Skill UI

This skill details implementing a ransomware-resistant, immutable backup strategy using the restic tool. It leverages S3-compatible Object Lock (Compliance Mode) to ensure Write Once Read Many (WORM) storage, preventing deletion or modification by attackers. The process includes automated backup, cryptographic integrity verification (restic check), and scheduled restore testing, adhering to advanced security standards like 3-2-1-1-0.

A comprehensive guide to implementing Mimecast Targeted Threat Protection (TTP). This suite defends against sophisticated phishing, spearphishing, and Business Email Compromise (BEC) attacks by integrating four core modules: URL Protect, Attachment Protect, Impersonation Protect, and Internal Email Protect. Follow the detailed workflow to secure your organizational communications and meet compliance standards.

This guide details the implementation of advanced, phishing-resistant, passwordless authentication using Microsoft Entra ID. It covers configuring FIDO2 security keys, Windows Hello for Business, and passkey support via Microsoft Authenticator. Use this skill to eliminate reliance on passwords, mitigate credential stuffing attacks, and satisfy strict regulatory mandates for modern identity access management.

A comprehensive guide to deploying and configuring Proofpoint Email Protection as a Secure Email Gateway (SEG). This solution establishes a critical security checkpoint that uses advanced ML, sandboxing, and threat intelligence to detect and block sophisticated threats, including phishing, malware, BEC, and spam, before they reach the user inbox. Ideal for organizations strengthening their email security architecture and meeting compliance standards.

A comprehensive guide for SOC analysts and digital forensics experts. This skill covers the entire lifecycle of a phishing incident, from initial user report and header analysis (SPF, DKIM, DMARC) to detonating malicious URLs/attachments in sandboxes. It guides users on scoping the attack, identifying impacted users via SIEM/proxy logs, and executing containment measures like email purges.

A comprehensive guide to detecting and mitigating advanced Adversary-in-the-Middle (AiTM) phishing attacks, which bypass Multi-Factor Authentication (MFA) using reverse proxies (e.g., Evilginx, EvilProxy). Learn defensive strategies including implementing FIDO2, configuring Conditional Access policies, and monitoring session hijacking indicators in SIEM/Web Proxies.

This skill simulates various network attack scenarios, including bandwidth throttling, traffic shaping, and network degradation, using tools like tc, iperf3, and Scapy. It is designed for authorized security assessments to test the resilience of applications, validate Quality-of-Service (QoS) policies, and assess the ability of network monitoring tools to detect sophisticated traffic manipulation attacks (e.g., Slowloris-style attacks).

This comprehensive guide outlines the phased rollout process for DMARC (Domain-based Message Authentication, Reporting, and Conformance). It details moving from monitoring (p=none) through quarantine (p=quarantine) to full rejection (p=reject). Adopting DMARC is critical for anti-spoofing, ensuring that only authorized senders can use your domain, thereby significantly reducing phishing and unauthorized email traffic.

This skill demonstrates how to integrate Hardware Security Modules (HSMs) using the standard PKCS#11 interface. It covers secure key generation, signing, encryption, and verification operations directly on the hardware. Ideal for security assessments, compliance audits (FIPS 140-2/3), and validating cryptographic controls using tools like python-pkcs11, AWS CloudHSM, and YubiHSM2.

This guide details how to use GoPhish, an open-source framework, to conduct authorized phishing simulations. You will learn the complete lifecycle, from deploying the tool and configuring SMTP profiles, to creating realistic email templates and cloning secure landing pages. The skill culminates in analyzing campaign results to assess organizational security posture and improve employee resilience against social engineering attacks.

This sophisticated tool automates the security review of serverless functions across major cloud providers, including AWS Lambda, Azure Functions, and GCP Cloud Functions. It systematically identifies critical misconfigurations such as overly permissive IAM execution roles (wildcard actions), hardcoded secrets in environment variables, and potential lack of runtime protections. Ideal for pre-production auditing and compliance checks.

This framework executes sophisticated threat emulation tests using Atomic Red Team, mapping directly to MITRE ATT&CK techniques. It allows security teams to actively simulate adversary behavior, validating the detection coverage of SIEM rules and EDR controls. Use this tool for comprehensive purple team operations, penetration testing, and security auditing.