Skill UI

This skill provides a structured methodology and Python implementation for monitoring and analyzing data leak sites (DLS) associated with ransomware groups. It helps security analysts track victim postings, extract threat intelligence on group tactics, assess sector-specific risks, and understand evolving ransomware threat landscapes for proactive defense.

This guide provides advanced detection methods and threat hunting queries (KQL/SPL) to identify abuse of Azure service principals. It covers techniques such as privilege escalation, credential compromise, unauthorized role assignment, and enumeration, essential for SOC analysts and security teams monitoring Microsoft Entra ID.