Skill UI

A comprehensive guide for analyzing PCAP files captured during malware execution. It demonstrates advanced techniques using Wireshark, Zeek, Suricata, and Python (scapy) to identify Command and Control (C2) communications, data exfiltration channels, Domain Generation Algorithms (DGA), and periodic beaconing patterns. Essential for malware reverse engineering and network threat detection.

This guide provides a structured methodology for hypothesis-driven threat hunting focused on detecting web shell deployment (T1505.003) on internet-facing servers. It analyzes file creation in web directories, suspicious child-process generation from web server processes, and anomalous HTTP request patterns. Use this during incident response, proactive security assessments, or when EDR/SIEM alerts indicate web server process anomalies.

This guide details how to implement HashiCorp Vault's dynamic secrets engine. It automates the generation, lease management, and rotation of short-lived credentials for databases (e.g., PostgreSQL, MySQL), AWS IAM, and PKI certificates. This method eliminates the use of static, hardcoded secrets, enforcing zero-trust principles and meeting stringent compliance mandates like PCI-DSS.

This skill guides the end-to-end deployment and configuration of Palo Alto Networks NGFWs. It covers advanced security features such as App-ID for application-aware policies, User-ID for identity-based enforcement, zone-based architecture, and Content-ID for deep threat inspection. Ideal for migrating legacy port-based firewalls to modern, identity-aware network security architectures.

A comprehensive tool for assessing cybersecurity vulnerabilities across power grid infrastructure, including generation, transmission, substations, and EMS/SCADA systems. It focuses specifically on NERC CIP compliance verification, IEC 61850 protocol security (GOOSE/MMS), and synchrophasor (PMU) network defense against advanced threats. Ideal for compliance audits and critical infrastructure security reviews.

This skill covers the technical process of setting up SSL/TLS inspection (decryption) on next-generation firewalls and proxies. It details how to act as a trusted Man-in-the-Middle to intercept, decrypt, and inspect encrypted HTTPS traffic for malicious payloads, data exfiltration, and policy violations. The workflow includes generating internal Certificate Authority (CA) certificates and deploying them across various operating systems (Windows, macOS, Linux) to ensure visibility into the web's encrypted blind spot.

A comprehensive guide to setting up a fast and secure WireGuard VPN server for remote access to your home network (homelab). Learn keypair generation, advanced Linux firewall (iptables) rules, and how to manage different tunneling modes (split vs. full tunnel) for optimal performance.

A comprehensive guide to setting up a fast and secure WireGuard VPN server for remote access to your home network (homelab). Learn keypair generation, advanced Linux firewall (iptables) rules, and how to manage different tunneling modes (split vs. full tunnel) for optimal performance.

This comprehensive tool provides a multi-stage verification pipeline for the RuView system. It executes full Rust workspace tests, runs a deterministic Python proof (Trust Kill Switch) to detect behavioral drift, and generates a detailed ADR-028 witness bundle. Use this before merging pull requests or when creating an official attestation package for recipients.

A comprehensive guide for researchers preparing academic artifacts for voluntary, post-acceptance evaluation (e.g., HPCA). It outlines best practices for structuring submissions for cold-start evaluators, defining reproducibility tiers (full reproduction, regeneration from logs, inspection), and managing computational budgets to successfully earn IEEE reproducibility badges.