Skill UI

This skill automates the hardening of Linux endpoints (Ubuntu, RHEL, CentOS) by implementing industry-standard security best practices guided by CIS Benchmarks. It systematically secures various layers, including filesystem permissions, network parameters (sysctl), SSH configuration, user access controls (PAM), and integrates deep auditing using auditd and OpenSCAP. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This skill guides the security hardening of Windows endpoints (10/11, Server 2019/2022) using established CIS Benchmarks. It provides a comprehensive workflow for establishing secure organizational baselines, configuring Group Policy Objects (GPOs), and enforcing security controls across critical areas like password policies, audit logs, and firewall rules. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This skill guides threat hunters in detecting Cobalt Strike Command and Control (C2) beacons. It utilizes advanced network forensic techniques, including analyzing default TLS certificate serials, JA3/JA3S/JARM fingerprints, beacon jitter, and HTTP profile matching. Detection is achieved by correlating data from Zeek logs, Suricata rules, and Python PCAP analysis to identify suspicious outbound communications.

This guide details how to hunt for DCSync attacks, a technique used to steal password hashes from Active Directory. It involves analyzing Windows Event ID 4662 to identify unauthorized DS-Replication-Get-Changes requests originating from non-domain-controller accounts. Essential for incident response and threat detection.

A comprehensive guide and detection methodology for identifying covert communication channels utilizing DNS records. This technique analyzes Zeek dns.log for indicators such as high-entropy subdomains, excessive query volume, unusually long query lengths, and abnormal record type distributions, which suggest data exfiltration or Command and Control (C2) activity.

Provides a structured methodology for proactive threat hunting against Living-off-the-Land Binaries (LOLBins). It guides practitioners in identifying techniques where adversaries abuse legitimate system tools (like certutil, mshta, rundll32) to execute payloads while bypassing traditional security controls (AV/EDR). Ideal for incident response, red team validation, and improving detection coverage against fileless attacks.

This guide provides a structured methodology for proactively hunting adversaries who establish persistence using Windows Scheduled Tasks (T1053). It outlines the necessary prerequisites (EDR, SIEM, Sysmon) and a comprehensive workflow—from hypothesis formulation to threat correlation—for detecting suspicious task creation, unusual scheduling patterns, and attacker TTPs during incident response or red teaming.

A comprehensive guide and methodology for proactively detecting webshell deployments on internet-facing servers. It focuses on analyzing file system anomalies, suspicious process spawning from web applications, and identifying unusual HTTP traffic patterns. Ideal for security operations centers (SOCs) during threat hunting, incident response, and purple team exercises.

This skill provides a comprehensive guide to implementing application whitelisting using Windows AppLocker. It drastically restricts unauthorized software execution (malware, shadow IT) on Windows endpoints by enforcing strict application control policies. Use this method to meet critical compliance requirements (such as PCI DSS or NIST standards), block common attack vectors like LOLBins, and significantly reduce the overall attack surface in high-security environments.

This skill provides a comprehensive guide to deploying AWS Security Hub for centralized Cloud Security Posture Management (CSPM). It covers aggregating security findings from multiple sources (GuardDuty, Inspector, Macie, and third-party tools), enabling compliance checks against standards like CIS and PCI-DSS, and automating remediation workflows across multi-account AWS organizations. Ideal for security teams needing continuous compliance monitoring and robust governance.

A comprehensive guide to implementing AWS Security Hub for centralized security posture management. It enables the aggregation of findings from multiple AWS accounts, evaluates compliance against industry standards (like CIS, PCI DSS, NIST), and configures automated remediation workflows using EventBridge and Lambda for robust organizational risk management.

This guide details the implementation of Microsoft Defender for Cloud, enabling comprehensive cloud security posture management (CSPM) and workload protection (CWPP). Learn how to secure VMs, containers, databases, and storage accounts, configure security recommendations, and establish automated remediation workflows to ensure continuous compliance and robust cloud defense.