Skill UI

Parse Linux auditd logs for unauthorized file access, privilege escalation, syscall anomalies, and suspicious processes using ausearch plus Python automation.

Parses Apache/Nginx Combined logs to flag SQL injection, LFI, XSS, scanner fingerprints, brute-force bursts, enriches hits with GeoIP, and delivers a prioritized JSON report for SOC analysts.

Performs authorized wireless penetration tests to probe WPA2/WPA3, evil twins, rogue APs, captive portals, and client-side attacks, validating wireless authentication, network segmentation, and intrusion detection in enterprise WiFi environments.

Guides configuring host-based intrusion detection systems such as Wazuh, OSSEC, or AIDE for endpoint monitoring, file integrity policies, rootkit checks, and alert automation when deploying agents on Windows and Linux.

Guides installing, configuring, and tuning Snort 3 to inspect traffic at critical boundaries using custom and community rules, DAQ, and alert outputs, helping security teams validate controls and feed SIEM platforms.

Identifies cyber attacks that target SCADA/ICS environments by leveraging OT-aware intrusion detection, industrial protocol anomaly analysis, and process data baselines to spot MITM, PLC injection, historian tampering, and DoS cases that IT-focused tools miss.

Simulates real-world adversary operations across people, processes, and technology by running full-scope red team exercises that stealthily work through reconnaissance, intrusion, post-exploitation, and objective completion to validate detection, response, and resilience.