Script
Static triage of obfuscated scripts, from one PowerShell file on Day 1 to 31 languages in one zip, mapped to MITRE ATT&CK.
Day by day
Power Play
Static PowerShell triage · decoding embedded config · extracting IOCs · mapping behaviour to MITRE ATT&CK (and choosing parent vs sub-technique) · handling password-protected sample archives safely
STTMHost With the Most
Static triage of PowerShell and JScript (Windows Script Host), decoding packed configs, ATT&CK mapping, JS syntax forms, scripted timed runs
STTMExpansion Pack
Static Batch deobfuscation (fragment variables; percent, delayed, CALL-double, and FOR-indirect expansion), decoding packed headers (Base64, XOR, hex, decimal, reversed text), ATT&CK mapping, finding a checker's label words by controlled tests, scripted timed runs
STTMDim and Dimmer
Static triage of VBScript, Batch, JScript, and PowerShell; decoding character-code arrays and byte transforms from a script's own constants; control-flow classification; ATT&CK mapping for hand-off scripts; single-answer wording tests; scripted timed runs
STTMHatch Careful
Static triage of Python carriers (pyc, PyInstaller, py2exe, cx_Freeze, PyArmor, zipapp, wheel), decoding packed configs without executing them, ATT&CK mapping, Batch/VBScript control-flow naming, scripted timed runs
STTMShell We Begin
Static triage of Bash droppers and cron chains, decoding packed configs, reading a behaviour graph, ATT&CK mapping, Batch/VBScript control-flow naming, scripted timed runs
STTMNode by Node
Static triage of Node.js ES modules (string-literal codecs, XOR, hex, Base64), Bash indirection and token fragmentation, Batch and VBScript control-flow labels, ATT&CK mapping (Cron vs systemd, own-interpreter rule), a growing solver chain with regression tests, scripted timed runs
STTMLost in Translation
Static triage across nine script languages, decoding a self-describing plan in four encodings, cross-checking a sample's header against its body, ATT&CK mapping, reading control structures, scripted timed runs
STTMAll the World's a Stager
Static triage of nine script languages (PowerShell, JScript incl. a .sct scriptlet, Batch, VBScript, Python, Bash, Node, PHP, and Lua polyglots), decoding packed plans, ATT&CK mapping, recovering stage graphs, working labels back from accepted answers, scripted timed runs
STTMBind Over Matter
Static triage of the Script lane's languages (PowerShell, JScript, Batch, VBScript, Python, Bash, Node, PHP, Lua, and new WMI MOF polyglots), reusing a solver chain unchanged, running it unattended, and handling a rate limit
STTMBy Any Other Name
Script behaviour mapping across 8 languages, ATT&CK mapping, compounding question sets
STTMAutoIt Takes Two
Compounding script triage; AutoIt as a script host; reading a decoded behaviour graph; role and ATT&CK mapping under a stated precedence rule
STTMZip Code
Compounding script triage; AppleScript as a script host; advanced Bash syntax (subshell pipelines, process substitution); reading a staged chain's decoded behaviour graph; bisecting a rejected batch
STTMTrust the Process
Compounding script triage; MSBuild project files as a script host (trusted developer utility proxy execution); reading a staged chain's decoded behaviour graph; ATT&CK mapping
STTMCrumb Trail
Compounding script triage; Perl as a new polyglot host; browser credential-store access (ATT&CK T1555.003); Batch variable-expansion forms; finding one wrong answer among 1,026 by batching
STTMSame Same, But Different
Script deobfuscation, behaviour equivalence across obfuscated variants, staged-chain profiling
STTMFetch Quest
Download-chain analysis across many script hosts, ATT&CK mapping
STTMOrphan Process
Script de-obfuscation (string-array reassembly), HEX/Base64/fragment decoding, ATT&CK mapping
STTMSharp Practice
Multi-language script analysis, ATT&CK mapping
STTMThe Butler Did It
Multi-language script analysis (Groovy, classic ASP VBScript, Bash), Jenkins Pipeline semantics, ATT&CK mapping
STTMActions Speak Louder
Multi-language script analysis, GitHub Actions workflows as a script host, ATT&CK mapping
STTMNext, Next, Finish
Multi-language script analysis, NSIS installer scripts as a script host, ATT&CK mapping
STTMPress Start to Decode
Script triage across 20+ languages, layered encodings (LYR- header), behaviour graphs, ATT&CK mapping, schema adaptation
STTMWeb of Lies
Script triage across 20+ languages, JSP webshell fixtures, analysis-descriptor plans, layered encodings (LYR-), ATT&CK mapping
STTMAshes to Assets
Script triage across 20+ languages, Elixir/Phoenix fixtures, analysis-descriptor plans, layered encodings (LYR-), ATT&CK mapping
STTMMixed Signals
Script triage across 20+ languages, Erlang escripts, analysis-descriptor plans, layered encodings (LYR-), ATT&CK mapping
STTMFROM Whence It Came
Script triage across 20+ languages, Dockerfiles, analysis-descriptor plans, ATT&CK mapping, per-file attribution against look-alike indicators
STTMOut of Order
Script triage across 20+ languages, now including Terraform (HCL); analysis-descriptor plans; ATT&CK mapping; the core plus plug-in batches
STTMMake It Make Sense
Static script triage across languages; reading each fixture's embedded analysis plan; role, ATT&CK mapping, stage graph, and indicators for a new host language (Makefile)
STTMSpill the Beans
Cumulative static script triage (30 languages in one zip); reading an encoded analysis-plan header and checking it against the body; ATT&CK mapping by a stated precedence
STTMThe Full Transform
Cumulative static script triage (31 languages in one zip); reading an encoded analysis-plan header and checking it against the body; ATT&CK mapping by a stated precedence
STTM