Skill UI

A comprehensive forensic workflow for detecting persistent, deep-seated malware, such as bootkits and advanced rootkits. The analysis covers multiple layers, including boot sectors (MBR/VBR), UEFI firmware modules, and kernel memory forensics. It is essential for investigating sophisticated, nation-state level threats that evade standard anti-malware and EDR solutions.

Detects container escape attempts at runtime by monitoring namespace manipulation, capability abuse, kernel exploits, sensitive mounts, and anomalous syscalls. Explains which signals matter for Falco, Sysdig, auditd, or EDR collection. Use when investigating suspected Docker/Kubernetes breakouts or comparing runtime sensor coverage.

A comprehensive guide for conducting hypothesis-driven threat hunting against supply chain compromises (T1195). This skill focuses on querying SIEM/EDR logs to detect indicators of trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. It is crucial when investigating suspected vendor compromises or scoping a build pipeline breach, requiring advanced knowledge of logging systems and threat intelligence.

This skill guides the deployment and implementation of Breach and Attack Simulation (BAS) platforms. It provides a continuous, automated method to validate security control effectiveness against real-world attacker techniques mapped to the MITRE ATT&CK framework. Use this when moving beyond traditional point-in-time penetration testing to establish continuous control validation and automated adversary emulation across the entire IT environment.

This guide details the full lifecycle of advanced red team engagements, simulating sophisticated, real-world adversaries. It covers crucial planning elements, including Scope definition, Rules of Engagement (ROE), and deconfliction procedures. Techniques include building resilient, tiered C2 infrastructure, implementing strict Operational Security (OPSEC), advanced evasion methods (EDR/AMSI bypass), and comprehensive mapping using MITRE ATT&CK. Applicable for testing mature defender capabilities against assumed-breach scenarios.

Methodology for assessing Bluetooth Classic BR/EDR targets, including device discovery, SDP service enumeration, profile abuse, legacy pairing weaknesses like KNOB, and BlueBorne-style flaws in older embedded, automotive, and accessory devices.

This skill provides advanced detection methods for credential dumping, covering LSASS memory access, SAM hive extraction, and NTDS.dit theft (e.g., using Mimikatz). It utilizes Sysmon Event ID 10 and Windows Security logs to enable threat hunting, assisting SOC analysts in triaging EDR alerts and building robust SIEM correlation rules.

Comprehensive expert for deploying and managing AI agents at scale using AWS Bedrock AgentCore. Covers all nine core services including Gateway, Runtime, Memory, Identity, Code Interpreter, Browser, Observability, Agent Registry, and Evaluations. Use for agent deployment, MCP integration, credential management, and cross-service workflows with AWS CLI.