Skill UI

This guide details the architecture and deployment of resilient Command and Control (C2) redirectors. By using tools like Nginx and Apache, operators establish an intermediary layer that filters beacon traffic based on malleable C2 profiles. This setup protects the true team server from detection, takedown, and analysis (OPSEC), enabling advanced techniques like domain fronting and traffic shaping for low attribution.

This skill details how to forcefully coerce a target machine account (e.g., a Domain Controller) to authenticate to an attacker-controlled relay. It combines tools like Coercer and PetitPotam, leveraging various RPC protocols (MS-EFSR, MS-RPRN) to achieve NTLM relay. This technique ultimately enables domain compromise by forcing authentication into services like AD CS Web Enrollment (ESC8).

A comprehensive tool and methodology for identifying and preventing dependency confusion attacks across major package ecosystems (npm, PyPI, Maven). It detects instances where internal, private package names are leaked and subsequently published publicly by attackers. The skill provides both detection (enumerating claimable internal names) and prevention strategies (enforcing registry pinning and scope restrictions) to secure the software supply chain.

This skill provides a comprehensive, cross-platform workflow for auditing UEFI firmware security. It detects advanced threats like bootkits (e.g., BlackLotus, Bootkitty) and Secure Boot bypasses by verifying the integrity of the platform's trust chain. Key checks include confirming Secure Boot status, assessing the currency and application of DBX revocations, and examining the protection of critical EFI variables using specialized tools. Essential for hardware security assessments and forensic investigation.

Stratus Red Team is an open-source tool designed for detection engineering and purple teaming. It programmatically detonates granular, documented offensive techniques across major cloud platforms (AWS, Azure, GCP, and Kubernetes). It validates existing security detections (like CloudTrail/GuardDuty) by simulating real attacker activity in a controlled, reversible environment. The tool ensures deterministic lifecycles, guaranteeing that all created resources are cleaned up after testing.

CloudFox is an open-source, attacker-centric tool designed for authorized cloud penetration testing. It maps attack paths and identifies exploitable misconfigurations across AWS and Azure environments. By simulating an attacker's perspective, it goes beyond simple configuration audits to reveal critical assets, exposed secrets, and lateral movement opportunities (like STS AssumeRole trust relationships), providing comprehensive situational awareness for security assessment.

Velociraptor is an open-source platform providing deep endpoint visibility and digital forensics capabilities. It enables security teams to deploy VQL-based 'Hunts' across large fleets of endpoints, allowing for remote threat hunting, incident response, and continuous monitoring of system artifacts.

This skill guides the end-to-end process of supply chain security by generating standards-compliant Software Bills of Materials (SBOMs) in CycloneDX and SPDX formats. It details using Syft to create inventories, correlating them with vulnerability intelligence via Grype, enforcing CI/CD gates based on severity, and establishing verifiable provenance using Cosign signing. Essential for modern DevSecOps practices.

Chainsaw is a fast, Rust-based tool for digital forensics and threat hunting. It enables analysts to rapidly perform Sigma rule checks and keyword searches across collected Windows Event Logs (.evtx) and specialized artifacts (like shimcache and SRUM). Ideal for first-response and offline analysis, it provides detection capabilities without needing a SIEM ingestion pipeline, allowing quick hypothesis testing in the field or air-gapped environments.

This skill enables comprehensive security graph mapping by ingesting both on-premises Active Directory data (via SharpHound) and cloud Entra ID data (via AzureHound) into BloodHound CE. It analyzes complex, hybrid attack paths, allowing security teams to identify critical privilege escalation chains from low-privileged accounts to Tier-0 assets, mapping findings to MITRE ATT&CK.

This guide demonstrates how to use the pycti Python client to model complex cyber threat intelligence within the OpenCTI platform. It structures threat actors, intrusion sets, campaigns, and TTPs into a unified STIX 2.1 knowledge graph. The skill is essential for correlating fragmented data from multiple sources (IOCs, reports) into a comprehensive, queryable adversary picture, supporting advanced threat hunting and detection engineering.

This skill guides the full lifecycle of threat intelligence processing, transforming raw indicators of compromise (IOCs) from MISP feeds into actionable security detections. It covers feed curation, false positive reduction using warninglists, and automating the generation of high-fidelity rules for Suricata, Sigma, and Wazuh. Use this to mature your MISP instance from a repository into a proactive detection engine.