Skill UI

This skill provides comprehensive methods for collecting and synthesizing Open-Source Intelligence (OSINT) regarding threat actors, malicious infrastructure, and attack campaigns. It utilizes public data sources, passive reconnaissance tools (like WHOIS, Certificate Transparency), and specialized platforms (Maltego, Shodan, SpiderFoot) to map adversary context and perform pre-engagement intelligence gathering for authorized red team assessments. Emphasis is placed on passive collection techniques to ensure legality and operational security.

This guide details the methodology for conducting internal network penetration tests, simulating an attacker operating from an assumed breach state. It covers initial network reconnaissance, Active Directory enumeration, advanced credential harvesting techniques (e.g., Kerberoasting, Pass-the-Hash), and lateral movement exploitation to determine the full blast radius of a potential breach. Essential for comprehensive security auditing.

This guide details the comprehensive workflow for conducting memory forensics using Volatility 3. It covers the entire incident response lifecycle, from acquiring raw RAM dumps to analyzing processes, detecting rootkits, investigating network connections, and extracting sensitive artifacts like credentials and injected code. Essential for live memory analysis in cybersecurity investigations.

A structured guide for conducting blameless post-mortem reviews after any security incident. This process helps identify root causes using techniques like the 5 Whys, calculates critical metrics (MTTD, MTTR), and generates actionable recommendations to continuously improve incident response playbooks and procedures.

This guide details the robust process of implementing VLAN-based (802.1Q) network segmentation on managed switches. It is crucial for isolating critical zones—such as DMZ, servers, and IoT—to meet strict compliance standards (PCI-DSS, HIPAA) and significantly limiting the blast radius during a security incident by controlling lateral movement. Includes port hardening and ACL configuration.

A comprehensive guide to configuring pfSense firewalls for robust network security. This skill covers setting up complex network segmentation across multiple zones (DMZ, internal, guest, IoT), implementing granular firewall rules, configuring NAT for port forwarding, and establishing site-to-site or remote-access VPN tunnels using IPsec or OpenVPN. Ideal for network engineers deploying perimeter or internal firewalls.

A comprehensive guide to implementing and validating Transport Layer Security (TLS) 1.3. This skill covers configuring modern cipher suites, key exchange groups, and enforcing perfect forward secrecy (PFS). Use this when deploying secure communication protocols, hardening network services, meeting compliance standards, or performing deep security assessments on web servers and applications.

This comprehensive guide provides a structured, multi-stage workflow for containing active security breaches. It details both short-term and long-term strategies, including network segmentation, endpoint isolation, credential revocation, and evidence preservation. Use this process during confirmed intrusions, ransomware attacks, or lateral movement events to effectively stop adversary activity and secure critical assets before eradication.

A comprehensive guide for implementing enterprise-grade Security Access Service Edge (SASE) architectures using Palo Alto Networks Prisma Access. This skill covers configuring ZTNA connectors, GlobalProtect agents, security policies, and device posture checks (HIP) to provide unified, cloud-delivered security, replacing traditional VPNs and maintaining zero trust principles across remote and branch offices.

This tool deploys advanced machine learning techniques to detect anomalies within Operational Technology (OT) and Industrial Control Systems (ICS) environments. It establishes behavioral baselines by analyzing network traffic (Modbus, DNP3, OPC UA) and communication timing. Use cases include continuous monitoring, detecting zero-day deviations, and enhancing security monitoring platforms beyond standard signature-based intrusion detection.

This guide details methods for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically targeting Microsoft Entra ID (Azure AD). It covers protection against access token theft, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Users can leverage Conditional Access and Token Protection features to cryptographically bind tokens to devices, significantly enhancing cloud identity security and preventing session hijacking.

This skill provides a comprehensive framework for detecting various privilege escalation techniques across Windows and Linux. It covers access token manipulation, UAC bypass, unquoted service path abuse, and kernel exploits. It is essential for threat hunting, scoping compromise during incident response, and validating detection coverage in proactive security assessments.