Skill UI

A comprehensive guide detailing detection and defense strategies against OAuth token theft, session hijacking, and token replay in Microsoft Entra ID (Azure AD). It covers advanced attacks like Primary Refresh Token (PRT) abuse and Adversary-in-the-Middle (AitM) phishing, and provides actionable steps for configuring Conditional Access and Token Protection policies.

Business Email Compromise (BEC) is a sophisticated social engineering fraud where attackers impersonate executives or vendors to trick employees into making unauthorized fund transfers or disclosing data. This skill provides comprehensive detection techniques by integrating email gateway rules, behavioral analytics, and mandatory financial process controls. It is essential for investigating suspected account compromises and building robust defenses against advanced phishing attacks.

A comprehensive guide to deploying cloud-native deception across AWS, Azure, and GCP. This skill utilizes decoy resources—such as canary IAM keys, honey object storage buckets, and decoy secrets—whose sole purpose is to generate high-fidelity alerts the instant they are interacted with by an attacker. It detects cloud reconnaissance, credential theft, and lateral movement by wiring detection through native logging services (CloudTrail, Sentinel, Cloud Audit Logs), ensuring near-zero false positives for the SOC.

This skill provides a comprehensive solution for monitoring brand impersonation attacks across multiple digital vectors. It systematically scans domains, social media platforms, mobile app stores, and the dark web to detect phishing campaigns, typosquatting, and unauthorized brand usage. It is essential for security teams conducting proactive threat intelligence gathering and vulnerability assessments to safeguard brand integrity.

This guide details setting up advanced Command and Control (C2) redirectors, acting as protective intermediaries between implant beacons and the hidden team server. It covers using Nginx and Apache for request filtering based on Malleable C2 profiles, layering Let's Encrypt TLS, and implementing advanced OPSEC controls like domain fronting, geo/UA filtering, and decoy diversion. Essential for red-teaming operations requiring high resilience against blue-team detection and takedown.

Falco is a powerful CNCF project for real-time runtime security monitoring. This guide teaches authors how to write and deploy custom detection rules using Falco's robust YAML rule engine and modern eBPF driver. It is designed to detect critical threats such as container escapes, namespace manipulation, privileged mounts, and anomalous syscalls in Kubernetes and Docker environments, significantly hardening the overall container security posture.

This skill provides advanced threat hunting queries for Microsoft Sentinel/Log Analytics. It detects the behavioral and string fingerprints left by popular offensive Entra ID enumeration tools (like ROADtools, AADInternals, and AzureHound) within both MicrosoftGraphActivityLogs and AADGraphActivityLogs. Use this when investigating suspicious Graph API activity, identifying internal reconnaissance, or building detection rules to surface active intrusions.

A comprehensive skill for triaging npm packages and dependency lockfiles against supply-chain threats. It utilizes heuristic scanning (GuardDog), manual tarball inspection, and dynamic detonation in isolated environments to detect malicious behavior such as credential exfiltration, reverse shell execution, and self-propagation. Essential for secure code review and CI/CD pipeline gating.

Stratus Red Team is an open-source tool for detection engineering and purple teaming. It atomistically detonates granular, MITRE ATT&CK-mapped offensive techniques across AWS, Azure, GCP, and Kubernetes. The tool executes a full, repeatable lifecycle (warmup, detonate, revert, cleanup) to generate realistic attacker telemetry. Use it to validate if cloud security tools (like CloudTrail or Sentinel) reliably trigger on simulated attacks, or to safely practice red teaming.

Hayabusa is a specialized threat-hunting and fast-forensics tool designed to analyze Windows EVTX event logs. It applies a comprehensive library of Sigma detection rules to raw log data, generating a single, prioritized, chronological timeline. The output includes severity levels, MITRE ATT&CK mappings, and detailed metrics, enabling analysts to perform rapid, SIEM-free incident triage and export results for collaborative analysis.

Chainsaw is a fast, Rust-based forensic tool designed for first-response threat hunting. It analyzes collected Windows EVTX files using the comprehensive Sigma rule corpus, built-in detection rules, and high-speed keyword/regex searching. Furthermore, it uniquely analyzes critical artifacts such as shimcache, SRUM, and event-log gaps, providing robust, offline detection capabilities without needing a SIEM pipeline. It is essential for digital forensic triage and hypothesis confirmation.

This guide details how to deploy OpenCTI, a powerful, open-source threat intelligence platform, and utilize the pycti Python client. It teaches analysts how to model complex cyber threat intelligence, including threat actors, campaigns, and indicators, into a structured STIX 2.1 knowledge graph. Use this for centralized threat-intel correlation, building adversary graphs, and generating STIX bundles for detection engineering.