Skill UI

A comprehensive guide to detecting sophisticated rootkit activity and persistent threats that evade standard security tools (like Task Manager or EDR). Techniques include cross-view process analysis, identifying System Service Descriptor Table (SSDT) hooks, kernel module analysis, and network connection forensics using tools like Volatility. Use this when standard monitoring fails, and deep system integrity checks are required.

A comprehensive guide and workflow for detecting unauthorized data exfiltration from AWS S3 buckets. It details how to leverage multiple AWS services—including CloudTrail, GuardDuty, Amazon Macie, and Athena—to analyze access patterns, identify bulk downloads, and detect cross-account data transfers, ensuring robust cloud compliance and security monitoring.

This skill analyzes proxy access logs, DNS query logs, and network flow data to identify unauthorized SaaS and cloud services (Shadow IT). It uses Python and pandas to aggregate traffic, classify domains against known SaaS categories, and calculate risk scores based on data volume and user count. Ideal for conducting thorough security audits and generating actionable remediation reports.

A comprehensive guide on configuring advanced email security gateways (SEGs) to detect and block sophisticated, targeted spearphishing attacks. This skill covers essential detection layers, including impersonation protection, real-time URL detonation, attachment sandboxing, and creating custom behavioral rules. It is crucial for SOC analysts and security engineers building robust email threat defense systems.

This tool analyzes Web Application Firewall (WAF) logs (ModSecurity, AWS WAF, Cloudflare) to detect sophisticated SQL injection attack campaigns. It parses diverse log formats, identifies common SQLi payloads (UNION SELECT, OR 1=1), correlates multi-stage attacks, tracks source IPs, and generates detailed incident reports classified by OWASP standards for SOC analysts and security researchers.

This skill detects advanced cyber-physical attacks mimicking the Stuxnet pattern. It monitors for unauthorized modifications to PLC logic and detects discrepancies between reported sensor readings and actual physical process behavior. Ideal for high-security OT/ICS environments when hunting for APT lateral movement or validating process integrity against sophisticated threats.

A robust security auditing tool designed to scan CI/CD pipeline configurations, such as GitHub Actions YAML, for critical supply chain vulnerabilities. It automatically detects issues like unpinned dependencies, script injection risks, secrets exposure, and dependency confusion, helping teams harden their build systems and maintain secure software development lifecycles.

This guide details how to detect T1055 process injection techniques, including DLL injection, process hollowing, and remote thread creation. By analyzing specific Sysmon Event IDs (1, 7, 8, 10, 25) that track cross-process memory operations and handle access, security teams can proactively hunt for defense-evasion activities, investigate EDR alerts, or validate security monitoring coverage.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.

This guide details the end-to-end process for executing authorized phishing simulations. It instructs security teams and red teams on designing realistic social engineering pretexts, setting up credential harvesting infrastructure (using tools like GoPhish), and measuring key metrics such as open rates, click-through rates, and credential submission rates. It is crucial for assessing organizational human security awareness and testing email security controls (e.g., DMARC, SPF, DKIM).

This skill guides the creation of a foundational red team engagement plan. It covers defining the scope, establishing detailed Rules of Engagement (ROE), selecting MITRE ATT&CK-aligned threat profiles, and defining operational timelines. It is essential for conducting large-scale, assumed-breach, or objective-based offensive security testing.

Execute deep, stealthy red team exercises that emulate real-world sophisticated adversaries. This process maps attacks to the MITRE ATT&CK framework, testing an organization's entire security posture—including detection, incident response, and containment capabilities (Blue Team). It is designed for simulating full attack lifecycles (initial access, lateral movement, exfiltration) to validate security investments and meet regulatory requirements (TIBER-EU, CBEST). Requires executive authorization and defined Rules of Engagement.