Skill UI

This tool provides a comprehensive security audit framework for Azure Storage accounts. It systematically detects critical misconfigurations, such as publicly accessible blob containers, weak encryption settings, overly permissive network access rules, and missing logging. Use it when performing compliance checks, responding to security incidents, or establishing storage security baselines in Azure environments.

This guide details methods for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically targeting Microsoft Entra ID (Azure AD). It covers protection against access token theft, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Users can leverage Conditional Access and Token Protection features to cryptographically bind tokens to devices, significantly enhancing cloud identity security and preventing session hijacking.

This comprehensive guide configures Fail2ban to implement a robust, layered defense mechanism for network security. It sets up custom filters and actions to automatically detect and mitigate threats such as port scanning, SSH brute force attempts, and network reconnaissance. By dynamically banning malicious IP addresses and providing security alerts, this skill significantly enhances the host-based intrusion prevention capabilities of your system.

A guide for security professionals and threat hunters to proactively detect advanced privilege escalation techniques across Windows and Linux environments. It covers critical attack methods including token manipulation, UAC bypass, unquoted service paths, and kernel exploits, utilizing EDR and SIEM data sources for comprehensive incident response and security assessments.

This skill provides comprehensive methods for detecting and preventing privilege escalation within Kubernetes pods and containers. It details using runtime tools like Falco for monitoring syscalls and capabilities, and implementing admission controls via OPA Gatekeeper or Pod Security Admission to enforce security best practices, thereby hardening the cluster against unauthorized access and dangerous configurations.

This skill analyzes Windows Security Event Logs (EVTX) to detect RDP brute force attacks. It parses failed logon events (ID 4625) and correlates them with successful logons (ID 4624), performing source IP frequency analysis to identify attack patterns, username spraying, and potential account compromises. This is critical for SOC analysts and threat hunters investigating lateral movement or credential stuffing attempts.

A comprehensive methodology for detecting advanced system compromises, including rootkits, hidden processes, and kernel-level malware. It utilizes memory forensics, cross-view detection (comparing different system views), and integrity checking to identify manipulated kernel structures, hooked system calls (SSDT, IAT, IRP), and covert network connections. Ideal for deep forensic investigations where standard tools fail to reveal the true state of a compromised system.

This skill provides a methodology for proactive threat hunting to detect compromised service accounts. It focuses on identifying anomalous activities such as unusual interactive logons, unauthorized privilege escalation, lateral movement, and suspicious access patterns using SIEM/EDR platforms. Essential for incident response and compliance.

This skill analyzes network logs, including proxy access logs, DNS query logs, and netflow data, to detect unauthorized Software as a Service (SaaS) applications and cloud services (Shadow IT). It classifies domains against known catalogs, measures data exfiltration volumes, calculates risk scores, and generates comprehensive reports for security and compliance teams.

This skill addresses advanced threat detection for critical infrastructure (OT/ICS). It monitors sophisticated, multi-stage cyber-physical attacks, focusing specifically on PLC logic integrity monitoring, detecting unauthorized modifications, and analyzing process anomalies. It covers the entire attack chain, from initial USB-borne access (IT) to process manipulation (OT).

This tool scans GitHub Actions workflows and CI/CD configurations to identify critical supply chain attack vectors. It specifically checks for unpinned actions, risks from script injection using expressions, dependency confusion, and secrets exposure, helping organizations harden their build systems against sophisticated threats.

A comprehensive guide for threat hunting designed to detect various forms of privilege escalation abuse, including UAC bypass, setuid/setgid manipulation, and exploiting auto-elevating processes on Windows and Linux. It provides specific monitoring workflows, detection queries (Splunk, KQL, Sigma), and key indicators related to MITRE ATT&CK T1548.