Skill UI

This skill focuses on advanced threat detection techniques used to identify the abuse of legitimate Windows binaries (LOLBins) for malicious purposes. It requires monitoring process creation, command-line arguments, and network activity to pinpoint fileless and living-off-the-land attacks. Ideal for building SIEM/EDR detection rules, threat hunting, and hardening endpoint security policies.

A comprehensive skill designed for advanced security analysis, detecting malicious behaviors across mobile applications (Android/iOS). It performs multi-layered analysis, including static indicator checks (permissions, manifest), dynamic instrumentation via Frida, network traffic monitoring (C2 communication, exfiltration), and automated scanning (MobSF). Use this when investigating suspicious apps, detecting trojans, or performing malware triage.

A comprehensive skill for detecting early-stage ransomware indicators before data encryption occurs. It utilizes advanced network detection tools such as Zeek and Suricata, combined with SIEM correlation rules and threat intelligence feeds. This method monitors the entire pre-encryption kill chain, identifying precursor behaviors like initial access broker activity, Cobalt Strike C2 beaconing, credential harvesting (e.g., Mimikatz signatures), and data staging attempts, enabling timely incident response and containment.

A comprehensive guide to detecting sophisticated rootkit activity and persistent threats that evade standard security tools (like Task Manager or EDR). Techniques include cross-view process analysis, identifying System Service Descriptor Table (SSDT) hooks, kernel module analysis, and network connection forensics using tools like Volatility. Use this when standard monitoring fails, and deep system integrity checks are required.

This tool simulates various BGP hijacking scenarios, including prefix hijacking and route leaks, within authorized, isolated lab environments. It is designed to assess the effectiveness of critical network defenses such as RPKI deployment, route origin validation, and BGP monitoring systems against unauthorized route announcements. It is a training and validation tool for network operations teams.

This utility implements comprehensive Cloud Workload Protection (CWPP) by monitoring compute workloads on cloud instances (EC2/GCE). It provides runtime security controls, detecting process anomalies, unauthorized binary execution, cryptomining activity, and suspicious network connections using AWS and Google APIs. Ideal for establishing robust security postures and meeting compliance requirements.

This skill guides the deployment and configuration of the Dragos Platform for specialized Operational Technology (OT) and Industrial Control System (ICS) network monitoring. It leverages industrial protocol parsers and threat intelligence to detect sophisticated threats (e.g., VOLTZITE). It is essential for establishing OT Security Operations Centers (SOCs) or integrating dedicated ICS monitoring capabilities into enterprise SIEM solutions.

Automate the deployment of osquery scheduled queries to continuously monitor endpoints, covering process inventory, network listeners, file integrity, and persistence mechanisms; generate osquery.conf, configure differential logging, analyze suspicious results, and produce a security report.

A guide and implementation pattern for deploying Nozomi Networks Guardian sensors. This solution enables passive, non-disruptive monitoring of Operational Technology (OT) and Industrial Control Systems (ICS). It provides critical asset visibility, behavioral anomaly detection, protocol-aware monitoring, and vulnerability assessment, making it essential for building robust OT Security Operations Centers (SOCs) and ensuring compliance without risking live operations.

This comprehensive guide details how to implement robust privileged session monitoring and recording using advanced PAM solutions like CyberArk PSM. It covers critical aspects including architecting network controls (routing all access through proxies), configuring keystroke logging and session recording for RDP/SSH, and establishing real-time monitoring rules. Essential for meeting strict compliance requirements (e.g., PCI-DSS, SOX, HIPAA) and generating non-repudiable audit trails.

This skill simulates bandwidth throttling and network degradation attacks using tools like tc, iperf3, and Scapy. Designed exclusively for authorized lab environments, it validates Quality of Service (QoS) controls, tests the resilience of real-time applications (like VoIP and video conferencing), and assesses network monitoring tools' ability to detect abnormal traffic manipulation.

A comprehensive guide to conducting security assessments on thick client (desktop) applications. This skill details techniques ranging from static analysis (using tools like dnSpy, IDA Pro) to dynamic analysis (process monitoring with Procmon, network interception via Burp Suite). It covers finding hardcoded credentials, identifying insecure local storage, mitigating DLL hijacking, and analyzing memory manipulation within local applications.