Skill UI

A specialized tool and workflow for investigating supply chain attacks. It helps security analysts analyze compromised software updates, trojanized binaries, and dependency artifacts by comparing legitimate versions against suspect files. Key functions include binary diffing, identifying injected code, and documenting code signing anomalies to determine the scope of a security breach.

This skill provides a systematic methodology for mapping real-world threat actor Tactics, Techniques, and Procedures (TTPs) to the globally recognized MITRE ATT&CK framework. Users learn how to leverage tools like ATT&CK Navigator and Python libraries (e.g., attackcti, stix2) to analyze security incidents, visualize technical coverage heatmaps, identify critical detection gaps, and generate actionable intelligence reports linking observed Indicators of Compromise (IOCs) to specific adversary techniques across various platforms (Enterprise, Mobile, ICS).

This tool helps security analysts map Advanced Persistent Threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework. By utilizing the ATT&CK Navigator and the attackcti Python library, users can query STIX/TAXII data to visualize threat profiles, assess detection coverage gaps, and guide defensive planning for complex cyber incidents.

This tool provides comprehensive analysis of the cybersecurity threat landscape using the Malware Information Sharing Platform (MISP). It allows users to query event statistics, analyze attribute distributions (IPs, domains, hashes), identify top threat actors and malware families, and track temporal trends. It is essential for SOC analysts performing incident response, threat hunting, and building advanced detection rules.

A powerful security tool for querying Certificate Transparency (CT) logs via crt.sh and pycrtsh. It detects potential security threats such as phishing domains, unauthorized certificate issuance, and shadow IT infrastructure. The tool specifically monitors new certificates for typosquatting and brand impersonation using advanced distance metrics, enabling proactive security threat detection.

This powerful tool leverages DNSTwist, a comprehensive domain permutation engine, to detect various forms of domain impersonation. It generates thousands of potential lookalike domains (including typosquatting, attribute flaws, and homographs) and performs deep checks on DNS records, web page similarity (ssdeep/pHash), and registration status. It is vital for security analysts and threat hunters to proactively monitor for brand squatting and sophisticated phishing threats targeting an organization.

This tool provides a comprehensive framework for analyzing web server logs (Apache/Nginx) to detect various security threats. It uses advanced regex matching against OWASP attack signatures to identify SQL injection, Local File Inclusion, and Directory Traversal attempts, alongside behavioral analysis for brute-force attacks and web scanner fingerprints. The system also enriches data using GeoIP for source attribution, generating a prioritized report for SOC analysts.

A comprehensive toolkit using Splunk's SPL language to analyze Windows Security, System, and Sysmon event logs. It maps advanced detection queries to specific MITRE ATT&CK techniques, enabling SOC analysts to investigate authentication attacks (e.g., brute force, password spraying), detect privilege escalation, locate persistence mechanisms, and trace lateral movement for detailed forensic timeline analysis.

This skill provides a method to parse Windows Prefetch files (.pf) using Python, allowing security analysts to reconstruct detailed application execution histories. It is crucial for incident response, enabling the detection of renamed binaries, identifying suspicious execution patterns, and building accurate chronological timelines of system activity for deep forensic investigation.

A comprehensive guide and set of scripts to systematically audit AWS S3 buckets for security misconfigurations. This tool identifies publicly exposed data, overly permissive ACLs, inadequate bucket policies, and missing encryption settings, ensuring adherence to least-privilege principles and compliance frameworks like SOC 2 or HIPAA.

This script provides a comprehensive security assessment of Microsoft Entra ID (Azure AD) identity configurations. It audits for risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using PowerShell and Graph API. Ideal for compliance audits, security posture review, and post-merger security assessments.

This guide provides a comprehensive methodology for conducting cloud security audits across major platforms (AWS, Azure, GCP) using industry-standard CIS Benchmarks. It covers selecting appropriate benchmark versions, running automated assessments using tools like Prowler and ScoutSuite, interpreting complex compliance results, and prioritizing systematic remediation steps to achieve and maintain continuous compliance (e.g., SOC 2, ISO 27001).