Skill UI

This skill fetches and compares live pricing for various Azure services, such as Virtual Machines, Storage, and SQL Databases. It utilizes the Azure Retail Prices API to allow users to check costs in specific geographic regions or compare the same service across multiple regions, helping them find the most cost-effective deployment option.

This comprehensive playbook details expert techniques for exploiting Server-Side Request Forgery (SSRF). It covers bypassing URL filters, accessing cloud metadata endpoints (AWS, GCP, Azure), utilizing advanced protocols like Gopher, and chaining vulnerabilities to achieve Remote Code Execution (RCE) in real-world scenarios. Ideal for penetration testers and security researchers.

This guide details how to establish SAML 2.0 identity federation between on-premises Active Directory (using AD FS or third-party IdP) and Microsoft Entra ID. It covers hybrid identity architectures, configuring federation models (AD FS, PHS, PTA), and implementing the full SAML authentication flow. Essential for extending on-premises authentication authority to cloud resources and maintaining security compliance.

This guide details how to configure Microsoft Entra Privileged Identity Management (PIM) to enforce Zero Trust principles. It converts standing, permanent privileged roles into eligible, time-bound assignments, requiring mandatory justification, MFA, and approval workflows before activation. Ideal for achieving strict role-assignment auditing and comprehensive identity governance in hybrid cloud environments.

A comprehensive guide detailing detection and defense strategies against OAuth token theft, session hijacking, and token replay in Microsoft Entra ID (Azure AD). It covers advanced attacks like Primary Refresh Token (PRT) abuse and Adversary-in-the-Middle (AitM) phishing, and provides actionable steps for configuring Conditional Access and Token Protection policies.

A comprehensive guide to deploying cloud-native deception across AWS, Azure, and GCP. This skill utilizes decoy resources—such as canary IAM keys, honey object storage buckets, and decoy secrets—whose sole purpose is to generate high-fidelity alerts the instant they are interacted with by an attacker. It detects cloud reconnaissance, credential theft, and lateral movement by wiring detection through native logging services (CloudTrail, Sentinel, Cloud Audit Logs), ensuring near-zero false positives for the SOC.

A powerful offensive suite for authorized red-teaming of Microsoft Entra ID (Azure AD). ROADtools combines ROADrecon for comprehensive directory enumeration (users, groups, policies, apps) and an offline GUI, with roadtx for advanced token acquisition, exchange, and Primary Refresh Token (PRT) abuse. It covers the full scope of cloud identity discovery and token-based attacks against highly regulated tenants.

This guide details using the comprehensive AADInternals PowerShell toolkit for defensive validation of Microsoft Entra ID, Azure AD, and AD FS environments. It covers unauthenticated tenant reconnaissance, acquiring access tokens for multiple Microsoft APIs, and critically, testing for federation backdoors (Golden SAML) by simulating advanced attack techniques (MITRE T1606.002). It is designed for authorized red-team assessments to map external attack surfaces and validate identity infrastructure hardening.

This skill provides advanced threat hunting queries for Microsoft Sentinel/Log Analytics. It detects the behavioral and string fingerprints left by popular offensive Entra ID enumeration tools (like ROADtools, AADInternals, and AzureHound) within both MicrosoftGraphActivityLogs and AADGraphActivityLogs. Use this when investigating suspicious Graph API activity, identifying internal reconnaissance, or building detection rules to surface active intrusions.

Stratus Red Team is an open-source tool for detection engineering and purple teaming. It atomistically detonates granular, MITRE ATT&CK-mapped offensive techniques across AWS, Azure, GCP, and Kubernetes. The tool executes a full, repeatable lifecycle (warmup, detonate, revert, cleanup) to generate realistic attacker telemetry. Use it to validate if cloud security tools (like CloudTrail or Sentinel) reliably trigger on simulated attacks, or to safely practice red teaming.

A comprehensive tool for authorized red-team engagements, designed to map complex on-prem Active Directory and cloud Entra ID attack paths. It uses SharpHound and AzureHound to collect rich data, ingesting it into BloodHound CE for analysis using built-in queries and custom Cypher. Effectively identifies privilege escalation chains leading to domain or tenant compromise, especially in hybrid identity environments.

This skill guides developers on implementing Conversational Language Understanding (CLU) using the official azure-ai-language-conversations Python SDK. It demonstrates how to analyze conversation intent and entities, build advanced NLP features, and integrate language understanding into applications using ConversationAnalysisClient. Best practices emphasize using DefaultAzureCredential and context managers for robust, production-ready code.