Skill UI

This skill guides the advanced configuration of Windows Event Logging using Group Policy Objects (GPO) and advanced audit policies. It enables high-fidelity logging for critical security events, including process creation (Event 4688), logon/logoff activities, and object access. The process covers optimizing log sizes and implementing Windows Event Forwarding (WEF) to centralize data into SIEM platforms for effective threat detection and forensic investigation.

A comprehensive guide for deploying and configuring CrowdStrike Falcon EDR agents across diverse endpoints (Windows, macOS, Linux). This skill covers silent installation via SCCM, Intune, GPO, and command-line methods, alongside establishing robust prevention and response policies. Ideal for onboarding endpoints, enhancing threat detection capabilities, and integrating Falcon telemetry into SIEM platforms for advanced security operations.

This skill guides the security hardening of Windows endpoints (10/11, Server 2019/2022) using established CIS Benchmarks. It provides a comprehensive workflow for establishing secure organizational baselines, configuring Group Policy Objects (GPOs), and enforcing security controls across critical areas like password policies, audit logs, and firewall rules. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This skill guides the implementation of full disk encryption using Microsoft BitLocker on Windows endpoints. It covers best practices for deploying encryption via GPO, Intune, and command line, ensuring data-at-rest protection. Use this when meeting compliance requirements (PCI, HIPAA) or securing mobile workstations against physical loss or theft.

This skill details the design and implementation of Privileged Access Workstations (PAWs). It covers establishing a tiered administration model, enforcing device compliance using Microsoft Intune or Group Policy, integrating Just-in-Time (JIT) access provisioning, and connecting with leading PAM platforms like CyberArk or BeyondTrust to secure sensitive administrative operations.

This skill provides a comprehensive guide to implementing robust USB device control policies. It restricts unauthorized removable media access to mitigate data exfiltration risks and prevent malware introduction via USB endpoints. Learn how to deploy granular policies using Group Policy Objects (GPO), Microsoft Intune, or advanced Endpoint Detection and Response (EDR) platforms to meet strict compliance standards.

This tool automates the deployment of deception-based honeytokens within Active Directory environments. It creates fake privileged accounts, decoy SPNs for Kerberoasting detection, and misleading GPOs with password traps. Designed for advanced security teams to detect reconnaissance, lateral movement, and credential theft with high fidelity.

A comprehensive guide to hardening Windows Active Directory environments using Group Policy Objects (GPO). This skill configures multiple layers of defense, including AppLocker, Controlled Folder Access, and Attack Surface Reduction (ASR) rules, to prevent ransomware execution paths, block unauthorized file modifications, and restrict lateral movement across the domain.

A comprehensive guide on implementing advanced security observability using eBPF and Cilium Tetragon. This skill covers real-time tracking of process execution, network connections, and file system access directly in the kernel. Learn how to author TracingPolicy CRDs, utilize kprobe/tracepoint hooks for in-kernel filtering, and enforce runtime security policies (e.g., process killing) on Linux hosts or Kubernetes clusters.

A comprehensive playbook detailing advanced techniques for exploiting misconfigured Active Directory Access Control Lists (ACLs). It covers BloodHound enumeration, abusing dangerous ACE types (GenericAll, WriteDACL), conducting DCSync attacks, leveraging shadow credentials, and exploiting GPO/LAPS weaknesses for privilege escalation and lateral movement in a deep dive for security professionals.