Skill UI

A comprehensive guide for deep packet inspection and network forensics using Wireshark and tshark. This skill is critical for incident response, where it allows users to capture, filter, and analyze network packet data to identify malicious command-and-control traffic, diagnose complex protocol issues, extract indicators of compromise (IOCs), and reconstruct data exfiltration paths. Use it for validating security rules and understanding network anomalies.

This comprehensive skill analyzes Zeek conn.log and NetFlow data to proactively detect advanced indicators of ransomware activity. It identifies critical threats such as Command and Control (C2) beaconing patterns, connections to TOR exit nodes, large-scale data exfiltration flows, and suspicious DNS anomalies. It is essential for threat hunting and complex security incident response.

This guide details how to hunt for DCSync attacks, a technique used to steal password hashes from Active Directory. It involves analyzing Windows Event ID 4662 to identify unauthorized DS-Replication-Get-Changes requests originating from non-domain-controller accounts. Essential for incident response and threat detection.

Provides a structured methodology for proactive threat hunting against Living-off-the-Land Binaries (LOLBins). It guides practitioners in identifying techniques where adversaries abuse legitimate system tools (like certutil, mshta, rundll32) to execute payloads while bypassing traditional security controls (AV/EDR). Ideal for incident response, red team validation, and improving detection coverage against fileless attacks.

This comprehensive skill guides the deployment and configuration of Wazuh SIEM/XDR for robust endpoint monitoring. Users will learn to manage agents via the API, create custom decoders and rules (XML), query security alerts, and test rule logic, enabling organizations to establish strong security controls and automate incident response.

A comprehensive playbook designed for Operational Technology (OT) and Industrial Control Systems (ICS) environments. It provides structured, phased incident response procedures aligned with SANS PICERL, IEC 62443, and NIST standards. It specifically addresses safety-critical challenges, process availability, and the unique coordination required between IT Security, OT Engineering, and Plant Operations during cyber incidents, such as ransomware attacks.

This skill provides a comprehensive guide to implementing robust USB device control policies. It restricts unauthorized removable media access to mitigate data exfiltration risks and prevent malware introduction via USB endpoints. Learn how to deploy granular policies using Group Policy Objects (GPO), Microsoft Intune, or advanced Endpoint Detection and Response (EDR) platforms to meet strict compliance standards.

This skill provides a comprehensive framework for simulating and testing disaster recovery plans against ransomware threats. It guides users through measuring Recovery Time Objective (RTO) and Recovery Point Objective (RPO), validating clean backup restores, and hardening security controls to ensure organizational resilience. It is designed for tabletop exercises and compliance auditing, not for active incident response.