Skill UI

This skill details advanced digital forensics techniques for recovering metadata and content of deleted files by analyzing the NTFS Master File Table ($MFT). It covers examining key system artifacts like $LogFile and $UsnJrnl, and analyzing MFT slack space. Use this when reconstructing file system timelines, investigating data loss, or detecting anti-forensic techniques like timestomping during a Windows forensic examination.

This guide outlines the process of passive external reconnaissance using Open Source Intelligence (OSINT) techniques. Users can map an organization's digital footprint by gathering comprehensive data, including DNS records, subdomains, certificate transparency logs, social media profiles, and leaked credentials. It is critical for the planning phase of penetration testing, asset mapping, or preparing for social engineering, all without actively interacting with target systems.

This guide details comprehensive detection methods for DCSync attacks (MITRE T1003.006) in Active Directory. Attackers abuse legitimate directory replication protocols to extract sensitive password hashes. Detection relies on auditing Windows Event ID 4662 for unauthorized access attempts to critical Directory Service GUIDs, specifically flagging non-domain-controller accounts attempting replication calls. Essential for threat hunting and incident response.

Provides advanced techniques for detecting fileless malware that operates entirely in memory or abuses legitimate system binaries (LOLBins). It analyzes WMI persistence, registry-resident payloads, and common abuse patterns of tools like PowerShell, mshta, and certutil, crucial for advanced threat hunting and forensic investigations.

This comprehensive guide details the methodology for detecting Process Hollowing (MITRE T1055.012), a critical defense evasion technique used by fileless malware. It involves analyzing memory-mapped sections, correlating EDR telemetry (Sysmon, ETW), and identifying memory mismatches between the running process and its on-disk binary image. Use this skill when investigating sophisticated, in-memory threats that masquerade as legitimate system processes.

A specialized technique for proactive threat hunting, designed to detect adversary activity that abuses legitimate cloud services (like Azure, AWS, GCP, and SaaS platforms). It focuses on identifying 'living off the cloud' tradecraft, such as using cloud APIs for command-and-control (C2), staging data, or exfiltrating information while blending into normal network traffic.

This advanced skill guides users on hunting for Living Off the Land Binaries (LOLBins) abuse by analyzing endpoint process creation logs. It focuses on detecting malicious use of legitimate Windows binaries (like certutil or mshta) for defense evasion or data exfiltration, mapping techniques to MITRE T1218. Ideal for threat hunters and security teams building advanced detection rules.

This tool analyzes historical network traffic baselines to design secure and functional segmentation architectures for Operational Technology (OT) environments. It helps map flat Purdue-model networks into secure zones (VLANs) and automatically generates required firewall rules based on observed legitimate communication paths, adhering to standards like IEC 62443. Ideal for IT/OT convergence and risk mitigation.

Utilize Velociraptor, an advanced open-source platform, to collect, query, and monitor forensic artifacts across diverse endpoints (Windows, Linux, macOS). This skill enables incident response teams to perform large-scale, rapid digital forensic investigations by collecting critical data such as event logs, registry entries, prefetch files, and network metadata using VQL queries.

A comprehensive guide for SOC analysts and digital forensics experts. This skill covers the entire lifecycle of a phishing incident, from initial user report and header analysis (SPF, DKIM, DMARC) to detonating malicious URLs/attachments in sandboxes. It guides users on scoping the attack, identifying impacted users via SIEM/proxy logs, and executing containment measures like email purges.

A comprehensive guide and workflow for digital forensic investigators to analyze ransomware artifacts. This process involves preserving volatile evidence (memory dumps), identifying the ransomware variant from file extensions and ransom notes, establishing the attack timeline using Prefetch and Event Logs, and extracting critical Indicators of Compromise (IoCs) such as Bitcoin addresses and Tor sites. Essential for incident response and recovery planning.

A comprehensive skill covering container security vulnerability scanning using Trivy. It detects vulnerabilities in OS packages, language dependencies, IaC misconfigurations, and exposed secrets across container images, Kubernetes manifests, and Git repositories. Features include generating SBOMs (CycloneDX/SPDX) and integrating security gates into CI/CD pipelines for robust supply chain security.