Skill UI

This comprehensive guide details the deployment and hardening of the Havoc C2 framework, a modern post-exploitation Command and Control system. Learn how to establish a production-grade infrastructure, including configuring Teamservers, setting up various listeners (HTTP/HTTPS/SMB), and integrating Nginx redirectors. It provides OPSEC-hardened techniques for authorized red team adversary emulation engagements.

This skill provides comprehensive methods for collecting and synthesizing Open-Source Intelligence (OSINT) regarding threat actors, malicious infrastructure, and attack campaigns. It utilizes public data sources, passive reconnaissance tools (like WHOIS, Certificate Transparency), and specialized platforms (Maltego, Shodan, SpiderFoot) to map adversary context and perform pre-engagement intelligence gathering for authorized red team assessments. Emphasis is placed on passive collection techniques to ensure legality and operational security.

A comprehensive guide to simulating Man-in-the-Middle (MITM) attacks using industry-standard tools like Bettercap, Ettercap, and mitmproxy. This technique is strictly for authorized penetration testing environments to assess cryptographic controls, validate TLS certificate pinning, and test network defense mechanisms against ARP/DNS spoofing and sniffing.

This guide details the comprehensive deployment of Cisco Duo Multi-Factor Authentication across critical access points like VPN, RDP, SSH, and web applications. It covers setting up the Duo Authentication Proxy, implementing adaptive access policies based on risk and device health, and deploying phishing-resistant methods like WebAuthn/FIDO2, ensuring compliance with NIST standards. Use this when hardening identity access management or establishing robust security controls.

This skill guides SOC analysts and detection engineers on how to correlate complex, multi-stage attacks within the IBM QRadar SIEM platform. It covers advanced usage of AQL (Ariel Query Language) for deep event investigation, building custom correlation rules (Building Blocks and Offenses), and cross-source data correlation (e.g., auth failures with network flows). It is essential for reducing false positives and improving threat detection accuracy.

This skill provides a comprehensive guide to deploying a Software-Defined Perimeter (SDP) compliant with the CSA v2.0 specification. It details implementing core zero trust mechanisms, including Single Packet Authorization (SPA) and mutual TLS (mTLS), using a controller and gateway architecture. Use this when establishing invisible, identity-centric network access (dark cloud) to harden infrastructure, enforce strict zero trust policies, or meet advanced compliance requirements.

This guide details deploying Tailscale (or self-hosted Headscale) to create a WireGuard-based zero trust mesh VPN. It establishes encrypted peer-to-peer connections between devices, eliminating the need for traditional VPN servers. Features include identity-aware Access Control Lists (ACLs), subnet routing, and secure connectivity for compliance-driven architectures. Use this when enforcing granular, identity-authenticated access control.

A specialized Python detector designed to monitor Operational Technology (OT) historian servers (such as OSIsoft PI, Ignition, etc.). It identifies critical indicators of compromise (IOCs), including unauthorized network connections, data manipulation attempts, and lateral movement activities that bridge IT and OT zones. Use this skill when validating data integrity and investigating potential cyber breaches in industrial environments.

This skill detects compromised cloud credentials by analyzing anomalous API activity, impossible travel patterns, and unauthorized access indicators across AWS, Azure, and GCP. It integrates findings from GuardDuty, Defender for Identity, and Security Command Center to provide comprehensive threat visibility and assist in incident response and scope assessment.

This guide details comprehensive detection methods for DCSync attacks (MITRE T1003.006) in Active Directory. Attackers abuse legitimate directory replication protocols to extract sensitive password hashes. Detection relies on auditing Windows Event ID 4662 for unauthorized access attempts to critical Directory Service GUIDs, specifically flagging non-domain-controller accounts attempting replication calls. Essential for threat hunting and incident response.

This tool detects critical anomalies in DNP3 communications used within SCADA and ICS environments. It employs deep packet inspection and machine learning to monitor for unauthorized control commands, protocol violations, firmware update attempts, and deviations from established network baselines. It is essential for securing critical infrastructure, such as energy grids and industrial control networks, and building robust anomaly-based Intrusion Detection Systems (IDS).

This guide is designed for threat hunting, helping security teams proactively detect persistent unauthorized access methods. It focuses on identifying malicious inbox/mail-flow forwarding rules that adversaries establish after a compromise to maintain access to corporate communications, often associated with Business Email Compromise (BEC) or T1114 techniques. Use during incident response and proactive security assessments.