Skill UI

Perform comprehensive security audits across AWS, Azure, and GCP by assessing infrastructure configurations against established CIS Foundations Benchmarks. This skill guides users through running automated scans using industry tools like Prowler and ScoutSuite, interpreting failed controls, identifying security gaps, and implementing systematic remediation to ensure continuous compliance and maintain a robust security posture.

This skill parses various cyber threat intelligence (CTI) reports (Mandiant, CrowdStrike, etc.) using NLP and specialized libraries (stix2, mitreattack-python, spaCy). It systematically extracts adversary behaviors, maps them to MITRE ATT&CK IDs, and constructs a searchable STIX 2.1 Attack Pattern library. This is essential for threat-informed detection engineering, generating detection rules (Sigma, YARA), and validating security controls.

This system provides a structured workflow for tracking security vulnerability exceptions and formally accepting related risks. It mandates documentation of compensating controls, manages required approval chains, and automatically handles expiration based on defined Service Level Agreements (SLAs). Essential for maintaining compliance and visibility into accepted risks, supporting frameworks like PCI DSS, SOC 2, and NIST CSF.

A comprehensive guide to simulating Man-in-the-Middle (MITM) attacks using industry-standard tools like Bettercap, Ettercap, and mitmproxy. This technique is strictly for authorized penetration testing environments to assess cryptographic controls, validate TLS certificate pinning, and test network defense mechanisms against ARP/DNS spoofing and sniffing.

This comprehensive skill guides users through designing and executing advanced social engineering penetration tests. It covers simulating real-world attacks, including phishing (email), vishing (voice), smishing (SMS), and physical pretexting. The goal is to measure an organization's human security resilience, identify training gaps, and test security controls across multiple vectors using tools like GoPhish and SET.

This guide outlines the comprehensive process for planning and executing authorized vishing (voice phishing) pretext calls. Used in red teaming exercises, it assesses employee susceptibility to social engineering attacks and evaluates the effectiveness of existing security awareness controls. Key steps include OSINT research, developing believable pretexts (e.g., IT helpdesk impersonation), structured call execution, and collecting detailed metrics.

This guide details the end-to-end process of conducting a sophisticated spearphishing simulation campaign, mirroring real red team adversary techniques. It covers initial OSINT research and pretext development, building weaponized payloads that bypass security controls, setting up robust email infrastructure (SPF/DKIM/DMARC), executing the campaign in waves, and performing detailed post-campaign metrics analysis for comprehensive security reporting.

AWS Verified Access is a Zero Trust Network Access (ZTNA) service that provides secure, VPN-less access to internal applications. It uses granular Cedar policies to evaluate user identity (integrating with Okta, IAM Identity Center) and device security posture (CrowdStrike, Jamf) in real-time. Use this guide when replacing traditional VPNs, enforcing strict conditional access controls, or deploying multi-account Verified Access infrastructure across AWS.

This guide details the comprehensive deployment of Cisco Duo Multi-Factor Authentication across critical access points like VPN, RDP, SSH, and web applications. It covers setting up the Duo Authentication Proxy, implementing adaptive access policies based on risk and device health, and deploying phishing-resistant methods like WebAuthn/FIDO2, ensuring compliance with NIST standards. Use this when hardening identity access management or establishing robust security controls.

A comprehensive guide to configuring secure OAuth 2.0 authorization flows, covering best practices for Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. Learn how to implement mandatory security controls, manage token lifecycles, and align with OAuth 2.1 standards to build robust identity and access management systems.

This skill provides comprehensive guidelines for detecting Business Email Compromise (BEC), a sophisticated fraud scheme. It covers detection techniques using email gateway rules, behavioral analytics, and robust financial process controls. Learn to identify red flags like unusual payment requests, domain mismatches, and patterns of social engineering to protect against financial loss.

This skill outlines methods and rules for detecting container drift—the unauthorized deviation of a running container from its original, immutable image state. By monitoring binary execution, filesystem writes, and configuration changes using tools like Falco and Kubernetes security context controls, users can investigate potential compromises, validate immutable infrastructure controls, and enhance overall container security posture.