Data Points

📁 File / Document

A file or document artifact — malware sample, leaked document, image, or email attachment.

Cyber

Sources

0 no-auth

Disciplines

that use it

Mission domains

reach

Workbench

—

native tool

🔗 Analyst pivots

Search platform →OSINT pivot →Source catalog →

🔍 Lookup

📜 Playbook — File / Document exploitation

Direction — frame the requirement for File / Document: what decision does this support, by when?
Collection — pull the 0 mapped sources (0 free) and the native workbench; capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 File / Document

A file or document is a concrete artifact — PE/ELF/Mach-O binary, Office doc, PDF, script, or archive — carrying content, structure, and rich metadata. It matters because static structure, embedded objects, and authorship metadata reveal capability, provenance, and links to actors before any detonation.

Format: Magic bytes / MIME type (PE MZ, PDF %PDF, ZIP PK); size; entropy (0-8); PE headers/sections; OLE/OOXML structure; embedded EXIF/XMP/author metadata.

📡 How it is collected

Email attachment and web-download capture
Endpoint file-system and quarantine collection
Forensic disk/memory image carving
Sandbox dropped-file artifacts
USB / removable-media acquisition
Document-sharing and repo scraping

📚 Enrichment & validation sources

VirusTotal →Hybrid Analysis →Triage (tria.ge) →NSRL known-file library →MalwareBazaar →MalDoc-in-the-wild feeds →Any.Run →InQuest Labs →

🔗 Pivot to

File Hash →Malware Family →dp_url / dp_ip (embedded) →author / metadata identity →dp_certificate (signature) →dp_cve (exploit trigger) →

🧩 Analysis & hunting techniques

Static triage (magic, entropy, strings)
Metadata / EXIF authorship extraction
Macro & OLE object analysis (maldoc)
Embedded-object & OLE stream carving
Entropy-based packer detection
PDF JavaScript & object-stream analysis
CAPA capability tagging
Structural (PE section) anomaly detection

🔧 Tools

oletools (olevba/oleid)
exiftool
binwalk
pdf-parser / peepdf
CAPA
Detect It Easy
strings / file / yara

⚡ Workbench actions

Compute hashes & entropy
Extract metadata / author
Analyze macros & embedded objects
Carve embedded files/IOCs
Detonate & capture drops
Tag capabilities (CAPA)
Check reputation
Pivot to family & C2

📊 Dashboard KPIs

File entropyEmbedded IOC countMacro / active-content flagAV detection ratioMetadata author uniqueness

📂 Open

Data point →Hash profile →IOC workbench →URL profile →Correlate →

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook