Skill UI

This skill provides a methodology to detect data exfiltration attempts hidden within DNS queries. By analyzing Zeek dns.log files, the agent computes Shannon entropy of subdomains, flags unusually long labels, and monitors unique subdomain counts per parent domain. This technique is crucial for identifying malicious tunneling tools like dnscat2 or iodine that bypass traditional security controls.

This skill analyzes network logs, including proxy access logs, DNS query logs, and netflow data, to detect unauthorized Software as a Service (SaaS) applications and cloud services (Shadow IT). It classifies domains against known catalogs, measures data exfiltration volumes, calculates risk scores, and generates comprehensive reports for security and compliance teams.

A comprehensive guide for discovering and exploiting broken link hijacking vulnerabilities. This skill focuses on identifying references to expired domains, decommissioned cloud resources (like S3 buckets), and dead external services. It covers advanced techniques such as subdomain takeover, supply chain security assessment, and resource claiming for authorized penetration testing.

This skill provides a comprehensive workflow to extract Indicators of Compromise (IOCs) from malware samples and analysis reports. It covers file hashes (SHA256, MD5), network artifacts (IPs, domains, URLs from strings and PCAPs), and host-based indicators (registry keys, file paths, mutexes) from sandbox reports. It is essential for threat intelligence sharing, building blocklists, and creating detection signatures (YARA, Snort).

A comprehensive guide and detection methodology for identifying covert communication channels utilizing DNS records. This technique analyzes Zeek dns.log for indicators such as high-entropy subdomains, excessive query volume, unusually long query lengths, and abnormal record type distributions, which suggest data exfiltration or Command and Control (C2) activity.

This tool implements network segmentation based on the Purdue Enterprise Reference Architecture (PERA). It helps secure Industrial Control Systems (ICS) by mapping assets and data flows to specific Purdue levels (0-5), defining necessary firewall rules, and establishing DMZs. It ensures strict traffic control between IT and OT domains, adhering to standards like IEC 62443 and facilitating secure network retrofitting.

This guide details how to implement NextDNS as a zero-trust DNS filtering layer. By utilizing encrypted resolution (DoH/DoT) and real-time threat intelligence, it blocks malicious domains, prevents data exfiltration, filters ads/trackers, and enforces granular security policies across all endpoints, aligning with Zero Trust principles and enhancing overall network security.

A comprehensive guide for authorized penetration testing to map a target's entire DNS infrastructure. This skill covers advanced techniques including enumerating various DNS record types (A, MX, TXT, SRV), attempting zone transfers (AXFR/IXFR), brute-forcing subdomains, and analyzing security configurations (DNSSEC, SPF, DMARC). It is crucial for identifying the full external attack surface of a target organization.

This skill automates the enrichment of Indicators of Compromise (IOCs) by orchestrating lookups across multiple industry-leading threat intelligence sources (e.g., VirusTotal, AbuseIPDB, Shodan). It provides contextual scoring and disposition recommendations for IPs, domains, URLs, and hashes. Ideal for SOC analysts during alert triage or incident investigation to quickly assess risk and scope.

This skill details advanced techniques for performing stealthy lateral movement across Windows domains using Windows Management Instrumentation (WMI). It covers the abuse of native tools like Impacket's wmiexec.py and CrackMapExec, enabling remote command execution, Pass-the-Hash attacks, and fileless techniques, crucial for authorized red team engagements and security auditing.

This skill provides a comprehensive workflow for analyzing malicious software to extract actionable Indicators of Compromise (IOCs). It covers static analysis (PE parsing, hashing, string extraction) and dynamic analysis techniques. Users learn how to identify file hashes, network indicators (C2 IPs, domains), registry modifications, and behavioral artifacts, ultimately formatting the findings into standard STIX 2.1 formats for sharing and incident response.

This skill automates deep packet capture (PCAP) analysis using tshark and pyshark. It is invaluable for security assessments and incident response, enabling the extraction of protocol statistics, identification of suspicious network flows (e.g., port scanning, beaconing), and comprehensive extraction of Indicators of Compromise (IOCs), including IPs, domains, and URLs. It also specializes in detecting complex anomalies like DNS tunneling.