Skill UI

This skill provides a methodology to detect data exfiltration attempts hidden within DNS queries. By analyzing Zeek dns.log files, the agent computes Shannon entropy of subdomains, flags unusually long labels, and monitors unique subdomain counts per parent domain. This technique is crucial for identifying malicious tunneling tools like dnscat2 or iodine that bypass traditional security controls.

This script detects and analyzes sophisticated fileless malware techniques that operate entirely in system memory. It specializes in identifying threats that utilize Living Off the Land Binaries (LOLBins), WMI event subscriptions, and registry-resident payloads, bypassing traditional file-based security controls. It is ideal for forensic investigations, threat hunting, and building advanced detection rules in modern enterprise environments.

This skill provides a comprehensive framework for detecting Living Off the Land Binaries (LOLBAS) abuse, such as misuse of certutil, regsvr32, and mshta. It leverages process telemetry from Sysmon and Windows Event Logs, combined with advanced Sigma rule-based detection and parent-child process anomaly analysis. Ideal for SOC analysts and threat hunters investigating sophisticated adversaries aiming to evade traditional security controls.

This skill provides comprehensive methods for detecting and preventing privilege escalation within Kubernetes pods and containers. It details using runtime tools like Falco for monitoring syscalls and capabilities, and implementing admission controls via OPA Gatekeeper or Pod Security Admission to enforce security best practices, thereby hardening the cluster against unauthorized access and dangerous configurations.

This guide details the end-to-end process for executing authorized phishing simulations. It instructs security teams and red teams on designing realistic social engineering pretexts, setting up credential harvesting infrastructure (using tools like GoPhish), and measuring key metrics such as open rates, click-through rates, and credential submission rates. It is crucial for assessing organizational human security awareness and testing email security controls (e.g., DMARC, SPF, DKIM).

A comprehensive guide for authorized penetration testing on detecting and exploiting HTTP Request Smuggling vulnerabilities. It details analyzing discrepancies between Content-Length and Transfer-Encoding header parsing in multi-tier architectures (e.g., CDN, reverse proxy, load balancers). Learn techniques to bypass access controls, capture subsequent user requests, and escalate attacks in a controlled environment.

This comprehensive guide outlines methods to identify and exploit specific IPv6 vulnerabilities, including SLAAC spoofing, Router Advertisement (RA) manipulation, and Neighbor Discovery Protocol (NDP) attacks. It is designed strictly for authorized penetration testing to assess dual-stack security controls, detect unauthorized tunnels (like Teredo or 6to4), and validate network defenses against IPv6-specific threats. Always obtain explicit written authorization before use.

A detailed guide on discovering and exploiting Mass Assignment vulnerabilities in REST APIs. Users learn to inject unexpected parameters into API requests (POST, PUT, PATCH) to bypass authorization controls, escalate privileges (e.g., changing 'role'), and modify sensitive fields (e.g., 'balance', 'isAdmin') during security assessments and bug bounty hunting.

This guide provides comprehensive steps to harden the Docker daemon configuration. It covers essential security controls like user namespace remapping, disabling inter-container communication (ICC), implementing TLS authentication, and adopting rootless mode. Implementing these measures significantly reduces the attack surface and mitigates risks associated with container breakouts and privilege escalation, aligning with CIS benchmarks.

This skill automates the hardening of Linux endpoints (Ubuntu, RHEL, CentOS) by implementing industry-standard security best practices guided by CIS Benchmarks. It systematically secures various layers, including filesystem permissions, network parameters (sysctl), SSH configuration, user access controls (PAM), and integrates deep auditing using auditd and OpenSCAP. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This skill guides the security hardening of Windows endpoints (10/11, Server 2019/2022) using established CIS Benchmarks. It provides a comprehensive workflow for establishing secure organizational baselines, configuring Group Policy Objects (GPOs), and enforcing security controls across critical areas like password policies, audit logs, and firewall rules. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This skill guides security analysts through advanced threat-hunting methodologies focused on detecting DNS-based persistence. It analyzes passive DNS history, zone file audits, and API data (like SecurityTrails) to identify unauthorized record modifications, subdomain takeovers, and DNS hijacking attempts that bypass traditional security controls. Ideal for SOC analysts and threat hunters.