Skill UI

Guides deploying Rapid7 InsightVM Security Console, pairing Scan Engines, defining templates, configuring credentialed scans, and integrating Insight Agents to automate authenticated and unauthenticated vulnerability detection across enterprise assets.

A workflow for detecting and responding to Adversary-in-the-Middle phishing attacks that swipe credentials/MFA tokens via reverse-proxy kits, with guidance for hardening MFA, conditional access, and logging.

Simulates authorized ARP spoofing attacks with arpspoof, Ettercap, and Scapy to demonstrate MITM risks, validate detection controls, and train analysts within isolated labs or approved windows.

Uses the Kubernetes Python client to inspect pod security contexts, privileged mode, capabilities, namespace sharing, and hostPath mounts to highlight container escape vectors during security audits or incident response.

Guides ransomware incident response from detection through containment, forensic analysis, recovery, and post-incident hardening while covering negotiation, validation of backups, and regulatory notification steps.

Builds a structured ransomware incident response playbook aligned with CISA StopRansomware guidance and NIST CSF, covering preparation, detection, containment, eradication, recovery, and post-incident chores for readiness assessments and compliance documentation.

Detect NTLM relay attacks by correlating Windows Security Event 4624 LogonType 3 entries against IP-to-hostname inventories, auditing SMB/LDAP signing enforcement, spotting Responder/LLMNR poisoning traffic, and tagging NTLM downgrade attempts for SIEM alerting.

Real-time detection pipeline that watches entropy spikes, file system I/O, and behavioral heuristics to flag ransomware-style encryption routines before they propagate and to help trigger containment actions.

Detects DCOM lateral movement by triangulating Sysmon Event ID 1/3, Windows security logs, and RPC traffic patterns tied to MMC20, ShellWindows, and ShellBrowserWindow abuse, enabling SOCs to hunt and tune detections across AD domains.

Detects and exploits ransomware kill switch mechanisms via mutex, domain, registry, and file checks, enabling proactive vaccination and DNS monitoring to stop execution before encryption.

This skill allows fine-grained control over how the browser environment is initialized. It manages two primary modes: the default managed CDP connection and a dedicated Playwright management mode (activated by setting private_mode=true). Users can also control the visibility of the browser window using the 'headed' parameter. This is crucial for scenarios requiring specific browser detection bypass or when switching between CDP-managed and Playwright-managed sessions.