Skill UI

This skill provides methods and tools for detecting sophisticated cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS). It focuses on detecting anomalies like unauthorized command injection, Man-in-the-Middle attacks on industrial protocols (Modbus, DNP3), and data manipulation, which traditional IT security tools often miss. Usage involves establishing deterministic communication baselines and monitoring network traffic for deviations.

This guide details comprehensive detection methods for DCSync attacks (MITRE T1003.006) in Active Directory. Attackers abuse legitimate directory replication protocols to extract sensitive password hashes. Detection relies on auditing Windows Event ID 4662 for unauthorized access attempts to critical Directory Service GUIDs, specifically flagging non-domain-controller accounts attempting replication calls. Essential for threat hunting and incident response.

Details techniques for exploiting misconfigured Kerberos Constrained Delegation (KCD) in Active Directory. By abusing the S4U2Self and S4U2Proxy protocols, attackers can impersonate highly privileged users (e.g., Domain Admins) to achieve lateral movement or full domain compromise during authorized red-team engagements.

This guide details the implementation of the three core email authentication protocols: SPF, DKIM, and DMARC. By configuring these DNS records, users can prevent domain spoofing, ensure message integrity, and define strict policies (quarantine/reject) for unauthenticated emails, drastically reducing exposure to phishing and spoofing attacks.

This comprehensive guide details the deployment and configuration of Tofino industrial firewalls to secure critical SCADA and PLC systems. It utilizes Deep Packet Inspection (DPI) capabilities for core OT protocols (Modbus, EtherNet/IP, S7comm), ensuring strict access control and enforcing IEC 62443 zone boundaries. Ideal for segmenting control networks and providing compensating controls for unpatchable legacy equipment.

A Python-powered engine implementing structured OT incident response procedures based on the SANS PICERL lifecycle. It classifies incident severity (safety, process, access, recon) and coordinates cross-functional teams (IT SOC, OT Engineering, Operations) to manage critical threats like ransomware in ICS/SCADA environments. Essential for establishing robust safety protocols and ensuring compliance with IEC 62443 and NERC CIP standards.

This comprehensive guide provides essential security protocols for building robust Laravel applications. It covers best practices for authentication (Sanctum, Passport), authorization (Policies), input validation, and protecting against common vulnerabilities like CSRF, XSS, and SQL injection. Key topics include secure file uploads, rate limiting, environment variable management, and implementing robust middleware.

This skill covers performing comprehensive vulnerability assessments across diverse environments, including on-premises infrastructure, cloud VMs, and container registries. It leverages standard network protocols like SSH (Linux) and WMI (Windows), coupled with advanced cloud provider APIs for analyzing disk snapshots without requiring local endpoint agents. Ideal for security auditing and compliance checks.

This skill provides a systematic cryptographic audit tool designed to review applications for security vulnerabilities. It scans source code and configuration files to detect weak hashing algorithms (MD5, SHA-1), insecure cipher modes (ECB), hardcoded secrets, and deprecated protocols like TLS 1.0. Essential for security assessments, compliance checks, and maintaining secure coding practices.

This tool provides comprehensive security assessments for the entire IoT ecosystem, including physical hardware, embedded firmware, network communications, and cloud APIs. Testers can perform deep dives using hardware debugging (UART/JTAG), firmware extraction and reverse engineering, analyzing protocols (MQTT, CoAP, BLE), and simulating cloud-to-device attacks to identify vulnerabilities across all layers of the smart device stack.

Conduct comprehensive security assessments for Operational Technology (OT) networks, including SCADA and DCS systems. This skill maps industrial protocols (Modbus, DNP3, OPC UA) and analyzes traffic against the Purdue Model. It is crucial for identifying IT/OT convergence risks, detecting misconfigurations, and ensuring compliance with standards like IEC 62443.

This guide facilitates comprehensive tabletop exercises simulating major ransomware incidents. It systematically tests an organization's preparedness, decision-making processes, and communication protocols across executive, legal, PR, and technical teams. Scenarios cover double extortion, regulatory compliance (GDPR, HIPAA), and varying backup compromise levels, helping organizations identify critical gaps before a real-world attack.