Skill UI

This tool deploys advanced machine learning techniques to detect anomalies within Operational Technology (OT) and Industrial Control Systems (ICS) environments. It establishes behavioral baselines by analyzing network traffic (Modbus, DNP3, OPC UA) and communication timing. Use cases include continuous monitoring, detecting zero-day deviations, and enhancing security monitoring platforms beyond standard signature-based intrusion detection.

This skill provides methods and tools for detecting sophisticated cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS). It focuses on detecting anomalies like unauthorized command injection, Man-in-the-Middle attacks on industrial protocols (Modbus, DNP3), and data manipulation, which traditional IT security tools often miss. Usage involves establishing deterministic communication baselines and monitoring network traffic for deviations.

This skill provides comprehensive guidelines for detecting Business Email Compromise (BEC), a sophisticated fraud scheme. It covers detection techniques using email gateway rules, behavioral analytics, and robust financial process controls. Learn to identify red flags like unusual payment requests, domain mismatches, and patterns of social engineering to protect against financial loss.

This tool detects critical anomalies in DNP3 communications used within SCADA and ICS environments. It employs deep packet inspection and machine learning to monitor for unauthorized control commands, protocol violations, firmware update attempts, and deviations from established network baselines. It is essential for securing critical infrastructure, such as energy grids and industrial control networks, and building robust anomaly-based Intrusion Detection Systems (IDS).

An advanced Intrusion Detection System (IDS) module designed for Operational Technology (OT) and ICS/SCADA environments. It monitors Modbus TCP/RTU traffic to detect unauthorized writes, anomalous function codes, malformed frames, and deviations from established communication baselines. Essential for investigating suspicious PLC register modifications and responding to industrial threats.

A comprehensive guide to detecting sophisticated rootkit activity and persistent threats that evade standard security tools (like Task Manager or EDR). Techniques include cross-view process analysis, identifying System Service Descriptor Table (SSDT) hooks, kernel module analysis, and network connection forensics using tools like Volatility. Use this when standard monitoring fails, and deep system integrity checks are required.

This skill detects advanced cyber-physical attacks mimicking the Stuxnet pattern. It monitors for unauthorized modifications to PLC logic and detects discrepancies between reported sensor readings and actual physical process behavior. Ideal for high-security OT/ICS environments when hunting for APT lateral movement or validating process integrity against sophisticated threats.

This tool leverages the Rekall memory forensics framework to conduct deep analysis of memory dumps. It is designed to detect sophisticated threats such as process hollowing, injected code via VAD anomalies, hidden operating system processes, and rootkit presence. It applies key forensic plugins (pslist, malfind, vadinfo) essential for rigorous incident response and malware analysis.

This skill detects sophisticated process injection techniques (MITRE T1055), including CreateRemoteThread and DLL injection. By analyzing Sysmon Event IDs 8 and 10 alongside EDR telemetry, it enables security analysts to hunt for in-memory code injection and defense evasion tactics used by adversaries on Windows endpoints. Essential for incident response and building detection coverage.

This skill automates the discovery of robotics research ideas by orchestrating a literature survey, idea generation, novelty check, and critical review workflow. It focuses on embodied AI, sim2real, and benchmark-grounded concepts for manipulation, locomotion, and navigation. The pipeline ensures ideas are feasible, falsifiable, and aligned with robotics constraints like simulation-first approaches and hardware availability.

A comprehensive guide detailing how to implement Microsoft Defender for Cloud across various workloads (VMs, containers, SQL, storage) to achieve continuous security monitoring and compliance assessment. This process utilizes Azure Policy, Log Analytics, and Azure Arc for holistic protection, enabling adaptive remediation and meeting stringent regulatory requirements like PCI-DSS and CIS standards.

This skill guides the deployment and configuration of the Dragos Platform for specialized Operational Technology (OT) and Industrial Control System (ICS) network monitoring. It leverages industrial protocol parsers and threat intelligence to detect sophisticated threats (e.g., VOLTZITE). It is essential for establishing OT Security Operations Centers (SOCs) or integrating dedicated ICS monitoring capabilities into enterprise SIEM solutions.