Skill UI

Leverage Certificate Transparency (CT) logs via crt.sh and Certstream to proactively monitor for suspicious SSL/TLS certificates. This skill helps detect lookalike domains, unauthorized certificate issuance, and potential phishing infrastructure targeting your organization before attacks launch. Includes querying logic and threat intelligence integration.

A powerful security tool for querying Certificate Transparency (CT) logs via crt.sh and pycrtsh. It detects potential security threats such as phishing domains, unauthorized certificate issuance, and shadow IT infrastructure. The tool specifically monitors new certificates for typosquatting and brand impersonation using advanced distance metrics, enabling proactive security threat detection.

This system deploys advanced AI, NLP, and behavioral analytics to detect sophisticated Business Email Compromise (BEC) attacks. Unlike traditional filters that rely on malicious links, this solution analyzes writing style, tone, grammatical patterns, and contextual anomalies to identify pure social engineering impersonation, providing a robust defense layer against advanced phishing and fraud.

A comprehensive guide on configuring advanced email security gateways (SEGs) to detect and block sophisticated, targeted spearphishing attacks. This skill covers essential detection layers, including impersonation protection, real-time URL detonation, attachment sandboxing, and creating custom behavioral rules. It is crucial for SOC analysts and security engineers building robust email threat defense systems.

This guide details a structured threat hunting methodology designed to proactively detect sophisticated spearphishing campaigns. It instructs users on correlating indicators across email logs, endpoint telemetry (EDR), and network data (SIEM) to identify targeted threats, supporting incident response and security posture improvement.

A comprehensive guide to implementing advanced security measures in Google Workspace. This covers enhanced pre-delivery scanning, anti-spoofing detection, attachment protection, and setting up Enhanced Safe Browsing to safeguard against sophisticated phishing and malware attacks within organizational emails. Ideal for security administrators and compliance teams.

A comprehensive guide to detecting and mitigating advanced Adversary-in-the-Middle (AiTM) phishing attacks, which bypass Multi-Factor Authentication (MFA) using reverse proxies (e.g., Evilginx, EvilProxy). Learn defensive strategies including implementing FIDO2, configuring Conditional Access policies, and monitoring session hijacking indicators in SIEM/Web Proxies.

This skill detects AI-generated deepfake audio used in voice phishing (vishing) attacks. It functions by extracting critical spectral features (including MFCCs, spectral centroid, and zero-crossing rate) and passing them through advanced machine learning models (like Random Forest and Gradient Boosting). The system supports batch forensic analysis, provides confidence scores, and generates detailed reports to verify the authenticity of recorded voice calls, making it essential for cybersecurity incident response and fraud investigation.

Covers comprehensive HTML injection attack scenarios, detection tips, and tooling so security testers can validate and document injection points, phishing overlays, and reflected or stored payloads during vulnerability assessments.

This playbook details the methodology for detecting and exploiting subdomain takeover vulnerabilities. It focuses on identifying CNAME/NS/MX records pointing to deprovisioned or unclaimed cloud resources (e.g., AWS S3 buckets, Heroku apps). Understanding these weaknesses allows attackers to serve malicious content under the victim's trusted domain, leading to phishing, credential theft, and security bypasses.

A comprehensive guide detailing detection and defense strategies against OAuth token theft, session hijacking, and token replay in Microsoft Entra ID (Azure AD). It covers advanced attacks like Primary Refresh Token (PRT) abuse and Adversary-in-the-Middle (AitM) phishing, and provides actionable steps for configuring Conditional Access and Token Protection policies.

Business Email Compromise (BEC) is a sophisticated social engineering fraud where attackers impersonate executives or vendors to trick employees into making unauthorized fund transfers or disclosing data. This skill provides comprehensive detection techniques by integrating email gateway rules, behavioral analytics, and mandatory financial process controls. It is essential for investigating suspected account compromises and building robust defenses against advanced phishing attacks.