Skill UI

This guide details advanced threat hunting techniques to proactively uncover adversary persistence mechanisms leveraging Windows Management Instrumentation (WMI) event subscriptions. It monitors the creation and binding of WMI events (Filter, Consumer, Binding) to detect malicious, fileless backdoors used by sophisticated threat actors, especially when standard persistence locations are clean.

This skill guides the implementation of digital signatures using Ed25519, a high-performance cryptographic algorithm based on the Edwards curve. It provides 128-bit security with small keys and signatures, offering significant advantages over RSA and ECDSA, including deterministic signing and side-channel resistance. Learn to generate key pairs, sign documents and code, and verify signatures for robust security controls.

This tool guides the deployment and configuration of the Dragos Platform for critical Operational Technology (OT) and Industrial Control System (ICS) network monitoring. It leverages over 600 industrial protocol parsers and advanced threat intelligence to detect sophisticated attacks (e.g., VOLTZITE, GRAPHITE). Use it for building an OT Security Operations Center (SOC), asset discovery, and vulnerability management in industrial settings, integrating alerts with enterprise SIEMs.

This skill provides comprehensive knowledge on using JSON Web Tokens (JWT) for secure authentication and authorization. It covers implementing various cryptographic signing algorithms (such as HS256, RS256, ES256, and EdDSA), validating signatures, enforcing claim constraints (like expiration time), and implementing robust defenses against common JWT vulnerabilities, including algorithm confusion and the 'none' algorithm attack. Ideal for building secure, scalable web APIs.

This skill details the deployment and advanced querying techniques for Arkime (Moloch), enabling comprehensive full packet capture network traffic analysis. Users can leverage the Arkime API v3 to search connections, download PCAPs, detect sophisticated C2 beaconing, and analyze connection patterns and anomalies across DNS, HTTP, and TLS traffic. Essential for security monitoring and network forensics.

This guide demonstrates how to programmatically create, validate, and exchange complex structured threat intelligence objects (Indicators, Malware, Campaigns) using the STIX 2.1 standard and the stix2 Python library. It covers the full lifecycle of intelligence sharing, including defining patterns and publishing data via TAXII 2.1, making it essential for building sophisticated Threat Intelligence Platforms (TIPs) and integrating with SIEM/SOAR systems.

This guide details how to implement advanced SIEM correlation rules to detect sophisticated Advanced Persistent Threats (APTs). By chaining multiple event types—including Windows authentication events, process execution telemetry, and network connection logs—across hosts, users can surface complex attack sequences that are invisible to single-event detections. It utilizes Splunk SPL and Sigma rule formats for robust security posture enhancement.

This skill automates the entire phishing incident response lifecycle using the Splunk SOAR REST API. It processes reported emails, extracts indicators of compromise (IOCs) like URLs and IPs, creates incident containers, attaches artifacts, and triggers automated playbooks for deep analysis and reporting. It is essential for security operations teams needing robust, programmatic incident handling and compliance alignment.

This guide details how to implement sophisticated Security Orchestration, Automation, and Response (SOAR) playbooks using Palo Alto Cortex XSOAR. It demonstrates full lifecycle automation, such as phishing incident investigation, requiring enrichment of URLs, IPs, and files, followed by automated containment actions (e.g., blocking senders, purging mailboxes). Mastering this allows SOC teams to drastically reduce Mean Time To Respond (MTTR) by automating detection, analysis, and remediation steps across multiple security tools.

In-toto is a CNCF standard project used to verify the integrity of software supply chains. It generates cryptographically signed attestations (link metadata) at every stage of the CI/CD pipeline, proving exactly what artifacts were produced and who authorized the process. This is crucial for securing container builds and ensuring compliance against tampering.

This skill implements a comprehensive brand monitoring system to detect brand impersonation attacks across multiple digital attack surfaces, including domain squatting, social media profiles, phishing sites, mobile apps, and the dark web. It uses tools like dnstwist and integrates APIs (Google Safe Browsing, VirusTotal) to proactively identify unauthorized brand usage and potential cyber threats targeting an organization.

Cartography is a CNCF project designed to perform comprehensive cloud asset inventory across AWS, GCP, and Azure. It queries cloud APIs to aggregate infrastructure resources, map complex relationships (like IAM permissions and network paths), and store them in a Neo4j graph database. This allows security teams to visualize potential attack paths, conduct deep security audits, and identify cross-cloud misconfigurations.