Skill UI

A comprehensive guide and workflow for threat hunting suspicious PowerShell activity (T1059.001). This technique focuses on detecting advanced adversary techniques such as encoded commands, AMSI bypass, and download cradles using telemetry from EDR platforms (CrowdStrike, MDE), SIEMs (Splunk, Elastic), and Sysmon. Essential for proactive threat detection, incident response, and security assessment.

This skill automates the Design Space Exploration (DSE) process, crucial for computer architecture and Electronic Design Automation (EDA). It runs complex simulations, analyzes performance metrics, and systematically tunes parameters (e.g., cache size, pipeline width) across a defined parameter space. It iterates until the objective metric is optimized or a defined timeout is reached, making it ideal for complex hardware tuning and system design.

This skill guides the comprehensive evaluation and selection of Threat Intelligence Platforms (TIPs). It assesses vendor capabilities, including STIX/TAXII support, workflow automation, SIEM/SOAR integration, and total cost of ownership. It is essential for procurement decisions, migrating between TIP solutions, or assessing whether the current CTI program meets required maturity levels.

This skill transforms a refined research proposal or method idea into a detailed, structured, and claim-driven experiment roadmap. It helps users determine exactly which experiments to run, in what order, and what evidence is needed to support the core claims of a research paper, ensuring focus on novelty, simplicity, and genuine contribution.

This skill provides a comprehensive guide for identifying and exploiting insecure local data storage vulnerabilities in Android and iOS applications. It covers analyzing plaintext credentials, unencrypted SQLite databases, insecure SharedPreferences, and improper keychain/keystore usage. Essential for performing robust mobile penetration testing focused on OWASP M9.

This guide details the exploitation chain for noPac, combining CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). It demonstrates how an attacker can escalate from a standard domain user to Domain Admin by manipulating Active Directory tickets and performing DCSync. Primarily used in authorized red-teaming and penetration testing to validate domain security.

This comprehensive guide outlines techniques for authorized penetration testing of real-time web applications using WebSocket connections. It covers discovering various WebSocket endpoints, testing for authentication bypass, identifying Cross-Site WebSocket Hijacking (CSWSH) vulnerabilities, and assessing message handling for injection flaws (SQLi, XSS). Essential for securing chat, trading, and live notification platforms.

This utility performs comprehensive forensic analysis on memory dumps. It leverages industry-standard tools like Volatility and Mimikatz to extract sensitive information, including cached credentials, NTLM/LM hashes, Kerberos tickets, and authentication tokens. It is crucial for incident response, assessing the scope of credential compromise, and investigating lateral movement attacks.

A comprehensive guide and toolkit for extracting, parsing, and analyzing Windows Event Logs (EVTX). This method utilizes industry-leading tools like Chainsaw and Hayabusa, along with Sigma rules, to perform deep digital forensics. It is specifically designed to detect critical security indicators such as lateral movement, persistence mechanisms, privilege escalation, and unauthorized access attempts on Windows systems.

This skill detects anti-forensic timestomping by analyzing NTFS Master File Table (MFT) entries. It compares timestamps from the $STANDARD_INFORMATION attribute (user-modifiable) against the $FILE_NAME attribute (kernel-protected). Discrepancies, such as SI Created < FN Created, strongly indicate malicious manipulation and defense evasion. This methodology is crucial for advanced threat hunting and digital forensic investigations.

A specialized technique for proactive threat hunting, designed to detect adversary activity that abuses legitimate cloud services (like Azure, AWS, GCP, and SaaS platforms). It focuses on identifying 'living off the cloud' tradecraft, such as using cloud APIs for command-and-control (C2), staging data, or exfiltrating information while blending into normal network traffic.

A comprehensive guide for security professionals to proactively hunt for Indicators of Compromise related to Volume Shadow Copy deletion (T1490). This technique is critical for detecting ransomware preparation and anti-forensics activity. It details using SIEM/EDR platforms to query for specific commands (vssadmin, wmic, PowerShell) associated with deleting system recovery points and shadow copies.