Skill UI

Performs authorized file path traversal assessments to map web inputs, craft traversal payloads, and document sensitive files that can be read, aiding defenders in hardening filesystem handling during security reviews.

Analyze email headers to uncover sender origins, routing chains, and authentication results, enabling defenders to validate legitimacy and spot phishing indicators using manual inspection and automation scripts.

This framework guides the systematic process of proactive threat hunting. It transforms raw threat intelligence and ATT&CK gap analyses into concrete, testable hypotheses. Users execute these hypotheses using industry-standard EDR/SIEM platforms (Splunk, CrowdStrike, Defender, etc.) to validate potential compromises, correlate activity, and document findings in a standardized report format.

This skill provides comprehensive guidance and PowerShell scripts for hardening Windows endpoints using Microsoft Defender for Endpoint (MDE). It covers advanced features like Attack Surface Reduction (ASR) rules to block common attack techniques, Controlled Folder Access for ransomware protection, and Network Protection. Use this for deploying enterprise-grade, compliance-required security policies via Intune or Group Policy.

Detect unauthorized crypto-mining in AWS, Azure, and GCP by correlating GuardDuty/Defender/SCC findings, compute anomalies, network flows, and container/serverless behaviors to validate threats and guide response.

This skill detects compromised cloud credentials by analyzing anomalous API activity, impossible travel patterns, and unauthorized access indicators across AWS, Azure, and GCP. It integrates findings from GuardDuty, Defender for Identity, and Security Command Center to provide comprehensive threat visibility and assist in incident response and scope assessment.

Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image. Uses Falco and Microsoft Defender for Containers. Ideal for validating immutable-infrastructure controls, hunting for unexpected package installs or binaries, and determining whether a container diverged from its source image.

A comprehensive guide detailing how to implement Microsoft Defender for Cloud across various workloads (VMs, containers, SQL, storage) to achieve continuous security monitoring and compliance assessment. This process utilizes Azure Policy, Log Analytics, and Azure Arc for holistic protection, enabling adaptive remediation and meeting stringent regulatory requirements like PCI-DSS and CIS standards.

This skill implements Cloud Security Posture Management (CSPM) across multi-cloud environments. It detects critical cloud-native misconfigurations, such as over-permissive IAM roles, exposed storage buckets, and unencrypted data, using industry-leading tools like AWS Security Hub, Azure Defender for Cloud, Prowler, and ScoutSuite. Use this when conducting comprehensive audits of complex, multi-cloud infrastructures for compliance or building consolidated security posture reports.

This skill guides the deployment and configuration of Microsoft Defender for Cloud (CNAPP) across Azure, multi-cloud, and hybrid environments. It covers enabling specialized security plans for various workloads (servers, containers, databases), managing the Secure Score, and implementing advanced security controls like Just-In-Time (JIT) access, ensuring comprehensive cloud workload protection and compliance.

This guide details the full lifecycle of advanced red team engagements, simulating sophisticated, real-world adversaries. It covers crucial planning elements, including Scope definition, Rules of Engagement (ROE), and deconfliction procedures. Techniques include building resilient, tiered C2 infrastructure, implementing strict Operational Security (OPSEC), advanced evasion methods (EDR/AMSI bypass), and comprehensive mapping using MITRE ATT&CK. Applicable for testing mature defender capabilities against assumed-breach scenarios.

Methodology for red team testing of on-prem Active Directory, hybrid AD/Entra ID, and ADCS. Covers reconnaissance, credential abuse, privilege escalation, lateral movement, persistence, trust abuse, and Defender for Identity evasion.