Skill UI

A comprehensive threat hunting methodology designed to detect adversary persistence and execution mechanisms utilizing Windows Scheduled Tasks (T1053.005). This guide covers analyzing task creation events (Event ID 4698), suspicious properties, unusual triggers, and correlating activity with process execution logs (Sysmon). Ideal for incident responders and security analysts conducting proactive threat hunting on compromised endpoints.

A specialized threat hunting skill that analyzes System event logs (Event ID 7045) to detect suspicious Windows service installations. It parses service binary paths, identifies indicators of persistence mechanisms, and maps findings to MITRE ATT&CK techniques (T1543.003), helping security analysts uncover covert persistence methods.

This skill guides the implementation of File Integrity Monitoring (FIM) using AIDE (Advanced Intrusion Detection Environment). It covers setting up AIDE configurations, creating initial baselines, performing scheduled integrity checks, and parsing detailed change reports. This is essential for maintaining strong security controls, meeting compliance requirements, and detecting unauthorized system modifications on Linux environments.

Automate the deployment of osquery scheduled queries to continuously monitor endpoints, covering process inventory, network listeners, file integrity, and persistence mechanisms; generate osquery.conf, configure differential logging, analyze suspicious results, and produce a security report.

This guide details how to implement advanced SIEM correlation rules to detect sophisticated Advanced Persistent Threats (APTs). By chaining multiple event types—including Windows authentication events, process execution telemetry, and network connection logs—across hosts, users can surface complex attack sequences that are invisible to single-event detections. It utilizes Splunk SPL and Sigma rule formats for robust security posture enhancement.

This skill provides a comprehensive guide to integrating STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information). It covers using Python to consume and produce cyber threat intelligence feeds, including server discovery, object fetching, and parsing of STIX 2.1 objects for integration into SIEM and TIP platforms.

Automate comprehensive vulnerability management by deploying and operating Greenbone/OpenVAS. This skill guides the use of the python-gvm library to programmatically manage the entire scanning lifecycle: creating scan targets, executing complex vulnerability scans via the Greenbone Management Protocol (GMP), monitoring progress, and parsing detailed XML reports into actionable JSON findings. Ideal for security assessments and compliance checks.

A comprehensive guide to deploying Zero Standing Privilege (ZSP) using CyberArk Secure Cloud Access. This solution eliminates persistent privileged access by provisioning ephemeral, Just-in-Time (JIT) credentials across hybrid and multi-cloud environments (AWS, Azure, GCP). Access is strictly governed by the TEA framework: Time limits, scoped Entitlements, and mandatory Approvals, ensuring the principle of least privilege is maintained.

A comprehensive guide for mastering version control using GitHub and Git. It provides two modes: Guided Setup for first-time users, and an adaptive, hands-on curriculum for learning advanced concepts like branching, PR workflows, and CI/CD. The system automatically adjusts language and depth based on the user's skill level, ensuring effective, real-world learning.

This comprehensive guide details the methodology for detecting and exploiting Blind Server-Side Request Forgery (SSRF) vulnerabilities. It covers crucial techniques including out-of-band (OOB) detection, internal network enumeration (port scanning, IP scanning), accessing cloud metadata endpoints (AWS, GCP, Azure), and bypassing common security filters using various encoding and parsing confusion methods. Ideal for penetration testing and cloud security assessments.

This tool performs comprehensive security testing on GraphQL APIs by generating deeply nested, recursive, or highly repetitive queries. It specifically aims to identify Denial-of-Service (DoS) vulnerabilities and resource exhaustion issues by overwhelming the server's CPU, memory, or database connections. Essential for security auditors and penetration testers.

A comprehensive guide for cybersecurity professionals detailing the process of collecting, parsing, and correlating system, application, and security logs (Windows EVTX, Linux syslog, web logs). It helps reconstruct event timelines, identify breach activity, and establish evidence for forensic reports.