,"tag":84,"props":633,"children":634},{"style":90},[635],{"type":51,"value":636},"id",{"type":45,"tag":84,"props":638,"children":639},{"style":132},[640],{"type":51,"value":145},{"type":45,"tag":84,"props":642,"children":643},{"style":132},[644],{"type":51,"value":301},{"type":45,"tag":84,"props":646,"children":647},{"style":132},[648],{"type":51,"value":135},{"type":45,"tag":84,"props":650,"children":651},{"style":96},[652],{"type":51,"value":653},"bundle--\u003Cuuid>",{"type":45,"tag":84,"props":655,"children":656},{"style":132},[657],{"type":51,"value":145},{"type":45,"tag":84,"props":659,"children":660},{"style":132},[661],{"type":51,"value":312},{"type":45,"tag":84,"props":663,"children":665},{"class":86,"line":664},14,[666,670,675,679,683],{"type":45,"tag":84,"props":667,"children":668},{"style":132},[669],{"type":51,"value":381},{"type":45,"tag":84,"props":671,"children":672},{"style":90},[673],{"type":51,"value":674},"objects",{"type":45,"tag":84,"props":676,"children":677},{"style":132},[678],{"type":51,"value":145},{"type":45,"tag":84,"props":680,"children":681},{"style":132},[682],{"type":51,"value":301},{"type":45,"tag":84,"props":684,"children":685},{"style":132},[686],{"type":51,"value":687}," [\n",{"type":45,"tag":84,"props":689,"children":691},{"class":86,"line":690},15,[692,697,701,705,709,713,717,722,726,731,735,740,744,748,753,757,763,767,771,775,780,784,789,793,798,802,806,810,814,818],{"type":45,"tag":84,"props":693,"children":694},{"style":132},[695],{"type":51,"value":696},"      {",{"type":45,"tag":84,"props":698,"children":699},{"style":132},[700],{"type":51,"value":145},{"type":45,"tag":84,"props":702,"children":703},{"style":304},[704],{"type":51,"value":598},{"type":45,"tag":84,"props":706,"children":707},{"style":132},[708],{"type":51,"value":145},{"type":45,"tag":84,"props":710,"children":711},{"style":132},[712],{"type":51,"value":301},{"type":45,"tag":84,"props":714,"children":715},{"style":132},[716],{"type":51,"value":135},{"type":45,"tag":84,"props":718,"children":719},{"style":96},[720],{"type":51,"value":721},"file",{"type":45,"tag":84,"props":723,"children":724},{"style":132},[725],{"type":51,"value":145},{"type":45,"tag":84,"props":727,"children":728},{"style":132},[729],{"type":51,"value":730},",",{"type":45,"tag":84,"props":732,"children":733},{"style":132},[734],{"type":51,"value":135},{"type":45,"tag":84,"props":736,"children":737},{"style":304},[738],{"type":51,"value":739},"hashes",{"type":45,"tag":84,"props":741,"children":742},{"style":132},[743],{"type":51,"value":145},{"type":45,"tag":84,"props":745,"children":746},{"style":132},[747],{"type":51,"value":301},{"type":45,"tag":84,"props":749,"children":750},{"style":132},[751],{"type":51,"value":752}," {",{"type":45,"tag":84,"props":754,"children":755},{"style":132},[756],{"type":51,"value":145},{"type":45,"tag":84,"props":758,"children":760},{"style":759},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[761],{"type":51,"value":762},"SHA-256",{"type":45,"tag":84,"props":764,"children":765},{"style":132},[766],{"type":51,"value":145},{"type":45,"tag":84,"props":768,"children":769},{"style":132},[770],{"type":51,"value":301},{"type":45,"tag":84,"props":772,"children":773},{"style":132},[774],{"type":51,"value":135},{"type":45,"tag":84,"props":776,"children":777},{"style":96},[778],{"type":51,"value":779},"...",{"type":45,"tag":84,"props":781,"children":782},{"style":132},[783],{"type":51,"value":145},{"type":45,"tag":84,"props":785,"children":786},{"style":132},[787],{"type":51,"value":788},"},",{"type":45,"tag":84,"props":790,"children":791},{"style":132},[792],{"type":51,"value":135},{"type":45,"tag":84,"props":794,"children":795},{"style":304},[796],{"type":51,"value":797},"name",{"type":45,"tag":84,"props":799,"children":800},{"style":132},[801],{"type":51,"value":145},{"type":45,"tag":84,"props":803,"children":804},{"style":132},[805],{"type":51,"value":301},{"type":45,"tag":84,"props":807,"children":808},{"style":132},[809],{"type":51,"value":135},{"type":45,"tag":84,"props":811,"children":812},{"style":96},[813],{"type":51,"value":779},{"type":45,"tag":84,"props":815,"children":816},{"style":132},[817],{"type":51,"value":145},{"type":45,"tag":84,"props":819,"children":820},{"style":132},[821],{"type":51,"value":822},"},\n",{"type":45,"tag":84,"props":824,"children":826},{"class":86,"line":825},16,[827,831,835,839,843,847,851,856,860,864,868,873,877,881,885,890,894],{"type":45,"tag":84,"props":828,"children":829},{"style":132},[830],{"type":51,"value":696},{"type":45,"tag":84,"props":832,"children":833},{"style":132},[834],{"type":51,"value":145},{"type":45,"tag":84,"props":836,"children":837},{"style":304},[838],{"type":51,"value":598},{"type":45,"tag":84,"props":840,"children":841},{"style":132},[842],{"type":51,"value":145},{"type":45,"tag":84,"props":844,"children":845},{"style":132},[846],{"type":51,"value":301},{"type":45,"tag":84,"props":848,"children":849},{"style":132},[850],{"type":51,"value":135},{"type":45,"tag":84,"props":852,"children":853},{"style":96},[854],{"type":51,"value":855},"ipv4-addr",{"type":45,"tag":84,"props":857,"children":858},{"style":132},[859],{"type":51,"value":145},{"type":45,"tag":84,"props":861,"children":862},{"style":132},[863],{"type":51,"value":730},{"type":45,"tag":84,"props":865,"children":866},{"style":132},[867],{"type":51,"value":135},{"type":45,"tag":84,"props":869,"children":870},{"style":304},[871],{"type":51,"value":872},"value",{"type":45,"tag":84,"props":874,"children":875},{"style":132},[876],{"type":51,"value":145},{"type":45,"tag":84,"props":878,"children":879},{"style":132},[880],{"type":51,"value":301},{"type":45,"tag":84,"props":882,"children":883},{"style":132},[884],{"type":51,"value":135},{"type":45,"tag":84,"props":886,"children":887},{"style":96},[888],{"type":51,"value":889},"1.2.3.4",{"type":45,"tag":84,"props":891,"children":892},{"style":132},[893],{"type":51,"value":145},{"type":45,"tag":84,"props":895,"children":896},{"style":132},[897],{"type":51,"value":822},{"type":45,"tag":84,"props":899,"children":901},{"class":86,"line":900},17,[902,906,910,914,918,922,926,931,935,939,943,947,951,955,959,964,968],{"type":45,"tag":84,"props":903,"children":904},{"style":132},[905],{"type":51,"value":696},{"type":45,"tag":84,"props":907,"children":908},{"style":132},[909],{"type":51,"value":145},{"type":45,"tag":84,"props":911,"children":912},{"style":304},[913],{"type":51,"value":598},{"type":45,"tag":84,"props":915,"children":916},{"style":132},[917],{"type":51,"value":145},{"type":45,"tag":84,"props":919,"children":920},{"style":132},[921],{"type":51,"value":301},{"type":45,"tag":84,"props":923,"children":924},{"style":132},[925],{"type":51,"value":135},{"type":45,"tag":84,"props":927,"children":928},{"style":96},[929],{"type":51,"value":930},"domain-name",{"type":45,"tag":84,"props":932,"children":933},{"style":132},[934],{"type":51,"value":145},{"type":45,"tag":84,"props":936,"children":937},{"style":132},[938],{"type":51,"value":730},{"type":45,"tag":84,"props":940,"children":941},{"style":132},[942],{"type":51,"value":135},{"type":45,"tag":84,"props":944,"children":945},{"style":304},[946],{"type":51,"value":872},{"type":45,"tag":84,"props":948,"children":949},{"style":132},[950],{"type":51,"value":145},{"type":45,"tag":84,"props":952,"children":953},{"style":132},[954],{"type":51,"value":301},{"type":45,"tag":84,"props":956,"children":957},{"style":132},[958],{"type":51,"value":135},{"type":45,"tag":84,"props":960,"children":961},{"style":96},[962],{"type":51,"value":963},"evil.example",{"type":45,"tag":84,"props":965,"children":966},{"style":132},[967],{"type":51,"value":145},{"type":45,"tag":84,"props":969,"children":970},{"style":132},[971],{"type":51,"value":822},{"type":45,"tag":84,"props":973,"children":975},{"class":86,"line":974},18,[976,980,984,988,992,996,1000,1005,1009,1013,1017,1022,1026,1030,1034,1039,1043,1047,1051,1056,1060,1064,1068,1072,