Skill UI

This comprehensive guide details the process of creating forensically sound, bit-for-bit disk images using industry-standard tools like `dd` and `dcfldd` on Linux systems. It covers essential steps including enabling write protection, documenting source metadata, performing the acquisition, and crucially, verifying the image integrity using cryptographic hashing (MD5/SHA-256). This methodology is vital for digital forensics, incident response, and legal proceedings to ensure evidence remains unaltered and admissible.

This comprehensive skill guides the setup and deployment of File Integrity Monitoring (FIM) using AIDE on Linux systems. It covers generating the initial baseline database, configuring monitoring rules, running scheduled checks via cron, and parsing change reports to detect unauthorized file modifications. Essential for meeting strict compliance requirements and enhancing endpoint security.

A comprehensive tool suite designed to analyze firmware images from embedded devices, including routers, IoT endpoints, and critical system components like UEFI/BIOS. It facilitates deep security analysis by performing firmware extraction, filesystem integrity checks, binary reverse engineering, and sophisticated detection of bootkits, backdoors, and unauthorized modifications.

A comprehensive, NIST/CISA-aligned workflow for structured recovery following a ransomware incident. It covers critical steps including environment isolation, forensic evidence preservation, Active Directory restoration (DSRM, krbtgt reset), backup integrity validation, and phased, dependency-based system rebuild. Essential for post-incident disaster recovery planning.

A deep dive toolset for forensic investigation of advanced persistent threats (APT) at the firmware level. It analyzes UEFI variable modifications, SPI flash implants, Secure Boot bypass techniques, and unauthorized components within the EFI System Partition (ESP). Utilizes tools like chipsec, flashrom, and YARA for comprehensive integrity verification.

This skill outlines the architecture and methodology for deploying canary files (honeytokens) across critical file systems. By placing decoy documents with known content in high-value locations, this system monitors for unauthorized modifications, deletions, or encryption attempts. It detects ransomware by triggering high-fidelity alerts via File Integrity Monitoring (FIM) systems, serving as a crucial deception layer that complements existing EDR/AV solutions.

This guide details how to implement secure, keyless software signing using the Sigstore ecosystem components (Cosign, Fulcio, Rekor). It establishes cryptographic provenance for container images and binaries by binding identity via OIDC, ensuring verifiable integrity and tamper-proofing throughout the CI/CD supply chain.

A systematic checklist for launching Attio API integrations into a live production environment. It covers critical best practices for ensuring stability, including robust authentication, advanced error handling (exponential backoff, retries), rate limiting strategies, data integrity checks, health monitoring endpoints, and comprehensive rollback plans. Essential for reliable SaaS deployments.

This advanced skill explores offensive reconnaissance techniques focused on defeating modern operating system security boundaries and mitigations. Topics include kernel/user boundary manipulation, sandbox escapes (AppContainer, LPAC), COM/RPC boundary exploitation, hypervisor interactions, and various integrity level bypassing methods. It is essential for planning advanced privilege escalation paths and understanding deep Windows security architecture, including AMSI, WDAC, and ETW manipulation.

CHIPSEC is an open-source framework designed to assess the low-level security configuration of x86 platform firmware and hardware. It verifies critical security controls such as SPI flash write protection, BIOS locks, SMM/SMRR configuration, and Secure Boot variable integrity. Users can run automated tests, dump SPI flash memories for forensics, and detect potential firmware implants that persist below the operating system layer.

This skill provides a comprehensive workflow for verifying the integrity of a system's boot chain using TPM 2.0. It covers local validation by reading Platform Configuration Registers (PCRs) and replaying the event log, and remote attestation by generating and checking signed quotes. Use cases include enforcing Zero Trust device posture, detecting firmware tampering, or establishing secure secret baselines.

KubeEye is a comprehensive cluster inspection tool designed for Kubernetes environments, particularly within KubeSphere. It systematically detects issues across workloads, nodes, and configurations by integrating multiple policy engines, including OPA/Rego, PromQL, file integrity checks, kernel parameter validation, and systemd health checks. Users can define custom inspection rules (InspectRule), schedule checks (InspectPlan), and retrieve detailed reports (InspectResult) to ensure cluster compliance and stability.