Read the sample. Write the detection.

Defenders need to read what attackers write.

Aligned models stop at the word payload. Abliterated models keep their full knowledge and answer the question you asked.

Malware triage

Decode, deobfuscate and explain what a sample does, stage by stage, with the indicators pulled out.

Reverse engineering

Walk through decompiled functions, name symbols, recover structs and the protocol on the wire.

Detection engineering

Sigma, YARA, KQL and Suricata drafts written next to the analysis they come from.

Vulnerability research

Reproduce known CVEs in an isolated lab to validate patches, mitigations and detections.

Incident response

Build timelines from raw logs, triage suspicious binaries and draft the write-up.

Threat intelligence

Summarize an actor's tradecraft from reports and map it to ATT&CK techniques.

From artifact to rule

1. Paste the artifact

   Scripts, decompiled code, PCAP summaries, EDR telemetry. 1M tokens holds a whole decompilation, not a snippet.

2. Ask what it does

   Say who you are and what is in scope. The model explains behavior, intent and indicators.

3. Get the detections

   Ask for rules alongside the analysis, in the format your SIEM takes.

4. Validate in your lab

   Run the sample and the rules in your sandbox. The model helps read what happened.

Two models, two opinions.

from openai import OpenAI
import os, pathlib

client = OpenAI(base_url="https://xfield.cloud.brutal.ai/api/v1", api_key=os.environ["XFIELD_API_KEY"])
sample = pathlib.Path("sample_7f3a.ps1").read_text()

reply = client.chat.completions.create(
    model="deepseek-v4.1-flash-1017-uncensored",
    reasoning_effort="high",
    messages=[
        {"role": "system", "content": "You are a malware analyst on our SOC. "
            "Samples come from our own incident queue."},
        {"role": "user", "content": f"Explain each stage, list IOCs, "
            f"then write a Sigma rule.\n\n{sample}"},
    ],
)

Questions

Yes. Analysis, reverse engineering, detection work and testing systems you are authorized to test are what these models are for. The acceptable use policy rules out attacking systems you have no permission to touch.

No. Prompts and replies are not written to storage. We keep a usage record per request (model, tokens, timing) and never the text. Data handling.

DeepSeek V4.1 Flash for most of it: it has the highest cybersecurity benchmark score of our models and runs long agent loops cheaply, because most of the context is cached between turns. GLM 5.3 when the write-up is long or you want a second opinion from another model family. Both take 1M tokens.

Anything that speaks the OpenAI or Anthropic API works, including Claude Code and Codex for agentic triage. See the security research guide.

Keep your stack. Lose the refusals.

Tell us what you are building. We reply with an invitation, a key and pricing for your volume.