1076],{"type":45,"tag":84,"props":977,"children":978},{"style":132},[979],{"type":51,"value":696},{"type":45,"tag":84,"props":981,"children":982},{"style":132},[983],{"type":51,"value":145},{"type":45,"tag":84,"props":985,"children":986},{"style":304},[987],{"type":51,"value":598},{"type":45,"tag":84,"props":989,"children":990},{"style":132},[991],{"type":51,"value":145},{"type":45,"tag":84,"props":993,"children":994},{"style":132},[995],{"type":51,"value":301},{"type":45,"tag":84,"props":997,"children":998},{"style":132},[999],{"type":51,"value":135},{"type":45,"tag":84,"props":1001,"children":1002},{"style":96},[1003],{"type":51,"value":1004},"indicator",{"type":45,"tag":84,"props":1006,"children":1007},{"style":132},[1008],{"type":51,"value":145},{"type":45,"tag":84,"props":1010,"children":1011},{"style":132},[1012],{"type":51,"value":730},{"type":45,"tag":84,"props":1014,"children":1015},{"style":132},[1016],{"type":51,"value":135},{"type":45,"tag":84,"props":1018,"children":1019},{"style":304},[1020],{"type":51,"value":1021},"pattern",{"type":45,"tag":84,"props":1023,"children":1024},{"style":132},[1025],{"type":51,"value":145},{"type":45,"tag":84,"props":1027,"children":1028},{"style":132},[1029],{"type":51,"value":301},{"type":45,"tag":84,"props":1031,"children":1032},{"style":132},[1033],{"type":51,"value":135},{"type":45,"tag":84,"props":1035,"children":1036},{"style":96},[1037],{"type":51,"value":1038},"[file:hashes.'SHA-256' = '...']",{"type":45,"tag":84,"props":1040,"children":1041},{"style":132},[1042],{"type":51,"value":145},{"type":45,"tag":84,"props":1044,"children":1045},{"style":132},[1046],{"type":51,"value":730},{"type":45,"tag":84,"props":1048,"children":1049},{"style":132},[1050],{"type":51,"value":135},{"type":45,"tag":84,"props":1052,"children":1053},{"style":304},[1054],{"type":51,"value":1055},"valid_from",{"type":45,"tag":84,"props":1057,"children":1058},{"style":132},[1059],{"type":51,"value":145},{"type":45,"tag":84,"props":1061,"children":1062},{"style":132},[1063],{"type":51,"value":301},{"type":45,"tag":84,"props":1065,"children":1066},{"style":132},[1067],{"type":51,"value":135},{"type":45,"tag":84,"props":1069,"children":1070},{"style":96},[1071],{"type":51,"value":779},{"type":45,"tag":84,"props":1073,"children":1074},{"style":132},[1075],{"type":51,"value":145},{"type":45,"tag":84,"props":1077,"children":1078},{"style":132},[1079],{"type":51,"value":1080},"}\n",{"type":45,"tag":84,"props":1082,"children":1084},{"class":86,"line":1083},19,[1085],{"type":45,"tag":84,"props":1086,"children":1087},{"style":132},[1088],{"type":51,"value":1089},"    ]\n",{"type":45,"tag":84,"props":1091,"children":1093},{"class":86,"line":1092},20,[1094],{"type":45,"tag":84,"props":1095,"children":1096},{"style":132},[1097],{"type":51,"value":560},{"type":45,"tag":84,"props":1099,"children":1101},{"class":86,"line":1100},21,[1102,1106,1111,1115,1119,1123,1128,1133,1138,1142,1146,1150],{"type":45,"tag":84,"props":1103,"children":1104},{"style":132},[1105],{"type":51,"value":286},{"type":45,"tag":84,"props":1107,"children":1108},{"style":289},[1109],{"type":51,"value":1110},"iocs_csv",{"type":45,"tag":84,"props":1112,"children":1113},{"style":132},[1114],{"type":51,"value":145},{"type":45,"tag":84,"props":1116,"children":1117},{"style":132},[1118],{"type":51,"value":301},{"type":45,"tag":84,"props":1120,"children":1121},{"style":132},[1122],{"type":51,"value":135},{"type":45,"tag":84,"props":1124,"children":1125},{"style":96},[1126],{"type":51,"value":1127},"indicator_type,value,source,confidence,first_seen",{"type":45,"tag":84,"props":1129,"children":1130},{"style":117},[1131],{"type":51,"value":1132},"\\n",{"type":45,"tag":84,"props":1134,"children":1135},{"style":96},[1136],{"type":51,"value":1137},"hash-sha256,abc123,static,high,2026-04-29",{"type":45,"tag":84,"props":1139,"children":1140},{"style":117},[1141],{"type":51,"value":1132},{"type":45,"tag":84,"props":1143,"children":1144},{"style":96},[1145],{"type":51,"value":779},{"type":45,"tag":84,"props":1147,"children":1148},{"style":132},[1149],{"type":51,"value":145},{"type":45,"tag":84,"props":1151,"children":1152},{"style":132},[1153],{"type":51,"value":312},{"type":45,"tag":84,"props":1155,"children":1157},{"class":86,"line":1156},22,[1158,1162,1167,1171,1175],{"type":45,"tag":84,"props":1159,"children":1160},{"style":132},[1161],{"type":51,"value":286},{"type":45,"tag":84,"props":1163,"children":1164},{"style":289},[1165],{"type":51,"value":1166},"recommended_actions",{"type":45,"tag":84,"props":1168,"children":1169},{"style":132},[1170],{"type":51,"value":145},{"type":45,"tag":84,"props":1172,"children":1173},{"style":132},[1174],{"type":51,"value":301},{"type":45,"tag":84,"props":1176,"children":1177},{"style":132},[1178],{"type":51,"value":687},{"type":45,"tag":84,"props":1180,"children":1182},{"class":86,"line":1181},23,[1183,1188,1192,1197,1201,1205,1209,1214,1218,1222,1226,1231,1235,1239,1243,1248,1252,1256,1260,1265,1269,1273,1277,1282,1286],{"type":45,"tag":84,"props":1184,"children":1185},{"style":132},[1186],{"type":51,"value":1187},"    {",{"type":45,"tag":84,"props":1189,"children":1190},{"style":132},[1191],{"type":51,"value":145},{"type":45,"tag":84,"props":1193,"children":1194},{"style":90},[1195],{"type":51,"value":1196},"action",{"type":45,"tag":84,"props":1198,"children":1199},{"style":132},[1200],{"type":51,"value":145},{"type":45,"tag":84,"props":1202,"children":1203},{"style":132},[1204],{"type":51,"value":301},{"type":45,"tag":84,"props":1206,"children":1207},{"style":132},[1208],{"type":51,"value":135},{"type":45,"tag":84,"props":1210,"children":1211},{"style":96},[1212],{"type":51,"value":1213},"host_isolation",{"type":45,"tag":84,"props":1215,"children":1216},{"style":132},[1217],{"type":51,"value":145},{"type":45,"tag":84,"props":1219,"children":1220},{"style":132},[1221],{"type":51,"value":730},{"type":45,"tag":84,"props":1223,"children":1224},{"style":132},[1225],{"type":51,"value":135},{"type":45,"tag":84,"props":1227,"children":1228},{"style":90},[1229],{"type":51,"value":1230},"priority",{"type":45,"tag":84,"props":1232,"children":1233},{"style":132},[1234],{"type":51,"value":145},{"type":45,"tag":84,"props":1236,"children":1237},{"style":132},[1238],{"type":51,"value":301},{"type":45,"tag":84,"props":1240,"children":1241},{"style":132},[1242],{"type":51,"value":135},{"type":45,"tag":84,"props":1244,"children":1245},{"style":96},[1246],{"type":51,"value":1247},"immediate",{"type":45,"tag":84,"props":1249,"children":1250},{"style":132},[1251],{"type":51,"value":145},{"type":45,"tag":84,"props":1253,"children":1254},{"style":132},[1255],{"type":51,"value":730},{"type":45,"tag":84,"props":1257,"children":1258},{"style":132},[1259],{"type":51,"value":135},{"type":45,"tag":84,"props":1261,"children":1262},{"style":90},[1263],{"type":51,"value":1264},"scope",{"type":45,"tag":84,"props":1266,"children":1267},{"style":132},[1268],{"type":51,"value":145},{"type":45,"tag":84,"props":1270,"children":1271},{"style":132},[1272],{"type":51,"value":301},{"type":45,"tag":84,"props":1274,"children":1275},{"style":132},[1276],{"type":51,"value":135},{"type":45,"tag":84,"props":1278,"children":1279},{"style":96},[1280],{"type":51,"value":1281},"hosts with matching process-injection