Skill UI

This skill generates a comprehensive, structured threat model for any given service or feature using the STRIDE framework. It guides users through identifying critical assets, defining trust boundaries, enumerating specific threats (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), assessing risk, and proposing concrete mitigation controls. Ideal for security design reviews and documentation.

This tool audits Kubernetes Role-Based Access Control (RBAC) configurations to systematically identify overly permissive roles, dangerous wildcards, and insecure ClusterRoleBindings. It helps pinpoint potential privilege escalation paths, service account abuses, and compliance gaps in EKS, GKE, and AKS clusters, ensuring adherence to the principle of least privilege.

This skill uses Python and boto3 to analyze AWS CloudTrail logs. It establishes statistical baselines of normal API activity and detects various anomalies, such as unusual event sources, first-time API usage, geographic IP deviations, and high-frequency calls. This is critical for identifying credential compromise, privilege escalation, and unauthorized resource access in a security incident.

This guide details how to configure Microsoft Entra Privileged Identity Management (PIM) to enforce Zero Trust principles. It converts standing, permanent privileged roles into eligible, time-bound assignments, requiring mandatory justification, MFA, and approval workflows before activation. Ideal for achieving strict role-assignment auditing and comprehensive identity governance in hybrid cloud environments.

A comprehensive guide to hardening AWS Identity and Access Management (IAM) configurations. This skill enforces least-privilege access by utilizing IAM Access Analyzer, setting permission boundaries, scoping policies, and managing credential rotation. It is crucial for reducing the blast radius of compromised accounts and passing compliance audits (e.g., SOC 2, PCI-DSS).

This guide outlines the comprehensive process of access recertification (or access review) using Saviynt Enterprise Identity Cloud. It details how to automate periodic validation of user entitlements to ensure adherence to the principle of least privilege. This function is critical for maintaining compliance with major standards such as SOX, SOC 2, and HIPAA. The process covers configuring various campaign types, managing the decision lifecycle (Approve/Revoke), and implementing remediation workflows.

This tool automates the OAuth 2.0 scope minimization review process. It identifies over-permissioned third-party application integrations, excessive API scopes, and risky OAuth consent patterns across identity providers. It is crucial for security audits, compliance (GDPR, SOC 2), and enforcing the least-privilege principle for cross-boundary data access.

Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which subjects can escalate toward cluster-admin. Use when reviewing who can escalate privileges in a cluster, hunting exploitable RoleBindings during an authorized review, or validating least privilege after an RBAC change.

Deploy and operate Falco with the modern eBPF driver in Kubernetes and Docker. Covers driver selection, Helm installation, output channels, and the built-in ruleset that detects container escape, namespace abuse, privileged mounts, and anomalous syscalls. Ideal for enabling runtime security, routing alerts to SIEM or Falcosidekick, and upgrading existing deployments.

A specialized, read-only tool designed for penetration testing and red teaming. It performs comprehensive enumeration across AWS and Azure, allowing users to build a deep situational awareness of an environment. Key functions include identifying internet-exposed endpoints, retrieving sensitive secrets, and mapping critical trust relationships (like sts:AssumeRole) necessary for planning lateral movement or privilege escalation.

Exploits privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during an authorized container-security assessment. Use when executing an approved breakout test, demonstrating the real impact of a privileged or hostPath workload, or validating that escape mitigations actually hold. Keywords: container breakout, privileged, hostPath, docker.sock, runC CVE-2019-5736, CVE-2024-21626, release_agent, nsenter. Do not use for defensive detection of these techniques - use detecting-container-escape-attempts.

A comprehensive red-teaming technique for Active Directory Certificate Services (AD CS). This skill utilizes the Certipy toolkit to enumerate and exploit various Certificate Service Configuration (ESC1-ESC16) misconfigurations over LDAP/RPC. It enables attackers to forge privileged certificates and perform PKINIT authentication, escalating a low-level domain foothold to Domain Admin or Domain Controller access during authorized penetration tests.