Skill UI

A proactive, hypothesis-driven skill designed to hunt for Advanced Persistent Threats (APT) within complex enterprise environments. It analyzes endpoint telemetry, network logs, and memory artifacts using frameworks like MITRE ATT&CK. Use this skill when investigating anomalous behavior flagged by UEBA, conducting scheduled threat sprints, or validating exposure to known TTPs using tools like Velociraptor and osquery.

This skill provides advanced threat hunting techniques to detect unauthorized data exfiltration. It guides the analysis of network traffic, DNS queries, and cloud uploads to identify unusual data flows, DNS tunneling, and abuse of encrypted channels, essential for incident response and preventing data loss.

This skill detects domain fronting, an advanced technique used by attackers to mask Command and Control (C2) traffic. It analyzes proxy/web gateway logs for mismatches between the TLS SNI field and the HTTP Host header, combined with deep TLS certificate inspection using pyOpenSSL. This is crucial for security teams investigating sophisticated network threats and validating detection coverage.

This skill provides advanced threat hunting capabilities to detect NTLM relay attacks within Active Directory environments. It analyzes critical Windows Security Event 4624 logs, specifically focusing on logon type 3 using NTLMSSP authentication. The detection logic identifies suspicious patterns, including IP-to-hostname mismatches, rapid multi-host authentications, and lack of SMB signing enforcement, helping SOC analysts pinpoint unauthorized credential access attempts.

This guide details a systematic methodology for proactive threat hunting across Windows endpoints. It focuses on identifying various adversary persistence techniques, such as registry modifications (Run Keys), malicious services, WMI event subscriptions, and scheduled tasks. It is essential for incident response, security audits, and improving detection coverage against dormant backdoors.

This guide details a structured threat hunting methodology designed to proactively detect sophisticated spearphishing campaigns. It instructs users on correlating indicators across email logs, endpoint telemetry (EDR), and network data (SIEM) to identify targeted threats, supporting incident response and security posture improvement.

A powerful academic tool designed for researchers. Given a broad research direction, it systematically surveys the current literature (landscape survey), identifies knowledge gaps, and generates multiple concrete, high-potential hypotheses. It then validates and ranks these ideas to propose novel, publishable research projects.

This sophisticated workflow guides users from a broad research concept or initial topic to a fully validated, actionable, and pilot-tested research idea. It orchestrates a multi-stage pipeline, including literature surveys, novelty checks, detailed idea generation, critical review, and the creation of a refined experimental plan, ensuring the output is a robust proposal ready for implementation.

This comprehensive skill automates the entire process of generating novel, robust, and benchmark-grounded research ideas in robotics and embodied AI. It guides users from a broad initial concept to concrete, actionable project proposals by chaining rigorous literature surveys, novelty verification, and critical reviews. The workflow enforces robotics constraints, prioritizing simulation-first, falsifiable, and feasible real-world applications.

This skill provides a structured methodology for mitigating alert fatigue within Security Operations Centers (SOCs). It guides users through advanced techniques, including implementing Risk-Based Alerting (RBA) to replace high-volume, low-fidelity alerts with consolidated risk scores. It emphasizes quantifying alert quality by analyzing True Positive (TP) and False Positive (FP) rates, and systematically tuning detection rules to maintain analyst effectiveness.

This guide details the implementation of robust API abuse detection mechanisms. It covers advanced rate limiting techniques, such as the Token Bucket and Sliding Window algorithms, to defend APIs against DDoS attacks, brute force attempts, and credential stuffing. It emphasizes using distributed stores like Redis for accurate, scalable, and adaptive security controls in an API gateway context.

This comprehensive guide details how to implement centralized security controls at the API gateway layer. It covers critical functionalities such as JWT authentication enforcement, advanced rate limiting, request/response validation against OpenAPI specs, and integrating Web Application Firewalls (WAF). The process is applicable across major platforms like Kong, AWS API Gateway, and Azure APIM, ensuring robust defense in depth for microservices architecture.