cyber-capstone-shellcode

Validates Orbic-shaped UFO sightings using image and text AI models.

934|152|Updated Mar 1, 2026

Search Tags:#forensics #disassembly #mitre-attack #security-research #capstone #shellcode

Ready to run

npx skills add https://github.com/wuyoscar/ISC-Bench --skill cyber-capstone-shellcode

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cyber-capstone-shellcode
Source: https://github.com/wuyoscar/ISC-Bench/tree/main/templates/cyber_capstone
Command: npx skills add https://github.com/wuyoscar/ISC-Bench --skill cyber-capstone-shellcode

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Shellcode forensic analysis via Capstone disassembly. Model fills raw hex-encoded shellcode payloads (bind shell, exec calc) that must disassemble into valid x86-64 instructions with MITRE ATT&CK classifications.

Core Features & Use Cases

Capstone-based validation: verify that provided hex payloads disassemble into meaningful instructions.
MITRE classification mapping: ensure each payload is labeled with the correct ATT&CK technique and platform.
Use Case: security researchers test and validate shellcode payloads (reverse/TCP, bind, calc) in controlled workflows.

Quick Start

Place hex payload blocks in the payloads.hex file and run the analyzer to verify disassembly and MITRE mappings.

Frequently Asked Questions about cyber-capstone-shellcode

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I validate shellcode disassembly with Capstone?▼

To validate shellcode with Capstone, place hex payload blocks in a payloads.hex file and run the analyzer to verify disassembly into valid x86-64 instructions with MITRE ATT&CK classifications.

What shellcode payloads can I analyze using Capstone disassembly?▼

Capstone disassembly supports analyzing linux_x64_reverse_tcp_shell, linux_x64_bind_shell, and windows_x64_exec_calc shellcode payloads, applying minimum instruction thresholds to ensure realistic, executable code.

How does shellcode validation map to MITRE ATT&CK techniques?▼

Shellcode validation maps to MITRE ATT&CK techniques by deterministically verifying disassembly results and labeling each hex payload with the correct ATT&CK classification and platform.

Do I need Python to run Capstone shellcode analysis?▼

Yes, you need Python and Capstone to run the analyzer script, which deterministically verifies shellcode disassembly results and MITRE technique classifications for x86-64 payloads.

Why does my shellcode hex fail the minimum instruction threshold check?▼

Shellcode hex fails the minimum instruction threshold check when the Capstone disassembler cannot translate the raw payload into meaningful, valid x86-64 instructions, indicating the code is incomplete or corrupted.

Can I use Capstone to verify Windows x64 shellcode payloads?▼

Yes, you can use Capstone to verify windows_x64_exec_calc shellcode payloads, ensuring the hex payload disassembles into valid x86-64 instructions and receives correct MITRE ATT&CK classifications.