Skill UI

This skill provides comprehensive guidance on establishing secure, high-performance connectivity between on-premises data centers and major public cloud providers (AWS, Azure, GCP). It covers various connection options, including Site-to-Site VPN, AWS Direct Connect, Azure ExpressRoute, and GCP Cloud Interconnect. Use this skill to design and implement complex hybrid network patterns (e.g., Hub-and-Spoke, Multi-Cloud), ensuring high availability, proper routing (BGP), and adherence to security best practices.

This skill empowers users to manage and monitor critical SSL/TLS certificates using the built-in certificate manager. It provides capabilities to check certificate expiration dates, automate the renewal process for expired credentials, and list all installed certificates. It is essential for system administrators and developers maintaining secure, uninterrupted network connections and ensuring compliance.

This comprehensive checklist guides the secure deployment and hardening of a Supabase project for production use. It covers critical security measures such as enforcing Row Level Security (RLS), separating client and service keys, optimizing connection pooling via Supavisor, setting up Point-in-Time Recovery (PITR) backups, and configuring network restrictions. Use this guide before launching or for conducting security audits to ensure maximum stability and security.

This comprehensive skill analyzes Zeek conn.log and NetFlow data to proactively detect advanced indicators of ransomware activity. It identifies critical threats such as Command and Control (C2) beaconing patterns, connections to TOR exit nodes, large-scale data exfiltration flows, and suspicious DNS anomalies. It is essential for threat hunting and complex security incident response.

This guide details the comprehensive workflow for conducting memory forensics using Volatility 3. It covers the entire incident response lifecycle, from acquiring raw RAM dumps to analyzing processes, detecting rootkits, investigating network connections, and extracting sensitive artifacts like credentials and injected code. Essential for live memory analysis in cybersecurity investigations.

This guide details deploying Tailscale (or self-hosted Headscale) to create a WireGuard-based zero trust mesh VPN. It establishes encrypted peer-to-peer connections between devices, eliminating the need for traditional VPN servers. Features include identity-aware Access Control Lists (ACLs), subnet routing, and secure connectivity for compliance-driven architectures. Use this when enforcing granular, identity-authenticated access control.

A specialized Python detector designed to monitor Operational Technology (OT) historian servers (such as OSIsoft PI, Ignition, etc.). It identifies critical indicators of compromise (IOCs), including unauthorized network connections, data manipulation attempts, and lateral movement activities that bridge IT and OT zones. Use this skill when validating data integrity and investigating potential cyber breaches in industrial environments.

Conduct hypothesis-driven threat hunting for Command-and-Control (C2) activity (T1071). This skill guides the analysis of SIEM/EDR network telemetry to detect anomalous outbound traffic, rare destination IPs, non-standard ports, and unusual connection frequencies, helping identify beaconing or data exfiltration attempts. Essential for proactive defense and incident response.

This guide focuses on developing multi-event correlation rules using Splunk SPL and Sigma format. It teaches how to detect Advanced Persistent Threats (APT) and lateral movement by chaining multiple Windows authentication, process execution, and network connection events across hosts within specified time windows. Use this to surface complex, multi-stage attack sequences that single-event detection rules typically miss.

A comprehensive guide to analyzing volatile memory (RAM) dumps using the Volatility 3 framework. This skill enables the extraction of crucial digital evidence, including running processes, network connections, loaded modules, credentials, and encryption keys. It is essential for incident response, detecting rootkits, process hollowing, or identifying malware when traditional disk-based forensics are insufficient.

This guide implements a secure conduit architecture for Operational Technology (OT) remote access, adhering to IEC 62443 standards. It establishes a layered defense using DMZs, jump servers, and MFA gateways. Use it to secure third-party vendor access to SCADA/ICS equipment, replacing risky direct VPN connections and remediating audit findings on uncontrolled access.

This skill provides comprehensive detection strategies for adversaries abusing DCOM objects (e.g., MMC20.Application) to perform stealthy lateral movement (MITRE ATT&CK T1021.003). It details how to correlate Sysmon Event IDs (Process Creation, Network Connection), analyze WMI activity, and monitor RPC traffic on port 135 to identify unauthorized remote command execution chains. Ideal for advanced threat hunting, red teaming, and purple team exercises.