Skill UI

This skill details how to monitor Certificate Transparency (CT) logs using industry tools like crt.sh and Certstream. By analyzing publicly issued SSL/TLS certificates, users can proactively detect lookalike domains, unauthorized certificate issuance for owned assets, and early-stage phishing infrastructure targeting their organization. Ideal for SOC analysts and threat hunters.

This guide provides a deep dive into the cryptographic techniques used by ransomware, including AES, RSA, ChaCha20, and hybrid schemes. It covers identifying algorithms, analyzing key management patterns (strong, weak, flawed), and reverse engineering file encryption routines to assess decryption feasibility and support recovery efforts.

This technique exploits the Active Directory attribute `msDS-KeyCredentialLink` by injecting attacker-controlled public keys (Shadow Credentials). Using tools like pyWhisker and Certipy, the attacker forces the target account to register a new key. Subsequently, by leveraging PKINIT (Public Key Cryptography for Initial Authentication in Kerberos), the attacker can obtain a service ticket and recover the target's NT hash, achieving a stealthy, password-less, complete account takeover.

ROADtools is a comprehensive offensive toolkit for Microsoft Entra ID (Azure AD). It consists of ROADrecon for offline directory enumeration (users, groups, roles, policies) and roadtx for advanced token acquisition and exchange. It is designed for authorized red-teaming and penetration testing to discover attack paths and pivot tokens across various Microsoft resources.

This skill provides comprehensive security auditing for Model Context Protocol (MCP) servers and their associated tool metadata. It is designed to detect sophisticated supply chain attacks, including tool poisoning (indirect prompt injection), Server-Side Request Forgery (SSRF), tool shadowing, and unauthenticated exposure. It is essential for securing AI agent stacks before integrating new tools or during CI/CD processes.

This skill detects malicious, misspelled, or brand-jacked package names (typosquatting) across major ecosystems (npm, PyPI, crates.io). It uses advanced techniques like edit-distance and keyboard-proximity analysis, powered by tools like typomania and OSSGadget, to flag potential supply chain attacks *before* a dependency is installed. It is essential for implementing robust CI/CD security gates and proactive dependency screening.

This PowerShell toolset performs advanced post-exploitation, reconnaissance, persistence, and data exfiltration against Microsoft 365/Entra ID tenants using the Microsoft Graph API. It operationalizes stolen Graph tokens to enumerate users, dump policies, escalate privileges, and search sensitive data across mailboxes, SharePoint, and Teams. Essential for authorized red teaming engagements.

This skill guides the verification of software build provenance and signatures using industry standards like SLSA and Sigstore. It leverages tools like cosign and slsa-verifier to enforce keyless OIDC identity and confirm that artifacts were built by trusted sources without tampering. It is essential for hardening CI/CD pipelines and securing the entire software supply chain against advanced attacks.