telemetry",{"type":45,"tag":84,"props":1283,"children":1284},{"style":132},[1285],{"type":51,"value":145},{"type":45,"tag":84,"props":1287,"children":1288},{"style":132},[1289],{"type":51,"value":822},{"type":45,"tag":84,"props":1291,"children":1293},{"class":86,"line":1292},24,[1294,1298,1302,1306,1310,1314,1318,1323,1327,1331,1335,1339,1343,1347,1351,1355,1359,1363,1367,1371,1375,1379,1383,1388,1392],{"type":45,"tag":84,"props":1295,"children":1296},{"style":132},[1297],{"type":51,"value":1187},{"type":45,"tag":84,"props":1299,"children":1300},{"style":132},[1301],{"type":51,"value":145},{"type":45,"tag":84,"props":1303,"children":1304},{"style":90},[1305],{"type":51,"value":1196},{"type":45,"tag":84,"props":1307,"children":1308},{"style":132},[1309],{"type":51,"value":145},{"type":45,"tag":84,"props":1311,"children":1312},{"style":132},[1313],{"type":51,"value":301},{"type":45,"tag":84,"props":1315,"children":1316},{"style":132},[1317],{"type":51,"value":135},{"type":45,"tag":84,"props":1319,"children":1320},{"style":96},[1321],{"type":51,"value":1322},"token_revocation",{"type":45,"tag":84,"props":1324,"children":1325},{"style":132},[1326],{"type":51,"value":145},{"type":45,"tag":84,"props":1328,"children":1329},{"style":132},[1330],{"type":51,"value":730},{"type":45,"tag":84,"props":1332,"children":1333},{"style":132},[1334],{"type":51,"value":135},{"type":45,"tag":84,"props":1336,"children":1337},{"style":90},[1338],{"type":51,"value":1230},{"type":45,"tag":84,"props":1340,"children":1341},{"style":132},[1342],{"type":51,"value":145},{"type":45,"tag":84,"props":1344,"children":1345},{"style":132},[1346],{"type":51,"value":301},{"type":45,"tag":84,"props":1348,"children":1349},{"style":132},[1350],{"type":51,"value":135},{"type":45,"tag":84,"props":1352,"children":1353},{"style":96},[1354],{"type":51,"value":1247},{"type":45,"tag":84,"props":1356,"children":1357},{"style":132},[1358],{"type":51,"value":145},{"type":45,"tag":84,"props":1360,"children":1361},{"style":132},[1362],{"type":51,"value":730},{"type":45,"tag":84,"props":1364,"children":1365},{"style":132},[1366],{"type":51,"value":135},{"type":45,"tag":84,"props":1368,"children":1369},{"style":90},[1370],{"type":51,"value":1264},{"type":45,"tag":84,"props":1372,"children":1373},{"style":132},[1374],{"type":51,"value":145},{"type":45,"tag":84,"props":1376,"children":1377},{"style":132},[1378],{"type":51,"value":301},{"type":45,"tag":84,"props":1380,"children":1381},{"style":132},[1382],{"type":51,"value":135},{"type":45,"tag":84,"props":1384,"children":1385},{"style":96},[1386],{"type":51,"value":1387},"credentials accessed by injected explorer.exe",{"type":45,"tag":84,"props":1389,"children":1390},{"style":132},[1391],{"type":51,"value":145},{"type":45,"tag":84,"props":1393,"children":1394},{"style":132},[1395],{"type":51,"value":822},{"type":45,"tag":84,"props":1397,"children":1399},{"class":86,"line":1398},25,[1400,1404,1408,1412,1416,1420,1424,1429,1433,1437,1441,1445,1449,1453,1457,1462,1466,1470,1474,1479,1483,1487,1492,1496,1500,1504,1508,1512,1516,1520],{"type":45,"tag":84,"props":1401,"children":1402},{"style":132},[1403],{"type":51,"value":1187},{"type":45,"tag":84,"props":1405,"children":1406},{"style":132},[1407],{"type":51,"value":145},{"type":45,"tag":84,"props":1409,"children":1410},{"style":90},[1411],{"type":51,"value":1196},{"type":45,"tag":84,"props":1413,"children":1414},{"style":132},[1415],{"type":51,"value":145},{"type":45,"tag":84,"props":1417,"children":1418},{"style":132},[1419],{"type":51,"value":301},{"type":45,"tag":84,"props":1421,"children":1422},{"style":132},[1423],{"type":51,"value":135},{"type":45,"tag":84,"props":1425,"children":1426},{"style":96},[1427],{"type":51,"value":1428},"perimeter_block",{"type":45,"tag":84,"props":1430,"children":1431},{"style":132},[1432],{"type":51,"value":145},{"type":45,"tag":84,"props":1434,"children":1435},{"style":132},[1436],{"type":51,"value":730},{"type":45,"tag":84,"props":1438,"children":1439},{"style":132},[1440],{"type":51,"value":135},{"type":45,"tag":84,"props":1442,"children":1443},{"style":90},[1444],{"type":51,"value":1230},{"type":45,"tag":84,"props":1446,"children":1447},{"style":132},[1448],{"type":51,"value":145},{"type":45,"tag":84,"props":1450,"children":1451},{"style":132},[1452],{"type":51,"value":301},{"type":45,"tag":84,"props":1454,"children":1455},{"style":132},[1456],{"type":51,"value":135},{"type":45,"tag":84,"props":1458,"children":1459},{"style":96},[1460],{"type":51,"value":1461},"high",{"type":45,"tag":84,"props":1463,"children":1464},{"style":132},[1465],{"type":51,"value":145},{"type":45,"tag":84,"props":1467,"children":1468},{"style":132},[1469],{"type":51,"value":730},{"type":45,"tag":84,"props":1471,"children":1472},{"style":132},[1473],{"type":51,"value":135},{"type":45,"tag":84,"props":1475,"children":1476},{"style":90},[1477],{"type":51,"value":1478},"iocs",{"type":45,"tag":84,"props":1480,"children":1481},{"style":132},[1482],{"type":51,"value":145},{"type":45,"tag":84,"props":1484,"children":1485},{"style":132},[1486],{"type":51,"value":301},{"type":45,"tag":84,"props":1488,"children":1489},{"style":132},[1490],{"type":51,"value":1491}," [",{"type":45,"tag":84,"props":1493,"children":1494},{"style":132},[1495],{"type":51,"value":145},{"type":45,"tag":84,"props":1497,"children":1498},{"style":96},[1499],{"type":51,"value":889},{"type":45,"tag":84,"props":1501,"children":1502},{"style":132},[1503],{"type":51,"value":145},{"type":45,"tag":84,"props":1505,"children":1506},{"style":132},[1507],{"type":51,"value":730},{"type":45,"tag":84,"props":1509,"children":1510},{"style":132},[1511],{"type":51,"value":135},{"type":45,"tag":84,"props":1513,"children":1514},{"style":96},[1515],{"type":51,"value":963},{"type":45,"tag":84,"props":1517,"children":1518},{"style":132},[1519],{"type":51,"value":145},{"type":45,"tag":84,"props":1521,"children":1522},{"style":132},[1523],{"type":51,"value":1524},"]},\n",{"type":45,"tag":84,"props":1526,"children":1528},{"class":86,"line":1527},26,[1529,1533,1537,1541,1545,1549,1553,1558,1562,1566,1570,1574,1578,1582,1586,1590,1594,1598,1602,1607,1611,1615,1619,1624,1628],{"type":45,"tag":84,"props":1530,"children":1531},{"style":132},[1532],{"type":51,"value":1187},{"type":45,"tag":84,"props":1534,"children":1535},{"style":132},[1536],{"type":51,"value":145},{"type":45,"tag":84,"props":1538,"children":1539},{"style":90},[1540],{"type":51,"value":1196},{"type":45,"tag":84,"props":1542,"children":1543},{"style":132},[1544],{"type":51,"value":145},{"type":45,"tag":84,"props":1546,"children":1547},{"style":132},[1548],{"type":51,"value":301},{"type":45,"tag":84,"props":1550,"children":1551},{"style":132},[1552],{"type":51,"value":135},{"type":45,"tag":84,"props":1554,"children":1555},{"style":96},[1556],{"type":51,"value":1557},"fleet_hunt",{"type":45,"tag":84,"props":1559,"children":1560},{"style":132},[1561],{"type":51,"value":145},{"type":45,"tag":84,"props":1563,"children":1564},{"style":132},[1565],{"type":51,"value":730},{"type":45,"tag":84,"props":1567,"children":1568},{"style":132},[1569],{"type":51,"value":135},{"type":45,"tag":84,"props":1571,"children":1572},{"style":90},[1573],{"type":51,"value":1230},{"type":45,"tag":84,"props":1575,"children":1576},{"style":132},[1577],{"type":51,"value":145},{"type":45,"tag":84,"props":1579,"children":1580},{"style":132},[1581],{"type":51,"value":301},{"type":45,"tag":84,"props":1583,"children":1584},{"style":132},[1585],{"type":51,"value":135},{"type":45,"tag":84,"props":1587,"children":1588},{"style":96},[1589],{"type":51,"value":1461},{"type":45,"tag":84,"props":1591,"children":1592},{"style":132},[1593],{"type":51,"value":145},{"type":45,"tag":84,"props":1595,"children":1596},{"style":132},[1597],{"type":51,"value":730},{"type":45,"tag":84,"props":1599,"children":1600},{"style":132},[1601],{"type":51,"value":135},{"type":45,"tag":84,"props":1603,"children":1604},{"style":90},[1605],{"type":51,"value":1606},"query",{"type":45,"tag":84,"props":1608,"children":1609},{"style":132},[1610],{"type":51,"value":145},{"type":45,"tag":84,"props":1612,"children":1613},{"style":132},[1614],{"type":51,"value":301},{"type":45,"tag":84,"props":1616,"children":1617},{"style":132},[1618],{"type":51,"value":135},{"type":45,"tag":84,"props":1620,"children":1621},{"style":96},[1622],{"type":51,"value":1623},"hash:\u003Csha256> OR mutex:\u003Cmutex>",{"type":45,"tag":84,"props":1625,"children":1626},{"style":132},[1627],{"type":51,"value":145},{"type":45,"tag":84,"props":1629,"children":1630},{"style":132},[1631],{"type":51,"value":1080},{"type":45,"tag":84,"props":1633,"children":1635},{"class":86,"line":1634},27,[1636],{"type":45,"tag":84,"props":1637,"children":1638},{"style":132},[1639],{"type":51,"value":1640},"  ]\n",{"type":45,"tag":84,"props":1642,"children":1644},{"class":86,"line":1643},28,[1645],{"type":45,"tag":84,"props":1646,"children":1647},{"style":132},[1648],{"type":51,"value":1080},{"type":45,"tag":60,"props":1650,"children":1652},{"id":1651},"steps",[1653],{"type":51,"value":1654},"Steps",{"type":45,"tag":1656,"props":1657,"children":1659},"h3",{"id":1658},"_1-determine-severity",[1660],{"type":51,"value":1661},"1. Determine severity",{"type":45,"tag":54,"props":1663,"children":1664},{},[1665],{"type":51,"value":1666},"Simple rule engine:",{"type":45,"tag":1668,"props":1669,"children":1670},"ul",{},[1671,1683,1693],{"type":45,"tag":1672,"props":1673,"children":1674},"li",{},[1675,1681],{"type":45,"tag":1676,"props":1677,"children":1678},"strong",{},[1679],{"type":51,"value":1680},"benign",{"type":51,"value":1682}," — Stage 2 short-circuit, OR Stage 3 all-clean + Stage 4 all-clean + signed Microsoft binary",{"type":45,"tag":1672,"props":1684,"children":1685},{},[1686,1691],{"type":45,"tag":1676,"props":1687,"children":1688},{},[1689],{"type":51,"value":1690},"malicious",{"type":51,"value":1692}," — Any of: ≥3 VT hits + family identified (Stage 2), YARA family rule hit (Stage 3), observed C2 callback to known-bad IP (Stage 4\u002F5), ≥2 MITRE TTPs confirmed (Stage 5)",{"type":45,"tag":1672,"props":1694,"children":1695},{},[1696,1701],{"type":45,"tag":1676,"props":1697,"children":1698},{},[1699],{"type":51,"value":1700},"suspicious",{"type":51,"value":1702}," — In between: high entropy + no signature + ≥1 IOC match, but no strong malicious signal",{"type":45,"tag":1656,"props":1704,"children":1706},{"id":1705},"_2-determine-confidence",[1707],{"type":51,"value":1708},"2. Determine confidence",{"type":45,"tag":1668,"props":1710,"children":1711},{},[1712,1721,1731],{"type":45,"tag":1672,"props":1713,"children":1714},{},[1715,1719],{"type":45,"tag":1676,"props":1716,"children":1717},{},[1718],{"type":51,"value":1461},{"type":51,"value":1720}," — severity = malicious AND ≥3 independent signals corroborate (e.g. VT + YARA + MITRE + MISP)",{"type":45,"tag":1672,"props":1722,"children":1723},{},[1724,1729],{"type":45,"tag":1676,"props":1725,"children":1726},{},[1727],{"type":51,"value":1728},"medium",{"type":51,"value":1730}," — 2 corroborating signals, OR family identified but no campaign attribution",{"type":45,"tag":1672,"props":1732,"children":1733},{},[1734,1739],{"type":45,"tag":1676,"props":1735,"children":1736},{},[1737],{"type":51,"value":1738},"low",{"type":51,"value":1740}," — 1 signal only, OR severity = suspicious, OR Stage 4 was skipped\u002Ffailed",{"type":45,"tag":1656,"props":1742,"children":1744},{"id":1743},"_3-build-stix-21-bundle",[1745],{"type":51,"value":1746},"3. Build STIX 2.1 bundle",{"type":45,"tag":54,"props":1748,"children":1749},{},[1750],{"type":51,"value":1751},"One Python one-liner or short script to emit a valid STIX bundle:",{"type":45,"tag":72,"props":1753,"children":1757},{"className":1754,"code":1755,"language":1756,"meta":77,"style":77},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import json, uuid\nfrom datetime import datetime\n\nbundle = {\n    \"type\": \"bundle\",\n    \"id\": f\"bundle--{uuid.uuid4()}\",\n    \"objects\": []\n}\n\n# File observable\nbundle[\"objects\"].append({\n    \"type\": \"file\",\n    \"id\": f\"file--{uuid.uuid4()}\",\n    \"hashes\": {\"SHA-256\": sha256, \"SHA-1\": sha1, \"MD5\": md5}\n})\n\n# IP observables\nfor ip in c2_ips:\n    bundle[\"objects\"].append({\n        \"type\": \"ipv4-addr\",\n        \"id\": f\"ipv4-addr--{uuid.uuid4()}\",\n        \"value\": ip\n    })\n\n# Indicators (STIX indicators, pattern-based)\nbundle[\"objects\"].append({\n    \"type\": \"indicator\",\n    \"id\": f\"indicator--{uuid.uuid4()}\",\n    \"pattern\": f\"[file:hashes.'SHA-256' = '{sha256}']\",\n    \"pattern_type\": \"stix\",\n    \"valid_from\": datetime.utcnow().isoformat() + \"Z\"\n})\n\nprint(json.dumps(bundle, indent=2))\n","python",[1758],{"type":45,"tag":80,"props":1759,"children":1760},{"__ignoreMap":77},[1761,1769,1777,1786,1794,1802,1810,1818,1825,1832,1840,1848,1856,1864,1872,1880,1887,1895,1903,1911,1919,1927,1935,1943,1950,1958,1965,1973,1981,1990,1999,2008,2016,2024],{"type":45,"tag":84,"props":1762,"children":1763},{"class":86,"line":29},[1764],{"type":45,"tag":84,"props":1765,"children":1766},{},[1767],{"type":51,"value":1768},"import json, uuid\n",{"type":45,"tag":84,"props":1770,"children":1771},{"class":86,"line":123},[1772],{"type":45,"tag":84,"props":1773,"children":1774},{},[1775],{"type":51,"value":1776},"from datetime import datetime\n",{"type":45,"tag":84,"props":1778,"children":1779},{"class":86,"line":152},[1780],{"type":45,"tag":84,"props":1781,"children":1783},{"emptyLinePlaceholder":1782},true,[1784],{"type":51,"value":1785},"\n",{"type":45,"tag":84,"props":1787,"children":1788},{"class":86,"line":178},[1789],{"type":45,"tag":84,"props":1790,"children":1791},{},[1792],{"type":51,"value":1793},"bundle = {\n",{"type":45,"tag":84,"props":1795,"children":1796},{"class":86,"line":226},[1797],{"type":45,"tag":84,"props":1798,"children":1799},{},[1800],{"type":51,"value":1801},"    \"type\": \"bundle\",\n",{"type":45,"tag":84,"props":1803,"children":1804},{"class":86,"line":414},[1805],{"type":45,"tag":84,"props":1806,"children":1807},{},[1808],{"type":51,"value":1809},"    \"id\": f\"bundle--{uuid.uuid4()}\",\n",{"type":45,"tag":84,"props":1811,"children":1812},{"class":86,"line":452},[1813],{"type":45,"tag":84,"props":1814,"children":1815},{},[1816],{"type":51,"value":1817},"    \"objects\": []\n",{"type":45,"tag":84,"props":1819,"children":1820},{"class":86,"line":490},[1821],{"type":45,"tag":84,"props":1822,"children":1823},{},[1824],{"type":51,"value":1080},{"type":45,"tag":84,"props":1826,"children":1827},{"class":86,"line":528},[1828],{"type":45,"tag":84,"props":1829,"children":1830},{"emptyLinePlaceholder":1782},[1831],{"type":51,"value":1785},{"type":45,"tag":84,"props":1833,"children":1834},{"class":86,"line":554},[1835],{"type":45,"tag":84,"props":1836,"children":1837},{},[1838],{"type":51,"value":1839},"# File observable\n",{"type":45,"tag":84,"props":1841,"children":1842},{"class":86,"line":563},[1843],{"type":45,"tag":84,"props":1844,"children":1845},{},[1846],{"type":51,"value":1847},"bundle[\"objects\"].append({\n",{"type":45,"tag":84,"props":1849,"children":1850},{"class":86,"line":588},[1851],{"type":45,"tag":84,"props":1852,"children":1853},{},[1854],{"type":51,"value":1855},"    \"type\": \"file\",\n",{"type":45,"tag":84,"props":1857,"children":1858},{"class":86,"line":626},[1859],{"type":45,"tag":84,"props":1860,"children":1861},{},[1862],{"type":51,"value":1863},"    \"id\": f\"file--{uuid.uuid4()}\",\n",{"type":45,"tag":84,"props":1865,"children":1866},{"class":86,"line":664},[1867],{"type":45,"tag":84,"props":1868,"children":1869},{},[1870],{"type":51,"value":1871},"    \"hashes\": {\"SHA-256\": sha256, \"SHA-1\": sha1, \"MD5\": md5}\n",{"type":45,"tag":84,"props":1873,"children":1874},{"class":86,"line":690},[1875],{"type":45,"tag":84,"props":1876,"children":1877},{},[1878],{"type":51,"value":1879},"})\n",{"type":45,"tag":84,"props":1881,"children":1882},{"class":86,"line":825},[1883],{"type":45,"tag":84,"props":1884,"children":1885},{"emptyLinePlaceholder":1782},[1886],{"type":51,"value":1785},{"type":45,"tag":84,"props":1888,"children":1889},{"class":86,"line":900},[1890],{"type":45,"tag":84,"props":1891,"children":1892},{},[1893],{"type":51,"value":1894},"# IP observables\n",{"type":45,"tag":84,"props":1896,"children":1897},{"class":86,"line":974},[1898],{"type":45,"tag":84,"props":1899,"children":1900},{},[1901],{"type":51,"value":1902},"for ip in c2_ips:\n",{"type":45,"tag":84,"props":1904,"children":1905},{"class":86,"line":1083},[1906],{"type":45,"tag":84,"props":1907,"children":1908},{},[1909],{"type":51,"value":1910},"    