Skill UI

This powerful tool leverages DNSTwist, a comprehensive domain permutation engine, to detect various forms of domain impersonation. It generates thousands of potential lookalike domains (including typosquatting, attribute flaws, and homographs) and performs deep checks on DNS records, web page similarity (ssdeep/pHash), and registration status. It is vital for security analysts and threat hunters to proactively monitor for brand squatting and sophisticated phishing threats targeting an organization.

This guide details comprehensive methods for auditing Terraform infrastructure-as-code (IaC) against security misconfigurations. By leveraging industry-standard tools like Checkov, tfsec, Terrascan, and Open Policy Agent (OPA), users can detect critical vulnerabilities—such as overly permissive IAM policies, public resource exposure, and missing encryption—before cloud deployment. It is essential for integrating robust security gates into CI/CD pipelines and enforcing compliance standards.

This skill details the implementation of a cloud-native SIEM and SOAR platform using Microsoft Sentinel. It covers ingesting multi-cloud logs (AWS, Azure, GCP), writing advanced KQL detection queries for threat hunting, and automating incident response workflows using Logic Apps. Ideal for centralized security operations in complex, multi-cloud environments.

This comprehensive guide details how to design and implement an end-to-end DevSecOps pipeline leveraging GitLab CI/CD. It integrates crucial automated security checks—such as SAST, DAST, container scanning, dependency scanning, and secret detection—directly into the development workflow. By adopting this approach, teams can effectively 'shift left' security, identifying and mitigating vulnerabilities early in the development lifecycle to ensure compliance and robust application security.

This skill details the architecture and implementation of an automated Indicator of Compromise (IOC) enrichment pipeline using OpenCTI. It demonstrates how to connect OpenCTI to various external threat intelligence services (like VirusTotal, Shodan, AbuseIPDB) to automatically gather context, correlate indicators, and assign confidence scores. This is crucial for enhancing security monitoring and prioritizing threats for cyber analysts.

This solution guides the implementation of a phishing reporting button within email clients, creating a critical feedback loop for security teams. By integrating with SOAR platforms, reported suspicious emails undergo automated triage, including IOC extraction, sandbox analysis, and threat intelligence checks. The workflow enables rapid classification, automated remediation (e.g., mass retraction, sender blocking), and provides detailed feedback to the user reporter, significantly enhancing overall security posture.

A comprehensive, structured playbook for Security Operations Centers (SOCs) detailing the entire lifecycle of ransomware incidents. It guides analysts through detection (SIEM queries), triage decision trees, containment (EDR/Firewall), evidence collection, and recovery phases, adhering to NIST CSF and MITRE ATT&CK frameworks.

This guide details how to build automated threat intelligence enrichment pipelines within Splunk Enterprise Security. By leveraging the Threat Intelligence Framework, users can ingest, normalize, and correlate Indicators of Compromise (IOCs) from diverse external sources (such as TAXII, CSV, and custom APIs). The process uses KV Store collections and lookup searches to enrich raw security events with critical threat context, significantly reducing triage time for SOC teams.

This skill provides a comprehensive framework for building automated pipelines that ingest, normalize, and operationalize threat intelligence (TI). It connects diverse sources—including STIX/TAXII feeds, open-source feeds (e.g., Abuse.ch), and commercial TI platforms—into SIEM and security tools. Use this when SOC teams need to automate the entire lifecycle of IOC ingestion, scoring, and real-time matching against network telemetry.

This guide details advanced techniques for authorized security assessments, focusing on forced browsing. It helps testers discover hidden administrative pages, unprotected APIs, and configuration files by systematically enumerating URLs and challenging application access control mechanisms. Techniques involve using tools like ffuf and Gobuster for comprehensive path and directory discovery.

MISP (Malware Information Sharing Platform) is an open-source platform designed for gathering, storing, and correlating Indicators of Compromise (IOCs). This skill guides users through deploying MISP using Docker, configuring various threat feeds (MISP, TAXII, CSV), and utilizing the PyMISP Python API. It enables the building of automated pipelines to aggregate diverse threat data, such as IP addresses, domains, and hashes, for enhanced security operations.

This skill details the advanced technique of DCSync, which exploits the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller. It is primarily used in authorized red-teaming and penetration testing to dump sensitive credentials, extract the KRBTGT hash, and ultimately forge Golden Tickets, establishing deep domain persistence. Ideal for security auditors and offensive security professionals.