Skill UI

This skill outlines the comprehensive process of memory forensics on compromised Linux systems. It guides users through acquiring volatile memory using the LiME kernel module and analyzing the resulting image with the Volatility 3 framework. Key artifacts extracted include process lists, network connections, bash history, and loaded kernel modules, making it an essential technique for incident response, threat hunting, and security investigations.

This skill guides users through advanced network security analysis using Scapy. It covers crafting, sending, sniffing, and dissecting various network packets (TCP/UDP/ICMP), analyzing pcap files, and detecting anomalies like SYN floods or DNS exfiltration. Ideal for SOC analysts, forensic investigators, and security researchers.

This skill utilizes the Microsoft Graph API to parse Office 365 Unified Audit Logs for security incident investigation. It is designed to detect critical indicators of account compromise, including the creation of suspicious email forwarding rules, unauthorized mailbox delegation changes, suspicious OAuth application consent grants, and other signs related to Business Email Compromise (BEC).

This tool provides comprehensive forensic analysis for Microsoft Outlook PST and OST files. It extracts critical evidence such as message content, detailed headers, attachments, and deleted items using open-source libraries like libpff and Python, supporting legal investigations and incident response.

A specialized tool and workflow for investigating supply chain attacks. It helps security analysts analyze compromised software updates, trojanized binaries, and dependency artifacts by comparing legitimate versions against suspect files. Key functions include binary diffing, identifying injected code, and documenting code signing anomalies to determine the scope of a security breach.

A comprehensive digital forensics technique used to investigate removable media usage. It parses artifacts from Windows registry (USBSTOR, MountedDevices), Event Logs, and SetupAPI logs to track which USB devices were connected, when they were used, and establishing a timeline for potential data exfiltration or insider threat activity.

This comprehensive forensic workflow guides investigators through the extraction and detailed analysis of Windows Registry hives (SAM, SYSTEM, SOFTWARE, etc.). It is used during incident response to uncover critical artifacts, including user activity history, malware persistence mechanisms (autorun keys), installed software records, and evidence of system compromise.

This comprehensive guide details how to design and implement an end-to-end DevSecOps pipeline leveraging GitLab CI/CD. It integrates crucial automated security checks—such as SAST, DAST, container scanning, dependency scanning, and secret detection—directly into the development workflow. By adopting this approach, teams can effectively 'shift left' security, identifying and mitigating vulnerabilities early in the development lifecycle to ensure compliance and robust application security.

This skill analyzes AWS CloudTrail logs to detect suspicious API call patterns, such as new event sources, geographic anomalies, or high-frequency usage. It establishes a statistical baseline of normal activity and flags deviations indicative of compromised credentials, privilege escalation, or insider threats, providing a detailed JSON report for security investigation and threat hunting.

This skill analyzes AWS IAM policies using boto3 and Cloudsplaining principles to detect potential privilege escalation paths in AWS accounts. It identifies overly permissive policies, dangerous permission combinations (such as combining role passing and resource creation), and violations of least-privilege principles. It is designed for security incident investigation, threat hunting, and validating overall cloud security posture.

This script detects and analyzes sophisticated fileless malware techniques that operate entirely in system memory. It specializes in identifying threats that utilize Living Off the Land Binaries (LOLBins), WMI event subscriptions, and registry-resident payloads, bypassing traditional file-based security controls. It is ideal for forensic investigations, threat hunting, and building advanced detection rules in modern enterprise environments.

A comprehensive skill designed for advanced security analysis, detecting malicious behaviors across mobile applications (Android/iOS). It performs multi-layered analysis, including static indicator checks (permissions, manifest), dynamic instrumentation via Frida, network traffic monitoring (C2 communication, exfiltration), and automated scanning (MobSF). Use this when investigating suspicious apps, detecting trojans, or performing malware triage.