bundle[\"objects\"].append({\n",{"type":45,"tag":84,"props":1912,"children":1913},{"class":86,"line":1092},[1914],{"type":45,"tag":84,"props":1915,"children":1916},{},[1917],{"type":51,"value":1918},"        \"type\": \"ipv4-addr\",\n",{"type":45,"tag":84,"props":1920,"children":1921},{"class":86,"line":1100},[1922],{"type":45,"tag":84,"props":1923,"children":1924},{},[1925],{"type":51,"value":1926},"        \"id\": f\"ipv4-addr--{uuid.uuid4()}\",\n",{"type":45,"tag":84,"props":1928,"children":1929},{"class":86,"line":1156},[1930],{"type":45,"tag":84,"props":1931,"children":1932},{},[1933],{"type":51,"value":1934},"        \"value\": ip\n",{"type":45,"tag":84,"props":1936,"children":1937},{"class":86,"line":1181},[1938],{"type":45,"tag":84,"props":1939,"children":1940},{},[1941],{"type":51,"value":1942},"    })\n",{"type":45,"tag":84,"props":1944,"children":1945},{"class":86,"line":1292},[1946],{"type":45,"tag":84,"props":1947,"children":1948},{"emptyLinePlaceholder":1782},[1949],{"type":51,"value":1785},{"type":45,"tag":84,"props":1951,"children":1952},{"class":86,"line":1398},[1953],{"type":45,"tag":84,"props":1954,"children":1955},{},[1956],{"type":51,"value":1957},"# Indicators (STIX indicators, pattern-based)\n",{"type":45,"tag":84,"props":1959,"children":1960},{"class":86,"line":1527},[1961],{"type":45,"tag":84,"props":1962,"children":1963},{},[1964],{"type":51,"value":1847},{"type":45,"tag":84,"props":1966,"children":1967},{"class":86,"line":1634},[1968],{"type":45,"tag":84,"props":1969,"children":1970},{},[1971],{"type":51,"value":1972},"    \"type\": \"indicator\",\n",{"type":45,"tag":84,"props":1974,"children":1975},{"class":86,"line":1643},[1976],{"type":45,"tag":84,"props":1977,"children":1978},{},[1979],{"type":51,"value":1980},"    \"id\": f\"indicator--{uuid.uuid4()}\",\n",{"type":45,"tag":84,"props":1982,"children":1984},{"class":86,"line":1983},29,[1985],{"type":45,"tag":84,"props":1986,"children":1987},{},[1988],{"type":51,"value":1989},"    \"pattern\": f\"[file:hashes.'SHA-256' = '{sha256}']\",\n",{"type":45,"tag":84,"props":1991,"children":1993},{"class":86,"line":1992},30,[1994],{"type":45,"tag":84,"props":1995,"children":1996},{},[1997],{"type":51,"value":1998},"    \"pattern_type\": \"stix\",\n",{"type":45,"tag":84,"props":2000,"children":2002},{"class":86,"line":2001},31,[2003],{"type":45,"tag":84,"props":2004,"children":2005},{},[2006],{"type":51,"value":2007},"    \"valid_from\": datetime.utcnow().isoformat() + \"Z\"\n",{"type":45,"tag":84,"props":2009,"children":2011},{"class":86,"line":2010},32,[2012],{"type":45,"tag":84,"props":2013,"children":2014},{},[2015],{"type":51,"value":1879},{"type":45,"tag":84,"props":2017,"children":2019},{"class":86,"line":2018},33,[2020],{"type":45,"tag":84,"props":2021,"children":2022},{"emptyLinePlaceholder":1782},[2023],{"type":51,"value":1785},{"type":45,"tag":84,"props":2025,"children":2027},{"class":86,"line":2026},34,[2028],{"type":45,"tag":84,"props":2029,"children":2030},{},[2031],{"type":51,"value":2032},"print(json.dumps(bundle, indent=2))\n",{"type":45,"tag":1656,"props":2034,"children":2036},{"id":2035},"_4-build-csv",[2037],{"type":51,"value":2038},"4. Build CSV",{"type":45,"tag":72,"props":2040,"children":2044},{"className":2041,"code":2042,"language":2043,"meta":77,"style":77},"language-csv shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","indicator_type,value,source,confidence,first_seen,notes\nhash-sha256,\u003Csha256>,triage,high,\u003Cdate>,\"Main sample\"\nhash-sha256,\u003Cdropped_hash>,dynamic,high,\u003Cdate>,\"Dropped payload\"\nipv4,\u003Cc2_ip>,dynamic+misp,high,\u003Cdate>,\"C2 callback + MISP feed\"\ndomain,\u003Cc2_domain>,static+dynamic,medium,\u003Cdate>,\"Seen in strings + DNS query\"\n","csv",[2045],{"type":45,"tag":80,"props":2046,"children":2047},{"__ignoreMap":77},[2048,2056,2064,2072,2080],{"type":45,"tag":84,"props":2049,"children":2050},{"class":86,"line":29},[2051],{"type":45,"tag":84,"props":2052,"children":2053},{},[2054],{"type":51,"value":2055},"indicator_type,value,source,confidence,first_seen,notes\n",{"type":45,"tag":84,"props":2057,"children":2058},{"class":86,"line":123},[2059],{"type":45,"tag":84,"props":2060,"children":2061},{},[2062],{"type":51,"value":2063},"hash-sha256,\u003Csha256>,triage,high,\u003Cdate>,\"Main sample\"\n",{"type":45,"tag":84,"props":2065,"children":2066},{"class":86,"line":152},[2067],{"type":45,"tag":84,"props":2068,"children":2069},{},[2070],{"type":51,"value":2071},"hash-sha256,\u003Cdropped_hash>,dynamic,high,\u003Cdate>,\"Dropped payload\"\n",{"type":45,"tag":84,"props":2073,"children":2074},{"class":86,"line":178},[2075],{"type":45,"tag":84,"props":2076,"children":2077},{},[2078],{"type":51,"value":2079},"ipv4,\u003Cc2_ip>,dynamic+misp,high,\u003Cdate>,\"C2 callback + MISP feed\"\n",{"type":45,"tag":84,"props":2081,"children":2082},{"class":86,"line":226},[2083],{"type":45,"tag":84,"props":2084,"children":2085},{},[2086],{"type":51,"value":2087},"domain,\u003Cc2_domain>,static+dynamic,medium,\u003Cdate>,\"Seen in strings + DNS query\"\n",{"type":45,"tag":1656,"props":2089,"children":2091},{"id":2090},"_5-generate-recommended-actions",[2092],{"type":51,"value":2093},"5. Generate recommended actions",{"type":45,"tag":54,"props":2095,"children":2096},{},[2097],{"type":51,"value":2098},"Tailor to severity:",{"type":45,"tag":1668,"props":2100,"children":2101},{},[2102,2111,2120],{"type":45,"tag":1672,"props":2103,"children":2104},{},[2105,2109],{"type":45,"tag":1676,"props":2106,"children":2107},{},[2108],{"type":51,"value":1680},{"type":51,"value":2110}," → no actions, short confirmation message",{"type":45,"tag":1672,"props":2112,"children":2113},{},[2114,2118],{"type":45,"tag":1676,"props":2115,"children":2116},{},[2117],{"type":51,"value":1700},{"type":51,"value":2119}," → 1 action: \"quarantine for further review\"",{"type":45,"tag":1672,"props":2121,"children":2122},{},[2123,2127],{"type":45,"tag":1676,"props":2124,"children":2125},{},[2126],{"type":51,"value":1690},{"type":51,"value":2128}," → full action set: isolate, revoke tokens, perimeter block, fleet hunt",{"type":45,"tag":1656,"props":2130,"children":2132},{"id":2131},"_6-write-envelope-publish-comment",[2133],{"type":51,"value":2134},"6. Write envelope + publish comment",{"type":45,"tag":54,"props":2136,"children":2137},{},[2138],{"type":51,"value":2139},"Comment format (lead with the verdict so on-call readers see it first):",{"type":45,"tag":72,"props":2141,"children":2145},{"className":2142,"code":2143,"language":2144,"meta":77,"style":77},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","## Stage 6 — Verdict\n\n# 🔴 MALICIOUS — high confidence\n\n**Family**: Qakbot v5.x\n**Reasoning**: Confirmed across 4 signals: VT (42\u002F73, family match), YARA (qakbot_v5 rule), dynamic C2 callback (1.2.3.4 matches MISP feed), MITRE T1055.002 + T1071.001 confirmed.\n\n### Immediate actions\n1. **Host isolation** — any host with process-injection telemetry matching `VirtualAllocEx→explorer.exe`\n2. **Token revocation** — credentials cached by explorer.exe on suspect hosts\n3. **Perimeter block** — `1.2.3.4`, `evil.example` (both directions)\n4. **Fleet hunt** — Splunk query in Stage 7 report\n\n\u003Cdetails>\u003Csummary>IOCs (STIX 2.1)\u003C\u002Fsummary>\n\n```json\n{STIX bundle...