Skill UI

Guides systematic detection and exploitation of cross-site scripting and HTML injection flaws, covering stored/reflected/DOM vectors, payload crafting, and remediation advice for web security assessments.

Leverages Monte Carlo-based simulation to spot potential software vulnerabilities by feeding randomized inputs into modules, tracking failure likelihoods, and highlighting risky code paths for security testing.

Yara Authoring helps security teams write precise YARA rules for threat detection and malware hunting by guiding string/tag management and metadata handling so signature creation keeps pace with investigations.

A powerful toolkit utilizing Objection and Frida for authorized mobile penetration testing. It enables deep runtime analysis of iOS applications, allowing users to inspect sensitive data in the keychain, filesystem, and memory. Key capabilities include bypassing client-side protections such as SSL pinning and jailbreak detection without requiring source code access.

Analyzes behavioral reports from security sandboxes (Cuckoo, AnyRun) to detect advanced anti-analysis and evasion techniques. It specifically identifies indicators such as timing checks, hypervisor artifact queries, user interaction patterns, and environment fingerprinting. This tool is essential for threat hunting, enhancing detection rules, and conducting deep malware triage.

This system maps advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework. Utilizing the attackcti library to query STIX/TAXII data, it generates specialized ATT&CK Navigator layer files. It is essential for security analysts to profile threat actors, visualize comprehensive coverage heatmaps, and precisely assess detection gaps against sophisticated adversaries.

A powerful security tool for querying Certificate Transparency (CT) logs via crt.sh and pycrtsh. It detects potential security threats such as phishing domains, unauthorized certificate issuance, and shadow IT infrastructure. The tool specifically monitors new certificates for typosquatting and brand impersonation using advanced distance metrics, enabling proactive security threat detection.

This skill parses various cyber threat intelligence (CTI) reports (Mandiant, CrowdStrike, etc.) using NLP and specialized libraries (stix2, mitreattack-python, spaCy). It systematically extracts adversary behaviors, maps them to MITRE ATT&CK IDs, and constructs a searchable STIX 2.1 Attack Pattern library. This is essential for threat-informed detection engineering, generating detection rules (Sigma, YARA), and validating security controls.

This skill provides a comprehensive workflow for building vendor-agnostic detection rules using the Sigma format. It empowers security operations center (SOC) engineers to translate raw threat intelligence and MITRE ATT&CK techniques into standardized, portable detection logic. The process guides users through rule validation and conversion into specific queries for major SIEM platforms, including Splunk, Elastic, and Microsoft Sentinel, ensuring robust detection coverage.

A comprehensive guide detailing how to integrate DevSecOps best practices into a GitLab CI/CD pipeline. It automates multiple security checks, including Static Analysis (SAST), Dynamic Analysis (DAST), container scanning, dependency scanning, and secret detection. This approach enforces 'shift-left' security, finding and fixing vulnerabilities early in the development lifecycle to ensure compliance and robust security.

A comprehensive, structured playbook for Security Operations Centers (SOCs) detailing the entire lifecycle of ransomware incidents. It guides analysts through detection (SIEM queries), triage decision trees, containment (EDR/Firewall), evidence collection, and recovery phases, adhering to NIST CSF and MITRE ATT&CK frameworks.

A comprehensive guide for responding to security incidents across major cloud providers (AWS, Azure, GCP). It details detection methods using cloud-native logs, containment strategies for compromising identities, evidence preservation techniques, and investigation steps for common cloud attack patterns.