Skill UI

This skill guides developers through integrating Static Application Security Testing (SAST) tools like CodeQL and Semgrep into GitHub Actions CI/CD pipelines. It covers automating code scanning on pull requests and pushes, tuning rules to reduce false positives, uploading SARIF results, and establishing quality gates to prevent vulnerable code from merging into production.

This skill maps observed adversary behaviors, security alerts, and detection rules to the MITRE ATT&CK framework. It is essential for quantifying detection coverage, building ATT&CK heatmaps, tagging SIEM alerts, and prioritizing security controls based on known threat actor playbooks. Use it for comprehensive gap analysis and risk reporting.

This skill guides users on performing deep runtime threat detection and forensics in cloud-native environments using Falco. It leverages Falco YAML rules to monitor syscalls, detecting critical security events such as shell spawning, file tampering (e.g., /etc/shadow), network anomalies, and privilege escalation within containers and Kubernetes clusters. Ideal for incident response, security auditing, and validating container runtime security controls.

Perform comprehensive security assessments for Google Cloud Platform environments. This tool audits critical security components—including IAM policies, firewall rules, and storage permissions—against industry benchmarks like the CIS GCP Foundations Benchmark. It helps organizations establish secure baselines and ensure continuous compliance across multiple GCP projects.

This guide details advanced hash cracking techniques using Hashcat, the world's fastest password recovery tool. It covers various attack modes—including dictionary, brute-force, and rule-based attacks—and supports numerous common hash types (e.g., NTLM, bcrypt). This skill is strictly designed for authorized security assessments and penetration testing to evaluate the strength and resilience of organizational password policies.

This comprehensive skill guides the process of rapid malware triage and classification using YARA rules. It covers advanced techniques for writing detection rules based on unique strings, specific byte sequences, and structural PE characteristics. It is essential for security analysts building automated detection pipelines, scanning endpoints, or performing large-scale threat hunting across an enterprise environment.

This skill demonstrates how to craft and inject custom, malformed, or spoofed network packets using tools like Scapy and hping3. It is designed for authorized cybersecurity assessments to rigorously test firewall rules, Intrusion Detection/Prevention Systems (IDS/IPS) signatures, anti-spoofing controls, and overall network stack resilience against protocol anomalies and fragmentation attacks. Use only in controlled, authorized environments.

This skill covers advanced techniques used in red teaming and penetration testing to elevate privileges from a low-level user to root access on a compromised Linux system. It details how to enumerate and exploit various vectors, including SUID/SGID binaries, misconfigured sudo rules, kernel vulnerabilities (e.g., Dirty Pipe), Cron job abuse, and abusing system services. Essential for comprehensive security assessments.

This skill guides the execution of structured purple team exercises, simulating real-world adversary techniques (Red Team) and validating the effectiveness of existing detection rules and controls (Blue Team). It is essential for Security Operations Center (SOC) teams to identify critical detection gaps, optimize analyst response playbooks, and enhance the overall security posture against specific threat actors mapped to MITRE ATT&CK techniques.

This framework executes sophisticated threat emulation tests using Atomic Red Team, mapping directly to MITRE ATT&CK techniques. It allows security teams to actively simulate adversary behavior, validating the detection coverage of SIEM rules and EDR controls. Use this tool for comprehensive purple team operations, penetration testing, and security auditing.

A comprehensive guide for Security Operations Center (SOC) teams to perform proactive threat hunting using Elastic SIEM. This skill teaches advanced techniques like KQL and EQL queries, analyzing event sequences, and investigating anomalies to uncover threats that bypass automated detection rules. Ideal for validating detection coverage gaps and responding to new TTPs based on the MITRE ATT&CK framework.

A comprehensive guide and workflow demonstrating how to use YARA rules for proactive threat hunting. This method helps detect unknown malware, suspicious patterns, and Indicators of Compromise (IOCs) across filesystems, memory dumps, and network artifacts, making it essential for incident response and security analysis.