Skill UI

A comprehensive guide and methodology for proactively hunting adversary abuse of legitimate cloud services (Azure, AWS, GCP, SaaS). This technique focuses on identifying Command and Control (C2), data staging, and exfiltration methods that leverage normal cloud functionality, making detection challenging.

This skill guides the implementation of network traffic baselining using historical NetFlow/IPFIX data. It leverages Python's pandas library to compute detailed statistical profiles, including hourly/daily distributions, per-host metrics, and protocol ratios. Anomalies are robustly detected using z-score and Interquartile Range (IQR) methods, assisting SOC analysts in identifying unusual activities like data exfiltration or beaconing.

Offensive cloud security methodology for AWS, Azure, and GCP. Covers identity discovery, credential harvesting, enumeration, privilege escalation, persistence, data exfiltration, lateral movement, serverless abuse, Kubernetes paths, and detection evasion during authorized assessments.

This comprehensive playbook details advanced techniques for testing and exploiting Large Language Models (LLMs). It covers direct instruction override, indirect poisoning via RAG and web sources, function/tool abuse, and sophisticated data exfiltration methods. Essential reading for AI security researchers and penetration testers.