Skill UI

This skill simulates bandwidth throttling and network degradation attacks using tools like tc, iperf3, and Scapy. Designed exclusively for authorized lab environments, it validates Quality of Service (QoS) controls, tests the resilience of real-time applications (like VoIP and video conferencing), and assesses network monitoring tools' ability to detect abnormal traffic manipulation.

Cartography syncs multi-cloud assets (AWS, GCP, Azure) into a Neo4j graph database. It maps relationships like IAM chains, network paths, and cross-account trusts, allowing security teams to conduct comprehensive asset inventories, identify complex attack paths, and generate detailed security reports across heterogeneous cloud environments.

Provides detailed, cloud-native procedures for containing security incidents across major platforms (AWS, Azure, GCP). The guide outlines how to revoke compromised IAM credentials, isolate resources using network security groups and ACLs, and preserve forensic evidence through snapshots and policy enforcement, minimizing lateral movement risk during an active breach.

This skill guides users on performing deep runtime threat detection and forensics in cloud-native environments using Falco. It leverages Falco YAML rules to monitor syscalls, detecting critical security events such as shell spawning, file tampering (e.g., /etc/shadow), network anomalies, and privilege escalation within containers and Kubernetes clusters. Ideal for incident response, security auditing, and validating container runtime security controls.

This skill enables sophisticated runtime dynamic analysis of Android applications using industry-standard tools like Frida and Objection. It is used to observe application behavior, intercept API calls, monitor network traffic, and bypass client-side security protections (e.g., root detection, anti-debugging). Essential for identifying vulnerabilities and analyzing obfuscated code that static analysis cannot reach.

This tool facilitates interactive dynamic malware analysis using the ANY.RUN cloud sandbox. It allows analysts to detonate suspicious samples, observe real-time execution behavior, and manually interact with prompts (like dialogs or CAPTCHAs). Key outputs include detailed process trees, network traffic analysis (C2 communication), and identification of all Indicators of Compromise (IOCs), mapping observed behaviors to MITRE ATT&CK. Essential for rapid, sophisticated behavioral analysis without maintaining local sandbox infrastructure.

A comprehensive guide simulating real-world attacks against internet-facing infrastructure (firewalls, web servers, DNS, etc.). It covers the entire penetration testing lifecycle, including passive and active reconnaissance, vulnerability scanning (using tools like Nmap, Nessus, and Nuclei), manual validation, and simulated exploitation, adhering to standards like PTES and OSSTMM.

This script automates the process of conducting comprehensive ICS/OT asset discovery using the Claroty xDome API. It facilitates inventorying critical industrial assets (PLCs, RTUs, HMIs) across various Purdue Model levels. Ideal for brownfield environments, preparing for IEC 62443 compliance, and gaining visibility into undocumented operational technology networks.

This tool provides comprehensive security assessments for the entire IoT ecosystem, including physical hardware, embedded firmware, network communications, and cloud APIs. Testers can perform deep dives using hardware debugging (UART/JTAG), firmware extraction and reverse engineering, analyzing protocols (MQTT, CoAP, BLE), and simulating cloud-to-device attacks to identify vulnerabilities across all layers of the smart device stack.

Provides a comprehensive guide to auditing the security posture of the etcd cluster, the critical key-value store backing Kubernetes. This assessment covers encryption at rest for secrets, TLS transport security, access control policies, secure backup procedures, and network isolation best practices. Essential for hardening control planes and ensuring regulatory compliance.

A comprehensive skill for Security Operations Center (SOC) teams and incident responders. It detects advanced lateral movement techniques, including Pass-the-Hash, PsExec, WMI, and RDP pivoting, by correlating Windows Security logs, Sysmon data, and network flow records within a SIEM. This capability is mapped to MITRE ATT&CK TA0008 and is essential for tracking an attacker's internal progression after initial compromise. Not intended for external attack detection.

This skill provides a comprehensive workflow for analyzing malicious software to extract actionable Indicators of Compromise (IOCs). It covers static analysis (PE parsing, hashing, string extraction) and dynamic analysis techniques. Users learn how to identify file hashes, network indicators (C2 IPs, domains), registry modifications, and behavioral artifacts, ultimately formatting the findings into standard STIX 2.1 formats for sharing and incident response.