Skill UI

This skill provides advanced threat hunting techniques to detect unauthorized data exfiltration. It guides the analysis of network traffic, DNS queries, and cloud uploads to identify unusual data flows, DNS tunneling, and abuse of encrypted channels, essential for incident response and preventing data loss.

This skill utilizes the Thinkst Canary REST API to programmatically deploy various decoy tokens, including web bugs, DNS records, MS Word documents, and AWS API keys. By monitoring these fake resources, the system detects unauthorized internal or external access attempts, providing early warnings and generating detailed deception coverage reports to strengthen security architecture.

Audits a domain’s email authentication by querying SPF, DKIM, and DMARC DNS records using dnspython, validating syntax/counts, flagging common spoofing risks, and producing remediation guidance.

This skill details the deployment and advanced querying techniques for Arkime (Moloch), enabling comprehensive full packet capture network traffic analysis. Users can leverage the Arkime API v3 to search connections, download PCAPs, detect sophisticated C2 beaconing, and analyze connection patterns and anomalies across DNS, HTTP, and TLS traffic. Essential for security monitoring and network forensics.

This skill implements a comprehensive brand monitoring system to detect brand impersonation attacks across multiple digital attack surfaces, including domain squatting, social media profiles, phishing sites, mobile apps, and the dark web. It uses tools like dnstwist and integrates APIs (Google Safe Browsing, VirusTotal) to proactively identify unauthorized brand usage and potential cyber threats targeting an organization.

Zeek is a powerful, open-source network security monitoring framework that generates high-fidelity structured logs and metadata from raw network traffic. This skill covers deploying Zeek, analyzing various protocol logs (HTTP, DNS, TLS, etc.), writing custom detection scripts to identify anomalies, and integrating resulting security insights with SIEM platforms for comprehensive threat detection and forensic investigation.

This skill provides a comprehensive guide to executing web cache deception attacks. It details methods for exploiting path normalization discrepancies, delimiter abuse, and cache key manipulation across CDNs and reverse proxies (e.g., Cloudflare, Akamai). Use this during authorized penetration testing to assess if authenticated sensitive content can be cached and retrieved by unauthenticated attackers.

A comprehensive guide for security professionals detailing how to exploit web cache mechanisms (CDNs, reverse proxies) to inject malicious content. It covers identifying caching layers, discovering unkeyed headers (like X-Forwarded-Host), and executing poisoning attacks for authorized penetration testing.

A comprehensive guide for analyzing .NET malware (C#, VB.NET, F#) using professional tools like dnSpy and de4dot. Learn to decompile code, identify obfuscation techniques (ConfuserEx, SmartAssembly), extract C2 configurations, and debug malicious behavior in stealers and RATs.

Register ICANN domains via a REST API with crypto payments so AI agents can autonomously check availability, pay in USDC/USDT/ETH/BTC, and retrieve DNS management credentials.

A comprehensive guide and technical framework for detecting and mitigating ransomware kill switch mechanisms. It details methods for analyzing mutex guards, domain-based communication, and registry checks. Learn how to deploy proactive mutex vaccination and use Sysmon/DNS monitoring to prevent malware execution during incident response and analysis.

This skill detects malicious Command and Control (C2) communications tunneled through the DNS protocol. It analyzes DNS query logs for indicators such as DNS tunneling tools (Iodine, dnscat2), Domain Generation Algorithms (DGA), and encoded payloads within TXT/CNAME records. Techniques include Shannon entropy analysis of subdomains, statistical anomaly detection, and machine learning classification. Ideal for network security analysts conducting deep threat hunting and forensic investigations.