Skill UI

This guide details the forensic process of extracting sensitive credentials, including password hashes, Kerberos tickets, and authentication tokens, from memory dumps. Utilizing industry-standard tools like Volatility and Mimikatz, this technique is crucial for incident response, determining the scope of a breach, and identifying compromised accounts during digital forensics investigations.

A comprehensive guide detailing the structured process for responding to phishing incidents. It covers email header analysis, malicious content sandboxing (URLs/attachments), scoping the impact across the organization, and performing thorough remediation, including mailbox purging and credential reset.

A comprehensive guide for defense contractors handling Controlled Unclassified Information (CUI). It covers preparing for CMMC Level 2 certification, implementing 110 NIST SP 800-171 controls, calculating the SPRS score using DoD methodology, and managing the POA&M and SSP. Essential for DFARS compliance and external assessments.

This guide teaches security teams how to proactively detect and respond to unauthorized cryptocurrency mining operations across major cloud platforms (AWS, Azure). It utilizes a multi-layered approach by analyzing compute cost anomalies, monitoring GuardDuty findings, inspecting network traffic to known mining pools, and analyzing runtime process execution in EC2, ECS, and EKS environments.

This skill provides a structured approach to monitoring and analyzing data leak sites (DLS) maintained by ransomware groups. By extracting structured data on victim postings, threat group tactics, and sector-specific details, users can assess current ransomware risk, track attack trends, and proactively build robust defense strategies.

A comprehensive guide to executing the NIST Risk Management Framework (RMF) to achieve an Authorization to Operate (ATO). This covers the full lifecycle, including preparation, system categorization (FIPS 199), control selection and tailoring (SP 800-53 Rev 5), implementation, assessment (SAR), and continuous monitoring. Essential for organizations working under FISMA or FedRAMP.

Automated system designed to monitor paste sites (e.g., Pastebin, GitHub Gists) for leaked credentials, API keys, and sensitive data dumps. It uses advanced scraping, keyword matching, and regex patterns to provide early detection of data breaches and security incidents.

A comprehensive guide to achieving compliance with the HIPAA Security Rule (45 CFR Part 164). This skill outlines the mandatory steps to protect electronic Protected Health Information (ePHI), including conducting thorough risk analyses, deploying administrative, physical, and technical safeguards, managing Business Associate Agreements (BAAs), and preparing for breach notifications and OCR audits. Essential for Covered Entities and Business Associates.

This guide provides a deep dive into the cryptographic techniques used by ransomware, including AES, RSA, ChaCha20, and hybrid schemes. It covers identifying algorithms, analyzing key management patterns (strong, weak, flawed), and reverse engineering file encryption routines to assess decryption feasibility and support recovery efforts.

This skill enforces a rigorous data validation protocol by establishing hard boundaries at every point data enters the system (API requests, user input, environment variables, webhooks, etc.). It mandates a four-phase process: detection, trust classification, mandatory filtering (schema validation, sanitization, type checking), and final verification. This prevents untrusted data from reaching core business logic, mitigating risks like SQL injection and XSS.

This technique exploits the Active Directory attribute `msDS-KeyCredentialLink` by injecting attacker-controlled public keys (Shadow Credentials). Using tools like pyWhisker and Certipy, the attacker forces the target account to register a new key. Subsequently, by leveraging PKINIT (Public Key Cryptography for Initial Authentication in Kerberos), the attacker can obtain a service ticket and recover the target's NT hash, achieving a stealthy, password-less, complete account takeover.

This guide details the architecture and deployment of resilient Command and Control (C2) redirectors. By using tools like Nginx and Apache, operators establish an intermediary layer that filters beacon traffic based on malleable C2 profiles. This setup protects the true team server from detection, takedown, and analysis (OPSEC), enabling advanced techniques like domain fronting and traffic shaping for low attribution.