Skill UI

This comprehensive skill guides the deployment and utilization of MISP, a powerful open-source threat intelligence platform. It covers configuring various threat feeds (TAXII, CSV, etc.) and using the PyMISP Python API to programmatically automate the collection, storage, and correlation of Indicators of Compromise (IOCs) and threat events from diverse community and commercial sources.

A comprehensive guide for collecting volatile forensic evidence from a compromised host while adhering to the order of volatility. This process captures critical data—including memory dumps, network connections, running processes, and system state—before the host is isolated or powered down. Essential for root cause analysis, fileless malware investigation, and maintaining a defensible chain of custody for legal proceedings.

This skill simulates Pass-the-Ticket (PtT) attacks, a critical post-exploitation technique. It involves dumping active Kerberos tickets (TGT/TGS) from memory (LSASS) on a compromised host and injecting them into another session. This allows an attacker to impersonate the ticket owner and perform lateral movement or escalate privileges without needing the user's password. Use exclusively for authorized red-teaming and security auditing.

Guides SOC teams through validating alerts, isolating networks and endpoints, preserving evidence, and disabling compromised accounts to rapidly contain an active breach while minimizing business impact.

This skill correlates disparate security incidents, Indicators of Compromise (IOCs), and adversary behaviors across time and organizations. It systematically identifies unified threat campaigns, attributes them to common threat actors, and extracts shared indicators for significantly improved detection capabilities. Ideal for cross-organizational threat intelligence sharing and building comprehensive campaign reports.

Utilizes User and Entity Behavior Analytics (UEBA), statistical baselines, and machine learning models to monitor authentication logs. This skill identifies sophisticated security threats such as impossible travel, credential stuffing, brute force attacks, and compromised accounts in real-time. Essential for security operations and identity access management.

A specialized Python detector designed to monitor Operational Technology (OT) historian servers (such as OSIsoft PI, Ignition, etc.). It identifies critical indicators of compromise (IOCs), including unauthorized network connections, data manipulation attempts, and lateral movement activities that bridge IT and OT zones. Use this skill when validating data integrity and investigating potential cyber breaches in industrial environments.

This skill analyzes AWS CloudTrail logs to detect suspicious API call patterns, such as new event sources, geographic anomalies, or high-frequency usage. It establishes a statistical baseline of normal activity and flags deviations indicative of compromised credentials, privilege escalation, or insider threats, providing a detailed JSON report for security investigation and threat hunting.

Build automated pipelines to respond to AWS GuardDuty findings. This solution uses EventBridge to detect high-severity threats and triggers a Lambda function. The function automatically quarantines compromised resources (e.g., EC2 instances), creates forensic EBS snapshots, and sends detailed notifications via SNS, drastically reducing Mean Time To Respond (MTTR). Ideal for proactive cloud security posture management.

This skill provides comprehensive guidelines for detecting Business Email Compromise (BEC), a sophisticated fraud scheme. It covers detection techniques using email gateway rules, behavioral analytics, and robust financial process controls. Learn to identify red flags like unusual payment requests, domain mismatches, and patterns of social engineering to protect against financial loss.

This system deploys advanced AI, NLP, and behavioral analytics to detect sophisticated Business Email Compromise (BEC) attacks. Unlike traditional filters that rely on malicious links, this solution analyzes writing style, tone, grammatical patterns, and contextual anomalies to identify pure social engineering impersonation, providing a robust defense layer against advanced phishing and fraud.

A comprehensive guide for deploying and operationalizing Amazon GuardDuty. It provides continuous, intelligent threat detection across core AWS services including S3, EKS, and EC2 runtime monitoring. Use this skill to investigate suspicious activity, detect compromised credentials, or build automated incident response playbooks using EventBridge and Lambda for proactive security.