Skill UI

This capability provides advanced threat hunting by analyzing network telemetry (DNS, proxy, connection logs) to detect Command and Control (C2) beaconing patterns. It uses statistical analysis, frequency detection, and jitter analysis to identify compromised endpoints communicating with adversary infrastructure, crucial for proactive threat detection and incident response.

This guide details how to hunt for DCSync attacks (MITRE ATT&CK T1003.006) in Active Directory environments. It focuses on analyzing Windows Security Event ID 4662, specifically looking for DS-Replication-Get-Changes requests originating from non-domain-controller accounts. This technique is critical for incident response, purple teaming, and detecting unauthorized credential theft via Active Directory replication abuse.

A comprehensive guide to identifying covert data exfiltration channels using Zeek logs. This technique analyzes DNS traffic for high-entropy subdomains, unusually long query lengths, abnormal record types (TXT/NULL), and excessive query volume, which are key indicators of malicious DNS tunneling or command-and-control (C2) activity.

This skill detects command-and-control (C2) traffic hidden using domain fronting techniques. It analyzes proxy and web gateway logs by comparing discrepancies between the TLS SNI field and the HTTP Host header. By inspecting these mismatches and correlating them with known CDN provider properties, it helps security analysts hunt for sophisticated network evasion tactics.

A specialized technique for proactive threat hunting, designed to detect adversary activity that abuses legitimate cloud services (like Azure, AWS, GCP, and SaaS platforms). It focuses on identifying 'living off the cloud' tradecraft, such as using cloud APIs for command-and-control (C2), staging data, or exfiltrating information while blending into normal network traffic.

This guide provides a systematic methodology for proactive threat hunting targeting Living-off-the-Land Binaries (LOLBins). Attackers misuse legitimate, signed system binaries (like certutil or rundll32) to execute malicious payloads or download files, effectively bypassing traditional security controls and application allowlisting. Use this framework when establishing EDR/SIEM detection rules or when investigating advanced, fileless defense-evasion techniques.

Conduct hypothesis-driven threat hunting for Command-and-Control (C2) activity (T1071). This skill guides the analysis of SIEM/EDR network telemetry to detect anomalous outbound traffic, rare destination IPs, non-standard ports, and unusual connection frequencies, helping identify beaconing or data exfiltration attempts. Essential for proactive defense and incident response.

This skill guides the secure implementation of AES-256 in GCM mode (FIPS 197) for protecting files and data stores at rest. It covers best practices for key derivation from passwords (using PBKDF2/Argon2), proper management of initialization vectors (IVs)/nonces, and applying authenticated encryption (AEAD) to detect tampering. Use this when establishing robust security controls or performing security assessments.

A comprehensive guide for implementing centralized security controls on API gateways (e.g., Kong, AWS API Gateway, Azure APIM). It covers critical defense layers including JWT-based authentication enforcement, advanced rate limiting and throttling, request validation against schemas, TLS termination, and Web Application Firewall (WAF) integration. Use this when establishing a robust, layer-7 security posture for microservice APIs.

This comprehensive guide details robust techniques for managing the entire API key lifecycle. It mandates secure key generation with high entropy, server-side hashing (SHA-256/bcrypt) to prevent plaintext storage, and implements granular controls like per-key scoping (endpoints, IPs, rate limits). Key features include zero-downtime key rotation workflows and automated monitoring for key leakage across code repositories and logs. Ideal for server-to-server API authentication.

This skill provides a comprehensive guide to implementing application whitelisting using Windows AppLocker. It drastically restricts unauthorized software execution (malware, shadow IT) on Windows endpoints by enforcing strict application control policies. Use this method to meet critical compliance requirements (such as PCI DSS or NIST standards), block common attack vectors like LOLBins, and significantly reduce the overall attack surface in high-security environments.

A comprehensive guide to implementing Google's BeyondCorp zero trust access model. This solution enforces identity- and device-aware access control using Cloud IAP and Access Context Manager, effectively replacing traditional VPN infrastructure. Use this to secure remote and hybrid access to GCP-hosted or on-prem applications by requiring granular device posture checks and strong user authentication.