Skill UI

A comprehensive system for systematically collecting, categorizing, and enriching Indicators of Compromise (IOCs) from various sources (network logs, memory dumps, email, etc.). It supports the entire incident response lifecycle, ensuring structured data representation using STIX/TAXII formats for robust threat intelligence sharing and defensive system automation.

Implements Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory. This skill guides the hardening of AD privileged access architecture by establishing strict separation between Tier 0, Tier 1, and Tier 2 accounts. It is essential for mitigating advanced threats like pass-the-hash, Kerberoasting, and ensuring compliance with industry standards (NIST 800-53).

Utilizes User and Entity Behavior Analytics (UEBA), statistical baselines, and machine learning models to monitor authentication logs. This skill identifies sophisticated security threats such as impossible travel, credential stuffing, brute force attacks, and compromised accounts in real-time. Essential for security operations and identity access management.

This skill analyzes AWS CloudTrail logs to detect suspicious API call patterns, such as new event sources, geographic anomalies, or high-frequency usage. It establishes a statistical baseline of normal activity and flags deviations indicative of compromised credentials, privilege escalation, or insider threats, providing a detailed JSON report for security investigation and threat hunting.

Build automated pipelines to respond to AWS GuardDuty findings. This solution uses EventBridge to detect high-severity threats and triggers a Lambda function. The function automatically quarantines compromised resources (e.g., EC2 instances), creates forensic EBS snapshots, and sends detailed notifications via SNS, drastically reducing Mean Time To Respond (MTTR). Ideal for proactive cloud security posture management.

Focuses on advanced threat detection within Azure AD/Entra ID. This skill guides users on correlating Graph API audit logs, sign-in anomalies, and KQL queries in Microsoft Sentinel to identify sophisticated lateral movement techniques, such as privilege escalation, OAuth abuse, and cross-tenant pivoting. Essential for SOC threat hunting.

A comprehensive guide providing detailed KQL and SPL detection queries for identifying potential abuse of Azure service principals within Microsoft Entra ID. This tool helps SOC analysts and security teams investigate complex threats like unauthorized credential addition, privileged role assignment, admin consent bypass, and enumeration, crucial for proactive threat hunting and incident response.

Detect unauthorized crypto-mining in AWS, Azure, and GCP by correlating GuardDuty/Defender/SCC findings, compute anomalies, network flows, and container/serverless behaviors to validate threats and guide response.

A comprehensive guide for deploying and operationalizing Amazon GuardDuty. It provides continuous, intelligent threat detection across core AWS services including S3, EKS, and EC2 runtime monitoring. Use this skill to investigate suspicious activity, detect compromised credentials, or build automated incident response playbooks using EventBridge and Lambda for proactive security.

This skill provides comprehensive detection methods for credential dumping techniques, a critical post-exploitation phase in cyber attacks. It targets the extraction of sensitive credentials from LSASS memory, SAM registry hives, and NTDS.dit using advanced security visibility. Detection relies on analyzing Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and complex SIEM correlation rules, making it essential for SOC analysts and threat hunters investigating advanced persistent threats (APTs).

This skill provides comprehensive guidance and detection rules for identifying fileless malware, in-memory attacks, and living-off-the-land techniques. It covers detecting PowerShell exploitation, reflective DLL injection, WMI abuse, and registry-resident threats, enabling security teams to build robust detections when traditional antivirus fails.

This skill provides structured procedures and Python examples for detecting internal data exfiltration. It analyzes endpoint, cloud, and email logs by establishing behavioral baselines and performing statistical anomaly detection. Use cases include investigating insider threats, monitoring DLP policy violations, and building robust User and Entity Behavior Analytics (UEBA) rules for SOC teams.