Skill UI

A comprehensive guide to using the Metasploit Framework for advanced penetration testing and vulnerability validation. This skill details how to confirm exploitability of identified CVEs, gather post-exploitation evidence, and validate patch remediation effectiveness. It is essential for risk-based vulnerability management and red team exercises, providing proof of real-world impact beyond simple scanner scores.

A proactive, hypothesis-driven skill designed to hunt for Advanced Persistent Threats (APT) within complex enterprise environments. It analyzes endpoint telemetry, network logs, and memory artifacts using frameworks like MITRE ATT&CK. Use this skill when investigating anomalous behavior flagged by UEBA, conducting scheduled threat sprints, or validating exposure to known TTPs using tools like Velociraptor and osquery.

This advanced skill guides users on hunting for Living Off the Land Binaries (LOLBins) abuse by analyzing endpoint process creation logs. It focuses on detecting malicious use of legitimate Windows binaries (like certutil or mshta) for defense evasion or data exfiltration, mapping techniques to MITRE T1218. Ideal for threat hunters and security teams building advanced detection rules.

A comprehensive guide for conducting hypothesis-driven threat hunting against supply chain compromises (T1195). This skill focuses on querying SIEM/EDR logs to detect indicators of trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. It is crucial when investigating suspected vendor compromises or scoping a build pipeline breach, requiring advanced knowledge of logging systems and threat intelligence.

Explores how to implement AWS IAM Permission Boundaries to cap the maximum permissions granted to users or roles. This advanced security feature allows security teams to safely delegate IAM management to developers for self-service while strictly enforcing the principle of least privilege and preventing privilege escalation in cloud environments.

This skill guides the implementation and auditing of advanced network segmentation within Kubernetes using Calico. It enables establishing zero-trust microsegmentation by creating and managing NetworkPolicy and GlobalNetworkPolicy resources. Use this to strictly control pod-to-pod traffic, enforce namespace isolation, restrict egress rules, and apply DNS-based security policies, significantly hardening your cluster's security posture.

This skill guides the implementation of email sandboxing using Proofpoint Targeted Attack Protection (TAP). It covers configuring isolated detonations for suspicious attachments and URLs to detect zero-day malware, evasive phishing, and advanced threats. Learn to tune policies, monitor the TAP dashboard, and integrate findings with SIEM for robust email security architecture.

This guide provides comprehensive security hardening procedures for enterprise Google Workspace environments. It covers advanced topics such as enforcing phishing-resistant Multi-Factor Authentication (MFA), configuring email authentication (DMARC/SPF/DKIM), implementing Data Loss Prevention (DLP), and securing super admin accounts using Advanced Protection Program enrollment. Ideal for achieving high compliance and defending against BEC and phishing attacks.

This skill guides the implementation of continuous, risk-adaptive identity verification crucial for Zero Trust Architecture (ZTA). It covers deploying phishing-resistant MFA (FIDO2/WebAuthn), advanced risk-based conditional access policies, and identity governance strategies. Users learn how to move beyond traditional credentials by leveraging multiple signals—such as device posture, behavioral biometrics, and location context—to dynamically assess and enforce trust levels before granting access.

This skill details how to implement robust network segmentation and zero-trust security within Kubernetes clusters using Calico's NetworkPolicy and GlobalNetworkPolicy resources. It covers advanced concepts such as default-deny rules, policy ordering, and service-account-based selectors, making it essential for building and auditing secure east-west and north-south traffic controls.

This skill provides a comprehensive guide to implementing advanced memory protection mechanisms on Windows endpoints. It covers critical techniques like Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG). Use this when hardening systems against various memory corruption exploits, such as buffer overflows and ROP chains, to significantly boost overall security posture.

This guide details the deployment of Cisco Identity Services Engine (ISE) for comprehensive Network Access Control (NAC). It utilizes 802.1X authentication, MAC Authentication Bypass (MAB), and posture assessment to enforce security policies. Key features include integrating with Active Directory, assigning dynamic VLANs, and applying TrustSec Security Group Tags (SGTs) for advanced network segmentation in enterprise environments.