Skill UI

This skill automates the entire phishing incident response workflow using the Splunk SOAR REST API. It parses suspicious email headers and bodies to extract artifacts (URLs, IPs, sender details), creates a structured incident container, triggers a comprehensive automated investigation playbook, and compiles a final verdict report for security teams.

A comprehensive guide to achieving compliance with the HIPAA Security Rule (45 CFR Part 164). This skill outlines the mandatory steps to protect electronic Protected Health Information (ePHI), including conducting thorough risk analyses, deploying administrative, physical, and technical safeguards, managing Business Associate Agreements (BAAs), and preparing for breach notifications and OCR audits. Essential for Covered Entities and Business Associates.

This skill guides the deployment of decoy files, or "canary tokens," across critical file systems. These files act as tripwires, monitoring for unauthorized changes (modification, deletion, renaming). By tracking these high-value decoys, systems can detect ransomware encryption activity in real-time, providing a low false-positive, high-fidelity detection layer that complements traditional EDR and backup solutions.

This skill details the implementation of continuous identity verification for Zero Trust architectures. It covers deploying phishing-resistant Multi-Factor Authentication (FIDO2/WebAuthn), establishing risk-based conditional access policies, and integrating identity governance controls aligned with NIST and CISA frameworks. Learn how to move beyond traditional passwords to dynamic, adaptive security models.

A comprehensive guide for conducting authorized vishing (voice phishing) pretext calls. This technique, utilized in red-teaming, simulates an attacker impersonating a trusted authority (e.g., IT support, vendor) to test an organization's human security controls. It measures employee adherence to verification protocols and highlights vulnerabilities in staff security awareness.

This skill provides comprehensive functionality for monitoring and mapping adversary-controlled assets, such as C2 servers, phishing domains, and exploit kit hosts. By leveraging tools like Passive DNS, Certificate Transparency logs, and specialized scanners (Shodan/Censys), analysts can discover, track, and pivot through complex threat actor infrastructure over time, significantly enhancing security operations and threat intelligence maturity.

A comprehensive guide detailing the systematic workflow for analyzing malicious Linux ELF binaries. It covers essential techniques including static analysis (using readelf, elftools), dynamic tracing (strace, ltrace), and deep reverse engineering (GDB) of various threats like botnets, cryptominers, and ransomware targeting Linux environments, containers, and cloud infrastructure.

A comprehensive, adaptive framework for developing and implementing features, adhering to a strict, multi-phase workflow: Specify, Design, Tasks, and Execute. This skill ensures feature quality through granular task breakdown, atomic Git commits, requirement traceability, and mandatory, independent verification. It automatically adjusts its depth based on feature complexity (Small to Complex), providing a robust mechanism for managing technical debt and capturing project lessons.

A specialized tool for scientific data visualization, acting as a visualization advisor to analyze data, recommend chart types, prevent common errors, and generate publication-grade figures.

This technique exploits the Active Directory attribute `msDS-KeyCredentialLink` by injecting attacker-controlled public keys (Shadow Credentials). Using tools like pyWhisker and Certipy, the attacker forces the target account to register a new key. Subsequently, by leveraging PKINIT (Public Key Cryptography for Initial Authentication in Kerberos), the attacker can obtain a service ticket and recover the target's NT hash, achieving a stealthy, password-less, complete account takeover.

ROADtools is a comprehensive offensive toolkit for Microsoft Entra ID (Azure AD). It consists of ROADrecon for offline directory enumeration (users, groups, roles, policies) and roadtx for advanced token acquisition and exchange. It is designed for authorized red-teaming and penetration testing to discover attack paths and pivot tokens across various Microsoft resources.

This skill simulates advanced red-teaming techniques targeting Microsoft Entra ID's OAuth 2.0 device-code flow and illicit consent mechanisms. It demonstrates how attackers can steal access and refresh tokens, bypass Multi-Factor Authentication (MFA), and pivot across various Microsoft 365 services. It is designed for authorized security testing to validate token protection and conditional access policies.