Skill UI

A comprehensive, NIST/CISA-aligned workflow for structured recovery following a ransomware incident. It covers critical steps including environment isolation, forensic evidence preservation, Active Directory restoration (DSRM, krbtgt reset), backup integrity validation, and phased, dependency-based system rebuild. Essential for post-incident disaster recovery planning.

This skill guides the implementation of comprehensive security controls for container registries. It details workflows for vulnerability scanning using Trivy and Grype, generating Software Bill of Materials (SBOMs) with Syft, and enforcing image authenticity using Cosign and Sigstore. It is essential for building robust CI/CD pipelines and preventing supply chain attacks by ensuring only scanned, signed, and compliant images are deployed.

A comprehensive guide for assessing the security of JSON Web Token (JWT) implementations. This toolkit details attacks against cryptographic weaknesses, including algorithm confusion (e.g., RS256 to HS256), 'none' attacks, brute-forcing HMAC secrets, and claim manipulation. Ideal for penetration testing and security audits of modern APIs and SSO systems.

A comprehensive guide and framework for assessing real-time WebSocket APIs (ws:// or wss://). This skill covers critical security checks, including Cross-Site WebSocket Hijacking (CSWSH), authentication bypass, message injection attacks, input validation flaws, and denial-of-service (DoS) via message flooding. It utilizes tools like Burp Suite and Python for simulating malicious payloads and ensuring secure real-time communication channels.

This tool monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance for owned domains, discover hidden subdomains, and track suspicious certificate activity. By querying public CT logs and APIs (like crt.sh), it helps build continuous security pipelines, identify potential phishing infrastructure, and map the external attack surface for comprehensive threat intelligence.

A comprehensive guide to building a structured incident response playbook for ransomware attacks. It aligns with the CISA StopRansomware Guide and NIST CSF, covering all phases from preparation and detection to containment, eradication, and recovery. Ideal for security teams conducting readiness assessments or updating compliance documentation.

This guide details how to analyze comprehensive Zeek network logs (conn.log, smb_files.log, ntlm.log, dce_rpc.log, etc.) to detect advanced attacker techniques. It specifically targets indicators of compromise related to lateral movement, such as SMB admin share access, NTLM account spraying, and remote service execution (DCE/RPC patterns). It is a critical network forensics tool for post-incident investigation.

This skill focuses on detecting and mitigating sophisticated code injection and privilege escalation attacks across the entire serverless ecosystem (AWS Lambda, Azure, GCP). It combines static analysis of dangerous code sinks (e.g., eval, exec) with continuous monitoring of event sources (S3, SQS, API Gateway) and rigorous IAM auditing. It provides a comprehensive framework to secure the expanding serverless attack surface.

A comprehensive guide to hardening Windows Active Directory environments using Group Policy Objects (GPO). This skill configures multiple layers of defense, including AppLocker, Controlled Folder Access, and Attack Surface Reduction (ASR) rules, to prevent ransomware execution paths, block unauthorized file modifications, and restrict lateral movement across the domain.

This tool monitors Modbus TCP communication within SCADA and ICS environments to detect security anomalies. It performs deep packet inspection, baselines normal communication patterns (e.g., typical function code distribution, register access), and applies statistical analysis to identify unauthorized register writes, reconnaissance attempts, or denial-of-service attacks targeting industrial control devices.

This skill provides a comprehensive framework for validating backup reliability. It automates processes like cryptographic hash verification, running simulated restores to isolated environments, detecting silent data corruption (bit rot), and scanning for ransomware indicators. Use it before relying on backups during a major incident or ransomware attack to ensure data recoverability and compliance.

This guide provides comprehensive best practices for creating optimized, secure, and efficient multi-stage Dockerfiles. Learn how to separate build environments (builder stage) from minimal runtime environments, significantly reducing image size and attack surface. Topics covered include layer caching optimization, security hardening (non-root users), and using minimal base images for reproducible builds.