Skill UI

This skill provides a comprehensive workflow for analyzing malicious software to extract actionable Indicators of Compromise (IOCs). It covers static analysis (PE parsing, hashing, string extraction) and dynamic analysis techniques. Users learn how to identify file hashes, network indicators (C2 IPs, domains), registry modifications, and behavioral artifacts, ultimately formatting the findings into standard STIX 2.1 formats for sharing and incident response.

A comprehensive guide for performing deep network forensics using Wireshark and tshark. This technique analyzes raw PCAP/PCAPNG files captured during security incidents to reconstruct network events, identify data exfiltration methods, extract sensitive artifacts (credentials, files), detect Command-and-Control (C2) communications, and pinpoint network indicators of compromise (IOCs). Ideal for digital forensics and incident response teams.

This guide details how to perform pre-execution static analysis of Windows PE malware samples using tools like PEStudio, Python's pefile, and FLOSS. It focuses on examining file headers, section entropy, import address tables (IAT), and embedded strings to identify malicious functionalities, packing techniques, and indicators of compromise (IOCs) without running the binary. Ideal for initial triage of suspicious executables.

This skill utilizes PyMISP, the official library, to programmatically manage the lifecycle of threat intelligence within a MISP instance. Users can create structured events containing Indicators of Compromise (IOCs) such as IPs, domains, and hashes, enrich these events with MITRE ATT&CK tags, manage sharing groups, and export the collected data in standardized STIX 2.1 format. Ideal for security assessments, incident response, and integrating external IOC feeds.

A comprehensive guide covering advanced Kerberos attacks against Active Directory environments. Techniques include AS-REP roasting, Kerberoasting, forging golden, silver, diamond, and sapphire tickets, and exploiting delegation abuse. Designed for penetration testers and red teams to simulate sophisticated domain compromise scenarios.

An expert playbook detailing advanced techniques for pivoting across compromised Linux hosts. Techniques cover SSH agent hijacking, credential harvesting from common system files, key extraction, and abusing internal services via D-Bus and systemd exploitation, crucial for post-exploitation stages.

This skill runs the Bumblebee scanner on macOS/Linux to perform read-only inventory and exposure checks. It detects compromised packages, developer tools, and host configurations against known security advisories. It is primarily used for supply-chain incident response and vulnerability assessment, providing developers with a clear picture of local system exposure.

This solution provides a comprehensive framework for detecting compromised cloud credentials across AWS, Azure, and GCP. It analyzes anomalous API activity, impossible travel patterns, and indicators of credential stuffing by leveraging services like AWS GuardDuty, Azure Defender, and GCP SCC. Use this when investigating suspicious cloud API calls, responding to exposed credential alerts, or scoping a potential account takeover.

A comprehensive framework for authorized AWS penetration testing and red-teaming. This skill automates end-to-end cloud exploitation using Pacu, covering session management, deep IAM enumeration, automated privilege escalation scanning, and establishing persistence backdoors. It is designed to assess the full blast radius of compromised cloud credentials.

A comprehensive tool for authorized red-team engagements, designed to map complex on-prem Active Directory and cloud Entra ID attack paths. It uses SharpHound and AzureHound to collect rich data, ingesting it into BloodHound CE for analysis using built-in queries and custom Cypher. Effectively identifies privilege escalation chains leading to domain or tenant compromise, especially in hybrid identity environments.

This skill provides methods to verify artifact signatures and SLSA provenance using tools like cosign and slsa-verifier. It is crucial for building secure CI/CD pipelines, detecting supply-chain attacks (e.g., tampering, compromised builds), and ensuring that deployed artifacts originate from trusted sources and build environments. Key features include enforcing keyless OIDC identity pinning and validating SLSA Build Levels.

A systematic methodology for resolving deeply conflicting technical requirements (e.g., needing a system to be both fast and consistent). Instead of accepting a midpoint compromise or trade-off, TRIZ instructs users to name the conflict, separate the opposing states (using time, space, condition, or scale), and invent a concrete, no-compromise resolution. Ideal for architecture, API design, and complex system parameter definition.