Skill UI

This skill covers the complete lifecycle for establishing, implementing, and maintaining an Information Security Management System (ISMS) based on ISO/IEC 27001:2022. Users learn the full process, from initial gap analysis and risk assessment (including defining risk treatment plans) to selecting Annex A controls, developing the Statement of Applicability (SoA), conducting internal audits, and preparing for final certification. It is essential for organizations needing to achieve formal security compliance and robust governance.

This guide details the systematic workflow for patch management, covering the entire lifecycle from vulnerability discovery and risk assessment to controlled testing, multi-phased deployment, and final verification. Learn how to integrate tools like WSUS, SCCM, and Ansible into a robust, automated process to significantly reduce the attack surface and ensure compliance across enterprise IT infrastructure.

This skill guides Security Operations Center (SOC) teams through structured threat modeling using the MITRE ATT&CK framework. It enables mapping adversary Tactics, Techniques, and Procedures (TTPs) against organizational assets to identify critical detection coverage gaps, prioritize defensive investments, and improve overall security posture. Ideal for risk assessment, purple teaming, and compliance planning.

This guide details the methodology and tools for conducting authorized privilege escalation assessments within AWS environments. It systematically utilizes specialized tools like Pacu and Principal Mapper (PMapper) to identify critical IAM misconfigurations, excessive permissions, and weak cross-account trust relationships. It is essential for validating the principle of least privilege and assessing the potential blast radius of compromised credentials during authorized penetration testing.

A comprehensive guide and workflow for performing authorized penetration testing on AWS environments using the open-source Pacu framework. This skill covers enumerating IAM configurations, identifying privilege escalation paths, testing credential harvesting, and validating security controls across S3, EC2, Lambda, and Secrets Manager. It is designed for red team exercises and risk assessment when auditing cloud infrastructure security.

A comprehensive guide for performing authorized security assessments on GraphQL APIs. This skill covers key areas such as endpoint discovery, schema introspection, testing for authorization flaws (BOLA/BFLA), injection vulnerabilities (SQL/NoSQL), and denial-of-service risks. Essential for penetration testers and bug bounty researchers targeting modern web applications.

This skill utilizes the Shodan API to perform comprehensive IP reputation analysis. It enriches IP addresses by identifying open ports, running services, known vulnerabilities (CVEs), and hosting context. It is crucial for threat intelligence enrichment, incident triage, and security assessments, helping security professionals assess the risk level and potential compromise of exposed infrastructure.

Conduct comprehensive security assessments for Operational Technology (OT) networks, including SCADA and DCS systems. This skill maps industrial protocols (Modbus, DNP3, OPC UA) and analyzes traffic against the Purdue Model. It is crucial for identifying IT/OT convergence risks, detecting misconfigurations, and ensuring compliance with standards like IEC 62443.

This skill details how to conduct comprehensive Operational Technology (OT) vulnerability assessments using platforms like Claroty xDome. It covers passive asset discovery, correlating vulnerabilities against CISA/ICS-CERT advisories, calculating risk scores, and prioritizing remediation based on operational impact and compliance standards (e.g., IEC 62443, NERC CIP). The provided workflow uses Python to manage asset inventory and vulnerability matching for highly regulated industrial environments.

This tool orchestrates safe vulnerability assessments for Operational Technology (OT) and Industrial Control Systems (ICS) environments. It prioritizes safety by guiding users through passive monitoring, native protocol querying, and carefully controlled active scanning methods, specifically designed to identify vulnerabilities without risk of disrupting industrial processes or crashing legacy controllers. Essential for compliance audits (e.g., IEC 62443).

This skill provides comprehensive cybersecurity assessments for critical electric power infrastructure, covering EMS, SCADA, and substation automation systems. It is crucial for verifying NERC CIP compliance, analyzing IEC 61850 protocols, and securing synchrophasor (PMU) networks against advanced threats like Industroyer. Use it for regulatory audits and operational security reviews.

A comprehensive skill for auditing service accounts across complex enterprise environments, including Active Directory, major cloud platforms (AWS, Azure, GCP), and databases. It identifies risks such as orphaned accounts, over-privileged access, and non-compliant credentials, ensuring adherence to industry standards like SOX, PCI DSS, and HIPAA. Used during security assessments and compliance reviews.