Skill UI

This guide details the process of adding, verifying, and publishing necessary DNS records (SPF, DKIM, DMARC) for a custom sending domain in Mailtrap. It covers both manual compliance steps via the UI and programmatic automation through the Sending Domains API. Essential for ensuring high email deliverability and authentication compliance.

A comprehensive skill for detecting and analyzing malicious behavior in mobile applications (Android/iOS). It employs multi-layered security analysis, including static indicator checking (permissions, manifest), dynamic instrumentation (Frida), network traffic monitoring, and automated scanning (MobSF). Use this skill when investigating suspicious apps for data exfiltration, C2 communication, or unauthorized access.

This guide details how to establish SAML 2.0 identity federation between on-premises Active Directory (using AD FS or third-party IdP) and Microsoft Entra ID. It covers hybrid identity architectures, configuring federation models (AD FS, PHS, PTA), and implementing the full SAML authentication flow. Essential for extending on-premises authentication authority to cloud resources and maintaining security compliance.

This skill uses Python and boto3 to analyze AWS CloudTrail logs. It establishes statistical baselines of normal API activity and detects various anomalies, such as unusual event sources, first-time API usage, geographic IP deviations, and high-frequency calls. This is critical for identifying credential compromise, privilege escalation, and unauthorized resource access in a security incident.

This guide details how to configure Microsoft Entra Privileged Identity Management (PIM) to enforce Zero Trust principles. It converts standing, permanent privileged roles into eligible, time-bound assignments, requiring mandatory justification, MFA, and approval workflows before activation. Ideal for achieving strict role-assignment auditing and comprehensive identity governance in hybrid cloud environments.

This solution designs and automates the entire Identity Governance and Lifecycle Management (IGA) program. It covers the Joiner-Mover-Leaver (JML) workflow, role mining, access provisioning, and remediation of orphaned accounts. It is essential for maintaining compliance (SOX, HIPAA, GDPR) by ensuring identity access consistency across multiple enterprise systems using an authoritative HR source.

A comprehensive guide for conducting memory forensics to extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps (LSASS). This technique is crucial during incident response or breach assessment to identify compromised accounts or investigate lateral movement.

A comprehensive guide detailing detection and defense strategies against OAuth token theft, session hijacking, and token replay in Microsoft Entra ID (Azure AD). It covers advanced attacks like Primary Refresh Token (PRT) abuse and Adversary-in-the-Middle (AitM) phishing, and provides actionable steps for configuring Conditional Access and Token Protection policies.

This methodology guides organizations through a comprehensive cybersecurity risk assessment using the NIST SP 800-30 framework. It systematically identifies threat sources, vulnerabilities, and potential threat events. By determining the likelihood and impact of these threats, the process calculates overall risk, resulting in a prioritized, defensible risk register. Essential for compliance (e.g., ISO 27001, HIPAA), system authorization, and strategic risk reporting.

This guide teaches security teams how to proactively detect and respond to unauthorized cryptocurrency mining operations across major cloud platforms (AWS, Azure). It utilizes a multi-layered approach by analyzing compute cost anomalies, monitoring GuardDuty findings, inspecting network traffic to known mining pools, and analyzing runtime process execution in EC2, ECS, and EKS environments.

A comprehensive guide and toolkit for digital forensics experts to parse and analyze raw email headers (Received, Message-ID, etc.). This method traces the true origin of suspicious emails, validates sender authenticity by analyzing SPF, DKIM, and DMARC records, and confirms or rules out email spoofing attempts. Essential for incident response and phishing investigation.

Business Email Compromise (BEC) is a sophisticated social engineering fraud where attackers impersonate executives or vendors to trick employees into making unauthorized fund transfers or disclosing data. This skill provides comprehensive detection techniques by integrating email gateway rules, behavioral analytics, and mandatory financial process controls. It is essential for investigating suspected account compromises and building robust defenses against advanced phishing attacks.