Skill UI

A comprehensive toolkit using Splunk's SPL language to analyze Windows Security, System, and Sysmon event logs. It maps advanced detection queries to specific MITRE ATT&CK techniques, enabling SOC analysts to investigate authentication attacks (e.g., brute force, password spraying), detect privilege escalation, locate persistence mechanisms, and trace lateral movement for detailed forensic timeline analysis.

This comprehensive guide details the systematic extraction and analysis of Windows Registry hives (SAM, SYSTEM, SOFTWARE, NTUSER.DAT) from forensic images. It demonstrates how to use specialized tools like RegRipper and Python scripts to uncover critical artifacts, including user activity history, persistence mechanisms (autorun keys), installed software records, and evidence of system compromise, which is crucial for digital forensics investigations.

This guide details advanced techniques for authorized security assessments, focusing on forced browsing. It helps testers discover hidden administrative pages, unprotected APIs, and configuration files by systematically enumerating URLs and challenging application access control mechanisms. Techniques involve using tools like ffuf and Gobuster for comprehensive path and directory discovery.

A comprehensive utility designed to assess the security posture of modern APIs, including REST, GraphQL, and gRPC. It strictly follows the OWASP API Security Top 10 framework, testing for critical vulnerabilities such as Broken Object/Function Level Authorization (BOLA/BFLA), SQL/NoSQL injection flaws, and weaknesses in authentication mechanisms like JWT manipulation. Essential for security engineers and penetration testers validating complex microservice architectures and API gateways.

A comprehensive guide to simulating Man-in-the-Middle (MITM) attacks using industry-standard tools like Bettercap, Ettercap, and mitmproxy. This technique is strictly for authorized penetration testing environments to assess cryptographic controls, validate TLS certificate pinning, and test network defense mechanisms against ARP/DNS spoofing and sniffing.

This skill provides a comprehensive guide to deploying a Software-Defined Perimeter (SDP) compliant with the CSA v2.0 specification. It details implementing core zero trust mechanisms, including Single Packet Authorization (SPA) and mutual TLS (mTLS), using a controller and gateway architecture. Use this when establishing invisible, identity-centric network access (dark cloud) to harden infrastructure, enforce strict zero trust policies, or meet advanced compliance requirements.

A comprehensive guide for advanced threat hunting, focusing on detecting DLL side-loading and search-order hijacking (MITRE T1574). It instructs users to analyze Sysmon Event ID 7 logs, validate file signatures and hashes, and identify path anomalies to uncover APT persistence mechanisms. Essential for incident response and proactive threat detection in enterprise environments.

This comprehensive guide configures Fail2ban to implement a robust, layered defense mechanism for network security. It sets up custom filters and actions to automatically detect and mitigate threats such as port scanning, SSH brute force attempts, and network reconnaissance. By dynamically banning malicious IP addresses and providing security alerts, this skill significantly enhances the host-based intrusion prevention capabilities of your system.

A comprehensive guide for threat hunting, detailing detection methods for the abuse of elevation controls (T1548). It covers both Windows environments (UAC bypass via registry modification and auto-elevating binaries like fodhelper.exe) and Linux systems (sudo/setuid abuse). Use this to monitor system events, registry changes, and process relationships to identify unauthorized privilege escalation attempts.

A comprehensive guide for threat hunters and incident responders to detect WMI-based persistence mechanisms (MITRE T1546.003). It details the analysis of Sysmon Event IDs 19, 20, and 21, cross-referencing these events with root\subscription namespaces and using tools like Autoruns and SIEM analysis for robust detection.

A comprehensive guide detailing the systematic process of eradicating malware, backdoors, and attacker persistence mechanisms from compromised Windows and Linux systems. This workflow covers mapping persistence (Autoruns, registry, scheduled tasks), identifying artifacts (YARA, AV scans), removing threats, resetting credentials, and patching vulnerabilities to restore a clean state.

This skill details techniques for exploiting PHP's type juggling vulnerabilities, primarily caused by loose (==) comparison operators. It demonstrates how attackers can bypass authentication mechanisms, defeat magic hash function verifications, and manipulate application logic through controlled type coercion when testing web applications. Ideal for authorized security penetration testing.