Skill UI

This guide provides advanced detection methods and threat hunting queries (KQL/SPL) to identify abuse of Azure service principals. It covers techniques such as privilege escalation, credential compromise, unauthorized role assignment, and enumeration, essential for SOC analysts and security teams monitoring Microsoft Entra ID.

This skill guides security analysts through advanced threat-hunting methodologies focused on detecting DNS-based persistence. It analyzes passive DNS history, zone file audits, and API data (like SecurityTrails) to identify unauthorized record modifications, subdomain takeovers, and DNS hijacking attempts that bypass traditional security controls. Ideal for SOC analysts and threat hunters.

A comprehensive guide and workflow demonstrating how to use YARA rules for proactive threat hunting. This method helps detect unknown malware, suspicious patterns, and Indicators of Compromise (IOCs) across filesystems, memory dumps, and network artifacts, making it essential for incident response and security analysis.