Skill UI

This guide teaches security teams how to proactively detect and respond to unauthorized cryptocurrency mining operations across major cloud platforms (AWS, Azure). It utilizes a multi-layered approach by analyzing compute cost anomalies, monitoring GuardDuty findings, inspecting network traffic to known mining pools, and analyzing runtime process execution in EC2, ECS, and EKS environments.

This skill provides a comprehensive solution for monitoring brand impersonation attacks across multiple digital vectors. It systematically scans domains, social media platforms, mobile app stores, and the dark web to detect phishing campaigns, typosquatting, and unauthorized brand usage. It is essential for security teams conducting proactive threat intelligence gathering and vulnerability assessments to safeguard brand integrity.

This skill details the process of building and maintaining a comprehensive anti-phishing training program. It covers establishing baseline susceptibility assessments, deploying regular, progressive simulations, and providing interactive, role-based learning modules (using platforms like KnowBe4 or Proofpoint). The focus is on measuring and improving the human layer of defense against social engineering and sophisticated phishing attempts, thereby fostering a continuous security culture.

Stratus Red Team is an open-source tool designed for detection engineering and purple teaming. It programmatically detonates granular, documented offensive techniques across major cloud platforms (AWS, Azure, GCP, and Kubernetes). It validates existing security detections (like CloudTrail/GuardDuty) by simulating real attacker activity in a controlled, reversible environment. The tool ensures deterministic lifecycles, guaranteeing that all created resources are cleaned up after testing.

A comprehensive guide for threat hunting and detection engineering focused on identifying SSO and OAuth token abuse. It detects 'pass-the-cookie' and session replay attacks where attackers use stolen tokens (like cookies or refresh tokens) to move laterally across federated SaaS platforms (Entra ID, Okta) without needing credentials. Essential for post-incident scope analysis and validating T1550.001 coverage.