}\n","markdown",[2146],{"type":45,"tag":80,"props":2147,"children":2148},{"__ignoreMap":77},[2149,2162,2169,2182,2189,2213,2234,2241,2254,2296,2322,2382,2408,2415,2423,2430,2444],{"type":45,"tag":84,"props":2150,"children":2151},{"class":86,"line":29},[2152,2157],{"type":45,"tag":84,"props":2153,"children":2154},{"style":132},[2155],{"type":51,"value":2156},"## ",{"type":45,"tag":84,"props":2158,"children":2159},{"style":90},[2160],{"type":51,"value":2161},"Stage 6 — Verdict\n",{"type":45,"tag":84,"props":2163,"children":2164},{"class":86,"line":123},[2165],{"type":45,"tag":84,"props":2166,"children":2167},{"emptyLinePlaceholder":1782},[2168],{"type":51,"value":1785},{"type":45,"tag":84,"props":2170,"children":2171},{"class":86,"line":152},[2172,2177],{"type":45,"tag":84,"props":2173,"children":2174},{"style":132},[2175],{"type":51,"value":2176},"# ",{"type":45,"tag":84,"props":2178,"children":2179},{"style":90},[2180],{"type":51,"value":2181},"🔴 MALICIOUS — high confidence\n",{"type":45,"tag":84,"props":2183,"children":2184},{"class":86,"line":178},[2185],{"type":45,"tag":84,"props":2186,"children":2187},{"emptyLinePlaceholder":1782},[2188],{"type":51,"value":1785},{"type":45,"tag":84,"props":2190,"children":2191},{"class":86,"line":226},[2192,2198,2204,2208],{"type":45,"tag":84,"props":2193,"children":2195},{"style":2194},"--shiki-light:#39ADB5;--shiki-light-font-weight:bold;--shiki-default:#89DDFF;--shiki-default-font-weight:bold;--shiki-dark:#89DDFF;--shiki-dark-font-weight:bold",[2196],{"type":51,"value":2197},"**",{"type":45,"tag":84,"props":2199,"children":2201},{"style":2200},"--shiki-light:#E53935;--shiki-light-font-weight:bold;--shiki-default:#F07178;--shiki-default-font-weight:bold;--shiki-dark:#F07178;--shiki-dark-font-weight:bold",[2202],{"type":51,"value":2203},"Family",{"type":45,"tag":84,"props":2205,"children":2206},{"style":2194},[2207],{"type":51,"value":2197},{"type":45,"tag":84,"props":2209,"children":2210},{"style":117},[2211],{"type":51,"value":2212},": Qakbot v5.x\n",{"type":45,"tag":84,"props":2214,"children":2215},{"class":86,"line":414},[2216,2220,2225,2229],{"type":45,"tag":84,"props":2217,"children":2218},{"style":2194},[2219],{"type":51,"value":2197},{"type":45,"tag":84,"props":2221,"children":2222},{"style":2200},[2223],{"type":51,"value":2224},"Reasoning",{"type":45,"tag":84,"props":2226,"children":2227},{"style":2194},[2228],{"type":51,"value":2197},{"type":45,"tag":84,"props":2230,"children":2231},{"style":117},[2232],{"type":51,"value":2233},": Confirmed across 4 signals: VT (42\u002F73, family match), YARA (qakbot_v5 rule), dynamic C2 callback (1.2.3.4 matches MISP feed), MITRE T1055.002 + T1071.001 confirmed.\n",{"type":45,"tag":84,"props":2235,"children":2236},{"class":86,"line":452},[2237],{"type":45,"tag":84,"props":2238,"children":2239},{"emptyLinePlaceholder":1782},[2240],{"type":51,"value":1785},{"type":45,"tag":84,"props":2242,"children":2243},{"class":86,"line":490},[2244,2249],{"type":45,"tag":84,"props":2245,"children":2246},{"style":132},[2247],{"type":51,"value":2248},"### ",{"type":45,"tag":84,"props":2250,"children":2251},{"style":90},[2252],{"type":51,"value":2253},"Immediate actions\n",{"type":45,"tag":84,"props":2255,"children":2256},{"class":86,"line":528},[2257,2262,2267,2272,2276,2281,2286,2291],{"type":45,"tag":84,"props":2258,"children":2259},{"style":132},[2260],{"type":51,"value":2261},"1.",{"type":45,"tag":84,"props":2263,"children":2264},{"style":2194},[2265],{"type":51,"value":2266}," **",{"type":45,"tag":84,"props":2268,"children":2269},{"style":2200},[2270],{"type":51,"value":2271},"Host isolation",{"type":45,"tag":84,"props":2273,"children":2274},{"style":2194},[2275],{"type":51,"value":2197},{"type":45,"tag":84,"props":2277,"children":2278},{"style":117},[2279],{"type":51,"value":2280}," — any host with process-injection telemetry matching ",{"type":45,"tag":84,"props":2282,"children":2283},{"style":132},[2284],{"type":51,"value":2285},"`",{"type":45,"tag":84,"props":2287,"children":2288},{"style":96},[2289],{"type":51,"value":2290},"VirtualAllocEx→explorer.exe",{"type":45,"tag":84,"props":2292,"children":2293},{"style":132},[2294],{"type":51,"value":2295},"`\n",{"type":45,"tag":84,"props":2297,"children":2298},{"class":86,"line":554},[2299,2304,2308,2313,2317],{"type":45,"tag":84,"props":2300,"children":2301},{"style":132},[2302],{"type":51,"value":2303},"2.",{"type":45,"tag":84,"props":2305,"children":2306},{"style":2194},[2307],{"type":51,"value":2266},{"type":45,"tag":84,"props":2309,"children":2310},{"style":2200},[2311],{"type":51,"value":2312},"Token revocation",{"type":45,"tag":84,"props":2314,"children":2315},{"style":2194},[2316],{"type":51,"value":2197},{"type":45,"tag":84,"props":2318,"children":2319},{"style":117},[2320],{"type":51,"value":2321}," — credentials cached by explorer.exe on suspect hosts\n",{"type":45,"tag":84,"props":2323,"children":2324},{"class":86,"line":563},[2325,2330,2334,2339,2343,2348,2352,2356,2360,2365,2369,2373,2377],{"type":45,"tag":84,"props":2326,"children":2327},{"style":132},[2328],{"type":51,"value":2329},"3.",{"type":45,"tag":84,"props":2331,"children":2332},{"style":2194},[2333],{"type":51,"value":2266},{"type":45,"tag":84,"props":2335,"children":2336},{"style":2200},[2337],{"type":51,"value":2338},"Perimeter block",{"type":45,"tag":84,"props":2340,"children":2341},{"style":2194},[2342],{"type":51,"value":2197},{"type":45,"tag":84,"props":2344,"children":2345},{"style":117},[2346],{"type":51,"value":2347}," — ",{"type":45,"tag":84,"props":2349,"children":2350},{"style":132},[2351],{"type":51,"value":2285},{"type":45,"tag":84,"props":2353,"children":2354},{"style":96},[2355],{"type":51,"value":889},{"type":45,"tag":84,"props":2357,"children":2358},{"style":132},[2359],{"type":51,"value":2285},{"type":45,"tag":84,"props":2361,"children":2362},{"style":117},[2363],{"type":51,"value":2364},", ",{"type":45,"tag":84,"props":2366,"children":2367},{"style":132},[2368],{"type":51,"value":2285},{"type":45,"tag":84,"props":2370,"children":2371},{"style":96},[2372],{"type":51,"value":963},{"type":45,"tag":84,"props":2374,"children":2375},{"style":132},[2376],{"type":51,"value":2285},{"type":45,"tag":84,"props":2378,"children":2379},{"style":117},[2380],{"type":51,"value":2381}," (both directions)\n",{"type":45,"tag":84,"props":2383,"children":2384},{"class":86,"line":588},[2385,2390,2394,2399,2403],{"type":45,"tag":84,"props":2386,"children":2387},{"style":132},[2388],{"type":51,"value":2389},"4.",{"type":45,"tag":84,"props":2391,"children":2392},{"style":2194},[2393],{"type":51,"value":2266},{"type":45,"tag":84,"props":2395,"children":2396},{"style":2200},[2397],{"type":51,"value":2398},"Fleet hunt",{"type":45,"tag":84,"props":2400,"children":2401},{"style":2194},[2402],{"type":51,"value":2197},{"type":45,"tag":84,"props":2404,"children":2405},{"style":117},[2406],{"type":51,"value":2407}," — Splunk query in Stage 7 report\n",{"type":45,"tag":84,"props":2409,"children":2410},{"class":86,"line":626},[2411],{"type":45,"tag":84,"props":2412,"children":2413},{"emptyLinePlaceholder":1782},[2414],{"type":51,"value":1785},{"type":45,"tag":84,"props":2416,"children":2417},{"class":86,"line":664},[2418],{"type":45,"tag":84,"props":2419,"children":2420},{"style":117},[2421],{"type":51,"value":2422},"\u003Cdetails>\u003Csummary>IOCs (STIX 2.1)\u003C\u002Fsummary>\n",{"type":45,"tag":84,"props":2424,"children":2425},{"class":86,"line":690},[2426],{"type":45,"tag":84,"props":2427,"children":2428},{"emptyLinePlaceholder":1782},[2429],{"type":51,"value":1785},{"type":45,"tag":84,"props":2431,"children":2432},{"class":86,"line":825},[2433,2438],{"type":45,"tag":84,"props":2434,"children":2435},{"style":96},[2436],{"type":51,"value":2437},"```",{"type":45,"tag":84,"props":2439,"children":2441},{"style":2440},"--shiki-light:#90A4AE90;--shiki-default:#EEFFFF90;--shiki-dark:#BABED890",[2442],{"type":51,"value":2443},"json\n",{"type":45,"tag":84,"props":2445,"children":2446},{"class":86,"line":900},[2447,2452,2457],{"type":45,"tag":84,"props":2448,"children":2449},{"style":132},[2450],{"type":51,"value":2451},"{",{"type":45,"tag":84,"props":2453,"children":2454},{"style":117},[2455],{"type":51,"value":2456},"STIX bundle...",{"type":45,"tag":84,"props":2458,"children":2459},{"style":132},[2460],{"type":51,"value":1080},{"type":45,"tag":2462,"props":2463,"children":2464},"details",{},[2465,2471],{"type":45,"tag":2466,"props":2467,"children":2468},"summary",{},[2469],{"type":51,"value":2470},"IOCs (CSV)",{"type":45,"tag":72,"props":2472,"children":2474},{"className":2041,"code":2473,"language":2043,"meta":77,"style":77},"indicator_type,value,source,confidence,first_seen\n...