Skill UI

A comprehensive playbook designed for Operational Technology (OT) and Industrial Control Systems (ICS) environments. It provides structured, phased incident response procedures aligned with SANS PICERL, IEC 62443, and NIST standards. It specifically addresses safety-critical challenges, process availability, and the unique coordination required between IT Security, OT Engineering, and Plant Operations during cyber incidents, such as ransomware attacks.

This guide details the implementation of advanced, phishing-resistant, passwordless authentication using Microsoft Entra ID. It covers configuring FIDO2 security keys, Windows Hello for Business, and passkey support via Microsoft Authenticator. Use this skill to eliminate reliance on passwords, mitigate credential stuffing attacks, and satisfy strict regulatory mandates for modern identity access management.

This comprehensive guide details the deployment of HashiCorp Vault for robust, centralized secrets management in hybrid and multi-cloud environments. It covers configuring dynamic secret engines for databases (PostgreSQL) and cloud providers (AWS), integrating diverse authentication methods (OIDC, AppRole, Kubernetes), and securely delivering short-lived secrets to Kubernetes workloads via agents. The primary goal is to enforce zero-trust principles by eliminating hardcoded, long-lived credentials from application code and CI/CD pipelines.

A comprehensive guide to deploying Zero Standing Privilege (ZSP) using CyberArk Secure Cloud Access. This solution eliminates persistent privileged access by provisioning ephemeral, Just-in-Time (JIT) credentials across hybrid and multi-cloud environments (AWS, Azure, GCP). Access is strictly governed by the TEA framework: Time limits, scoped Entitlements, and mandatory Approvals, ensuring the principle of least privilege is maintained.

This comprehensive guide details the implementation of Zero Trust Architecture (ZTA) in multi-cloud environments (AWS, Azure, GCP). Following NIST SP 800-207 and BeyondCorp principles, it covers identity-centric access controls, micro-segmentation, continuous verification, and deploying Identity-Aware Proxies (IAP) to eliminate implicit network trust.

HashiCorp Boundary is an identity-aware proxy that establishes secure, zero-trust access to infrastructure resources, eliminating the need for traditional VPNs. It enforces a default-deny model and integrates with HashiCorp Vault to dynamically broker credentials. This ensures just-in-time, least-privilege access, automatic credential revocation, and comprehensive session recording for strict compliance and auditing.

A comprehensive guide for SOC analysts and digital forensics experts. This skill covers the entire lifecycle of a phishing incident, from initial user report and header analysis (SPF, DKIM, DMARC) to detonating malicious URLs/attachments in sandboxes. It guides users on scoping the attack, identifying impacted users via SIEM/proxy logs, and executing containment measures like email purges.

A comprehensive guide to executing cloud-native incident containment procedures across major platforms including AWS, Azure, and GCP. Learn how to systematically isolate compromised resources, revoke malicious credentials, apply network restrictions (Security Groups/ACLs), and capture forensic evidence to prevent lateral movement during a security event. Essential for security assessments and incident response.

This tool orchestrates safe vulnerability assessments for Operational Technology (OT) and Industrial Control Systems (ICS) environments. It prioritizes safety by guiding users through passive monitoring, native protocol querying, and carefully controlled active scanning methods, specifically designed to identify vulnerabilities without risk of disrupting industrial processes or crashing legacy controllers. Essential for compliance audits (e.g., IEC 62443).

This skill demonstrates how to craft and inject custom, malformed, or spoofed network packets using tools like Scapy and hping3. It is designed for authorized cybersecurity assessments to rigorously test firewall rules, Intrusion Detection/Prevention Systems (IDS/IPS) signatures, anti-spoofing controls, and overall network stack resilience against protocol anomalies and fragmentation attacks. Use only in controlled, authorized environments.

This guide details how to use GoPhish, an open-source framework, to conduct authorized phishing simulations. You will learn the complete lifecycle, from deploying the tool and configuring SMTP profiles, to creating realistic email templates and cloning secure landing pages. The skill culminates in analyzing campaign results to assess organizational security posture and improve employee resilience against social engineering attacks.

This skill teaches the comprehensive process of developing precise YARA rules for malware detection. It covers techniques such as identifying unique byte patterns, analyzing strings, and inspecting PE file headers to create robust signatures. Ideal for security analysts performing threat hunting, incident response, and security auditing.