Skill UI

A comprehensive toolkit designed for cybersecurity professionals to deobfuscate malicious JavaScript code. It reverses complex encoding layers (Base64, Hex, Unicode), eval chains, and control flow obfuscation techniques found in phishing pages, web skimmers, and dropper scripts, revealing the original malicious logic for thorough forensic analysis and threat intelligence gathering.

This skill monitors critical OT historian servers (such as OSIsoft PI and Ignition) located at the IT/OT boundary. It is designed to detect sophisticated cyber threats, including unauthorized access attempts, data manipulation, suspicious query patterns, and indicators of lateral movement between enterprise and control networks. Use it to validate data integrity and respond to potential ICS security incidents.

This skill provides methods and tools for detecting sophisticated cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS). It focuses on detecting anomalies like unauthorized command injection, Man-in-the-Middle attacks on industrial protocols (Modbus, DNP3), and data manipulation, which traditional IT security tools often miss. Usage involves establishing deterministic communication baselines and monitoring network traffic for deviations.

This skill provides comprehensive detection methods for credential dumping techniques, a critical post-exploitation phase in cyber attacks. It targets the extraction of sensitive credentials from LSASS memory, SAM registry hives, and NTDS.dit using advanced security visibility. Detection relies on analyzing Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and complex SIEM correlation rules, making it essential for SOC analysts and threat hunters investigating advanced persistent threats (APTs).

This skill guides the essential pre-testing phase for red team engagements. It defines the scope, objectives, Rules of Engagement (ROE), and threat models using established frameworks like MITRE ATT&CK. By developing a comprehensive plan, users ensure that offensive security testing is performed safely, legally, and within defined operational boundaries, thereby preventing unintended business disruption.

A comprehensive guide and method for extracting and analyzing digital forensic artifacts from major web browsers, including Chrome, Firefox, and Edge. This process retrieves critical data such as web history, cookies, cached items, downloads, and bookmarks to reconstruct user web activity trails for deep cybersecurity and digital forensics investigations.

This skill guides the implementation and maintenance of compliance controls for North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards. It covers key areas including asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), and supply chain risk management. Use this when auditing, updating, or establishing compliance measures for Bulk Electric System (BES) cyber assets.

A comprehensive playbook designed for Operational Technology (OT) and Industrial Control Systems (ICS) environments. It provides structured, phased incident response procedures aligned with SANS PICERL, IEC 62443, and NIST standards. It specifically addresses safety-critical challenges, process availability, and the unique coordination required between IT Security, OT Engineering, and Plant Operations during cyber incidents, such as ransomware attacks.

This skill provides a structured framework for implementing patch management in Operational Technology (OT) and Industrial Control Systems (ICS) environments. It addresses the critical balance between cybersecurity remediation and maintaining continuous operational safety and availability. Key components include risk-based patch prioritization, vendor compatibility testing, staged deployment through test environments, managing maintenance windows, and implementing compensating controls for unpatchable assets.

This skill provides a comprehensive guide for designing and deploying Privileged Access Workstations (PAWs). It covers critical security controls such as device hardening, Zero Trust principles, and integrating Just-in-Time (JIT) access management. Learn how to enforce compliance using tools like Intune/GPO and secure credentials using leading PAM platforms like CyberArk or BeyondTrust, ensuring secure administrative operations.

This skill guides the deployment and comprehensive configuration of Rapid7 InsightVM. It covers setting up the Security Console and distributed Scan Engines for both authenticated and unauthenticated vulnerability scanning. Learn how to manage diverse scan templates (e.g., PCI, HIPAA), utilize various credential types (SSH, WMI), and integrate endpoint assessment for robust cybersecurity posture management.

This skill guides the implementation of a structured, six-phase threat intelligence lifecycle. It covers transforming raw data into actionable intelligence by mastering planning, collection, processing, analysis, dissemination, and feedback. Ideal for building mature Cyber Threat Intelligence (CTI) programs and aligning security architecture with compliance standards.