Skill UI

An expert in designing, implementing, and optimizing scalable, reliable, and cost-effective data pipelines for both batch and streaming data. Covers advanced topics including ETL/ELT patterns, Kappa/Lambda architectures, workflow orchestration (Airflow/Prefect), transformation using dbt/Spark, and managing modern storage formats like Delta Lake and Iceberg. Focuses heavily on data quality, monitoring, and cost optimization strategies.

This skill maps identified security threats to appropriate controls and mitigation strategies. It is essential for prioritizing security investments, building comprehensive remediation roadmaps, validating existing control coverage, and performing detailed risk treatment planning. It helps organizations design robust, defense-in-depth security architectures.

A comprehensive forensic workflow for detecting persistent, deep-seated malware, such as bootkits and advanced rootkits. The analysis covers multiple layers, including boot sectors (MBR/VBR), UEFI firmware modules, and kernel memory forensics. It is essential for investigating sophisticated, nation-state level threats that evade standard anti-malware and EDR solutions.

A deep-dive tool for cybersecurity professionals to analyze malware Command and Control (C2) communication across multiple protocols (HTTP, HTTPS, DNS, custom). It helps reverse-engineer beaconing patterns, decode proprietary protocols, and map threat actor infrastructure, making it crucial for building robust detection signatures and attributing threats.

This comprehensive skill analyzes Zeek conn.log and NetFlow data to proactively detect advanced indicators of ransomware activity. It identifies critical threats such as Command and Control (C2) beaconing patterns, connections to TOR exit nodes, large-scale data exfiltration flows, and suspicious DNS anomalies. It is essential for threat hunting and complex security incident response.

A comprehensive system for systematically collecting, categorizing, and enriching Indicators of Compromise (IOCs) from various sources (network logs, memory dumps, email, etc.). It supports the entire incident response lifecycle, ensuring structured data representation using STIX/TAXII formats for robust threat intelligence sharing and defensive system automation.

A comprehensive guide for deploying and operationalizing Amazon GuardDuty. It provides continuous, intelligent threat detection across core AWS services including S3, EKS, and EC2 runtime monitoring. Use this skill to investigate suspicious activity, detect compromised credentials, or build automated incident response playbooks using EventBridge and Lambda for proactive security.

This skill provides comprehensive detection methods for credential dumping techniques, a critical post-exploitation phase in cyber attacks. It targets the extraction of sensitive credentials from LSASS memory, SAM registry hives, and NTDS.dit using advanced security visibility. Detection relies on analyzing Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and complex SIEM correlation rules, making it essential for SOC analysts and threat hunters investigating advanced persistent threats (APTs).

An advanced Intrusion Detection System (IDS) module designed for Operational Technology (OT) and ICS/SCADA environments. It monitors Modbus TCP/RTU traffic to detect unauthorized writes, anomalous function codes, malformed frames, and deviations from established communication baselines. Essential for investigating suspicious PLC register modifications and responding to industrial threats.

This comprehensive guide details the methodology for detecting Process Hollowing (MITRE T1055.012), a critical defense evasion technique used by fileless malware. It involves analyzing memory-mapped sections, correlating EDR telemetry (Sysmon, ETW), and identifying memory mismatches between the running process and its on-disk binary image. Use this skill when investigating sophisticated, in-memory threats that masquerade as legitimate system processes.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.

This comprehensive guide outlines methods to identify and exploit specific IPv6 vulnerabilities, including SLAAC spoofing, Router Advertisement (RA) manipulation, and Neighbor Discovery Protocol (NDP) attacks. It is designed strictly for authorized penetration testing to assess dual-stack security controls, detect unauthorized tunnels (like Teredo or 6to4), and validate network defenses against IPv6-specific threats. Always obtain explicit written authorization before use.