Skill UI

CAPE is an open-source sandbox built for automated malware analysis, derived from Cuckoo. It provides advanced behavioral monitoring, payload dumping, and configuration extraction using over 70 parsers for known malware families (e.g., Emotet, Cobalt Strike). It captures network IOCs, dropped files, and detects anti-evasion techniques, making it ideal for security assessments and incident response workflows via its robust API.

This comprehensive guide outlines a structured workflow for conducting digital forensics investigations across major cloud providers, including AWS, Azure, and GCP. It covers critical steps such as evidence preservation (snapshots, metadata capture), systematic log collection (CloudTrail, Activity Logs, Audit Logs, VPC Flow Logs), and advanced analysis techniques to trace unauthorized accesses and identify root causes of security breaches.

A comprehensive guide to executing cloud-native incident containment procedures across major platforms including AWS, Azure, and GCP. Learn how to systematically isolate compromised resources, revoke malicious credentials, apply network restrictions (Security Groups/ACLs), and capture forensic evidence to prevent lateral movement during a security event. Essential for security assessments and incident response.

This comprehensive guide details the end-to-end process of conducting wireless security assessments. It covers passive reconnaissance, capturing WPA/WPA2 handshakes, cracking keys using Aircrack-ng and Hashcat, simulating Evil Twin attacks, detecting rogue access points, and testing network segmentation. It is essential for organizations validating their WiFi infrastructure security.

A comprehensive framework for advanced forensic analysis of UEFI firmware and boot process integrity. It details methods to detect firmware implants in SPI flash, audit UEFI variables (PK, KEK, DB), inspect the EFI System Partition (ESP) for unauthorized components, and analyze boot chain anomalies. Ideal for investigating advanced persistent threats (APTs) and verifying system security posture against rootkits and bootkit techniques.

A comprehensive provider for integrating Eufy security cameras (supporting local P2P or cloud connectivity). This tool facilitates stable RTSP streaming for live monitoring and efficiently captures event-triggered video clips. It is designed for advanced systems that require continuous video feeds and reliable event-based data input for AI analysis and monitoring solutions.

This tool provides comprehensive integration for Reolink security cameras, supporting both RTSP streaming and HTTP API access. It allows users to discover cameras via ONVIF, capture live streams, take snapshots, and even capture motion-triggered video clips. It is ideal for developers building robust, networked surveillance or monitoring systems.

This skill helps users create specialized 'steering documents' or project memory for highly specific domains (e.g., API standards, testing strategies, security patterns). By analyzing the existing codebase and following predefined architectural principles, it synthesizes concise, actionable guides that capture technical patterns, best practices, and domain-specific rules, ensuring project consistency and knowledge retention.

This guide provides a comprehensive, advanced methodology for red team operations. It covers critical topics such as Operational Security (OPSEC), designing robust C2 infrastructure using redirectors, employing living-off-the-land techniques, mastering lateral movement, establishing persistence, and planning data exfiltration while evading modern defensive systems. Use this to plan complex red team engagements or deeply understand Advanced Persistent Threat (APT) TTPs.

This skill provides a deep dive into the architecture of low-level keyloggers. It covers techniques such as kernel driver hooks, using WH_KEYBOARD_LL, ETW-based input capture, and analyzing user-mode vs. kernel-mode approaches. Use this methodology to understand input capture mechanisms, research EDR evasion methods, or analyze malware architecture for advanced security threat detection.

Covers offensive workflows for Zigbee, Thread, and Matter mesh networks, including 802.15.4 sniffing, commissioning abuse, key capture, replay/injection, and control-command exploitation in smart-home deployments.

A comprehensive guide detailing various 802.11 management frame attacks, including deauthentication and disassociation. It covers targeted single-client deauth for handshake capture, broadcast DoS attacks, and advanced action-frame exploitation to bypass PMF (802.11w). Essential for professional penetration testing and wireless vulnerability assessment.