Skill UI

This skill guides the implementation of email sandboxing using Proofpoint Targeted Attack Protection (TAP). It covers configuring isolated detonations for suspicious attachments and URLs to detect zero-day malware, evasive phishing, and advanced threats. Learn to tune policies, monitor the TAP dashboard, and integrate findings with SIEM for robust email security architecture.

A comprehensive guide to deploying and configuring Proofpoint Email Protection as a Secure Email Gateway (SEG). This solution establishes a critical security checkpoint that uses advanced ML, sandboxing, and threat intelligence to detect and block sophisticated threats, including phishing, malware, BEC, and spam, before they reach the user inbox. Ideal for organizations strengthening their email security architecture and meeting compliance standards.

This skill provides a comprehensive guide to implementing robust USB device control policies. It restricts unauthorized removable media access to mitigate data exfiltration risks and prevent malware introduction via USB endpoints. Learn how to deploy granular policies using Group Policy Objects (GPO), Microsoft Intune, or advanced Endpoint Detection and Response (EDR) platforms to meet strict compliance standards.

CAPE is an open-source sandbox built for automated malware analysis, derived from Cuckoo. It provides advanced behavioral monitoring, payload dumping, and configuration extraction using over 70 parsers for known malware families (e.g., Emotet, Cobalt Strike). It captures network IOCs, dropped files, and detects anti-evasion techniques, making it ideal for security assessments and incident response workflows via its robust API.

A comprehensive guide for analyzing firmware images from embedded systems, IoT devices, routers, and specialized components like UEFI/BIOS. This skill covers advanced techniques including filesystem extraction, binary reverse engineering (using Ghidra/IDA), rootkit detection, and deep forensic analysis to uncover backdoors, implants, and supply chain compromises. Essential for cybersecurity professionals investigating compromised hardware.

A comprehensive guide for digital forensics professionals on analyzing volatile memory dumps using Volatility 3. Learn to extract critical evidence, including running processes, network connections, loaded DLLs, system credentials, and detecting advanced threats like process hollowing and rootkits. Essential for incident response and malware analysis.

This skill teaches the comprehensive process of developing precise YARA rules for malware detection. It covers techniques such as identifying unique byte patterns, analyzing strings, and inspecting PE file headers to create robust signatures. Ideal for security analysts performing threat hunting, incident response, and security auditing.

A deep dive into advanced malware reverse engineering techniques. Learn how to utilize Ghidra's powerful disassembler and decompiler to analyze complex malware binaries. This guide covers identifying C2 communication protocols, extracting cryptographic routines, understanding memory injection, and analyzing low-level assembly code for core logic and evasion techniques. Essential for professional cybersecurity analysts.

This skill provides a deep dive into the architecture of low-level keyloggers. It covers techniques such as kernel driver hooks, using WH_KEYBOARD_LL, ETW-based input capture, and analyzing user-mode vs. kernel-mode approaches. Use this methodology to understand input capture mechanisms, research EDR evasion methods, or analyze malware architecture for advanced security threat detection.

Pi-hole is a powerful, network-wide DNS ad blocker solution that runs on Linux hosts (like Raspberry Pi). It automatically blocks ads, trackers, and malware domains for every device on your network without requiring browser extensions. This guide details installation via Docker or bare-metal setup, configuring it as the primary DNS server for a home network, managing blocklists, and implementing advanced features like DNS-over-HTTPS (DoH) for enhanced privacy.

A comprehensive guide on segmenting a home network using VLANs to dramatically enhance security. Learn how to isolate different device types—such as IoT gadgets, guests, and servers—from main PCs, preventing cross-segment malware spread and unauthorized communication. Covers setup steps for UniFi, pfSense, and OPNsense.

A comprehensive skill for detecting and analyzing malicious behavior in mobile applications (Android/iOS). It employs multi-layered security analysis, including static indicator checking (permissions, manifest), dynamic instrumentation (Frida), network traffic monitoring, and automated scanning (MobSF). Use this skill when investigating suspicious apps for data exfiltration, C2 communication, or unauthorized access.