Skill UI

This skill uses the Python azure-mgmt-storage SDK to perform comprehensive security audits on Azure Blob and ADLS storage accounts. It detects critical misconfigurations, including public access exposure, weak or long-lived SAS tokens, lack of encryption at rest, failure to enforce HTTPS, and outdated TLS versions. The output is a detailed, risk-scored report with remediation recommendations, essential for SOC analysts and security posture management.

This guide details methods and rules for detecting container escape attempts, a critical security vulnerability where an adversary breaks out of container isolation to access the host system or other containers. It covers monitoring syscalls, namespace manipulation (e.g., nsenter, unshare), accessing sensitive host paths (/proc), and detecting privileged operations using tools like Falco and eBPF.

This skill provides advanced runtime security rules using Falco, a CNCF-graduated tool. It monitors Linux syscalls to detect container escape attempts in real-time, identifying techniques such as mounting host filesystems, unauthorized namespace access (nsenter), and privileged container launches. It is crucial for SOC analysts and security teams enhancing cloud-native security coverage.

This skill provides comprehensive detection methods for credential dumping techniques, a critical post-exploitation phase in cyber attacks. It targets the extraction of sensitive credentials from LSASS memory, SAM registry hives, and NTDS.dit using advanced security visibility. Detection relies on analyzing Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and complex SIEM correlation rules, making it essential for SOC analysts and threat hunters investigating advanced persistent threats (APTs).

A comprehensive guide for security teams on detecting and responding to unauthorized crypto mining operations in cloud environments (AWS, Azure). It details a multi-layered approach, utilizing cost anomaly detection, compute utilization monitoring, GuardDuty findings, and network flow log analysis (VPC/KQL) to identify resource hijacking attempts and suspicious activity across EC2, ECS, and EKS workloads.

This skill guides the detection of Golden Ticket attacks within Active Directory by analyzing Kerberos logs (Event IDs 4768, 4769, 4771). It hunts for critical anomalies, such as mismatched encryption types (e.g., RC4 in AES environments), impossible ticket lifetimes, or service tickets appearing without a prior ticket grant request. This is essential for post-breach assessment and advanced threat hunting in domain environments.

A specialized Intrusion Detection System (IDS) designed for Operational Technology (OT) and Industrial Control Systems (ICS). It monitors Modbus TCP/RTU traffic to detect unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines. Essential for securing SCADA environments against attacks like FrostyGoop.

This comprehensive guide configures Fail2ban to implement a robust, layered defense mechanism for network security. It sets up custom filters and actions to automatically detect and mitigate threats such as port scanning, SSH brute force attempts, and network reconnaissance. By dynamically banning malicious IP addresses and providing security alerts, this skill significantly enhances the host-based intrusion prevention capabilities of your system.

This tool detects, inventories, and analyzes undocumented or abandoned API endpoints (Shadow APIs). By comparing live network traffic logs against official OpenAPI specifications, it helps security teams identify hidden attack vectors, gaps in API governance, and unmonitored entry points, significantly improving the security posture of complex systems.

A comprehensive guide and workflow for the post-containment phase of incident response. This process details systematic methods for mapping all persistence mechanisms, identifying malware artifacts, removing threats, resetting compromised credentials, and patching initial access vulnerabilities to ensure complete system eradication.

This skill guides the comprehensive evaluation and selection of Threat Intelligence Platforms (TIPs). It assesses vendor capabilities, including STIX/TAXII support, workflow automation, SIEM/SOAR integration, and total cost of ownership. It is essential for procurement decisions, migrating between TIP solutions, or assessing whether the current CTI program meets required maturity levels.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.