Skill UI

Performs authorized file path traversal assessments to map web inputs, craft traversal payloads, and document sensitive files that can be read, aiding defenders in hardening filesystem handling during security reviews.

Analyze email headers to uncover sender origins, routing chains, and authentication results, enabling defenders to validate legitimacy and spot phishing indicators using manual inspection and automation scripts.

This framework guides the systematic process of proactive threat hunting. It transforms raw threat intelligence and ATT&CK gap analyses into concrete, testable hypotheses. Users execute these hypotheses using industry-standard EDR/SIEM platforms (Splunk, CrowdStrike, Defender, etc.) to validate potential compromises, correlate activity, and document findings in a standardized report format.

This skill provides comprehensive guidance and PowerShell scripts for hardening Windows endpoints using Microsoft Defender for Endpoint (MDE). It covers advanced features like Attack Surface Reduction (ASR) rules to block common attack techniques, Controlled Folder Access for ransomware protection, and Network Protection. Use this for deploying enterprise-grade, compliance-required security policies via Intune or Group Policy.

Detect unauthorized crypto-mining in AWS, Azure, and GCP by correlating GuardDuty/Defender/SCC findings, compute anomalies, network flows, and container/serverless behaviors to validate threats and guide response.

Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image. Uses Falco and Microsoft Defender for Containers. Ideal for validating immutable-infrastructure controls, hunting for unexpected package installs or binaries, and determining whether a container diverged from its source image.

This skill implements Cloud Security Posture Management (CSPM) across multi-cloud environments. It detects critical cloud-native misconfigurations, such as over-permissive IAM roles, exposed storage buckets, and unencrypted data, using industry-leading tools like AWS Security Hub, Azure Defender for Cloud, Prowler, and ScoutSuite. Use this when conducting comprehensive audits of complex, multi-cloud infrastructures for compliance or building consolidated security posture reports.

Methodology for red team testing of on-prem Active Directory, hybrid AD/Entra ID, and ADCS. Covers reconnaissance, credential abuse, privilege escalation, lateral movement, persistence, trust abuse, and Defender for Identity evasion.

This solution provides a comprehensive framework for detecting compromised cloud credentials across AWS, Azure, and GCP. It analyzes anomalous API activity, impossible travel patterns, and indicators of credential stuffing by leveraging services like AWS GuardDuty, Azure Defender, and GCP SCC. Use this when investigating suspicious cloud API calls, responding to exposed credential alerts, or scoping a potential account takeover.