Skill UI

A comprehensive guide and framework for performing digital forensics analysis on PCAP/PCAPNG files. This skill covers using industry-standard tools like Wireshark, tshark, tcpdump, and Python/Scapy to reconstruct network communications, extract evidence of data exfiltration, identify command-and-control (C2) activity, and trace lateral movement during incident response.

This skill automates red team operations using the Covenant C2 framework, providing comprehensive capabilities for authorized adversary simulation. It covers the full attack lifecycle, including listener setup, deploying agents (grunts), executing tasks on compromised hosts, and tracking lateral movement via the Covenant API. Ideal for professional penetration testing and security auditing.

Guides teams through designing, implementing, and evidencing SOC 2 Type II controls aligned with the AICPA Trust Services Criteria, covering scoping, control mapping, evidence collection, remediation, and audit collaboration for a six- to twelve-month examination.

A comprehensive guide for statically analyzing suspicious Android APKs. This skill demonstrates how to use JADX, apktool, and androguard to decompile Java/Kotlin source code, examine manifest permissions, and identify malicious patterns. Use this to detect data exfiltration, C2 command and control communication, privilege escalation, and overlay attacks in mobile threats.

A comprehensive guide for reversing and analyzing .NET malware samples. Learn the full workflow, including identifying .NET assemblies, using de4dot to deobfuscate code protected by tools like ConfuserEx or SmartAssembly, and loading the cleaned code into dnSpy. This skill is essential for extracting hardcoded C2 configurations, encryption keys, and credentials, and debugging runtime behaviors of complex malware.

This comprehensive guide details a step-by-step workflow for reverse engineering malware binaries using Ghidra. It guides users through static and dynamic analysis techniques to study internal logic, C2 communication protocols, cryptographic routines, and obfuscation methods at the assembly and pseudo-C code level. Use this when deep code review is required to extract configuration data, understand exploit mechanisms, or develop detection signatures.

This skill provides advanced techniques and code examples for monitoring, mapping, and pivoting across adversary-controlled infrastructure. It leverages Passive DNS, Certificate Transparency logs, Shodan/Censys scanning, and network fingerprinting (JARM/JA3S) to discover C2 servers, phishing domains, and exploitable assets over time, which is crucial for advanced security operations and threat intelligence gathering.

A comprehensive guide for preparing SaaS and cloud infrastructure companies for SOC 2 Type I and Type II audits. Covers mapping Trust Service Criteria (TSC), generating control matrices, performing thorough gap analysis, collecting evidence, and assessing overall compliance readiness across Security, Availability, Confidentiality, and Privacy domains. Essential for demonstrating operational trustworthiness to enterprise clients.

This skill provides comprehensive detection strategies for adversaries abusing DCOM objects (e.g., MMC20.Application) to perform stealthy lateral movement (MITRE ATT&CK T1021.003). It details how to correlate Sysmon Event IDs (Process Creation, Network Connection), analyze WMI activity, and monitor RPC traffic on port 135 to identify unauthorized remote command execution chains. Ideal for advanced threat hunting, red teaming, and purple team exercises.

A comprehensive guide for implementing hardware-level confidential computing using AWS Nitro Enclaves. This process involves creating secure enclave images (EIFs), performing cryptographic attestation validation against the Nitro PKI, and configuring AWS KMS policies. It ensures that sensitive data (like PII or PHI) remains isolated from the parent EC2 instance, guaranteeing security even if the host system is compromised.

This skill automates the entire SOC 2 Type II audit lifecycle. It facilitates gap assessment against AICPA Trust Services Criteria (CC1-CC9) and collects continuous evidence from major cloud providers (AWS, Azure, GCP) and identity systems (Okta, Jira). It supports validating control effectiveness, remediation tracking, and overall compliance monitoring for Security, Availability, Processing Integrity, Confidentiality, and Privacy.

A sophisticated skill for detecting Command and Control (C2) traffic tunneled through DNS protocols. It utilizes advanced techniques like Shannon entropy analysis of subdomains, Machine Learning for DGA classification, and correlation with network logs from Zeek/Suricata. Ideal for SOC analysts and threat hunters investigating data exfiltration, DNS beaconing, or suspicious DNS activity.