Skill UI

Guides forensic analysts through using Volatility 3 (and legacy Volatility 2) to inspect RAM dumps, identify injected/malicious processes, dump artifacts, scan with YARA, and extract credentials or network activity from compromised systems.

Detects anomalous authentication patterns via UEBA, statistical baselines, and machine learning to flag impossible travel, credential stuffing, brute force, and compromised account behavior across authentication logs for SOC investigations.

Detect compromised AWS, Azure, and GCP credentials by analyzing GuardDuty, Defender for Identity, and SCC alerts alongside log anomalies, impossible travel, and unauthorized provisioning indicators for rapid incident response.

Orchestrates cloud-native incident containment across AWS, Azure, and GCP by isolating compromised compute and storage, revoking credentials, preserving evidence, and enforcing strict network controls to stop lateral movement.

Performs privilege escalation assessments on compromised Linux and Windows hosts to trace paths from low-privilege shells to root/SYSTEM control. Enumerates misconfigurations, SUID binaries, kernel exploits, and credential stores so testers can demonstrate escalation impact and validate controls like least-privilege policies and EDR detections.

Automates periodic service account credential rotation across Active Directory, cloud providers, and databases, ensuring secrets are renewed, propagated, and validated to minimize stale keys and compromise risk.