Skill UI

This skill addresses advanced threat detection for critical infrastructure (OT/ICS). It monitors sophisticated, multi-stage cyber-physical attacks, focusing specifically on PLC logic integrity monitoring, detecting unauthorized modifications, and analyzing process anomalies. It covers the entire attack chain, from initial USB-borne access (IT) to process manipulation (OT).

A comprehensive guide and set of detection rules for identifying OS credential dumping techniques (MITRE T1003). It leverages EDR telemetry, Sysmon process access monitoring, and Windows security event correlation to detect attacks targeting LSASS memory, SAM databases, and NTDS.dit files. Essential for proactive threat hunting and incident response.

A comprehensive guide for threat hunting designed to detect various forms of privilege escalation abuse, including UAC bypass, setuid/setgid manipulation, and exploiting auto-elevating processes on Windows and Linux. It provides specific monitoring workflows, detection queries (Splunk, KQL, Sigma), and key indicators related to MITRE ATT&CK T1548.

This tool simulates various BGP hijacking scenarios, including prefix hijacking and route leaks, within authorized, isolated lab environments. It is designed to assess the effectiveness of critical network defenses such as RPKI deployment, route origin validation, and BGP monitoring systems against unauthorized route announcements. It is a training and validation tool for network operations teams.

This skill guides security analysts in detecting data staging activities, a critical precursor to data exfiltration. It monitors for the use of archiving tools (7-Zip, RAR), unusual file consolidation patterns, and suspicious writes to temporary or hidden directories using EDR and process telemetry. Essential for proactive threat hunting and improving detection coverage for T1074 techniques.

This guide details advanced threat hunting techniques to proactively uncover adversary persistence mechanisms leveraging Windows Management Instrumentation (WMI) event subscriptions. It monitors the creation and binding of WMI events (Filter, Consumer, Binding) to detect malicious, fileless backdoors used by sophisticated threat actors, especially when standard persistence locations are clean.

A detailed methodology for proactive threat hunting focused on identifying deep-seated persistence mechanisms within Windows operating systems. This guide covers advanced techniques such as monitoring Run keys, analyzing Winlogon modifications, detecting IFEO injection, and identifying COM object hijacking. It is crucial for incident response, purple teaming, and ensuring system integrity against advanced persistent threats (APTs).

This methodology guides security professionals in proactively hunting for suspicious activity related to Volume Shadow Copy deletion. By monitoring commands like vssadmin, wmic, and PowerShell usage, it helps detect anti-forensics techniques and preparatory steps often executed by ransomware actors, crucial during incident response or threat hunting exercises.

Detects persistence mechanisms (T1547.001) by monitoring critical Windows startup directories. This skill analyzes autoruns entries, monitors for real-time file system changes using Python watchdog, and examines file metadata (like creation timestamps and digital signatures) to identify suspicious implants and unauthorized execution points.

Monitors Windows process creation events to flag Living Off The Land Binary abuse by matching Event ID 4688/Sysmon 1 logs against LOLBAS database entries, supporting threat hunting and SIEM rule creation for fileless attacks.

This skill details how to establish continuous compliance monitoring for AWS resources. It covers deploying managed and custom Config rules aligned with industry standards like CIS and PCI DSS. The workflow includes setting up recording, implementing automated remediation using SSM, and aggregating compliance data across multiple AWS accounts using AWS Organizations. Ideal for security auditing and guardrail deployment.

This skill provides a comprehensive guide to deploying AWS Security Hub for centralized Cloud Security Posture Management (CSPM). It covers aggregating security findings from multiple sources (GuardDuty, Inspector, Macie, and third-party tools), enabling compliance checks against standards like CIS and PCI-DSS, and automating remediation workflows across multi-account AWS organizations. Ideal for security teams needing continuous compliance monitoring and robust governance.