Skill UI

A comprehensive guide to deploying and configuring Suricata as a high-performance Intrusion Detection System (IDS) or Intrusion Prevention System (IPS). This skill covers setting up multi-threaded packet processing for high-throughput links, enabling protocol-aware inspection (HTTP, TLS, DNS, SMB), generating structured EVE JSON logs for SIEM ingestion, and integrating advanced signature and anomaly detection capabilities.

This tool deploys advanced machine learning techniques to detect anomalies within Operational Technology (OT) and Industrial Control Systems (ICS) environments. It establishes behavioral baselines by analyzing network traffic (Modbus, DNP3, OPC UA) and communication timing. Use cases include continuous monitoring, detecting zero-day deviations, and enhancing security monitoring platforms beyond standard signature-based intrusion detection.

This guide provides comprehensive techniques for detecting Layer 2 ARP poisoning and spoofing attacks. It covers monitoring gratuitous ARP floods, tracking IP-to-MAC mapping changes, and identifying rogue devices. Techniques include deploying ARPWatch, configuring Dynamic ARP Inspection (DAI) on managed switches, and using advanced Wireshark filters or custom Python scripts for robust security monitoring and incident response.

A comprehensive skill for detecting early-stage ransomware indicators before data encryption occurs. It utilizes advanced network detection tools such as Zeek and Suricata, combined with SIEM correlation rules and threat intelligence feeds. This method monitors the entire pre-encryption kill chain, identifying precursor behaviors like initial access broker activity, Cobalt Strike C2 beaconing, credential harvesting (e.g., Mimikatz signatures), and data staging attempts, enabling timely incident response and containment.

This tool simulates various BGP hijacking scenarios, including prefix hijacking and route leaks, within authorized, isolated lab environments. It is designed to assess the effectiveness of critical network defenses such as RPKI deployment, route origin validation, and BGP monitoring systems against unauthorized route announcements. It is a training and validation tool for network operations teams.

This comprehensive guide details how to implement robust privileged session monitoring and recording using advanced PAM solutions like CyberArk PSM. It covers critical aspects including architecting network controls (routing all access through proxies), configuring keystroke logging and session recording for RDP/SSH, and establishing real-time monitoring rules. Essential for meeting strict compliance requirements (e.g., PCI-DSS, SOX, HIPAA) and generating non-repudiable audit trails.

This skill simulates bandwidth throttling and network degradation attacks using tools like tc, iperf3, and Scapy. Designed exclusively for authorized lab environments, it validates Quality of Service (QoS) controls, tests the resilience of real-time applications (like VoIP and video conferencing), and assesses network monitoring tools' ability to detect abnormal traffic manipulation.

A comprehensive guide to conducting security assessments on thick client (desktop) applications. This skill details techniques ranging from static analysis (using tools like dnSpy, IDA Pro) to dynamic analysis (process monitoring with Procmon, network interception via Burp Suite). It covers finding hardcoded credentials, identifying insecure local storage, mitigating DLL hijacking, and analyzing memory manipulation within local applications.

This skill provides advanced techniques and code examples for monitoring, mapping, and pivoting across adversary-controlled infrastructure. It leverages Passive DNS, Certificate Transparency logs, Shodan/Censys scanning, and network fingerprinting (JARM/JA3S) to discover C2 servers, phishing domains, and exploitable assets over time, which is crucial for advanced security operations and threat intelligence gathering.

This tool provides comprehensive integration for Reolink security cameras, supporting both RTSP streaming and HTTP API access. It allows users to discover cameras via ONVIF, capture live streams, take snapshots, and even capture motion-triggered video clips. It is ideal for developers building robust, networked surveillance or monitoring systems.

A comprehensive skill for detecting and analyzing malicious behavior in mobile applications (Android/iOS). It employs multi-layered security analysis, including static indicator checking (permissions, manifest), dynamic instrumentation (Frida), network traffic monitoring, and automated scanning (MobSF). Use this skill when investigating suspicious apps for data exfiltration, C2 communication, or unauthorized access.