Skill UI

Use boto3, Athena, and the AWS CLI to query CloudTrail logs, reconstruct attacker timelines, surface suspicious API calls and credential abuse, then craft forensic reports for AWS incident response.

Uses ANY.RUN's cloud sandbox for interactive malware hunts, letting analysts trigger dialogs, monitor process trees, capture traffic, and export behavioral evidence without local infrastructure.

Detects lateral movement techniques such as Pass-the-Hash, PsExec, WMI, RDP, and SMB pivots through SIEM correlation of Windows event logs, network flows, and endpoint telemetry aligned with MITRE ATT&CK TA0008 for SOC response and investigation.

Performs forensic investigation on Linux logs (auth.log, syslog, kern.log, journalctl, auditd, cron, package logs) to reconstruct user activity, detect unauthorized access, and timeline intrusions with scripts and shell commands.

Workflow for collecting, parsing, and correlating Windows, Linux, and web logs to rebuild timelines, surface malicious actions, and support forensic reporting during incident investigations.

Tracking Threat Actor Infrastructure uses Shodan, Censys, passive DNS, CT logs, WHOIS, and network fingerprinting to discover, map, and pivot across adversary-controlled servers and domains, letting analysts detect new C2 nodes and phishing sites earlier.

Astro is a content-focused web framework that ships zero JavaScript by default while selectively hydrating interactive Islands, letting you mix React, Vue, Svelte, and other UI components. It excels for blogs, docs, marketing, and e-commerce sites with Markdown/MDX content that need static output with optional SSR.