Skill UI

This utility performs comprehensive forensic analysis on memory dumps. It leverages industry-standard tools like Volatility and Mimikatz to extract sensitive information, including cached credentials, NTLM/LM hashes, Kerberos tickets, and authentication tokens. It is crucial for incident response, assessing the scope of credential compromise, and investigating lateral movement attacks.

A comprehensive guide and toolkit for extracting, parsing, and analyzing Windows Event Logs (EVTX). This method utilizes industry-leading tools like Chainsaw and Hayabusa, along with Sigma rules, to perform deep digital forensics. It is specifically designed to detect critical security indicators such as lateral movement, persistence mechanisms, privilege escalation, and unauthorized access attempts on Windows systems.

This guide details how to harden the Docker daemon (dockerd) configuration by modifying /etc/docker/daemon.json. It implements critical security controls such as user namespace remapping, disabling inter-container communication (ICC), enforcing no-new-privileges, and configuring secure TLS client authentication. Use this method to prevent container breakout, privilege escalation, and lateral movement, ensuring compliance with standards like CIS benchmarks.

This tool analyzes Windows Event Logs (ID 4688, Sysmon ID 1) and WMI-Activity Operational events to detect suspicious lateral movement. It specifically hunts for WmiPrvSE.exe spawning child processes (like cmd.exe or powershell.exe) or identifying WMI event subscriptions, which are common indicators of remote code execution and persistence.

This guide details the deployment of deception technologies, including canary files and honeypot shares, to detect ransomware activity at its earliest stages. It outlines configuring file integrity monitoring (FIM) and using specialized tokens to trigger alerts when ransomware attempts encryption or performs lateral movement, significantly enhancing security posture beyond standard EDR.

This guide details implementing microsegmentation using Akamai Guardicore Segmentation. It helps map application dependencies, visualize east-west traffic flows, and establish granular, least-privilege network policies across diverse environments (VMs, containers, bare metal, cloud). Essential for achieving zero-trust architecture and meeting compliance standards like PCI DSS or HIPAA by preventing lateral movement.

A comprehensive guide for deploying and managing network deception systems using industry-leading honeypot platforms like OpenCanary, T-Pot, and Cowrie. This skill helps security professionals detect unauthorized access attempts, trace lateral movement, and gather critical threat intelligence by simulating vulnerable services within a controlled environment. Ideal for enhancing network security architecture and creating early warning indicators for intrusions.

A comprehensive guide detailing how to implement portable Kubernetes NetworkPolicies to enforce zero-trust microsegmentation. Learn to apply default-deny rules, control ingress and egress traffic, and restrict lateral movement between pods and namespaces across various CNI platforms (Calico, Cilium). Ideal for establishing robust security posture and meeting compliance requirements.

This guide focuses on developing multi-event correlation rules using Splunk SPL and Sigma format. It teaches how to detect Advanced Persistent Threats (APT) and lateral movement by chaining multiple Windows authentication, process execution, and network connection events across hosts within specified time windows. Use this to surface complex, multi-stage attack sequences that single-event detection rules typically miss.

This guide details implementing Zero Trust Network Access (ZTNA) across major cloud providers (AWS, Azure, GCP). It replaces traditional VPNs by enforcing identity-based, context-aware access controls using identity-aware proxies and micro-segmentation. Use it to secure cloud workloads, limit lateral movement, and comply with modern security standards like BeyondCorp.

A comprehensive guide for incident responders detailing how to investigate Active Directory (AD) compromises. This skill covers analyzing critical components like NTDS.dit integrity, detecting Kerberos anomalies (Golden/Silver Tickets), tracing lateral movement, and identifying Group Policy abuse to reconstruct attacker activity and determine the full scope of a breach.

This skill guides comprehensive Active Directory (AD) security assessment using industry-standard tools like PingCastle, BloodHound, and Purple Knight. It helps identify critical misconfigurations, excessive privileges, weak Kerberos settings, and potential lateral movement paths. Ideal for penetration testing, security audits, and incident response to proactively secure enterprise identity management systems.