Skill UI

A comprehensive, step-by-step guide for security professionals to perform deep-dive malware analysis. It covers methodologies for static analysis (disassemblers, imports), dynamic execution (sandboxing, monitoring), identifying Indicators of Compromise (IOCs), and structuring professional threat reports. Essential for incident response and threat intelligence.

A comprehensive guide to deploying and configuring Suricata, a high-performance IDS/IPS. This skill covers setting up multi-threaded packet capture, integrating Emerging Threats rulesets, generating structured EVE JSON logs, and enabling deep protocol inspection (HTTP, TLS, DNS). It enables real-time threat detection and seamless SIEM integration for centralized security monitoring.

This guide outlines a comprehensive threat hunting methodology for detecting Kerberoasting attacks. It focuses on monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs, which are indicators of brute-force or offline password cracking attempts. Use this workflow during proactive security assessments, incident response, or when analyzing SIEM/EDR telemetry to identify potential lateral movement.

This skill provides a comprehensive guide to deploying Zeek (formerly Bro) for passive network security monitoring. It details how to generate structured logs (DNS, HTTP, SSL, etc.) and write custom Zeek scripts to detect sophisticated anomalies like DNS tunneling and beaconing. Ideal for threat hunting, security incident response, and complementing traditional IDS solutions.

A comprehensive skill for detecting early-stage ransomware indicators before data encryption occurs. It utilizes advanced network detection tools such as Zeek and Suricata, combined with SIEM correlation rules and threat intelligence feeds. This method monitors the entire pre-encryption kill chain, identifying precursor behaviors like initial access broker activity, Cobalt Strike C2 beaconing, credential harvesting (e.g., Mimikatz signatures), and data staging attempts, enabling timely incident response and containment.

This skill addresses advanced threat detection for critical infrastructure (OT/ICS). It monitors sophisticated, multi-stage cyber-physical attacks, focusing specifically on PLC logic integrity monitoring, detecting unauthorized modifications, and analyzing process anomalies. It covers the entire attack chain, from initial USB-borne access (IT) to process manipulation (OT).

A comprehensive guide and set of detection rules for identifying OS credential dumping techniques (MITRE T1003). It leverages EDR telemetry, Sysmon process access monitoring, and Windows security event correlation to detect attacks targeting LSASS memory, SAM databases, and NTDS.dit files. Essential for proactive threat hunting and incident response.

This guide details the implementation of comprehensive security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection. It covers deploying the Datadog Agent across hybrid cloud infrastructure (AWS, Azure, GCP), ingesting critical log sources (CloudTrail, VPC Flow Logs, etc.), configuring Workload Protection, and creating custom detection rules to detect threats, enforce compliance, and provide centralized SOC visibility.

This skill provides advanced techniques and code examples for monitoring, mapping, and pivoting across adversary-controlled infrastructure. It leverages Passive DNS, Certificate Transparency logs, Shodan/Censys scanning, and network fingerprinting (JARM/JA3S) to discover C2 servers, phishing domains, and exploitable assets over time, which is crucial for advanced security operations and threat intelligence gathering.