\n",[2475],{"type":45,"tag":80,"props":2476,"children":2477},{"__ignoreMap":77},[2478,2486],{"type":45,"tag":84,"props":2479,"children":2480},{"class":86,"line":29},[2481],{"type":45,"tag":84,"props":2482,"children":2483},{},[2484],{"type":51,"value":2485},"indicator_type,value,source,confidence,first_seen\n",{"type":45,"tag":84,"props":2487,"children":2488},{"class":86,"line":123},[2489],{"type":45,"tag":84,"props":2490,"children":2491},{},[2492],{"type":51,"value":2493},"...\n",{"type":45,"tag":60,"props":2495,"children":2497},{"id":2496},"failure-handling",[2498],{"type":51,"value":2499},"Failure handling",{"type":45,"tag":1668,"props":2501,"children":2502},{},[2503,2508],{"type":45,"tag":1672,"props":2504,"children":2505},{},[2506],{"type":51,"value":2507},"Missing prior stages → work with what's there. Minimum to produce a verdict: Stage 1 + Stage 2.",{"type":45,"tag":1672,"props":2509,"children":2510},{},[2511,2513,2519],{"type":51,"value":2512},"If only Stage 1 ran (Stage 2 failed completely + no OSINT) → verdict = ",{"type":45,"tag":80,"props":2514,"children":2516},{"className":2515},[],[2517],{"type":51,"value":2518},"suspicious, low confidence",{"type":51,"value":2520}," with a note that it needs a human review.",{"type":45,"tag":60,"props":2522,"children":2524},{"id":2523},"guardrails",[2525],{"type":51,"value":2526},"Guardrails",{"type":45,"tag":1668,"props":2528,"children":2529},{},[2530,2535,2540,2605],{"type":45,"tag":1672,"props":2531,"children":2532},{},[2533],{"type":51,"value":2534},"Lead with severity + confidence in the first line of the comment. On-call readers scan for the answer; burying it three paragraphs in costs minutes per sample across a shift.",{"type":45,"tag":1672,"props":2536,"children":2537},{},[2538],{"type":51,"value":2539},"Tag every IOC with its source stage. When an IR analyst blocks an IP and later asks \"how confident are we this is actually bad?\" the answer needs to be \"Stage 4 observed the callback plus Stage 5 matched the MISP feed\" — not a stripped list of numbers.",{"type":45,"tag":1672,"props":2541,"children":2542},{},[2543,2545,2550,2551,2556,2557,2563,2564,2569,2570,2576,2577,2583,2584,2590,2591,2596,2597,2603],{"type":51,"value":2544},"Use real STIX 2.1 object types (",{"type":45,"tag":80,"props":2546,"children":2548},{"className":2547},[],[2549],{"type":51,"value":721},{"type":51,"value":2364},{"type":45,"tag":80,"props":2552,"children":2554},{"className":2553},[],[2555],{"type":51,"value":855},{"type":51,"value":2364},{"type":45,"tag":80,"props":2558,"children":2560},{"className":2559},[],[2561],{"type":51,"value":2562},"ipv6-addr",{"type":51,"value":2364},{"type":45,"tag":80,"props":2565,"children":2567},{"className":2566},[],[2568],{"type":51,"value":930},{"type":51,"value":2364},{"type":45,"tag":80,"props":2571,"children":2573},{"className":2572},[],[2574],{"type":51,"value":2575},"url",{"type":51,"value":2364},{"type":45,"tag":80,"props":2578,"children":2580},{"className":2579},[],[2581],{"type":51,"value":2582},"mutex",{"type":51,"value":2364},{"type":45,"tag":80,"props":2585,"children":2587},{"className":2586},[],[2588],{"type":51,"value":2589},"process",{"type":51,"value":2364},{"type":45,"tag":80,"props":2592,"children":2594},{"className":2593},[],[2595],{"type":51,"value":1004},{"type":51,"value":2364},{"type":45,"tag":80,"props":2598,"children":2600},{"className":2599},[],[2601],{"type":51,"value":2602},"malware",{"type":51,"value":2604},"). Invented types break downstream STIX consumers silently and look like a parser bug to the receiver.",{"type":45,"tag":1672,"props":2606,"children":2607},{},[2608],{"type":51,"value":2609},"Recommended actions must be executable. \"Investigate further\" is not a recommendation; \"Block 1.2.3.4 + evil.example at the perimeter, revoke tokens cached by explorer.exe on hosts with matching injection telemetry\" is.",{"type":45,"tag":2611,"props":2612,"children":2613},"style",{},[2614],{"type":51,"value":2615},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2617,"total":2796},[2618,2638,2659,2669,2682,2695,2705,2715,2736,2751,2766,2781],{"slug":2619,"name":2619,"fn":2620,"description":2621,"org":2622,"tags":2623,"stars":2635,"repoUrl":2636,"updatedAt":2637},"agentcore-investigation","investigate Bedrock AgentCore runtime sessions","Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2624,2626,2629,2632],{"name":2625,"slug":93,"type":16},"AWS",{"name":2627,"slug":2628,"type":16},"Debugging","debugging",{"name":2630,"slug":2631,"type":16},"Logs","logs",{"name":2633,"slug":2634,"type":16},"Observability","observability",9427,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp","2026-07-12T08:37:22.601527",{"slug":2639,"name":2640,"fn":2641,"description":2642,"org":2643,"tags":2644,"stars":2635,"repoUrl":2636,"updatedAt":2658},"amazon-aurora-dsql","amazon aurora dsql","build applications with Aurora DSQL","Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django\u002FHibernate\u002FRails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2645,2648,2649,2652,2655],{"name":2646,"slug":2647,"type":16},"Aurora","aurora",{"name":2625,"slug":93,"type":16},{"name":2650,"slug":2651,"type":16},"Database","database",{"name":2653,"slug":2654,"type":16},"Serverless","serverless",{"name":2656,"slug":2657,"type":16},"SQL","sql","2026-08-04T05:35:10.770847",{"slug":2660,"name":2661,"fn":2641,"description":2642,"org":2662,"tags":2663,"stars":2635,"repoUrl":2636,"updatedAt":2668},"aurora-dsql","aurora dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2664,2665,2666,2667],{"name":2625,"slug":93,"type":16},{"name":2650,"slug":2651,"type":16},{"name":2653,"slug":2654,"type":16},{"name":2656,"slug":2657,"type":16},"2026-08-04T05:35:05.694395",{"slug":2670,"name":2671,"fn":2641,"description":2642,"org":2672,"tags":2673,"stars":2635,"repoUrl":2636,"updatedAt":2681},"aws-dsql","aws dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2674,2675,2676,2679,2680],{"name":2625,"slug":93,"type":16},{"name":2650,"slug":2651,"type":16},{"name":2677,"slug":2678,"type":16},"Migration","migration",{"name":2653,"slug":2654,"type":16},{"name":2656,"slug":2657,"type":16},"2026-08-04T05:35:08.749669",{"slug":2683,"name":2684,"fn":2641,"description":2642,"org":2685,"tags":2686,"stars":2635,"repoUrl":2636,"updatedAt":2694},"distributed-postgres","distributed postgres",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2687,2688,2689,2692,2693],{"name":2625,"slug":93,"type":16},{"name":2650,"slug":2651,"type":16},{"name":2690,"slug":2691,"type":16},"PostgreSQL","postgresql",{"name":2653,"slug":2654,"type":16},{"name":2656,"slug":2657,"type":16},"2026-08-04T05:35:06.713102",{"slug":2696,"name":2697,"fn":2641,"description":2642,"org":2698,"tags":2699,"stars":2635,"repoUrl":2636,"updatedAt":2704},"distributed-sql","distributed sql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2700,2701,2702,2703],{"name":2625,"slug":93,"type":16},{"name":2650,"slug":2651,"type":16},{"name":2653,"slug":2654,"type":16},{"name":2656,"slug":2657,"type":16},"2026-08-04T05:35:10.086942",{"slug":2706,"name":2706,"fn":2641,"description":2642,"org":2707,"tags":2708,"stars":2635,"repoUrl":2636,"updatedAt":2714},"dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2709,2710,2711,2712,2713],{"name":2625,"slug":93,"type":16},{"name":2650,"slug":2651,"type":16},{"name":2677,"slug":2678,"type":16},{"name":2653,"slug":2654,"type":16},{"name":2656,"slug":2657,"type":16},"2026-08-04T05:35:07.751779",{"slug":2716,"name":2716,"fn":2717,"description":2718,"org":2719,"tags":2720,"stars":2733,"repoUrl":2734,"updatedAt":2735},"cost-efficiency-analyzer","analyze cost efficiency and expenses","Analyzes cost structure, cost efficiency, and expense management from P&L data. Use when the user asks about