Skill UI

This skill provides advanced detection methods for credential dumping, covering LSASS memory access, SAM hive extraction, and NTDS.dit theft (e.g., using Mimikatz). It utilizes Sysmon Event ID 10 and Windows Security logs to enable threat hunting, assisting SOC analysts in triaging EDR alerts and building robust SIEM correlation rules.

This methodology guides organizations through a comprehensive cybersecurity risk assessment using the NIST SP 800-30 framework. It systematically identifies threat sources, vulnerabilities, and potential threat events. By determining the likelihood and impact of these threats, the process calculates overall risk, resulting in a prioritized, defensible risk register. Essential for compliance (e.g., ISO 27001, HIPAA), system authorization, and strategic risk reporting.

This comprehensive guide details how to use industry-leading tools like TruffleHog and git-secrets to scan source code repositories, full git history, and configuration files for hardcoded AWS credentials and secrets. It is essential for integrating secrets detection into CI/CD pipelines, performing proactive security audits, and ensuring compliance by preventing sensitive keys from reaching production environments.

This skill enforces a rigorous data validation protocol by establishing hard boundaries at every point data enters the system (API requests, user input, environment variables, webhooks, etc.). It mandates a four-phase process: detection, trust classification, mandatory filtering (schema validation, sanitization, type checking), and final verification. This prevents untrusted data from reaching core business logic, mitigating risks like SQL injection and XSS.

A specialized tool for scientific data visualization, acting as a visualization advisor to analyze data, recommend chart types, prevent common errors, and generate publication-grade figures.

This skill audits Model Context Protocol (MCP) servers to detect critical AI security vulnerabilities. It scans for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure. Use it before integrating new tools or during security reviews to ensure agent reliability and prevent supply chain attacks.

This skill details the process of generating comprehensive forensic super-timelines using Plaso's log2timeline tools. It fuses diverse artifacts—including file-system MACB times, registry data, EVTX, and browser histories—into a single, normalized chronological view. This is critical for reconstructing the full sequence of events on compromised or forensically imaged systems during Digital Forensics and Incident Response (DFIR) investigations, helping analysts detect anti-forensic activity.

This skill provides a comprehensive framework to detect and prevent dependency confusion—a critical supply chain vulnerability. It guides users through enumerating internal package names, scanning manifests (npm, PyPI, Maven, etc.) using tools like `confused` and OWASP `dep-scan`, and implementing preventative measures like registry pinning and defensive package registration.

Hayabusa is a specialized threat-hunting and fast-forensics tool designed to analyze Windows EVTX event logs. It applies a comprehensive library of Sigma detection rules to raw log data, generating a single, prioritized, chronological timeline. The output includes severity levels, MITRE ATT&CK mappings, and detailed metrics, enabling analysts to perform rapid, SIEM-free incident triage and export results for collaborative analysis.

Chainsaw is a fast, Rust-based forensic tool designed for first-response threat hunting. It analyzes collected Windows EVTX files using the comprehensive Sigma rule corpus, built-in detection rules, and high-speed keyword/regex searching. Furthermore, it uniquely analyzes critical artifacts such as shimcache, SRUM, and event-log gaps, providing robust, offline detection capabilities without needing a SIEM pipeline. It is essential for digital forensic triage and hypothesis confirmation.

KAPE (Kroll Artifact Parser and Extractor) is a specialized, rapid triage tool for incident response. It collects specific, volatile forensic artifacts (like registry hives, event logs, and browser data) from compromised Windows systems. It is designed for remote, at-scale artifact collection when full disk imaging is impractical, enabling analysts to quickly build a defensible, parseable dataset for initial investigation and containment.

This skill provides a comprehensive workflow for verifying the integrity of a system's boot chain using TPM 2.0. It covers local validation by reading Platform Configuration Registers (PCRs) and replaying the event log, and remote attestation by generating and checking signed quotes. Use cases include enforcing Zero Trust device posture, detecting firmware tampering, or establishing secure secret baselines.