Skill UI

This skill detects compromised cloud credentials by analyzing anomalous API activity, impossible travel patterns, and unauthorized access indicators across AWS, Azure, and GCP. It integrates findings from GuardDuty, Defender for Identity, and Security Command Center to provide comprehensive threat visibility and assist in incident response and scope assessment.

A comprehensive guide for security teams on detecting and responding to unauthorized crypto mining operations in cloud environments (AWS, Azure). It details a multi-layered approach, utilizing cost anomaly detection, compute utilization monitoring, GuardDuty findings, and network flow log analysis (VPC/KQL) to identify resource hijacking attempts and suspicious activity across EC2, ECS, and EKS workloads.

This tool provides a comprehensive security audit framework for Azure Storage accounts. It systematically detects critical misconfigurations, such as publicly accessible blob containers, weak encryption settings, overly permissive network access rules, and missing logging. Use it when performing compliance checks, responding to security incidents, or establishing storage security baselines in Azure environments.

This guide details methods for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically targeting Microsoft Entra ID (Azure AD). It covers protection against access token theft, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Users can leverage Conditional Access and Token Protection features to cryptographically bind tokens to devices, significantly enhancing cloud identity security and preventing session hijacking.

This skill analyzes Azure AD/Microsoft Entra ID environments to detect illicit OAuth application consent grants. It leverages the Microsoft Graph API and directory audit logs to enumerate permissions, identify overly broad scopes, and flag high-risk applications based on publisher verification status. It is essential for SOC analysts and threat hunters investigating cloud identity security incidents.

A comprehensive guide and methodology for proactively hunting adversary abuse of legitimate cloud services (Azure, AWS, GCP, SaaS). This technique focuses on identifying Command and Control (C2), data staging, and exfiltration methods that leverage normal cloud functionality, making detection challenging.

This comprehensive guide details how to implement centralized security controls at the API gateway layer. It covers critical functionalities such as JWT authentication enforcement, advanced rate limiting, request/response validation against OpenAPI specs, and integrating Web Application Firewalls (WAF). The process is applicable across major platforms like Kong, AWS API Gateway, and Azure APIM, ensuring robust defense in depth for microservices architecture.

This guide details the implementation of Microsoft Entra Privileged Identity Management (PIM), enforcing Just-in-Time (JIT) role activation, mandatory approval workflows, and periodic access reviews for critical Azure AD and resource roles. It aligns with Zero Trust principles by eliminating standing privileges.

This guide details the implementation of Microsoft Defender for Cloud, enabling comprehensive cloud security posture management (CSPM) and workload protection (CWPP). Learn how to secure VMs, containers, databases, and storage accounts, configure security recommendations, and establish automated remediation workflows to ensure continuous compliance and robust cloud defense.

A comprehensive technical guide covering the implementation of Data Loss Prevention (DLP) across major cloud platforms, including AWS Macie, Google Cloud DLP, and Azure Information Protection. Learn how to automatically discover, classify, and protect sensitive data (PII, PHI) residing in cloud storage, databases, and data pipelines, ensuring adherence to compliance frameworks like GDPR and HIPAA.

A comprehensive guide for implementing Cloud Security Posture Management (CSPM) across multi-cloud environments (AWS, Azure, GCP). Learn how to use specialized tools like Prowler and ScoutSuite, combined with native cloud services (Security Hub, Defender, SCC), to continuously monitor for misconfigurations, compliance violations (CIS, SOC 2), and security drifts, thereby enforcing security guardrails in complex cloud architectures.

Implement a comprehensive Cloud Security Posture Management (CSPM) solution across multi-cloud environments (AWS, Azure). This skill guides the use of industry tools like AWS Security Hub, Azure Defender for Cloud, Prowler, and ScoutSuite to continuously detect misconfigurations, compliance violations, and vulnerabilities. It is crucial for establishing robust, centralized security controls and meeting regulatory compliance requirements.