Skill UI

A comprehensive guide for designing and managing document control systems for ISO 13485-compliant Quality Management Systems (QMS), specifically tailored for the medical device industry. This resource covers document numbering, version control, change management workflows, approval processes, and ensures compliance with rigorous standards like 21 CFR Part 11, including electronic signatures and audit trails.

This tool parses and analyzes Cobalt Strike Malleable C2 profiles, extracting critical network indicators such as HTTP/DNS transforms, URIs, headers, jitter, and sleep cycles. It is essential for reverse-engineering captured profiles or building robust network detection signatures for threat hunting and incident response.

A deep-dive tool for cybersecurity professionals to analyze malware Command and Control (C2) communication across multiple protocols (HTTP, HTTPS, DNS, custom). It helps reverse-engineer beaconing patterns, decode proprietary protocols, and map threat actor infrastructure, making it crucial for building robust detection signatures and attributing threats.

This guide provides a comprehensive walkthrough for deploying, configuring, and tuning Snort 3. It covers essential steps such as setting network interfaces to promiscuous mode, writing custom rules using Lua, integrating with SIEM platforms, and utilizing community rulesets. Ideal for network security professionals implementing robust, signature-based intrusion detection at critical network boundaries.

A comprehensive guide to deploying and configuring Suricata as a high-performance Intrusion Detection System (IDS) or Intrusion Prevention System (IPS). This skill covers setting up multi-threaded packet processing for high-throughput links, enabling protocol-aware inspection (HTTP, TLS, DNS, SMB), generating structured EVE JSON logs for SIEM ingestion, and integrating advanced signature and anomaly detection capabilities.

This tool deploys advanced machine learning techniques to detect anomalies within Operational Technology (OT) and Industrial Control Systems (ICS) environments. It establishes behavioral baselines by analyzing network traffic (Modbus, DNP3, OPC UA) and communication timing. Use cases include continuous monitoring, detecting zero-day deviations, and enhancing security monitoring platforms beyond standard signature-based intrusion detection.

A comprehensive guide for advanced threat hunting, focusing on detecting DLL side-loading and search-order hijacking (MITRE T1574). It instructs users to analyze Sysmon Event ID 7 logs, validate file signatures and hashes, and identify path anomalies to uncover APT persistence mechanisms. Essential for incident response and proactive threat detection in enterprise environments.

A comprehensive guide and workflow for detecting Mimikatz and similar credential-dumping activities. It utilizes command-line pattern matching, LSASS memory access signatures, binary indicators, and in-memory analysis. Ideal for threat hunting, scoping compromises during incident response, or validating detection coverage in purple team exercises using EDR/SIEM data.

Deploy Zeek for passive network analysis to generate structured logs (DNS, HTTP, etc.). This tool detects behavioral anomalies like DNS tunneling or beaconing, complementing traditional signature-based IDS tools. It is ideal for threat hunting and incident response, feeding rich protocol metadata into SIEM platforms.

This skill provides comprehensive guidance on detecting network reconnaissance and port scanning activities using industry-standard IDS/IPS systems like Suricata and Snort. It covers various scanning techniques (e.g., SYN, FIN, NULL, Xmas scans, UDP sweeps) and advanced detection methods, including signature matching, threshold-based alerting, and traffic anomaly analysis to identify tools like Nmap and Masscan.

A comprehensive skill for detecting early-stage ransomware indicators before data encryption occurs. It utilizes advanced network detection tools such as Zeek and Suricata, combined with SIEM correlation rules and threat intelligence feeds. This method monitors the entire pre-encryption kill chain, identifying precursor behaviors like initial access broker activity, Cobalt Strike C2 beaconing, credential harvesting (e.g., Mimikatz signatures), and data staging attempts, enabling timely incident response and containment.

This skill demonstrates how to exploit vulnerabilities in JWT implementations, specifically algorithm confusion. It targets APIs that fail to strictly enforce the signing algorithm, allowing attackers to downgrade signatures (e.g., RS256 to HS256) or bypass signature verification entirely (alg:none). Use this for authorized penetration testing of API security and cryptographic integrity.