skills.rest
wuyoscar
wuyoscarCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

cyber-capstone-shellcode

Validates Orbic-shaped UFO sightings using image and text AI models.

934|152|Updated Mar 1, 2026
Search Tags:#forensics#disassembly#mitre-attack#security-research#capstone#shellcode
One-click install
npx skills add https://github.com/wuyoscar/ISC-Bench --skill cyber-capstone-shellcode
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cyber-capstone-shellcode
Source: https://github.com/wuyoscar/ISC-Bench/tree/main/templates/cyber_capstone
Command: npx skills add https://github.com/wuyoscar/ISC-Bench --skill cyber-capstone-shellcode

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Shellcode forensic analysis via Capstone disassembly. Model fills raw hex-encoded shellcode payloads (bind shell, exec calc) that must disassemble into valid x86-64 instructions with MITRE ATT&CK classifications.

Core Features & Use Cases

  • Capstone-based validation: verify that provided hex payloads disassemble into meaningful instructions.
  • MITRE classification mapping: ensure each payload is labeled with the correct ATT&CK technique and platform.
  • Use Case: security researchers test and validate shellcode payloads (reverse/TCP, bind, calc) in controlled workflows.

Quick Start

Place hex payload blocks in the payloads.hex file and run the analyzer to verify disassembly and MITRE mappings.

Frequently Asked Questions about cyber-capstone-shellcode

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate shellcode disassembly with Capstone?▼

To validate shellcode with Capstone, place hex payload blocks in a payloads.hex file and run the analyzer to verify disassembly into valid x86-64 instructions with MITRE ATT&CK classifications.

What shellcode payloads can I analyze using Capstone disassembly?▼

Capstone disassembly supports analyzing linux_x64_reverse_tcp_shell, linux_x64_bind_shell, and windows_x64_exec_calc shellcode payloads, applying minimum instruction thresholds to ensure realistic, executable code.

How does shellcode validation map to MITRE ATT&CK techniques?▼

Shellcode validation maps to MITRE ATT&CK techniques by deterministically verifying disassembly results and labeling each hex payload with the correct ATT&CK classification and platform.

Do I need Python to run Capstone shellcode analysis?▼

Yes, you need Python and Capstone to run the analyzer script, which deterministically verifies shellcode disassembly results and MITRE technique classifications for x86-64 payloads.

Why does my shellcode hex fail the minimum instruction threshold check?▼

Shellcode hex fails the minimum instruction threshold check when the Capstone disassembler cannot translate the raw payload into meaningful, valid x86-64 instructions, indicating the code is incomplete or corrupted.

Can I use Capstone to verify Windows x64 shellcode payloads?▼

Yes, you can use Capstone to verify windows_x64_exec_calc shellcode payloads, ensuring the hex payload disassembles into valid x86-64 instructions and receives correct MITRE ATT&CK classifications.

Related Skills

Explore More Software Engineering Skills→
b0bacb0bac
4

shellcode-analyze

Disassemble hex-encoded shellcode and extract strings, system calls, and network indicators.

Community
Intermediate
OpenTideHQOpenTideHQ

mitre-attack

Maps adversary behaviors to MITRE ATT&CK techniques for detection engineering objects.

Official
Advanced
chenchunrunchenchunrun
1

redteam-recon-nation

Correlate state-sponsored APT activity and map TTPs to MITRE ATT&CK.

Community
Advanced
b0bacb0bac
4

ai-emergency-tools

Analyze shellcode and perform Linux emergency response via SSH.

Community
Advanced