Skill UI

This comprehensive guide provides a structured, multi-stage workflow for containing active security breaches. It details both short-term and long-term strategies, including network segmentation, endpoint isolation, credential revocation, and evidence preservation. Use this process during confirmed intrusions, ransomware attacks, or lateral movement events to effectively stop adversary activity and secure critical assets before eradication.

Guides SOC teams through validating alerts, isolating networks and endpoints, preserving evidence, and disabling compromised accounts to rapidly contain an active breach while minimizing business impact.

A comprehensive guide for deploying and configuring CrowdStrike Falcon EDR agents across diverse endpoints (Windows, macOS, Linux). This skill covers silent installation via SCCM, Intune, GPO, and command-line methods, alongside establishing robust prevention and response policies. Ideal for onboarding endpoints, enhancing threat detection capabilities, and integrating Falcon telemetry into SIEM platforms for advanced security operations.

A comprehensive guide to deploying and configuring osquery across diverse endpoints (Windows, macOS, Linux). This tool allows security teams to gather deep, SQL-based insights into endpoint state, including running processes, network connections, system configuration, and installed software. It is essential for threat hunting, compliance auditing, and building centralized fleet visibility.

This skill provides comprehensive detection rules for advanced defense evasion techniques used by adversaries, including log tampering (T1070), timestomping, process injection (T1055), and disabling security tools (T1562). It is ideal for threat hunting, building detection rules, and investigating stealthy attacker activity using Sysmon and SIEM data.

This skill provides comprehensive guidance and detection rules for identifying fileless malware, in-memory attacks, and living-off-the-land techniques. It covers detecting PowerShell exploitation, reflective DLL injection, WMI abuse, and registry-resident threats, enabling security teams to build robust detections when traditional antivirus fails.

This skill focuses on advanced threat detection techniques used to identify the abuse of legitimate Windows binaries (LOLBins) for malicious purposes. It requires monitoring process creation, command-line arguments, and network activity to pinpoint fileless and living-off-the-land attacks. Ideal for building SIEM/EDR detection rules, threat hunting, and hardening endpoint security policies.

This skill provides a structured method for analyzing Windows Security Event Logs (EVTX) to detect brute force attacks targeting RDP endpoints. It involves parsing failed logon events (Event ID 4625) and correlating them with successful logons (Event ID 4624), while also analyzing source IP frequency and NLA bypass attempts. Ideal for security incident investigation, blue-team threat hunting, and building SIEM detection rules.

A specialized security testing skill designed to identify excessive data exposure in REST or GraphQL APIs, adhering to OWASP API3:2023 guidelines. It works by intercepting raw API responses and systematically comparing the returned data against what the frontend UI actually displays. This helps auditors detect leaked PII, internal identifiers, debug fields, or other sensitive business data that should have been filtered out by the endpoint response. Use cases include auditing microservice boundaries, assessing mobile API responses designed for multiple clients, and verifying proper respons...

A specialized skill for discovering and exploiting Mass Assignment vulnerabilities (autobinding) in REST APIs. It guides the injection of unexpected or hidden parameters (such as role or isAdmin) into create/update requests. This technique is crucial during API security assessments to test for privilege escalation, authorization bypass, and unintended parameter binding in ORM-backed endpoints (e.g., Rails, Django).

This comprehensive guide outlines techniques for authorized penetration testing of real-time web applications using WebSocket connections. It covers discovering various WebSocket endpoints, testing for authentication bypass, identifying Cross-Site WebSocket Hijacking (CSWSH) vulnerabilities, and assessing message handling for injection flaws (SQLi, XSS). Essential for securing chat, trading, and live notification platforms.

This skill automates the hardening of Linux endpoints (Ubuntu, RHEL, CentOS) by implementing industry-standard security best practices guided by CIS Benchmarks. It systematically secures various layers, including filesystem permissions, network parameters (sysctl), SSH configuration, user access controls (PAM), and integrates deep auditing using auditd and OpenSCAP. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.