Skill UI

A powerful security tool for querying Certificate Transparency (CT) logs via crt.sh and pycrtsh. It detects potential security threats such as phishing domains, unauthorized certificate issuance, and shadow IT infrastructure. The tool specifically monitors new certificates for typosquatting and brand impersonation using advanced distance metrics, enabling proactive security threat detection.

AWT provides AI coding tools with the ability to perform sophisticated End-to-End (E2E) web testing using a real browser. It accepts declarative YAML scenarios and executes them via Playwright. Key features include visual matching (OpenCV + OCR) instead of relying on fragile DOM selectors, automatic platform detection (React, Vue, etc.), and structured failure diagnosis for improved AI coding workflows.

A comprehensive guide detailing how to integrate DevSecOps best practices into a GitLab CI/CD pipeline. It automates multiple security checks, including Static Analysis (SAST), Dynamic Analysis (DAST), container scanning, dependency scanning, and secret detection. This approach enforces 'shift-left' security, finding and fixing vulnerabilities early in the development lifecycle to ensure compliance and robust security.

A comprehensive, structured playbook for Security Operations Centers (SOCs) detailing the entire lifecycle of ransomware incidents. It guides analysts through detection (SIEM queries), triage decision trees, containment (EDR/Firewall), evidence collection, and recovery phases, adhering to NIST CSF and MITRE ATT&CK frameworks.

A comprehensive guide for responding to security incidents across major cloud providers (AWS, Azure, GCP). It details detection methods using cloud-native logs, containment strategies for compromising identities, evidence preservation techniques, and investigation steps for common cloud attack patterns.

A comprehensive, multi-stage framework for responding to confirmed or suspected malware infections across an enterprise. This guide covers the entire incident lifecycle: detection, scoping, containment, deep analysis (mapping to MITRE ATT&CK), thorough eradication, and system recovery, ensuring all steps are documented for resilience and compliance.

This skill guides the setup of Host-Based Intrusion Detection Systems (HIDS) using industry-standard tools like Wazuh, OSSEC, or AIDE. It covers essential security practices, including File Integrity Monitoring (FIM) for critical directories, monitoring system calls, detecting configuration changes, and identifying rootkits. It is crucial for meeting regulatory compliance requirements (e.g., PCI DSS) and significantly enhancing overall endpoint security posture.

This tool deploys decoy canary files in critical system directories to provide early warning against ransomware attacks. Utilizing Python's watchdog library, it monitors for any read, modify, rename, or delete operations on these decoy files. Detection triggers immediate alerts via multiple channels (Email, Slack, Syslog), helping security teams identify and respond to malicious activity before full data encryption occurs. It serves as a crucial detection layer in a layered security defense.

This skill provides comprehensive guidelines for detecting Business Email Compromise (BEC), a sophisticated fraud scheme. It covers detection techniques using email gateway rules, behavioral analytics, and robust financial process controls. Learn to identify red flags like unusual payment requests, domain mismatches, and patterns of social engineering to protect against financial loss.

Detect unauthorized crypto-mining in AWS, Azure, and GCP by correlating GuardDuty/Defender/SCC findings, compute anomalies, network flows, and container/serverless behaviors to validate threats and guide response.

This skill provides comprehensive guidance and detection rules for identifying fileless malware, in-memory attacks, and living-off-the-land techniques. It covers detecting PowerShell exploitation, reflective DLL injection, WMI abuse, and registry-resident threats, enabling security teams to build robust detections when traditional antivirus fails.

A comprehensive guide and framework for detecting attacker lateral movement within enterprise networks. It details the use of network flow analysis (Zeek), authentication log review (Windows Event Logs, Kerberos), and dedicated SIEM correlation rules (Splunk, Elastic) to identify techniques like Pass-the-Hash and RDP hopping. Ideal for threat hunters and security engineers building detection pipelines.