Skill UI

This skill automates the validation of AWS environments against critical industry compliance benchmarks. It performs detailed checks for CIS AWS Foundations, PCI-DSS, HIPAA, and SOC 2 standards, covering key areas like Identity and Access Management (IAM), logging, data protection, and network security. Essential for preparing for regulatory audits and maintaining continuous secure operations.

A comprehensive guide for establishing robust, enterprise-grade access control within Databricks. Covers implementing Single Sign-On (SSO) via SCIM, leveraging Unity Catalog for fine-grained Role-Based Access Control (RBAC), defining cluster policies, and enforcing data governance measures like Row-Level Security (RLS) and column masking. Essential for large-scale, secure data platforms.

This skill guides the advanced configuration of Windows Event Logging using Group Policy Objects (GPO) and advanced audit policies. It enables high-fidelity logging for critical security events, including process creation (Event 4688), logon/logoff activities, and object access. The process covers optimizing log sizes and implementing Windows Event Forwarding (WEF) to centralize data into SIEM platforms for effective threat detection and forensic investigation.

A comprehensive guide and workflow for detecting Mimikatz and similar credential-dumping activities. It utilizes command-line pattern matching, LSASS memory access signatures, binary indicators, and in-memory analysis. Ideal for threat hunting, scoping compromises during incident response, or validating detection coverage in purple team exercises using EDR/SIEM data.

A comprehensive skill for detecting early-stage ransomware indicators before data encryption occurs. It utilizes advanced network detection tools such as Zeek and Suricata, combined with SIEM correlation rules and threat intelligence feeds. This method monitors the entire pre-encryption kill chain, identifying precursor behaviors like initial access broker activity, Cobalt Strike C2 beaconing, credential harvesting (e.g., Mimikatz signatures), and data staging attempts, enabling timely incident response and containment.

A comprehensive guide and workflow for detecting unauthorized data exfiltration from AWS S3 buckets. It details how to leverage multiple AWS services—including CloudTrail, GuardDuty, Amazon Macie, and Athena—to analyze access patterns, identify bulk downloads, and detect cross-account data transfers, ensuring robust cloud compliance and security monitoring.

A comprehensive guide and set of detection rules for identifying OS credential dumping techniques (MITRE T1003). It leverages EDR telemetry, Sysmon process access monitoring, and Windows security event correlation to detect attacks targeting LSASS memory, SAM databases, and NTDS.dit files. Essential for proactive threat hunting and incident response.

A comprehensive guide detailing the methodology for identifying and exploiting Server-Side Request Forgery (SSRF). This technique is critical in authorized penetration testing, allowing attackers to pivot from public-facing applications to internal resources. Use cases include stealing cloud provider metadata (AWS, GCP), scanning private IP ranges, and accessing internal APIs and admin panels.

This skill details the deployment of Privileged Access Management (PAM) for critical database systems, including Oracle, SQL Server, PostgreSQL, and MySQL. It covers essential security controls such as session proxy configuration, credential vaulting, query auditing, and enforcing least-privilege access, helping organizations meet stringent compliance and security standards.

This skill provides a comprehensive guide to implementing robust USB device control policies. It restricts unauthorized removable media access to mitigate data exfiltration risks and prevent malware introduction via USB endpoints. Learn how to deploy granular policies using Group Policy Objects (GPO), Microsoft Intune, or advanced Endpoint Detection and Response (EDR) platforms to meet strict compliance standards.

A comprehensive guide to securing Software as a Service (SaaS) applications (e.g., Microsoft 365, Salesforce) using Zero Trust principles. This skill covers deploying CASB/SSPM solutions, enforcing conditional access policies (MFA, device compliance), governing OAuth permissions, and applying session-level DLP controls to prevent data exfiltration in multi-cloud environments. Ideal for security architects and engineers.

A comprehensive guide for authorized red-team assessments using the Pacu framework. This process details how to enumerate IAM policies, scan for privilege escalation paths, test data access across services (S3, DynamoDB), and simulate lateral movement to determine the blast radius of compromised AWS credentials.