Skill UI

This skill guides Security Operations Center (SOC) teams through structured threat modeling using the MITRE ATT&CK framework. It enables mapping adversary Tactics, Techniques, and Procedures (TTPs) against organizational assets to identify critical detection coverage gaps, prioritize defensive investments, and improve overall security posture. Ideal for risk assessment, purple teaming, and compliance planning.

This skill maps observed adversary behaviors, security alerts, and detection rules to the MITRE ATT&CK framework. It is essential for quantifying detection coverage, building ATT&CK heatmaps, tagging SIEM alerts, and prioritizing security controls based on known threat actor playbooks. Use it for comprehensive gap analysis and risk reporting.

A comprehensive skill for Security Operations Center (SOC) teams and incident responders. It detects advanced lateral movement techniques, including Pass-the-Hash, PsExec, WMI, and RDP pivoting, by correlating Windows Security logs, Sysmon data, and network flow records within a SIEM. This capability is mapped to MITRE ATT&CK TA0008 and is essential for tracking an attacker's internal progression after initial compromise. Not intended for external attack detection.

Conducts comprehensive, sector-specific threat landscape assessments by profiling key threat actors, mapping attack vectors, and detailing associated MITRE ATT&CK TTPs (covering financial, healthcare, energy, etc.). Utilizing sophisticated data analysis via Python stacks and integrating real-time threat intelligence feeds (ISAC, CVEs), this tool generates highly actionable intelligence for risk management, security investment prioritization, and high-level board-level reporting on industry exposure.

This guide details using the comprehensive AADInternals PowerShell toolkit for defensive validation of Microsoft Entra ID, Azure AD, and AD FS environments. It covers unauthenticated tenant reconnaissance, acquiring access tokens for multiple Microsoft APIs, and critically, testing for federation backdoors (Golden SAML) by simulating advanced attack techniques (MITRE T1606.002). It is designed for authorized red-team assessments to map external attack surfaces and validate identity infrastructure hardening.

This skill provides comprehensive methods and frameworks to detect sophisticated AI attacks, including model extraction, membership inference, and model inversion, which abuse inference APIs. It focuses on monitoring per-principal query volume, input distribution, and confidence exposure. Use it for securing public or partner inference APIs, or for conducting pre-deployment red-teaming to assess the model's extractability and overall security posture against MITRE ATLAS techniques.

Stratus Red Team is an open-source tool for detection engineering and purple teaming. It atomistically detonates granular, MITRE ATT&CK-mapped offensive techniques across AWS, Azure, GCP, and Kubernetes. The tool executes a full, repeatable lifecycle (warmup, detonate, revert, cleanup) to generate realistic attacker telemetry. Use it to validate if cloud security tools (like CloudTrail or Sentinel) reliably trigger on simulated attacks, or to safely practice red teaming.

A comprehensive methodology for exploiting modern Continuous Integration/Continuous Delivery (CI/CD) pipelines. This skill covers advanced attack vectors across major platforms, including GitHub Actions expression injection, Jenkins RCE, GitLab YAML abuse, and Azure DevOps compromise. Techniques focus on privilege escalation, credential theft, and supply chain poisoning, mapping to MITRE ATT&CK T1195.002.

A comprehensive methodology for offensive security, detailing how to systematically extract secrets from Continuous Integration/Continuous Deployment (CI/CD) pipelines. Techniques covered include dumping environment variables, exploiting misconfigurations in HashiCorp Vault, AWS Secrets Manager, and cloud platform tokens (GitHub, GitLab, etc.). It also guides attackers on OIDC federation abuse, build log analysis, and advanced exfiltration methods, mapping to MITRE ATT&CK T1552.

A comprehensive guide for authorized red team and penetration testing engagements, detailing techniques that exploit human trust and psychological vulnerabilities. Coverage includes pretexting, vishing, smishing, physical access attacks (e.g., badge cloning, tailgating), USB payload delivery, and OSINT-driven targeting. This methodology maps to key MITRE ATT&CK T-numbers, simulating real-world, multi-vector adversaries to test organizational defenses at the human layer.

Red team tactics principles based on MITRE ATT&CK framework. Covers attack phases, detection evasion, lateral movement, and reporting for authorized security assessments.