Skill UI

A comprehensive guide to deploying cloud-native deception across AWS, Azure, and GCP. This skill utilizes decoy resources—such as canary IAM keys, honey object storage buckets, and decoy secrets—whose sole purpose is to generate high-fidelity alerts the instant they are interacted with by an attacker. It detects cloud reconnaissance, credential theft, and lateral movement by wiring detection through native logging services (CloudTrail, Sentinel, Cloud Audit Logs), ensuring near-zero false positives for the SOC.

A comprehensive guide to deploying decoy artifacts, such as fake credentials, URLs, and files, called honeytokens or canarytokens. These tokens have no legitimate operational use; therefore, any interaction with them provides a high-fidelity, low-false-positive signal of an intrusion, data theft, or insider threat. Use this technique to enhance detection in low-telemetry areas like file shares or credential stores.

Falco is a powerful CNCF project for real-time runtime security monitoring. This guide teaches authors how to write and deploy custom detection rules using Falco's robust YAML rule engine and modern eBPF driver. It is designed to detect critical threats such as container escapes, namespace manipulation, privileged mounts, and anomalous syscalls in Kubernetes and Docker environments, significantly hardening the overall container security posture.

This guide details how to mature and operationalize a MISP instance, transforming it from a simple repository into an active threat detection engine. Users learn to enable and cache curated threat feeds, apply warninglists to minimize false positives, query indicators using PyMISP, and automate the export of matching attributes into industry-standard detection rules like Suricata, Sigma, and Wazuh.

A comprehensive tool for aggregating and displaying system metrics (counters, gauges, histograms) from the observability namespace. It computes baselines and flags anomalies by detecting deviations exceeding standard deviations, providing a clear snapshot of system health, error rates, and performance degradation trends.

A comprehensive framework for advanced sensing utilizing WiFi signals. It implements multistatic radar sensing, cross-viewpoint data fusion, RF tomography for volumetric imaging, and persistent field modeling. Features include pre-movement intention detection, biomechanics drift tracking, and robust mesh security hardening for research-grade deployments.

This advanced skill is designed for security research and CTF environments to trace subtle divergences in request handling across multiple network hops (proxies, gateways, backend servers). It focuses on identifying vulnerabilities stemming from differential interpretation of headers, path normalization, transfer framing (CL/TE), and host derivation, crucial for detecting request smuggling and parsing inconsistencies.

A comprehensive guide covering the entire lifecycle of malware analysis, from initial triage and deep static reverse engineering to automated sandboxing and behavioral monitoring. It details a multi-stage workflow that includes extracting Indicators of Compromise (IOCs), generating detection rules using YARA and Sigma, and identifying anti-analysis techniques. Ideal for threat intelligence researchers and incident responders.

Provides a comprehensive framework for blue-team threat hunting and detection engineering. Users learn hypothesis-driven hunting techniques, optimize SIEM queries, and build robust detection rules using industry standards like Sigma and YARA. Essential for minimizing false positives and validating security controls in a defensive posture.

This guide outlines a structured methodology for authorized wireless security assessments. It covers essential techniques such as Wi-Fi data capture, WPA/WPA2 handshake analysis, and rogue Access Point detection. It is designed for assessing corporate network security, verifying wireless isolation, and providing professional penetration testing recommendations, strictly adhering to legal scope and authorization.