Skill UI

This skill provides advanced threat hunting capabilities to detect NTLM relay attacks within Active Directory environments. It analyzes critical Windows Security Event 4624 logs, specifically focusing on logon type 3 using NTLMSSP authentication. The detection logic identifies suspicious patterns, including IP-to-hostname mismatches, rapid multi-host authentications, and lack of SMB signing enforcement, helping SOC analysts pinpoint unauthorized credential access attempts.

This guide details advanced threat hunting techniques to proactively uncover adversary persistence mechanisms leveraging Windows Management Instrumentation (WMI) event subscriptions. It monitors the creation and binding of WMI events (Filter, Consumer, Binding) to detect malicious, fileless backdoors used by sophisticated threat actors, especially when standard persistence locations are clean.

A detailed methodology for proactive threat hunting focused on identifying deep-seated persistence mechanisms within Windows operating systems. This guide covers advanced techniques such as monitoring Run keys, analyzing Winlogon modifications, detecting IFEO injection, and identifying COM object hijacking. It is crucial for incident response, purple teaming, and ensuring system integrity against advanced persistent threats (APTs).

This guide details a threat hunting technique for detecting persistence mechanisms utilizing Windows Registry Run keys (T1547.001). By analyzing Sysmon Event ID 13 logs, it identifies suspicious auto-start entries pointing to temporary directories, encoded PowerShell commands, or abused LOLBins. Essential for SOC analysts and security engineers investigating incidents and developing robust detection rules.

This skill guides threat hunters in detecting MITRE ATT&CK T1098 account manipulation techniques. It focuses on analyzing Windows Security Event Logs (like 4738, 4728) to uncover shadow administration creation, suspicious group membership changes, SID history injection, and unauthorized credential modifications, crucial for incident response and building robust detection rules.

Scans web server roots for high-entropy files, suspicious PHP/JSP/ASP payloads, and recent modifications to flag obfuscated webshells via entropy thresholds, regex signatures, and file metadata.

This skill provides a comprehensive guide on implementing AES-256-GCM, a robust symmetric block cipher, for protecting sensitive data at rest. It covers best practices including secure key derivation (using PBKDF2 and Argon2id), proper management of initialization vectors (IVs) and nonces, and utilizing authenticated encryption to ensure data integrity and detect tampering.

This guide details the implementation of robust API abuse detection mechanisms. It covers advanced rate limiting techniques, such as the Token Bucket and Sliding Window algorithms, to defend APIs against DDoS attacks, brute force attempts, and credential stuffing. It emphasizes using distributed stores like Redis for accurate, scalable, and adaptive security controls in an API gateway context.

Implements comprehensive security controls for the entire API key lifecycle, including secure generation, hashing, storage, rotation, and revocation. This skill involves designing keys with sufficient entropy, enforcing per-key scoping, setting rate limits, and building automated workflows to prevent leakage and unauthorized access. Essential for robust server-to-server authentication.

This skill covers implementing robust API rate limiting and throttling controls using advanced algorithms like token bucket and sliding window. It teaches how to protect backend systems against attacks such as brute force, credential stuffing, and resource exhaustion. Key components include configuring limits per user, per IP, and per endpoint, utilizing Redis for distributed counting, and implementing proper HTTP 429 responses for effective abuse prevention.

API Security Posture Management (API-SPM) provides continuous, unified visibility into an organization's entire API attack surface. It automatically discovers, classifies, and risk-scores all APIs—including internal, external, and shadow endpoints. By aggregating findings from various sources (DAST, SAST, runtime logs), it helps enforce security policies, detect configuration drift, and maintain compliance across the entire API lifecycle.

This guide details how to implement multi-layered API threat protection using Google Apigee. It covers critical security policies including JSON/XML content validation, OAuth 2.0 enforcement, SpikeArrest rate limiting, and advanced regex patterns to defend against OWASP Top 10 threats. Ideal for establishing robust API security controls and meeting compliance requirements.