Skill UI

This comprehensive guide outlines how to plan and execute a full-scope red team engagement. It simulates real-world Advanced Persistent Threat (APT) behavior, covering the entire cyber kill chain from initial reconnaissance (OSINT) through lateral movement, credential harvesting, and data exfiltration. It utilizes MITRE ATT&CK frameworks to rigorously test an organization's detection, prevention, and incident response capabilities.

A proactive, hypothesis-driven skill designed to hunt for Advanced Persistent Threats (APT) within complex enterprise environments. It analyzes endpoint telemetry, network logs, and memory artifacts using frameworks like MITRE ATT&CK. Use this skill when investigating anomalous behavior flagged by UEBA, conducting scheduled threat sprints, or validating exposure to known TTPs using tools like Velociraptor and osquery.

This framework executes sophisticated threat emulation tests using Atomic Red Team, mapping directly to MITRE ATT&CK techniques. It allows security teams to actively simulate adversary behavior, validating the detection coverage of SIEM rules and EDR controls. Use this tool for comprehensive purple team operations, penetration testing, and security auditing.

A comprehensive guide for Security Operations Center (SOC) teams to perform proactive threat hunting using Elastic SIEM. This skill teaches advanced techniques like KQL and EQL queries, analyzing event sequences, and investigating anomalies to uncover threats that bypass automated detection rules. Ideal for validating detection coverage gaps and responding to new TTPs based on the MITRE ATT&CK framework.

This playbook guides Security Operations Center (SOC) analysts through a comprehensive, multi-step process for triaging and prioritizing security incidents. It covers receiving alerts from SIEM/EDR, enriching data using threat intelligence feeds (VirusTotal, AbuseIPDB), classifying the incident type (MITRE ATT&CK mapping), and calculating a severity score based on asset criticality and data sensitivity. The workflow culminates in automating ticket creation and triggering immediate response procedures via tools like PagerDuty.

This skill provides comprehensive guidance on detecting post-exploitation credential dumping activities, such as LSASS memory access, SAM registry hive extraction, and NTDS.dit theft. It utilizes advanced log sources, including Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and SIEM correlation rules, to identify suspicious process behaviors and malicious tool usage, mapping these detections to MITRE ATT&CK techniques.