Skill UI

A comprehensive guide on configuring advanced email security gateways (SEGs) to detect and block sophisticated, targeted spearphishing attacks. This skill covers essential detection layers, including impersonation protection, real-time URL detonation, attachment sandboxing, and creating custom behavioral rules. It is crucial for SOC analysts and security engineers building robust email threat defense systems.

This skill addresses advanced threat detection for critical infrastructure (OT/ICS). It monitors sophisticated, multi-stage cyber-physical attacks, focusing specifically on PLC logic integrity monitoring, detecting unauthorized modifications, and analyzing process anomalies. It covers the entire attack chain, from initial USB-borne access (IT) to process manipulation (OT).

A comprehensive guide and set of detection rules for identifying OS credential dumping techniques (MITRE T1003). It leverages EDR telemetry, Sysmon process access monitoring, and Windows security event correlation to detect attacks targeting LSASS memory, SAM databases, and NTDS.dit files. Essential for proactive threat hunting and incident response.

This skill provides a comprehensive workflow to extract Indicators of Compromise (IOCs) from malware samples and analysis reports. It covers file hashes (SHA256, MD5), network artifacts (IPs, domains, URLs from strings and PCAPs), and host-based indicators (registry keys, file paths, mutexes) from sandbox reports. It is essential for threat intelligence sharing, building blocklists, and creating detection signatures (YARA, Snort).

This skill guides threat hunters in detecting Cobalt Strike Command and Control (C2) beacons. It utilizes advanced network forensic techniques, including analyzing default TLS certificate serials, JA3/JA3S/JARM fingerprints, beacon jitter, and HTTP profile matching. Detection is achieved by correlating data from Zeek logs, Suricata rules, and Python PCAP analysis to identify suspicious outbound communications.

This guide details how to hunt for DCSync attacks, a technique used to steal password hashes from Active Directory. It involves analyzing Windows Event ID 4662 to identify unauthorized DS-Replication-Get-Changes requests originating from non-domain-controller accounts. Essential for incident response and threat detection.

Provides a structured methodology for proactive threat hunting against Living-off-the-Land Binaries (LOLBins). It guides practitioners in identifying techniques where adversaries abuse legitimate system tools (like certutil, mshta, rundll32) to execute payloads while bypassing traditional security controls (AV/EDR). Ideal for incident response, red team validation, and improving detection coverage against fileless attacks.

A comprehensive guide and methodology for proactively detecting webshell deployments on internet-facing servers. It focuses on analyzing file system anomalies, suspicious process spawning from web applications, and identifying unusual HTTP traffic patterns. Ideal for security operations centers (SOCs) during threat hunting, incident response, and purple team exercises.

Suricata is a high-performance, open-source network threat detection engine used for deep packet inspection. This skill details the deployment and configuration of Suricata in Intrusion Prevention System (IPS) mode. It covers setting up custom rules, integrating third-party rulesets (like Emerging Threats), and actively blocking malicious traffic in real time, making it essential for robust network security and compliance enforcement.

This guide details passive OT network traffic analysis using Nozomi Networks Guardian sensors. It provides methods to achieve comprehensive asset visibility, real-time threat detection, and vulnerability assessment across sensitive Industrial Control Systems (ICS) without disrupting operations. It is crucial for building robust OT Security Operations Centers (SOCs) and ensuring compliance with industry standards like IEC 62443.

This guide details the implementation of comprehensive security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection. It covers deploying the Datadog Agent across hybrid cloud infrastructure (AWS, Azure, GCP), ingesting critical log sources (CloudTrail, VPC Flow Logs, etc.), configuring Workload Protection, and creating custom detection rules to detect threats, enforce compliance, and provide centralized SOC visibility.

This guide outlines systematic methodologies for reducing false positives in Security Information and Event Management (SIEM) systems. It covers advanced techniques including threshold tuning, multi-signal correlation enhancement, behavioral baseline integration, and threat intelligence filtering. Used by SOC analysts and detection engineers to combat alert fatigue and improve true positive detection rates.