Skill UI

A comprehensive skill designed for advanced security analysis, detecting malicious behaviors across mobile applications (Android/iOS). It performs multi-layered analysis, including static indicator checks (permissions, manifest), dynamic instrumentation via Frida, network traffic monitoring (C2 communication, exfiltration), and automated scanning (MobSF). Use this when investigating suspicious apps, detecting trojans, or performing malware triage.

This comprehensive guide configures Fail2ban to implement a robust, layered defense mechanism for network security. It sets up custom filters and actions to automatically detect and mitigate threats such as port scanning, SSH brute force attempts, and network reconnaissance. By dynamically banning malicious IP addresses and providing security alerts, this skill significantly enhances the host-based intrusion prevention capabilities of your system.

This skill analyzes Azure AD/Microsoft Entra ID environments to detect illicit OAuth application consent grants. It leverages the Microsoft Graph API and directory audit logs to enumerate permissions, identify overly broad scopes, and flag high-risk applications based on publisher verification status. It is essential for SOC analysts and threat hunters investigating cloud identity security incidents.

This skill detects anti-forensic timestomping by analyzing NTFS Master File Table (MFT) entries. It compares timestamps from the $STANDARD_INFORMATION attribute (user-modifiable) against the $FILE_NAME attribute (kernel-protected). Discrepancies, such as SI Created < FN Created, strongly indicate malicious manipulation and defense evasion. This methodology is crucial for advanced threat hunting and digital forensic investigations.

This skill detects domain fronting, an advanced technique used by attackers to mask Command and Control (C2) traffic. It analyzes proxy/web gateway logs for mismatches between the TLS SNI field and the HTTP Host header, combined with deep TLS certificate inspection using pyOpenSSL. This is crucial for security teams investigating sophisticated network threats and validating detection coverage.

This guide details a threat hunting technique for detecting persistence mechanisms utilizing Windows Registry Run keys (T1547.001). By analyzing Sysmon Event ID 13 logs, it identifies suspicious auto-start entries pointing to temporary directories, encoded PowerShell commands, or abused LOLBins. Essential for SOC analysts and security engineers investigating incidents and developing robust detection rules.

A comprehensive guide to securing Kubernetes Role-Based Access Control (RBAC). It teaches best practices for implementing least-privilege policies, eliminating excessive cluster-admin bindings, utilizing namespace-scoped roles, and integrating external identity providers (OIDC) to mitigate risks like privilege escalation and unauthorized data access.

This guide details how to implement sophisticated Security Orchestration, Automation, and Response (SOAR) playbooks using Palo Alto Cortex XSOAR. It demonstrates full lifecycle automation, such as phishing incident investigation, requiring enrichment of URLs, IPs, and files, followed by automated containment actions (e.g., blocking senders, purging mailboxes). Mastering this allows SOC teams to drastically reduce Mean Time To Respond (MTTR) by automating detection, analysis, and remediation steps across multiple security tools.

This guide details the implementation of Zero Trust Architecture for securing Software as a Service (SaaS) applications. It leverages Conditional Access Policies, CASB (Cloud Access Security Broker), and Identity Governance to enforce strict identity verification, device compliance, and data loss prevention (DLP) across cloud environments (e.g., M365, Salesforce). It helps mitigate risks associated with shadow IT and excessive application permissions.

A comprehensive guide for mastering version control using GitHub and Git. It provides two modes: Guided Setup for first-time users, and an adaptive, hands-on curriculum for learning advanced concepts like branching, PR workflows, and CI/CD. The system automatically adjusts language and depth based on the user's skill level, ensuring effective, real-world learning.

This skill provides methods for comprehensive forensic acquisition of data from major cloud services, including Google Drive, OneDrive, Dropbox, and Box. It collects evidence through both API-based remote acquisition and local endpoint artifact analysis, making it essential for incident response, security assessments, and digital forensic investigations.

This skill automates the enrichment of Indicators of Compromise (IOCs) by orchestrating lookups across multiple industry-leading threat intelligence sources (e.g., VirusTotal, AbuseIPDB, Shodan). It provides contextual scoring and disposition recommendations for IPs, domains, URLs, and hashes. Ideal for SOC analysts during alert triage or incident investigation to quickly assess risk and scope.