Skill UI

A specialized tool and workflow for investigating supply chain attacks. It helps security analysts analyze compromised software updates, trojanized binaries, and dependency artifacts by comparing legitimate versions against suspect files. Key functions include binary diffing, identifying injected code, and documenting code signing anomalies to determine the scope of a security breach.

This tool helps security analysts map Advanced Persistent Threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework. By utilizing the ATT&CK Navigator and the attackcti Python library, users can query STIX/TAXII data to visualize threat profiles, assess detection coverage gaps, and guide defensive planning for complex cyber incidents.

A comprehensive toolkit using Splunk's SPL language to analyze Windows Security, System, and Sysmon event logs. It maps advanced detection queries to specific MITRE ATT&CK techniques, enabling SOC analysts to investigate authentication attacks (e.g., brute force, password spraying), detect privilege escalation, locate persistence mechanisms, and trace lateral movement for detailed forensic timeline analysis.

This comprehensive forensic workflow guides investigators through the extraction and detailed analysis of Windows Registry hives (SAM, SYSTEM, SOFTWARE, etc.). It is used during incident response to uncover critical artifacts, including user activity history, malware persistence mechanisms (autorun keys), installed software records, and evidence of system compromise.

This guide provides a comprehensive methodology for conducting cloud security audits across major platforms (AWS, Azure, GCP) using industry-standard CIS Benchmarks. It covers selecting appropriate benchmark versions, running automated assessments using tools like Prowler and ScoutSuite, interpreting complex compliance results, and prioritizing systematic remediation steps to achieve and maintain continuous compliance (e.g., SOC 2, ISO 27001).

This skill facilitates autonomous, multi-round research review and refinement. It continuously submits work for assessment via external reviewers (Codex or manual), implements suggested fixes, and re-reviews until the designated positive threshold is met or the maximum number of rounds is reached. It manages state persistence and adjusts difficulty levels for rigorous, iterative quality assurance.

This advanced skill automates the rigorous, iterative review and refinement of complex research topics or papers. It runs multi-round cycles, using an external LLM (MiniMax API) to provide continuous, constructive feedback. The process guides the user through review, fixes, and re-review stages until a positive assessment is achieved or the maximum round limit is reached. It includes robust state persistence for long-running academic workflows.

This skill automates the process of parsing Cyber Threat Intelligence (CTI) reports to extract adversary behaviors. It maps these behaviors to MITRE ATT&CK techniques and structures them as STIX 2.1 Attack Pattern objects. The resulting library supports detection engineering by generating rule templates (Sigma, YARA) for proactive defense and threat-informed security control implementation.

This skill provides a comprehensive workflow for building vendor-agnostic detection rules using the Sigma format. It empowers security operations center (SOC) engineers to translate raw threat intelligence and MITRE ATT&CK techniques into standardized, portable detection logic. The process guides users through rule validation and conversion into specific queries for major SIEM platforms, including Splunk, Elastic, and Microsoft Sentinel, ensuring robust detection coverage.

This skill details the advanced technique of DCSync, which exploits the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller. It is primarily used in authorized red-teaming and penetration testing to dump sensitive credentials, extract the KRBTGT hash, and ultimately forge Golden Tickets, establishing deep domain persistence. Ideal for security auditors and offensive security professionals.

This comprehensive guide outlines how to plan and execute a full-scope red team engagement. It simulates real-world Advanced Persistent Threat (APT) behavior, covering the entire cyber kill chain from initial reconnaissance (OSINT) through lateral movement, credential harvesting, and data exfiltration. It utilizes MITRE ATT&CK frameworks to rigorously test an organization's detection, prevention, and incident response capabilities.

This skill uses the Python azure-mgmt-storage SDK to perform comprehensive security audits on Azure Blob and ADLS storage accounts. It detects critical misconfigurations, including public access exposure, weak or long-lived SAS tokens, lack of encryption at rest, failure to enforce HTTPS, and outdated TLS versions. The output is a detailed, risk-scored report with remediation recommendations, essential for SOC analysts and security posture management.