Skill UI

This skill provides a comprehensive workflow to extract Indicators of Compromise (IOCs) from malware samples and analysis reports. It covers file hashes (SHA256, MD5), network artifacts (IPs, domains, URLs from strings and PCAPs), and host-based indicators (registry keys, file paths, mutexes) from sandbox reports. It is essential for threat intelligence sharing, building blocklists, and creating detection signatures (YARA, Snort).

A comprehensive guide detailing best practices for hardening Docker containers, aligning with CIS Docker Benchmark v1.8.0. It covers host configuration, minimizing attack surface, implementing least privilege, and enhancing runtime security using techniques like read-only filesystems, Seccomp, and AppArmor. Use this when deploying secure, production-grade containerized applications.

This skill automates the hardening of Linux endpoints (Ubuntu, RHEL, CentOS) by implementing industry-standard security best practices guided by CIS Benchmarks. It systematically secures various layers, including filesystem permissions, network parameters (sysctl), SSH configuration, user access controls (PAM), and integrates deep auditing using auditd and OpenSCAP. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

A comprehensive tool for security analysts to hunt for malicious PowerShell activity. It analyzes Windows Event Log (EVTX) files by parsing Script Block Logging (Event 4104), Module Logging (4103), and process creation events. Detects obfuscated commands, AMSI bypass attempts, encoded payloads, and credential dumping techniques crucial for incident response and threat hunting.

This skill guides threat hunters in detecting Cobalt Strike Command and Control (C2) beacons. It utilizes advanced network forensic techniques, including analyzing default TLS certificate serials, JA3/JA3S/JARM fingerprints, beacon jitter, and HTTP profile matching. Detection is achieved by correlating data from Zeek logs, Suricata rules, and Python PCAP analysis to identify suspicious outbound communications.

This skill guides security analysts in detecting data staging activities, a critical precursor to data exfiltration. It monitors for the use of archiving tools (7-Zip, RAR), unusual file consolidation patterns, and suspicious writes to temporary or hidden directories using EDR and process telemetry. Essential for proactive threat hunting and improving detection coverage for T1074 techniques.

This skill detects anti-forensic timestomping by analyzing NTFS Master File Table (MFT) entries. It compares timestamps from the $STANDARD_INFORMATION attribute (user-modifiable) against the $FILE_NAME attribute (kernel-protected). Discrepancies, such as SI Created < FN Created, strongly indicate malicious manipulation and defense evasion. This methodology is crucial for advanced threat hunting and digital forensic investigations.

This skill guides security analysts through advanced threat-hunting methodologies focused on detecting DNS-based persistence. It analyzes passive DNS history, zone file audits, and API data (like SecurityTrails) to identify unauthorized record modifications, subdomain takeovers, and DNS hijacking attempts that bypass traditional security controls. Ideal for SOC analysts and threat hunters.

Provides a structured methodology for proactive threat hunting against Living-off-the-Land Binaries (LOLBins). It guides practitioners in identifying techniques where adversaries abuse legitimate system tools (like certutil, mshta, rundll32) to execute payloads while bypassing traditional security controls (AV/EDR). Ideal for incident response, red team validation, and improving detection coverage against fileless attacks.

This skill focuses on threat hunting techniques to detect adversaries leveraging Living Off the Land Binaries (LOLBins). By analyzing detailed endpoint process creation logs (e.g., Sysmon), practitioners can identify suspicious execution patterns of legitimate Windows system binaries (like certutil, mshta, rundll32) used for malicious fileless attacks or defense evasion. It is crucial for improving detection coverage against advanced persistent threats.

This guide details advanced threat hunting techniques to proactively uncover adversary persistence mechanisms leveraging Windows Management Instrumentation (WMI) event subscriptions. It monitors the creation and binding of WMI events (Filter, Consumer, Binding) to detect malicious, fileless backdoors used by sophisticated threat actors, especially when standard persistence locations are clean.

Detects persistence mechanisms (T1547.001) by monitoring critical Windows startup directories. This skill analyzes autoruns entries, monitors for real-time file system changes using Python watchdog, and examines file metadata (like creation timestamps and digital signatures) to identify suspicious implants and unauthorized execution points.