Skill UI

Detects abnormal access patterns across major cloud storage platforms, including AWS S3, GCS, and Azure Blob Storage. By analyzing cloud audit logs (CloudTrail, etc.), this tool identifies critical security threats such as after-hours bulk data downloads, sudden spikes in API calls (GetObject spikes), access from new geographic IPs, and potential data exfiltration. It utilizes statistical baselines and time-series anomaly detection for proactive threat hunting and security incident investigation.

This skill analyzes DNS query logs to detect sophisticated threats such as data exfiltration via DNS tunneling, Domain Generation Algorithm (DGA) usage, and covert Command and Control (C2) channels. It utilizes advanced techniques like entropy analysis, query volume anomaly detection, and subdomain length analysis within SIEM platforms, helping SOC teams identify threats that bypass traditional network security controls.

This skill analyzes Indicators of Compromise (IOCs)—such as IP addresses, domains, and file hashes—by querying multiple threat intelligence platforms (VirusTotal, AbuseIPDB, MISP). It determines maliciousness confidence, assigns blocking priorities, and attributes threats to campaigns, crucial for incident response, threat triage, and making informed security decisions.

This tool parses Kubernetes API server audit logs (JSON lines) to detect critical security events. It specifically targets unauthorized access, secret enumeration, RBAC escalation, privileged pod creation, and shell access (exec/attach). Use it for incident response, threat hunting, or building SIEM detection rules.

This skill provides a comprehensive guide to using the Malpedia API for advanced malware intelligence analysis. Users can track malware family relationships, analyze variant evolution, extract associated YARA rules for detection, and map connections to specific threat actors. It is essential for security researchers and SOC analysts building robust threat models.

This skill provides a systematic methodology for mapping real-world threat actor Tactics, Techniques, and Procedures (TTPs) to the globally recognized MITRE ATT&CK framework. Users learn how to leverage tools like ATT&CK Navigator and Python libraries (e.g., attackcti, stix2) to analyze security incidents, visualize technical coverage heatmaps, identify critical detection gaps, and generate actionable intelligence reports linking observed Indicators of Compromise (IOCs) to specific adversary techniques across various platforms (Enterprise, Mobile, ICS).

This tool helps security analysts map Advanced Persistent Threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework. By utilizing the ATT&CK Navigator and the attackcti Python library, users can query STIX/TAXII data to visualize threat profiles, assess detection coverage gaps, and guide defensive planning for complex cyber incidents.

This tool provides comprehensive analysis of the cybersecurity threat landscape using the Malware Information Sharing Platform (MISP). It allows users to query event statistics, analyze attribute distributions (IPs, domains, hashes), identify top threat actors and malware families, and track temporal trends. It is essential for SOC analysts performing incident response, threat hunting, and building advanced detection rules.

A specialized tool for digital forensics investigators that parses the Windows Amcache.hve registry hive. It extracts crucial evidence regarding program execution history, application installation metadata, and loaded driver binaries. By correlating SHA-1 hashes and reconstructing timelines, users can determine which executables ran on a system, aiding in incident response and threat detection.

This skill provides a method to parse Windows Prefetch files (.pf) using Python, allowing security analysts to reconstruct detailed application execution histories. It is crucial for incident response, enabling the detection of renamed binaries, identifying suspicious execution patterns, and building accurate chronological timelines of system activity for deep forensic investigation.

This skill provides comprehensive functionality to interact with the arXiv academic database. Users can search for papers using keywords or specific arXiv IDs, retrieve detailed metadata (authors, abstract, categories), download corresponding PDF files, and generate summarized reports on research topics. Ideal for academic research, literature reviews, and continuous learning.

This system automates the tracking and mapping of threat actor Command-and-Control (C2) networks. By leveraging passive DNS records, WHOIS data, certificate transparency logs, and IP enrichment, it helps security analysts perform infrastructure pivoting. It identifies shared hosting patterns, monitors domain reuse, and continuously maps adversary relationships for proactive threat intelligence.