Skill UI

A comprehensive, step-by-step guide for security professionals to perform deep-dive malware analysis. It covers methodologies for static analysis (disassemblers, imports), dynamic execution (sandboxing, monitoring), identifying Indicators of Compromise (IOCs), and structuring professional threat reports. Essential for incident response and threat intelligence.

This skill provides comprehensive operational controls for long-lived, cloud-hosted agent workloads. It manages the entire lifecycle—from deployment and scaling to observability and security. Features include detailed monitoring (logs, metrics, traces), safety controls (kill switches, least privilege), and robust change management processes (rollout, rollback, auditing). Ideal for mission-critical microservices and background agents.

This comprehensive guide details advanced forensic techniques for detecting and analyzing sophisticated malware that operates at the system's deepest levels, such as the Master Boot Record (MBR), Volume Boot Record (VBR), and UEFI firmware. It covers boot sector disassembly, UEFI module inspection, and memory forensics (SSDT/DKOM). Use this when standard security tools fail or when investigating nation-state level compromises.

A comprehensive guide for deep packet inspection and network forensics using Wireshark and tshark. This skill is critical for incident response, where it allows users to capture, filter, and analyze network packet data to identify malicious command-and-control traffic, diagnose complex protocol issues, extract indicators of compromise (IOCs), and reconstruct data exfiltration paths. Use it for validating security rules and understanding network anomalies.

This guide details the comprehensive workflow for conducting memory forensics using Volatility 3. It covers the entire incident response lifecycle, from acquiring raw RAM dumps to analyzing processes, detecting rootkits, investigating network connections, and extracting sensitive artifacts like credentials and injected code. Essential for live memory analysis in cybersecurity investigations.

A structured guide for conducting blameless post-mortem reviews after any security incident. This process helps identify root causes using techniques like the 5 Whys, calculates critical metrics (MTTD, MTTR), and generates actionable recommendations to continuously improve incident response playbooks and procedures.

This guide details the end-to-end process of conducting a sophisticated spearphishing simulation campaign, mirroring real red team adversary techniques. It covers initial OSINT research and pretext development, building weaponized payloads that bypass security controls, setting up robust email infrastructure (SPF/DKIM/DMARC), executing the campaign in waves, and performing detailed post-campaign metrics analysis for comprehensive security reporting.

This guide provides comprehensive security hardening procedures for enterprise Google Workspace environments. It covers advanced topics such as enforcing phishing-resistant Multi-Factor Authentication (MFA), configuring email authentication (DMARC/SPF/DKIM), implementing Data Loss Prevention (DLP), and securing super admin accounts using Advanced Protection Program enrollment. Ideal for achieving high compliance and defending against BEC and phishing attacks.

This skill provides comprehensive guidance on configuring Fluentd and Fluent Bit for centralized log collection, routing, filtering, and enrichment. It covers setting up lightweight log forwarders on endpoints and designing central aggregators that route data to SIEM tools, Elasticsearch, or Splunk. Essential for achieving observability and meeting strict security compliance requirements.

A comprehensive playbook designed for Operational Technology (OT) and Industrial Control Systems (ICS) environments. It provides structured, phased incident response procedures aligned with SANS PICERL, IEC 62443, and NIST standards. It specifically addresses safety-critical challenges, process availability, and the unique coordination required between IT Security, OT Engineering, and Plant Operations during cyber incidents, such as ransomware attacks.

This guide details passive OT network traffic analysis using Nozomi Networks Guardian sensors. It provides methods to achieve comprehensive asset visibility, real-time threat detection, and vulnerability assessment across sensitive Industrial Control Systems (ICS) without disrupting operations. It is crucial for building robust OT Security Operations Centers (SOCs) and ensuring compliance with industry standards like IEC 62443.

This skill assesses Bluetooth Low Energy (BLE) device security by scanning nearby devices, enumerating GATT services, and analyzing characteristics. It detects critical vulnerabilities such as unencrypted sensitive data exposure, weak pairing configurations, and known vulnerable device fingerprints, making it essential for IoT and medical device security auditing.