Skill UI

This tool monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance for owned domains, discover hidden subdomains, and track suspicious certificate activity. By querying public CT logs and APIs (like crt.sh), it helps build continuous security pipelines, identify potential phishing infrastructure, and map the external attack surface for comprehensive threat intelligence.

A comprehensive guide to building a structured incident response playbook for ransomware attacks. It aligns with the CISA StopRansomware Guide and NIST CSF, covering all phases from preparation and detection to containment, eradication, and recovery. Ideal for security teams conducting readiness assessments or updating compliance documentation.

This skill outlines the architecture and methodology for deploying canary files (honeytokens) across critical file systems. By placing decoy documents with known content in high-value locations, this system monitors for unauthorized modifications, deletions, or encryption attempts. It detects ransomware by triggering high-fidelity alerts via File Integrity Monitoring (FIM) systems, serving as a crucial deception layer that complements existing EDR/AV solutions.

This guide details how to analyze comprehensive Zeek network logs (conn.log, smb_files.log, ntlm.log, dce_rpc.log, etc.) to detect advanced attacker techniques. It specifically targets indicators of compromise related to lateral movement, such as SMB admin share access, NTLM account spraying, and remote service execution (DCE/RPC patterns). It is a critical network forensics tool for post-incident investigation.

This skill focuses on detecting and mitigating sophisticated code injection and privilege escalation attacks across the entire serverless ecosystem (AWS Lambda, Azure, GCP). It combines static analysis of dangerous code sinks (e.g., eval, exec) with continuous monitoring of event sources (S3, SQS, API Gateway) and rigorous IAM auditing. It provides a comprehensive framework to secure the expanding serverless attack surface.

A comprehensive guide to hardening Windows Active Directory environments using Group Policy Objects (GPO). This skill configures multiple layers of defense, including AppLocker, Controlled Folder Access, and Attack Surface Reduction (ASR) rules, to prevent ransomware execution paths, block unauthorized file modifications, and restrict lateral movement across the domain.

This guide outlines the implementation of Remote Browser Isolation (RBI) as a core component of a Zero Trust architecture. It details policies for URL risk classification, Data Loss Prevention (DLP) controls, and Content Disarm and Reconstruction (CDR). This is essential for hardening web access, protecting against zero-day exploits, phishing, and preventing data exfiltration from untrusted web content.

This skill details the deployment of various canary tokens (DNS, HTTP, AWS API Keys) across enterprise network infrastructure. It establishes digital tripwires that detect behavioral anomalies, such as unauthorized access, credential leakage, or lateral movement. Tokens are configured with webhook alerts (Slack, SIEM) for real-time, low-false-positive notification, significantly enhancing traditional IDS/IPS capabilities.

This tool monitors Modbus TCP communication within SCADA and ICS environments to detect security anomalies. It performs deep packet inspection, baselines normal communication patterns (e.g., typical function code distribution, register access), and applies statistical analysis to identify unauthorized register writes, reconnaissance attempts, or denial-of-service attacks targeting industrial control devices.

A comprehensive guide detailing the workflow for firmware reverse engineering. It uses tools like binwalk to identify embedded filesystems (e.g., SquashFS, CramFS), perform entropy analysis to locate hidden data, and extract components. The process covers deep inspection, credential discovery, and reporting for IoT and embedded security assessments.

This comprehensive skill provides a systematic framework for performing deep security assessments on iOS applications. It covers static analysis of IPA packages, dynamic instrumentation using Frida and Objection, SSL pinning bypass for traffic interception, extraction and auditing of sensitive data from the Keychain, and runtime method hooking. Use this for authorized penetration testing against standards like OWASP MASTG.

This skill provides a comprehensive framework for simulating and testing disaster recovery plans against ransomware threats. It guides users through measuring Recovery Time Objective (RTO) and Recovery Point Objective (RPO), validating clean backup restores, and hardening security controls to ensure organizational resilience. It is designed for tabletop exercises and compliance auditing, not for active incident response.