Skill UI

Walks through analyzing RAM dumps with Volatility 3/2 to uncover injected code, hidden processes, network activity, and credentials when responding to compromised hosts.

This skill outlines the comprehensive process of memory forensics on compromised Linux systems. It guides users through acquiring volatile memory using the LiME kernel module and analyzing the resulting image with the Volatility 3 framework. Key artifacts extracted include process lists, network connections, bash history, and loaded kernel modules, making it an essential technique for incident response, threat hunting, and security investigations.

A comprehensive tool for detecting and analyzing covert communication channels used by sophisticated malware. It focuses on identifying anomalies in network traffic, such as DNS tunneling, ICMP exfiltration, and steganographic HTTP abuse, which are used for Command and Control (C2) communication and data exfiltration. Ideal for security incident response, threat hunting, and building advanced network detection rules.

This skill guides users through advanced network security analysis using Scapy. It covers crafting, sending, sniffing, and dissecting various network packets (TCP/UDP/ICMP), analyzing pcap files, and detecting anomalies like SYN floods or DNS exfiltration. Ideal for SOC analysts, forensic investigators, and security researchers.

Examines packet captures, Zeek logs, and NetFlow data to uncover C2 channels, lateral movement, and exfiltration during security incidents, guiding analysts through capture, filtering, and IOC extraction workflows.

This skill provides a comprehensive framework for building automated pipelines that ingest, normalize, and operationalize threat intelligence (TI). It connects diverse sources—including STIX/TAXII feeds, open-source feeds (e.g., Abuse.ch), and commercial TI platforms—into SIEM and security tools. Use this when SOC teams need to automate the entire lifecycle of IOC ingestion, scoring, and real-time matching against network telemetry.

A comprehensive guide for conducting penetration testing on iOS and Android mobile applications, adhering to the OWASP MASTG. This skill covers the full mobile attack surface, including static analysis of binaries, dynamic runtime testing, and deep API security assessment. Techniques taught include bypassing certificate pinning, analyzing local data storage (Keychain, SQLite), and identifying vulnerabilities in authentication and network communication.

A comprehensive guide for conducting authorized wireless network penetration tests. This skill assesses the overall security posture of WiFi infrastructure, covering weak encryption protocols, captive portal bypasses, Evil Twin attacks, WPA2/WPA3 handshake capture, and rogue access point detection. It evaluates wireless authentication methods, network segmentation, and the effectiveness of WIDS/WIPS systems.

This skill provides comprehensive guidance and PowerShell scripts for hardening Windows endpoints using Microsoft Defender for Endpoint (MDE). It covers advanced features like Attack Surface Reduction (ASR) rules to block common attack techniques, Controlled Folder Access for ransomware protection, and Network Protection. Use this for deploying enterprise-grade, compliance-required security policies via Intune or Group Policy.

Guides SOC teams through validating alerts, isolating networks and endpoints, preserving evidence, and disabling compromised accounts to rapidly contain an active breach while minimizing business impact.

This guide details the comprehensive deployment of Palo Alto Networks Prisma Access for implementing a modern SASE-based Zero Trust Network Access (ZTNA). It covers configuring the cloud infrastructure, deploying ZTNA Connectors, defining granular application policies, enforcing device posture via Host Information Profile (HIP), and utilizing GlobalProtect agents for secure, enterprise-grade remote access.

This skill monitors critical OT historian servers (such as OSIsoft PI and Ignition) located at the IT/OT boundary. It is designed to detect sophisticated cyber threats, including unauthorized access attempts, data manipulation, suspicious query patterns, and indicators of lateral movement between enterprise and control networks. Use it to validate data integrity and respond to potential ICS security incidents.