Skill UI

This framework provides comprehensive detection capabilities for compromised cloud credentials across major platforms including AWS, Azure, and GCP. It analyzes critical threat indicators such as anomalous API activity, impossible travel patterns (impossible login locations), and unauthorized resource provisioning. Designed for incident response, security monitoring, and building robust detection rules to mitigate account takeover and credential abuse.

This skill provides comprehensive guidance on detecting post-exploitation credential dumping activities, such as LSASS memory access, SAM registry hive extraction, and NTDS.dit theft. It utilizes advanced log sources, including Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and SIEM correlation rules, to identify suspicious process behaviors and malicious tool usage, mapping these detections to MITRE ATT&CK techniques.

Falco is a powerful CNCF project for real-time runtime security monitoring. This guide teaches authors how to write and deploy custom detection rules using Falco's robust YAML rule engine and modern eBPF driver. It is designed to detect critical threats such as container escapes, namespace manipulation, privileged mounts, and anomalous syscalls in Kubernetes and Docker environments, significantly hardening the overall container security posture.

KubeEye is a comprehensive cluster inspection tool designed for Kubernetes environments, particularly within KubeSphere. It systematically detects issues across workloads, nodes, and configurations by integrating multiple policy engines, including OPA/Rego, PromQL, file integrity checks, kernel parameter validation, and systemd health checks. Users can define custom inspection rules (InspectRule), schedule checks (InspectPlan), and retrieve detailed reports (InspectResult) to ensure cluster compliance and stability.

A comprehensive guide to setting up a fast and secure WireGuard VPN server for remote access to your home network (homelab). Learn keypair generation, advanced Linux firewall (iptables) rules, and how to manage different tunneling modes (split vs. full tunnel) for optimal performance.