Skill UI

A comprehensive guide and set of scripts to systematically audit AWS S3 buckets for security misconfigurations. This tool identifies publicly exposed data, overly permissive ACLs, inadequate bucket policies, and missing encryption settings, ensuring adherence to least-privilege principles and compliance frameworks like SOC 2 or HIPAA.

This utility provides comprehensive security auditing for Kubernetes Role-Based Access Control (RBAC) configurations. It identifies overly permissive roles, dangerous wildcard permissions (*), critical ClusterRoleBindings, and potential privilege escalation paths. By integrating tools like rbac-tool, KubiScan, and Kubeaudit, it helps users enforce the principle of least privilege, crucial for compliance and security assessments on EKS, GKE, and AKS clusters.

This guide details the methodology for conducting internal network penetration tests, simulating an attacker operating from an assumed breach state. It covers initial network reconnaissance, Active Directory enumeration, advanced credential harvesting techniques (e.g., Kerberoasting, Pass-the-Hash), and lateral movement exploitation to determine the full blast radius of a potential breach. Essential for comprehensive security auditing.

This skill guides the advanced configuration of Windows Event Logging using Group Policy Objects (GPO) and advanced audit policies. It enables high-fidelity logging for critical security events, including process creation (Event 4688), logon/logoff activities, and object access. The process covers optimizing log sizes and implementing Windows Event Forwarding (WEF) to centralize data into SIEM platforms for effective threat detection and forensic investigation.

This guide provides comprehensive steps to harden Docker containers and associated runtime environments based on the CIS Docker Benchmark v1.8.0. It covers implementing least-privilege principles, such as running as non-root users, dropping capabilities, using read-only filesystems, and applying seccomp/AppArmor profiles. Use this when preparing containers for production deployment or conducting security audits to minimize the attack surface.

This skill automates the hardening of Linux endpoints (Ubuntu, RHEL, CentOS) by implementing industry-standard security best practices guided by CIS Benchmarks. It systematically secures various layers, including filesystem permissions, network parameters (sysctl), SSH configuration, user access controls (PAM), and integrates deep auditing using auditd and OpenSCAP. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This skill guides the security hardening of Windows endpoints (10/11, Server 2019/2022) using established CIS Benchmarks. It provides a comprehensive workflow for establishing secure organizational baselines, configuring Group Policy Objects (GPOs), and enforcing security controls across critical areas like password policies, audit logs, and firewall rules. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This skill provides a structured methodology for threat hunting DNS-based persistence mechanisms. It detects unauthorized changes such as DNS hijacking, dangling CNAME records enabling subdomain takeover, wildcard DNS abuse, or unauthorized NS delegation modifications. By utilizing passive DNS history (e.g., SecurityTrails API) and auditing cloud DNS logs (Route53, Azure, Cloudflare), users can identify persistent attack vectors that survive traditional remediation efforts.

This skill guides proactive security auditing and threat hunting for registry-based persistence artifacts (MITRE T1547) in Windows environments. It focuses on identifying mechanisms such as Run/RunOnce keys, Winlogon modifications, IFEO debugger injection, and COM hijacking to detect malware autostart techniques and scope compromises during incident response.

This comprehensive guide details how to establish AWS Security Hub as a centralized Cloud Security Posture Management (CSPM) platform. It aggregates security findings from multiple AWS services (GuardDuty, Inspector, Macie) and third-party tools. Users can enforce compliance against industry standards (CIS, PCI-DSS, NIST), automate remediation workflows via EventBridge, and generate comprehensive evidence for compliance audits.

This guide teaches how to implement and audit Google Cloud Platform (GCP) VPC firewall rules using gcloud. It covers creating restrictive ingress and egress rules, enforcing network segmentation using tags and service accounts, and auditing for overly permissive settings. Ideal for compliance, zero-trust architectures, and responding to security findings.

Provides comprehensive, end-to-end guidance for establishing and maintaining an Information Security Management System (ISMS) compliant with ISO/IEC 27001:2022. This framework covers critical phases including gap analysis, detailed risk assessment methodology, selecting and documenting Annex A controls, creating the Statement of Applicability (SoA), and preparing for internal and external certification audits.