Skill UI

A comprehensive skill for detecting and analyzing malicious behavior in mobile applications (Android/iOS). It employs multi-layered security analysis, including static indicator checking (permissions, manifest), dynamic instrumentation (Frida), network traffic monitoring, and automated scanning (MobSF). Use this skill when investigating suspicious apps for data exfiltration, C2 communication, or unauthorized access.

This solution provides a comprehensive framework for detecting compromised cloud credentials across AWS, Azure, and GCP. It analyzes anomalous API activity, impossible travel patterns, and indicators of credential stuffing by leveraging services like AWS GuardDuty, Azure Defender, and GCP SCC. Use this when investigating suspicious cloud API calls, responding to exposed credential alerts, or scoping a potential account takeover.

This skill uses Python and boto3 to analyze AWS CloudTrail logs. It establishes statistical baselines of normal API activity and detects various anomalies, such as unusual event sources, first-time API usage, geographic IP deviations, and high-frequency calls. This is critical for identifying credential compromise, privilege escalation, and unauthorized resource access in a security incident.

A comprehensive guide for conducting memory forensics to extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps (LSASS). This technique is crucial during incident response or breach assessment to identify compromised accounts or investigate lateral movement.

This tool automates the OAuth 2.0 scope minimization review process. It identifies over-permissioned third-party application integrations, excessive API scopes, and risky OAuth consent patterns across identity providers. It is crucial for security audits, compliance (GDPR, SOC 2), and enforcing the least-privilege principle for cross-boundary data access.

Automated system designed to monitor paste sites (e.g., Pastebin, GitHub Gists) for leaked credentials, API keys, and sensitive data dumps. It uses advanced scraping, keyword matching, and regex patterns to provide early detection of data breaches and security incidents.

This skill automates the entire phishing incident response workflow using the Splunk SOAR REST API. It parses suspicious emails, creates incident containers, attaches artifacts (URLs, IPs, headers), triggers automated investigation playbooks, and compiles a comprehensive security verdict. It is designed for security operations teams building robust, automated incident response capabilities.

A specialized tool for blockchain forensics, designed to trace the movement of ransomware payments across public blockchains (like Bitcoin). By leveraging APIs from services like Chainalysis and WalletExplorer, it identifies wallet clusters, tracks funds through mixers and tumblers, and maps fund flow from the victim to final exchange deposits. Essential for law enforcement attribution and threat intelligence gathering.

This skill enforces a rigorous data validation protocol by establishing hard boundaries at every point data enters the system (API requests, user input, environment variables, webhooks, etc.). It mandates a four-phase process: detection, trust classification, mandatory filtering (schema validation, sanitization, type checking), and final verification. This prevents untrusted data from reaching core business logic, mitigating risks like SQL injection and XSS.

This skill details how to abuse the Windows DPAPI (Data Protection API) to extract and decrypt sensitive secrets protected by the OS. It covers multiple scenarios: online decryption (using the target user's context), offline decryption (requiring passwords or NTLM hashes), and advanced domain-wide decryption via the DPAPI backup key. Essential for red-teaming and post-exploitation activities to harvest credentials, browser logins, and Wi-Fi passwords.

This guide details using the comprehensive AADInternals PowerShell toolkit for defensive validation of Microsoft Entra ID, Azure AD, and AD FS environments. It covers unauthenticated tenant reconnaissance, acquiring access tokens for multiple Microsoft APIs, and critically, testing for federation backdoors (Golden SAML) by simulating advanced attack techniques (MITRE T1606.002). It is designed for authorized red-team assessments to map external attack surfaces and validate identity infrastructure hardening.

This skill provides advanced threat hunting queries for Microsoft Sentinel/Log Analytics. It detects the behavioral and string fingerprints left by popular offensive Entra ID enumeration tools (like ROADtools, AADInternals, and AzureHound) within both MicrosoftGraphActivityLogs and AADGraphActivityLogs. Use this when investigating suspicious Graph API activity, identifying internal reconnaissance, or building detection rules to surface active intrusions.