Skill UI

Detects and prevents privilege escalation in Kubernetes pods by combining admission control, runtime monitoring, and audit log analysis. Covers security contexts, Linux capabilities, and syscall patterns. Use when investigating pods running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope.

This skill provides a structured method for analyzing Windows Security Event Logs (EVTX) to detect brute force attacks targeting RDP endpoints. It involves parsing failed logon events (Event ID 4625) and correlating them with successful logons (Event ID 4624), while also analyzing source IP frequency and NLA bypass attempts. Ideal for security incident investigation, blue-team threat hunting, and building SIEM detection rules.

A comprehensive guide on configuring advanced email security gateways (SEGs) to detect and block sophisticated, targeted spearphishing attacks. This skill covers essential detection layers, including impersonation protection, real-time URL detonation, attachment sandboxing, and creating custom behavioral rules. It is crucial for SOC analysts and security engineers building robust email threat defense systems.

A comprehensive guide and workflow for threat hunting suspicious PowerShell activity (T1059.001). This technique focuses on detecting advanced adversary techniques such as encoded commands, AMSI bypass, and download cradles using telemetry from EDR platforms (CrowdStrike, MDE), SIEMs (Splunk, Elastic), and Sysmon. Essential for proactive threat detection, incident response, and security assessment.

A comprehensive guide and set of detection rules for identifying OS credential dumping techniques (MITRE T1003). It leverages EDR telemetry, Sysmon process access monitoring, and Windows security event correlation to detect attacks targeting LSASS memory, SAM databases, and NTDS.dit files. Essential for proactive threat hunting and incident response.

Execute deep, stealthy red team exercises that emulate real-world sophisticated adversaries. This process maps attacks to the MITRE ATT&CK framework, testing an organization's entire security posture—including detection, incident response, and containment capabilities (Blue Team). It is designed for simulating full attack lifecycles (initial access, lateral movement, exfiltration) to validate security investments and meet regulatory requirements (TIBER-EU, CBEST). Requires executive authorization and defined Rules of Engagement.

This skill guides the detection and exploitation of JavaScript prototype pollution vulnerabilities. It covers both client-side (DOM XSS) and server-side (RCE, Auth Bypass) attacks by injecting properties into Object.prototype using keys like `__proto__`. Use this when assessing APIs that deep-merge or clone user-controlled JSON data, or for general web application security testing.

Detects data-staging activity (MITRE ATT&CK T1074) by analyzing EDR/Sysmon process-creation and file-system telemetry. This skill monitors for archive creation (7-Zip, RAR, tar), unusual file consolidation from multiple directories, and suspicious activity in temporary or hidden paths. It is essential for threat hunting, building robust detection rules, and validating security monitoring coverage against data exfiltration attempts.

This guide provides a systematic methodology for proactive threat hunting targeting Living-off-the-Land Binaries (LOLBins). Attackers misuse legitimate, signed system binaries (like certutil or rundll32) to execute malicious payloads or download files, effectively bypassing traditional security controls and application allowlisting. Use this framework when establishing EDR/SIEM detection rules or when investigating advanced, fileless defense-evasion techniques.

This advanced skill guides users on hunting for Living Off the Land Binaries (LOLBins) abuse by analyzing endpoint process creation logs. It focuses on detecting malicious use of legitimate Windows binaries (like certutil or mshta) for defense evasion or data exfiltration, mapping techniques to MITRE T1218. Ideal for threat hunters and security teams building advanced detection rules.

This comprehensive guide outlines a structured methodology for threat hunting and incident response, focusing on identifying adversary persistence mechanisms across Windows endpoints. It covers critical areas such as Registry Run/RunOnce keys, services, scheduled tasks, WMI event subscriptions, and COM hijacking. Use this workflow to proactively detect unauthorized backdoors, strengthen detection rules, and assess overall security posture against MITRE ATT&CK techniques (T1547).

This skill detects sophisticated process injection techniques (MITRE T1055), including CreateRemoteThread and DLL injection. By analyzing Sysmon Event IDs 8 and 10 alongside EDR telemetry, it enables security analysts to hunt for in-memory code injection and defense evasion tactics used by adversaries on Windows endpoints. Essential for incident response and building detection coverage.