Skill UI

This guide details a threat hunting technique for detecting persistence mechanisms utilizing Windows Registry Run keys (T1547.001). By analyzing Sysmon Event ID 13 logs, it identifies suspicious auto-start entries pointing to temporary directories, encoded PowerShell commands, or abused LOLBins. Essential for SOC analysts and security engineers investigating incidents and developing robust detection rules.

This skill guides threat hunters in detecting MITRE ATT&CK T1098 account manipulation techniques. It focuses on analyzing Windows Security Event Logs (like 4738, 4728) to uncover shadow administration creation, suspicious group membership changes, SID history injection, and unauthorized credential modifications, crucial for incident response and building robust detection rules.

Monitors Windows process creation events to flag Living Off The Land Binary abuse by matching Event ID 4688/Sysmon 1 logs against LOLBAS database entries, supporting threat hunting and SIEM rule creation for fileless attacks.

This skill provides a structured framework for implementing patch management in Operational Technology (OT) and Industrial Control Systems (ICS) environments. It addresses the critical balance between cybersecurity remediation and maintaining continuous operational safety and availability. Key components include risk-based patch prioritization, vendor compatibility testing, staged deployment through test environments, managing maintenance windows, and implementing compensating controls for unpatchable assets.

This guide details how to implement advanced SIEM correlation rules to detect sophisticated Advanced Persistent Threats (APTs). By chaining multiple event types—including Windows authentication events, process execution telemetry, and network connection logs—across hosts, users can surface complex attack sequences that are invisible to single-event detections. It utilizes Splunk SPL and Sigma rule formats for robust security posture enhancement.

This skill covers performing comprehensive vulnerability assessments across diverse environments, including on-premises infrastructure, cloud VMs, and container registries. It leverages standard network protocols like SSH (Linux) and WMI (Windows), coupled with advanced cloud provider APIs for analyzing disk snapshots without requiring local endpoint agents. Ideal for security auditing and compliance checks.

This guide provides a comprehensive methodology for performing directory traversal and path traversal testing on web applications. It covers identifying file path parameters, executing basic payloads (Linux/Windows), bypassing common security filters using encoding (URL, double, UTF-8), and automating the process with tools like ffuf and dotdotpwn. It also details advanced steps for local file inclusion (LFI) and potential escalation to Remote Code Execution (RCE) via log poisoning.

This skill details advanced techniques for performing stealthy lateral movement across Windows domains using Windows Management Instrumentation (WMI). It covers the abuse of native tools like Impacket's wmiexec.py and CrackMapExec, enabling remote command execution, Pass-the-Hash attacks, and fileless techniques, crucial for authorized red team engagements and security auditing.

A comprehensive guide for cybersecurity professionals detailing the process of collecting, parsing, and correlating system, application, and security logs (Windows EVTX, Linux syslog, web logs). It helps reconstruct event timelines, identify breach activity, and establish evidence for forensic reports.

This automated toolkit streamlines memory forensics using the Volatility3 framework. It is designed to analyze raw memory dumps from Windows, Linux, and macOS, revealing complex threats such as process injection, hidden rootkits, malicious code artifacts, and illicit network connections that traditional disk-based methods cannot detect. Essential for real-time incident response and deep security auditing.

This guide provides a comprehensive workflow for configuring SSL/TLS inspection on network security devices. It covers deploying root CA certificates across various operating systems (Windows, macOS, Linux), setting up forwarding proxies, and configuring next-generation firewalls to decrypt, inspect, and re-encrypt encrypted HTTPS traffic for advanced threat detection and compliance.

A comprehensive guide detailing best practices for executing commands on Windows using PowerShell and CMD. It addresses critical pitfalls such as handling spaces in file paths, ensuring correct character encoding (UTF-8), using native cmdlets, and managing long path limits. Essential for developers building robust, cross-platform Windows automation scripts.