Skill UI

This skill analyzes Active Directory (AD) Access Control Lists (ACLs) to detect dangerous misconfigurations. It uses the ldap3 Python library to query domain controllers, parse security descriptors (SDDL), and identify instances where non-privileged users or groups are granted dangerous permissions like GenericAll, WriteDACL, or WriteOwner on sensitive objects. Essential for security incident response and privilege escalation path discovery.

A comprehensive tool for performing static analysis on Android APK malware samples. It utilizes androguard, apktool, and jadx to detect dangerous permission combinations, suspicious API calls (like reflection or crypto), dynamic code loading patterns, and extract Indicators of Compromise (IOCs) for robust security incident response and threat hunting.

This guide details the comprehensive process of using the Linux Audit framework (auditd) to detect advanced security threats. It covers deploying specific rules to monitor critical system files, detecting unauthorized privilege escalation, process injection, and suspicious system calls. Users can then leverage ausearch and aureport to efficiently query, reconstruct timelines, and summarize findings for forensic analysis and compliance auditing.

A powerful security tool for querying Certificate Transparency (CT) logs via crt.sh and pycrtsh. It detects potential security threats such as phishing domains, unauthorized certificate issuance, and shadow IT infrastructure. The tool specifically monitors new certificates for typosquatting and brand impersonation using advanced distance metrics, enabling proactive security threat detection.

Systematically review Kubernetes RBAC roles, bindings, and service accounts to surface overly permissive access, privilege escalation paths, and least-privilege violations using tools like rbac-tool and KubiScan.

This skill guides the creation of automated workflows for enriching raw Indicators of Compromise (IOCs) with multi-source threat intelligence context. It is designed for integration into SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR) or Python pipelines. By automatically querying multiple sources like VirusTotal, AbuseIPDB, and MISP, it significantly reduces analyst mean time to triage (MTTT) and standardizes the resulting threat context and confidence scoring.

Builds a comprehensive, automated pipeline for malware submission and analysis. It collects suspicious files from multiple sources (EDR, email gateways), automatically submits them to sandbox environments and multi-engine scanners, and generates detailed verdicts and Indicators of Compromise (IOCs). Essential for SOC teams needing to scale high-volume malware triage and incident response.

This skill details the architecture and implementation of an automated Indicator of Compromise (IOC) enrichment pipeline using OpenCTI. It demonstrates how to connect OpenCTI to various external threat intelligence services (like VirusTotal, Shodan, AbuseIPDB) to automatically gather context, correlate indicators, and assign confidence scores. This is crucial for enhancing security monitoring and prioritizing threats for cyber analysts.

This system manages vulnerabilities that cannot be remediated within Service Level Agreement (SLA) timelines. It provides structured workflows for requesting exceptions, documenting compensating controls, obtaining formal risk acceptance approvals, and automatically managing expiration. It helps organizations maintain visibility into accepted risks to comply with major frameworks like PCI DSS, SOC 2, and NIST CSF.

This guide details advanced techniques for authorized security assessments, focusing on forced browsing. It helps testers discover hidden administrative pages, unprotected APIs, and configuration files by systematically enumerating URLs and challenging application access control mechanisms. Techniques involve using tools like ffuf and Gobuster for comprehensive path and directory discovery.

A robust framework for orchestrating complex, multi-step coding tasks using multiple AI agents. It functions by first planning the entire project into a mission dependency graph (DAG), then dispatching specialized agents to isolated Git worktrees for parallel development. The system automatically monitors progress, handles merges, and generates structured, comprehensive reports detailing changes, completed tasks, and next steps.

This skill guides the setup of Host-Based Intrusion Detection Systems (HIDS) using industry-standard tools like Wazuh, OSSEC, or AIDE. It covers essential security practices, including File Integrity Monitoring (FIM) for critical directories, monitoring system calls, detecting configuration changes, and identifying rootkits. It is crucial for meeting regulatory compliance requirements (e.g., PCI DSS) and significantly enhancing overall endpoint security posture.