Skill UI

A comprehensive guide detailing red team tactics based on the MITRE ATT&CK framework. It covers the entire adversary lifecycle, including reconnaissance, initial access, privilege escalation, defense evasion, lateral movement, and exfiltration. This skill is designed for authorized security assessments to simulate real-world threats and identify critical defensive gaps.

Guides product teams through MITRE's Problem Framing Canvas with structured inward/outward/reframe questions so you clarify assumptions, surface stakeholders, and create an actionable HMW statement before ideating.

This skill provides a programmatic method for analyzing Advanced Persistent Threat (APT) groups using the MITRE ATT&CK framework. By querying TTPs and generating multi-layer JSON files compatible with ATT&CK Navigator, analysts can visualize threat actor coverage, map detection capabilities, and identify critical security gaps to build highly targeted, threat-informed defenses.

A specialized threat hunting skill designed to detect remnants of the PowerShell Empire post-exploitation framework. It analyzes Windows event logs (specifically Script Block and Module Logging) for key Indicators of Compromise (IOCs), such as default launcher strings, Base64 encoded payloads, known module signatures (e.g., Mimikatz), and staging URL patterns. The output provides a detailed JSON report, comprehensive timeline, and MITRE ATT&CK mapping for incident response and security validation.

This skill provides a systematic methodology for mapping real-world threat actor Tactics, Techniques, and Procedures (TTPs) to the globally recognized MITRE ATT&CK framework. Users learn how to leverage tools like ATT&CK Navigator and Python libraries (e.g., attackcti, stix2) to analyze security incidents, visualize technical coverage heatmaps, identify critical detection gaps, and generate actionable intelligence reports linking observed Indicators of Compromise (IOCs) to specific adversary techniques across various platforms (Enterprise, Mobile, ICS).

This tool helps security analysts map Advanced Persistent Threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework. By utilizing the ATT&CK Navigator and the attackcti Python library, users can query STIX/TAXII data to visualize threat profiles, assess detection coverage gaps, and guide defensive planning for complex cyber incidents.

A comprehensive toolkit using Splunk's SPL language to analyze Windows Security, System, and Sysmon event logs. It maps advanced detection queries to specific MITRE ATT&CK techniques, enabling SOC analysts to investigate authentication attacks (e.g., brute force, password spraying), detect privilege escalation, locate persistence mechanisms, and trace lateral movement for detailed forensic timeline analysis.

This skill automates the process of parsing Cyber Threat Intelligence (CTI) reports to extract adversary behaviors. It maps these behaviors to MITRE ATT&CK techniques and structures them as STIX 2.1 Attack Pattern objects. The resulting library supports detection engineering by generating rule templates (Sigma, YARA) for proactive defense and threat-informed security control implementation.

This skill provides a comprehensive workflow for building vendor-agnostic detection rules using the Sigma format. It empowers security operations center (SOC) engineers to translate raw threat intelligence and MITRE ATT&CK techniques into standardized, portable detection logic. The process guides users through rule validation and conversion into specific queries for major SIEM platforms, including Splunk, Elastic, and Microsoft Sentinel, ensuring robust detection coverage.

A comprehensive, structured playbook for Security Operations Centers (SOCs) detailing the entire lifecycle of ransomware incidents. It guides analysts through detection (SIEM queries), triage decision trees, containment (EDR/Firewall), evidence collection, and recovery phases, adhering to NIST CSF and MITRE ATT&CK frameworks.

This skill provides a systematic methodology for building comprehensive threat actor profiles using Open-Source Intelligence (OSINT). It involves gathering, correlating, and analyzing publicly available data from diverse sources (e.g., vendor reports, dark web forums, code repositories). Users can map adversary TTPs to MITRE ATT&CK, assess motivations, and build structured dossiers for proactive defensive strategies and attribution assessments.

A comprehensive guide covering methodologies for conducting authorized penetration testing across major cloud platforms, including AWS, Azure, and GCP. It details the shared responsibility model, techniques for exploiting IAM misconfigurations, testing for SSRF vulnerabilities to cloud metadata services, and utilizing industry tools like Pacu and ScoutSuite. Findings are mapped to the MITRE ATT&CK Cloud matrix for robust reporting.