Skill UI

This guide details how to hunt for DCSync attacks (MITRE ATT&CK T1003.006) in Active Directory environments. It focuses on analyzing Windows Security Event ID 4662, specifically looking for DS-Replication-Get-Changes requests originating from non-domain-controller accounts. This technique is critical for incident response, purple teaming, and detecting unauthorized credential theft via Active Directory replication abuse.

This platform deploys continuous attack graph analysis to map how adversaries can chain together various exposures—including vulnerabilities, misconfigurations, identity risks, and credential weaknesses—toward critical business assets. It pinpoints 'choke points,' allowing security teams to prioritize remediation efforts for maximum risk reduction with minimal effort, ideal for CTEM programs.

This skill automates the process of vulnerability prioritization by querying the FIRST Exploit Prediction Scoring System (EPSS) API. It calculates the real-world probability of a CVE being exploited within 30 days, providing a crucial risk metric that surpasses traditional CVSS severity scoring. Use it for risk-based vulnerability management, allowing security teams to efficiently triage and remediate the most actively threatened vulnerabilities first.

A Python-powered engine implementing structured OT incident response procedures based on the SANS PICERL lifecycle. It classifies incident severity (safety, process, access, recon) and coordinates cross-functional teams (IT SOC, OT Engineering, Operations) to manage critical threats like ransomware in ICS/SCADA environments. Essential for establishing robust safety protocols and ensuring compliance with IEC 62443 and NERC CIP standards.

This skill guides security teams on systematically tuning SIEM detection rules in platforms like Splunk and Elastic. It focuses on reducing alert fatigue and false positives by analyzing historical alert volumes, establishing environmental baselines, creating context-aware whitelists, and measuring detection efficacy using metrics like precision and recall. This is crucial for maturing a Security Operations Center (SOC).

This skill guides the implementation of Security Orchestration, Automation, and Response (SOAR) workflows using platforms like Splunk Phantom. It automates the entire incident lifecycle, including alert triage, IOC enrichment (via VirusTotal, CrowdStrike), containment actions, and ticket creation (ServiceNow). Ideal for SOC teams needing to reduce Mean Time To Respond (MTTR) and standardize complex security procedures across multiple tools.

This skill guides Security Operations Center (SOC) teams through structured threat modeling using the MITRE ATT&CK framework. It enables mapping adversary Tactics, Techniques, and Procedures (TTPs) against organizational assets to identify critical detection coverage gaps, prioritize defensive investments, and improve overall security posture. Ideal for risk assessment, purple teaming, and compliance planning.

This skill provides SOC teams with a structured, multi-source workflow to investigate potential insider threats. It correlates data from SIEM, DLP, EDR, and HR feeds to detect data exfiltration attempts (via cloud, USB, email), unauthorized access patterns, and policy violations. It is crucial for building comprehensive investigation timelines, especially when handling departing employees or suspected data theft.

This skill monitors dark web forums, ransomware leak sites, and paste sites for early warning intelligence. It tracks organizational assets, leaked credentials, and threat actor communications to enrich incident response and establish proactive monitoring coverage. Essential for cybersecurity teams performing deep OSINT investigations.

This guide details the process of performing Active Directory reconnaissance using BloodHound and SharpHound. It leverages graph theory to visualize hidden trust relationships, group memberships, and ACLs, mapping the shortest attack paths from a low-privilege compromised user all the way to Domain Admin rights. This is essential for red-teaming, security auditing, and identifying critical misconfigurations.

This skill utilizes Impacket to perform comprehensive audits and simulated attacks on Active Directory forest trust relationships. It enumerates trust boundaries, analyzes SID filtering configurations, detects SID history abuse vectors, and assesses inter-realm Kerberos ticket risks. Ideal for red-teaming multi-forest environments or performing deep security audits to find cross-forest privilege escalation paths.

A comprehensive guide for authorized red-team assessments using the Pacu framework. This process details how to enumerate IAM policies, scan for privilege escalation paths, test data access across services (S3, DynamoDB), and simulate lateral movement to determine the blast radius of compromised AWS credentials.