Skill UI

This skill analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework. It identifies which attack phases an adversary has completed, points where defenses failed or succeeded, and recommends controls to disrupt the attack at earlier stages. It is essential for post-incident analysis, threat intelligence reporting, and designing robust defense-in-depth strategies.

This guide details the comprehensive process of using the Linux Audit framework (auditd) to detect advanced security threats. It covers deploying specific rules to monitor critical system files, detecting unauthorized privilege escalation, process injection, and suspicious system calls. Users can then leverage ausearch and aureport to efficiently query, reconstruct timelines, and summarize findings for forensic analysis and compliance auditing.

This tool provides a comprehensive framework for analyzing web server logs (Apache/Nginx) to detect various security threats. It uses advanced regex matching against OWASP attack signatures to identify SQL injection, Local File Inclusion, and Directory Traversal attempts, alongside behavioral analysis for brute-force attacks and web scanner fingerprints. The system also enriches data using GeoIP for source attribution, generating a prioritized report for SOC analysts.

Structures completed intrusion investigations with the Diamond Model by documenting adversaries, capabilities, infrastructure, and victims plus their relationships, metadata, and pivots to cluster incidents and support campaign attribution, confidence scoring, and analytic write-ups.

This skill implements the Diamond Model framework, providing a structured approach to analyzing complex cyber intrusions. It allows users to programmatically classify and correlate events based on four core elements: Adversary, Capability, Infrastructure, and Victim. Key functionalities include building activity threads, identifying pivot points, and generating comprehensive, pivot-ready threat intelligence reports.