Skill UI

Guides SOC teams through full phishing email investigations, from header and link analysis to attachment detonation, user impact mapping, and containment using tools such as Splunk, Microsoft Defender, URLScan, and sandboxes.

Maps observed detection rules, Sigma or SIEM alerts, and intelligence on adversaries to MITRE ATT&CK techniques; builds Navigator heatmaps, labels assets with TIDs, and highlights coverage gaps so SOCs can prioritize controls and report threat exposure.

This skill generates a highly structured, section-by-section paper outline by synthesizing raw research data, detailed review conclusions, and experimental results. It guides the writing process by mapping core claims to supporting evidence (Claims-Evidence Matrix) and adhering to specific academic venue formatting guidelines (e.g., ICLR, NeurIPS). Use this when you need to transform scattered findings into a cohesive narrative structure.

Guides security teams through Active Directory vulnerability assessments with PingCastle health checks, BloodHound attack-path mapping, and Purple Knight scoring to spot misconfigurations, privilege escalation paths, and Kerberos lateral-movement weaknesses in enterprise domains.

Guides authorized testers through enumerating IAM permissions, scanning for escalation techniques with Pacu, mapping privilege graphs via Principal Mapper, and auditing cross-account trust policies to prevent unauthorized admin escalation.

Use the ANY.RUN cloud sandbox to perform interactive dynamic malware analysis, interact with prompts, capture process trees, network activity, and export IOCs plus ATT&CK mappings for team reporting.

Guides red teams and security testers through executing stealthy lateral movement on Windows networks via WMIExec, CrackMapExec, native WMI/CIM commands, and Pass-the-Hash workflows while mapping to MITRE ATT&CK T1047 to validate defenses.

Guides teams through a complete NIST Cybersecurity Framework 2.0 maturity assessment, mapping current implementation tiers across Govern, Identify, Protect, Detect, Respond, and Recover functions and producing gap analyses plus improvement roadmaps.

Guides red teamers and defenders through an OSINT-driven reconnaissance workflow, from domain enumeration and personnel mapping to credential leaks and technology stack discovery, helping shape initial attack surface models and validate security controls before deeper testing.

Performs comprehensive assessments of OT networks (SCADA/DCS) by mapping Purdue layers, evaluating OT/IT convergence risks, analyzing industrial protocols, and validating firewall zones to detect misconfigurations or attack paths during compliance or incident response work.

Guides teams through designing, implementing, and evidencing SOC 2 Type II controls aligned with the AICPA Trust Services Criteria, covering scoping, control mapping, evidence collection, remediation, and audit collaboration for a six- to twelve-month examination.

Use ProjectDiscovery’s Subfinder to passively enumerate target domains’ subdomains, configure API sources, and stream results to httpx/dnsx/nuclei for validation, rate control, and attack-surface mapping during penetration tests or bug bounty reconnaissance.