Skill UI

This comprehensive skill guides the deployment and utilization of MISP, a powerful open-source threat intelligence platform. It covers configuring various threat feeds (TAXII, CSV, etc.) and using the PyMISP Python API to programmatically automate the collection, storage, and correlation of Indicators of Compromise (IOCs) and threat events from diverse community and commercial sources.

This skill correlates disparate security incidents, Indicators of Compromise (IOCs), and adversary behaviors across time and organizations. It systematically identifies unified threat campaigns, attributes them to common threat actors, and extracts shared indicators for significantly improved detection capabilities. Ideal for cross-organizational threat intelligence sharing and building comprehensive campaign reports.

A specialized Python detector designed to monitor Operational Technology (OT) historian servers (such as OSIsoft PI, Ignition, etc.). It identifies critical indicators of compromise (IOCs), including unauthorized network connections, data manipulation attempts, and lateral movement activities that bridge IT and OT zones. Use this skill when validating data integrity and investigating potential cyber breaches in industrial environments.

This skill detects compromised cloud credentials by analyzing anomalous API activity, impossible travel patterns, and unauthorized access indicators across AWS, Azure, and GCP. It integrates findings from GuardDuty, Defender for Identity, and Security Command Center to provide comprehensive threat visibility and assist in incident response and scope assessment.

A comprehensive guide and analysis framework for detecting compromised Office 365 or Google Workspace email accounts. It focuses on analyzing unified audit logs and Azure AD sign-in logs to identify indicators of account takeover (ATO) or Business Email Compromise (BEC). Detection methods include monitoring impossible travel events, identifying malicious inbox rules (e.g., external forwarding or deletion rules), and analyzing suspicious Microsoft Graph API access patterns.

This skill detects DNS-based data exfiltration by analyzing Zeek dns.log files. It identifies indicators such as high Shannon entropy subdomains, oversized TXT/NULL records, and abnormal query volumes. Use it when investigating suspected DNS tunneling or covert C2 channels to enhance threat detection capabilities.

Utilizes SIEM platforms (Splunk/Elastic) and Windows Event Log analysis (ID 4769) to detect indicators of Golden Ticket attacks. This skill analyzes Kerberos logs for specific anomalies such as RC4 encryption downgrades, abnormal ticket lifetimes, and correlation failures between TGT and TGS requests, crucial for advanced threat hunting in Active Directory environments.

This guide provides a structured methodology for proactively detecting and hunting various insider threat behaviors. It focuses on identifying indicators such as unusual data access, off-hours activity, mass file downloads, and privilege misuse. It is crucial for threat-hunting during incident response or investigating departed employees for potential data theft.

A comprehensive guide and workflow for detecting Mimikatz and similar credential-dumping activities. It utilizes command-line pattern matching, LSASS memory access signatures, binary indicators, and in-memory analysis. Ideal for threat hunting, scoping compromises during incident response, or validating detection coverage in purple team exercises using EDR/SIEM data.

A comprehensive skill for detecting early-stage ransomware indicators before data encryption occurs. It utilizes advanced network detection tools such as Zeek and Suricata, combined with SIEM correlation rules and threat intelligence feeds. This method monitors the entire pre-encryption kill chain, identifying precursor behaviors like initial access broker activity, Cobalt Strike C2 beaconing, credential harvesting (e.g., Mimikatz signatures), and data staging attempts, enabling timely incident response and containment.

A comprehensive toolkit designed to automatically extract Indicators of Compromise (IOCs) from malware samples. It harvests critical artifacts including file hashes (MD5, SHA256), network indicators (IPs, domains, URLs), and host artifacts (registry keys, mutexes) using static, dynamic, and PCAP analysis. Essential for threat intelligence, building defense rules (YARA, Snort), and incident response.

A comprehensive guide and toolkit for extracting, parsing, and analyzing Windows Event Logs (EVTX). This method utilizes industry-leading tools like Chainsaw and Hayabusa, along with Sigma rules, to perform deep digital forensics. It is specifically designed to detect critical security indicators such as lateral movement, persistence mechanisms, privilege escalation, and unauthorized access attempts on Windows systems.