Skill UI

This guide details advanced threat hunting techniques to proactively detect Mimikatz execution. It focuses on identifying command-line patterns, unauthorized access to LSASS memory, binary indicators, and known credential dumping techniques (e.g., DCSync, Golden Tickets). Ideal for security analysts, threat hunters, and incident response teams during proactive assessments or active compromise investigation.

This guide details methods for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically targeting Microsoft Entra ID (Azure AD). It covers protection against access token theft, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Users can leverage Conditional Access and Token Protection features to cryptographically bind tokens to devices, significantly enhancing cloud identity security and preventing session hijacking.

A comprehensive methodology for detecting advanced system compromises, including rootkits, hidden processes, and kernel-level malware. It utilizes memory forensics, cross-view detection (comparing different system views), and integrity checking to identify manipulated kernel structures, hooked system calls (SSDT, IAT, IRP), and covert network connections. Ideal for deep forensic investigations where standard tools fail to reveal the true state of a compromised system.

This guide details how to detect advanced process injection techniques (T1055) by analyzing rich Sysmon telemetry. It focuses on identifying cross-process memory operations, such as remote thread creation (Event 8), suspicious process access (Event 10), and memory divergence (ProcessTampering/Event 25), which are hallmarks of DLL injection and process hollowing. Ideal for threat hunters and security analysts investigating sophisticated defense evasion.

This utility performs comprehensive forensic analysis on memory dumps. It leverages industry-standard tools like Volatility and Mimikatz to extract sensitive information, including cached credentials, NTLM/LM hashes, Kerberos tickets, and authentication tokens. It is crucial for incident response, assessing the scope of credential compromise, and investigating lateral movement attacks.

This guide provides comprehensive steps to harden the Docker daemon configuration. It covers essential security controls like user namespace remapping, disabling inter-container communication (ICC), implementing TLS authentication, and adopting rootless mode. Implementing these measures significantly reduces the attack surface and mitigates risks associated with container breakouts and privilege escalation, aligning with CIS benchmarks.

A proactive, hypothesis-driven skill designed to hunt for Advanced Persistent Threats (APT) within complex enterprise environments. It analyzes endpoint telemetry, network logs, and memory artifacts using frameworks like MITRE ATT&CK. Use this skill when investigating anomalous behavior flagged by UEBA, conducting scheduled threat sprints, or validating exposure to known TTPs using tools like Velociraptor and osquery.

A comprehensive guide to configuring multi-layered DDoS protection using Cloudflare. This skill covers mitigating volumetric (L3/4) and application-layer (L7) attacks by setting up managed rulesets, Web Application Firewall (WAF) rules, rate limiting, and Bot Management. Ideal for strengthening security architecture and meeting compliance standards.

This skill covers the architecture, design, and implementation of Just-In-Time (JIT) access provisioning. The goal is to eliminate standing privileges by granting temporary, time-bound access only when specific business needs arise. It guides users through designing robust approval workflows, integrating JIT with PAM and IGA platforms, and enforcing zero standing privilege (ZSP) principles to drastically reduce the attack surface and ensure compliance.

This guide details the implementation of advanced, phishing-resistant, passwordless authentication using Microsoft Entra ID. It covers configuring FIDO2 security keys, Windows Hello for Business, and passkey support via Microsoft Authenticator. Use this skill to eliminate reliance on passwords, mitigate credential stuffing attacks, and satisfy strict regulatory mandates for modern identity access management.

This skill provides a comprehensive guide to implementing robust USB device control policies. It restricts unauthorized removable media access to mitigate data exfiltration risks and prevent malware introduction via USB endpoints. Learn how to deploy granular policies using Group Policy Objects (GPO), Microsoft Intune, or advanced Endpoint Detection and Response (EDR) platforms to meet strict compliance standards.

Utilize Velociraptor, an advanced open-source platform, to collect, query, and monitor forensic artifacts across diverse endpoints (Windows, Linux, macOS). This skill enables incident response teams to perform large-scale, rapid digital forensic investigations by collecting critical data such as event logs, registry entries, prefetch files, and network metadata using VQL queries.