Skill UI

A comprehensive framework for assessing network security posture. This skill guides the tester through the entire penetration testing lifecycle, from reconnaissance and host discovery (using tools like Nmap) to service enumeration, vulnerability identification (CVEs), and controlled exploitation (Metasploit). It is essential for validating firewall rules, ensuring compliance (e.g., PCI-DSS), and stress-testing critical infrastructure security.

This guide details the end-to-end process of conducting a sophisticated spearphishing simulation campaign, mirroring real red team adversary techniques. It covers initial OSINT research and pretext development, building weaponized payloads that bypass security controls, setting up robust email infrastructure (SPF/DKIM/DMARC), executing the campaign in waves, and performing detailed post-campaign metrics analysis for comprehensive security reporting.

This guide details how to build and manage a robust two-tier Public Key Infrastructure (PKI) using OpenSSL. Learn to establish a Root CA and an Intermediate CA, issue server and client certificates, configure Certificate Revocation Lists (CRLs), and implement best practices for secure key management and certificate policy enforcement, ensuring compliance and high security standards.

This comprehensive guide details how to implement robust security hardening measures for LDAP directory services. It specifically addresses critical vulnerabilities like LDAP injection, anonymous binding, and channel binding bypass. Key features include mandatory LDAPS enforcement, granular access control list configuration, and integrating advanced monitoring to ensure the infrastructure meets high compliance standards (e.g., NIST 800-53). Essential for security architects and operations teams.

This skill detects unauthorized modifications (container drift) to running containers by monitoring for deviations from the original image state. It monitors binary execution drift, file system changes, and configuration deviations using tools like Falco and Kubernetes security contexts. Essential for SOC analysts and security teams investigating runtime compromises and enforcing immutable infrastructure.

This skill addresses advanced threat detection for critical infrastructure (OT/ICS). It monitors sophisticated, multi-stage cyber-physical attacks, focusing specifically on PLC logic integrity monitoring, detecting unauthorized modifications, and analyzing process anomalies. It covers the entire attack chain, from initial USB-borne access (IT) to process manipulation (OT).

This guide details the process of implementing BGP route origin validation using Resource Public Key Infrastructure (RPKI). Learn how to create Route Origin Authorizations (ROAs), deploy RPKI validators, and configure Route Origin Validation (ROV) on major routers like Cisco IOS-XE and Juniper Junos. This technique is crucial for preventing malicious route hijacking and securing internet routing paths.

This comprehensive guide details the end-to-end deployment of Delinea Secret Server for robust Privileged Access Management (PAM). It provides scripts and steps for configuring the vault infrastructure, defining secret templates, and automating the discovery of privileged credentials across hybrid environments. Essential for organizations needing centralized, compliant, and automatically rotated management of shared and service accounts.

This skill guides the implementation and maintenance of compliance controls for North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards. It covers key areas including asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), and supply chain risk management. Use this when auditing, updating, or establishing compliance measures for Bulk Electric System (BES) cyber assets.

This guide details the implementation of comprehensive security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection. It covers deploying the Datadog Agent across hybrid cloud infrastructure (AWS, Azure, GCP), ingesting critical log sources (CloudTrail, VPC Flow Logs, etc.), configuring Workload Protection, and creating custom detection rules to detect threats, enforce compliance, and provide centralized SOC visibility.

HashiCorp Boundary is an identity-aware proxy that establishes secure, zero-trust access to infrastructure resources, eliminating the need for traditional VPNs. It enforces a default-deny model and integrates with HashiCorp Vault to dynamically broker credentials. This ensures just-in-time, least-privilege access, automatic credential revocation, and comprehensive session recording for strict compliance and auditing.

A comprehensive guide for authorized penetration testing to map a target's entire DNS infrastructure. This skill covers advanced techniques including enumerating various DNS record types (A, MX, TXT, SRV), attempting zone transfers (AXFR/IXFR), brute-forcing subdomains, and analyzing security configurations (DNSSEC, SPF, DMARC). It is crucial for identifying the full external attack surface of a target organization.