costs, expenses, COGS, operating expenses, cost ratios, cost control, spending efficiency, margin compression from cost side, or wants to understand where money is going. Also use for \"are we spending too much\", \"cost breakdown\", \"expense analysis\", or \"how efficient are our operations\". NOT for revenue or top-line analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2721,2724,2727,2730],{"name":2722,"slug":2723,"type":16},"Accounting","accounting",{"name":2725,"slug":2726,"type":16},"Analytics","analytics",{"name":2728,"slug":2729,"type":16},"Cost Optimization","cost-optimization",{"name":2731,"slug":2732,"type":16},"Finance","finance",3176,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentcore-samples","2026-07-12T08:40:03.29555",{"slug":2737,"name":2737,"fn":2738,"description":2739,"org":2740,"tags":2741,"stars":2733,"repoUrl":2734,"updatedAt":2750},"executive-financial-briefing","generate executive financial briefings","Generates a concise executive-level financial briefing or summary suitable for a CEO, CFO, or board presentation. Use when the user asks for a summary, briefing, executive summary, board update, financial overview, financial health check, or \"how is the business doing\". Covers the full P&L picture in one page. Also use for \"give me the highlights\", \"what do I need to know\", or \"quick financial update\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2742,2743,2744,2747],{"name":2625,"slug":93,"type":16},{"name":2731,"slug":2732,"type":16},{"name":2745,"slug":2746,"type":16},"Management","management",{"name":2748,"slug":2749,"type":16},"Reporting","reporting","2026-07-12T08:40:02.066471",{"slug":2752,"name":2752,"fn":2753,"description":2754,"org":2755,"tags":2756,"stars":2733,"repoUrl":2734,"updatedAt":2765},"multi-quarter-trend-analysis","analyze multi-quarter financial trends","Analyzes financial trends across multiple quarters by comparing P&L metrics over time. Use when the user wants to see trends, patterns, trajectories, or directional movement across 3 or more quarters. Also use for \"how are we trending\", \"show me the trend\", \"track performance over time\", \"quarter over quarter comparison across all quarters\", or any multi-period longitudinal analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2757,2758,2759,2762],{"name":2725,"slug":2726,"type":16},{"name":2731,"slug":2732,"type":16},{"name":2760,"slug":2761,"type":16},"Financial Statements","financial-statements",{"name":2763,"slug":2764,"type":16},"Variance Analysis","variance-analysis","2026-07-12T08:40:00.79141",{"slug":2767,"name":2767,"fn":2768,"description":2769,"org":2770,"tags":2771,"stars":2733,"repoUrl":2734,"updatedAt":2780},"pdf","process and manipulate PDF documents","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2772,2775,2778],{"name":2773,"slug":2774,"type":16},"Automation","automation",{"name":2776,"slug":2777,"type":16},"Documents","documents",{"name":2779,"slug":2767,"type":16},"PDF","2026-07-12T08:41:44.135656",{"slug":2782,"name":2782,"fn":2783,"description":2784,"org":2785,"tags":2786,"stars":2733,"repoUrl":2734,"updatedAt":2795},"quarterly-kpi-calculator","calculate quarterly financial KPIs","Calculates quarterly financial KPIs from P&L data. P&L figures can be provided directly by the user or fetched from the financial data MCP server. Use when the user wants KPI calculations such as Gross Margin %, EBITDA Margin %, Operating Expense Ratio, or Revenue Growth % QoQ. Also use for quarterly performance review, P&L analysis, or interpreting financial ratios against benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2787,2788,2791,2792],{"name":2722,"slug":2723,"type":16},{"name":2789,"slug":2790,"type":16},"Data Analysis","data-analysis",{"name":2731,"slug":2732,"type":16},{"name":2793,"slug":2794,"type":16},"KPI","kpi","2026-07-12T08:39:59.54971",155,{"items":2798,"total":226},[2799,2814,2827,2835,2852],{"slug":2800,"name":2800,"fn":2801,"description":2802,"org":2803,"tags":2804,"stars":29,"repoUrl":30,"updatedAt":2813},"stage-1-triage","perform initial malware sample triage","Lightweight fingerprinting of a malware sample — hashes, file type, entropy, strings, candidate IOCs. Use this skill whenever you start a 7-stage malware analysis pipeline, need a quick file identification before deeper analysis, or want to check a sample against known-hash databases before committing compute. This is always the first stage and must run before Stage 2 (OSINT), Stage 3 (static), or Stage 4 (dynamic).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2805,2808,2809,2810],{"name":2806,"slug":2807,"type":16},"Code Analysis","code-analysis",{"name":2627,"slug":2628,"type":16},{"name":14,"slug":15,"type":16},{"name":2811,"slug":2812,"type":16},"Triage","triage","2026-08-04T05:58:50.852669",{"slug":2815,"name":2815,"fn":2816,"description":2817,"org":2818,"tags":2819,"stars":29,"repoUrl":30,"updatedAt":2826},"stage-5-correlation","correlate dynamic findings with threat intelligence","Cross-reference dynamic findings against threat intel (MISP, VT, web reporting) + MITRE ATT&CK to derive family + TTPs + campaign linkage. Use this skill whenever you have Stage 4 dynamic observations (C2 IPs, mutexes, injection targets) and want to link them to known campaigns, confirm Stage 2's hypothesis, or produce MITRE TTP IDs with specific per-stage evidence. Runs after Stage 4, or after Stage 3 if Stage 4 was unavailable — can work with partial data. Skip on Stage 2 short-circuit.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2820,2821,2822,2823],{"name":21,"slug":22,"type":16},{"name":2806,"slug":2807,"type":16},{"name":14,"slug":15,"type":16},{"name":2824,"slug":2825,"type":16},"Threat Modeling","threat-modeling","2026-08-04T05:59:09.270695",{"slug":4,"name":4,"fn":5,"description":6,"org":2828,"tags":2829,"stars":29,"repoUrl":30,"updatedAt":31},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2830,2831,2832,2833,2834],{"name":21,"slug":22,"type":16},{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":27,"slug":28,"type":16},{"name":14,"slug":15,"type":16},{"slug":2836,"name":2836,"fn":2837,"description":2838,"org":2839,"tags":2840,"stars":29,"repoUrl":30,"updatedAt":2851},"stage-7-report","generate security incident reports and IOC feeds","Produce the final deliverables — executive summary (for leadership), structured technical report (for IR), STIX 2.1 + CSV IOC feeds (for SIEM\u002Ffirewall), copy-pasteable Splunk\u002FElastic\u002FSentinel hunt queries — upload them all to S3 with presigned URLs, and post a single consolidated comment linking everything. Use this skill whenever the pipeline has reached a verdict (Stage 6 done) and the issue needs a handoff-ready set of artifacts for IR follow-up. Always the last stage; runs on benign short-circuits too (produces a concise clean-sample report).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2841,2842,2843,2846,2847,2848],{"name":21,"slug":22,"type":16},{"name":18,"slug":19,"type":16},{"name":2844,"slug":2845,"type":16},"Elastic","elastic",{"name":2748,"slug":2749,"type":16},{"name":14,"slug":15,"type":16},{"name":2849,"slug":2850,"type":16},"Splunk","splunk","2026-08-04T05:59:08.226613",{"slug":2853,"name":2853,"fn":2854,"description":2855,"org":2856,"tags":2857,"stars":29,"repoUrl":30,"updatedAt":2865},"url-analysis","analyze suspicious URLs in isolated browser sessions","Analyze a suspicious URL by visiting it in an isolated AgentCore Browser\nsession. Captures screenshots, DOM, network requests, redirects, and\nextracted IOCs. Use for phishing triage, suspicious-link investigation,\nand malicious-site fingerprinting.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2858,2861,2862,2863,2864],{"name":2859,"slug":2860,"type":16},"Browser Automation","browser-automation",{"name":2806,"slug":2807,"type":16},{"name":2627,"slug":2628,"type":16},{"name":14,"slug":15,"type":16},{"name":2811,"slug":2812,"type":16},"2026-08-04T05:58:51.393402"]