Skill UI

This comprehensive guide outlines a structured workflow for conducting digital forensics investigations across major cloud providers, including AWS, Azure, and GCP. It covers critical steps such as evidence preservation (snapshots, metadata capture), systematic log collection (CloudTrail, Activity Logs, Audit Logs, VPC Flow Logs), and advanced analysis techniques to trace unauthorized accesses and identify root causes of security breaches.

A comprehensive tool for auditing container security posture by detecting potential escape vectors. It analyzes Kubernetes Pod specs for dangerous configurations, such as running in privileged mode, dangerous capability assignments (like CAP_SYS_ADMIN), host namespace sharing, and writable hostPath mounts. Ideal for security assessments and incident response to prevent container breakout.

This comprehensive guide outlines the phased rollout process for DMARC (Domain-based Message Authentication, Reporting, and Conformance). It details moving from monitoring (p=none) through quarantine (p=quarantine) to full rejection (p=reject). Adopting DMARC is critical for anti-spoofing, ensuring that only authorized senders can use your domain, thereby significantly reducing phishing and unauthorized email traffic.

A comprehensive guide for authorized penetration testing to map a target's entire DNS infrastructure. This skill covers advanced techniques including enumerating various DNS record types (A, MX, TXT, SRV), attempting zone transfers (AXFR/IXFR), brute-forcing subdomains, and analyzing security configurations (DNSSEC, SPF, DMARC). It is crucial for identifying the full external attack surface of a target organization.

This guide outlines systematic methodologies for reducing false positives in Security Information and Event Management (SIEM) systems. It covers advanced techniques including threshold tuning, multi-signal correlation enhancement, behavioral baseline integration, and threat intelligence filtering. Used by SOC analysts and detection engineers to combat alert fatigue and improve true positive detection rates.

A comprehensive guide for analyzing firmware images from embedded systems, IoT devices, routers, and specialized components like UEFI/BIOS. This skill covers advanced techniques including filesystem extraction, binary reverse engineering (using Ghidra/IDA), rootkit detection, and deep forensic analysis to uncover backdoors, implants, and supply chain compromises. Essential for cybersecurity professionals investigating compromised hardware.

This skill provides a comprehensive, multi-stage guide for investigating insider threats. It covers the entire lifecycle, from receiving an allegation and ensuring legal authorization, to covert evidence collection (DLP logs, endpoint forensics), advanced user behavior pattern analysis, and reconstructing a detailed activity timeline for potential legal action. Essential for security incident response.

A comprehensive guide for systematically evaluating Kubernetes cluster security. It simulates advanced attacker techniques against critical components like the API server, etcd, kubelet, RBAC, and network policies, identifying misconfigurations and vulnerabilities. Essential for security auditors, penetration testers, and DevOps teams performing deep cluster security assessments.

A comprehensive guide for digital forensics professionals on analyzing volatile memory dumps using Volatility 3. Learn to extract critical evidence, including running processes, network connections, loaded DLLs, system credentials, and detecting advanced threats like process hollowing and rootkits. Essential for incident response and malware analysis.

This comprehensive guide outlines the end-to-end workflow for mobile device forensics, covering data acquisition and analysis for both iOS and Android platforms. It details techniques using commercial tools like Cellebrite UFED and open-source utilities (ALEAPP, iLEAPP, ADB). This methodology is critical for investigating deleted messages, call logs, location data, and application artifacts in legal or corporate investigations.

Conduct comprehensive cybersecurity assessments for critical oil and gas infrastructure, spanning upstream, midstream, and downstream operations. This skill covers securing SCADA, DCS, and safety systems, and ensures compliance with industry standards like API 1164, IEC 62443, and TSA Directives.

Conduct comprehensive security assessments for Operational Technology (OT) networks, including SCADA and DCS systems. This skill maps industrial protocols (Modbus, DNP3, OPC UA) and analyzes traffic against the Purdue Model. It is crucial for identifying IT/OT convergence risks, detecting misconfigurations, and ensuring compliance with standards like IEC 62443.