Skill UI

This skill analyzes Active Directory (AD) Access Control Lists (ACLs) to detect dangerous misconfigurations. It uses the ldap3 Python library to query domain controllers, parse security descriptors (SDDL), and identify instances where non-privileged users or groups are granted dangerous permissions like GenericAll, WriteDACL, or WriteOwner on sensitive objects. Essential for security incident response and privilege escalation path discovery.

This tool parses Kubernetes API server audit logs (JSON lines) to detect critical security events. It specifically targets unauthorized access, secret enumeration, RBAC escalation, privileged pod creation, and shell access (exec/attach). Use it for incident response, threat hunting, or building SIEM detection rules.

This guide details the implementation of Microsoft's Enhanced Security Admin Environment (ESAE) tiered model for Active Directory. It covers best practices for establishing Tier 0/1/2 separation, deploying Privileged Access Workstations (PAWs), and designing robust access control policies. Ideal for security architects and compliance officers seeking to meet stringent standards like NIST 800-53.

This guide details methods and rules for detecting container escape attempts, a critical security vulnerability where an adversary breaks out of container isolation to access the host system or other containers. It covers monitoring syscalls, namespace manipulation (e.g., nsenter, unshare), accessing sensitive host paths (/proc), and detecting privileged operations using tools like Falco and eBPF.

This skill provides advanced runtime security rules using Falco, a CNCF-graduated tool. It monitors Linux syscalls to detect container escape attempts in real-time, identifying techniques such as mounting host filesystems, unauthorized namespace access (nsenter), and privileged container launches. It is crucial for SOC analysts and security teams enhancing cloud-native security coverage.

This skill automates the process of testing for Broken Function Level Authorization (BFLA) vulnerabilities in APIs. It simulates attempts by low-privilege users to access or execute administrative functions and privileged endpoints by manipulating HTTP methods, paths, and credentials. It is essential for comprehensive API security audits and validating Role-Based Access Control (RBAC) enforcement.

This guide details the implementation of Microsoft Entra Privileged Identity Management (PIM), enforcing Just-in-Time (JIT) role activation, mandatory approval workflows, and periodic access reviews for critical Azure AD and resource roles. It aligns with Zero Trust principles by eliminating standing privileges.

This comprehensive guide details the end-to-end deployment of Delinea Secret Server for robust Privileged Access Management (PAM). It provides scripts and steps for configuring the vault infrastructure, defining secret templates, and automating the discovery of privileged credentials across hybrid environments. Essential for organizations needing centralized, compliant, and automatically rotated management of shared and service accounts.

This skill details the deployment of Privileged Access Management (PAM) for critical database systems, including Oracle, SQL Server, PostgreSQL, and MySQL. It covers essential security controls such as session proxy configuration, credential vaulting, query auditing, and enforcing least-privilege access, helping organizations meet stringent compliance and security standards.

This comprehensive guide details the deployment of Privileged Access Management (PAM) using CyberArk. Learn how to secure the enterprise by discovering, vaulting, rotating, and monitoring highly privileged credentials. The process covers vault architecture design, policy configuration, session isolation via PSM, and integration with SIEM systems, ensuring adherence to strict compliance standards like NIST 800-53.

This skill provides a comprehensive guide for designing and deploying Privileged Access Workstations (PAWs). It covers critical security controls such as device hardening, Zero Trust principles, and integrating Just-in-Time (JIT) access management. Learn how to enforce compliance using tools like Intune/GPO and secure credentials using leading PAM platforms like CyberArk or BeyondTrust, ensuring secure administrative operations.

Configure Azure AD Privileged Identity Management via Microsoft Graph API to enumerate eligible and active assignments, request just-in-time activations, audit logs, and enforce MFA or approval policies for zero-trust privileged access scenarios.