Skill UI

This guide details methods and rules for detecting container escape attempts, a critical security vulnerability where an adversary breaks out of container isolation to access the host system or other containers. It covers monitoring syscalls, namespace manipulation (e.g., nsenter, unshare), accessing sensitive host paths (/proc), and detecting privileged operations using tools like Falco and eBPF.

This skill provides advanced runtime security rules using Falco, a CNCF-graduated tool. It monitors Linux syscalls to detect container escape attempts in real-time, identifying techniques such as mounting host filesystems, unauthorized namespace access (nsenter), and privileged container launches. It is crucial for SOC analysts and security teams enhancing cloud-native security coverage.

A comprehensive methodology for detecting advanced system compromises, including rootkits, hidden processes, and kernel-level malware. It utilizes memory forensics, cross-view detection (comparing different system views), and integrity checking to identify manipulated kernel structures, hooked system calls (SSDT, IAT, IRP), and covert network connections. Ideal for deep forensic investigations where standard tools fail to reveal the true state of a compromised system.

Use RESTler to automate stateful security testing of REST APIs. It processes OpenAPI specifications to generate fuzzing grammars, allowing users to discover complex bugs, such as injection vulnerabilities, resource leaks, and unhandled exceptions (500 errors), by executing diverse sequences of API calls. Essential for robust CI/CD regression testing and proactive API security assessments.

This comprehensive guide teaches advanced iOS reverse engineering techniques using Frida dynamic instrumentation. Users can analyze proprietary app logic, extract encryption keys, trace method calls, and bypass anti-tampering or anti-debugging mechanisms without needing source code. It is essential for authorized mobile security testing and protocol analysis.

This skill provides comprehensive API calls using `curl` to interact with the CAST AI platform. It allows users to list connected Kubernetes clusters, retrieve detailed cost savings reports, and inspect the inventory of managed nodes. It is essential for verifying connectivity, auditing cloud spending, and monitoring resource allocation after onboarding.