Skill UI

Parses Cobalt Strike malleable C2 profiles via pyMalleableC2 to pull beacon configs, HTTP communication patterns, sleep/jitter settings, and combines JARM scans for C2 detection when hunting suspected infrastructure or building IDS signatures.

Shellbags are registry artifacts that track user folder browsing activity (view settings, access path) via Windows Explorer. This method reconstructs a user's interaction history with local drives, network shares, and removable media, providing definitive evidence of folder access even when the directories are deleted. Essential for digital forensics and incident response.

A comprehensive guide and set of scripts to systematically audit AWS S3 buckets for security misconfigurations. This tool identifies publicly exposed data, overly permissive ACLs, inadequate bucket policies, and missing encryption settings, ensuring adherence to least-privilege principles and compliance frameworks like SOC 2 or HIPAA.

This skill provides comprehensive guidance and PowerShell scripts for hardening Windows endpoints using Microsoft Defender for Endpoint (MDE). It covers advanced features like Attack Surface Reduction (ASR) rules to block common attack techniques, Controlled Folder Access for ransomware protection, and Network Protection. Use this for deploying enterprise-grade, compliance-required security policies via Intune or Group Policy.

This guide provides a comprehensive framework for auditing Azure Storage accounts to detect critical security misconfigurations. It specifically checks for publicly accessible blob containers, insufficient encryption settings (e.g., missing infrastructure encryption), overly permissive network rules, and exposed SAS tokens. It is essential for compliance verification, responding to security alerts (like anonymous access), and establishing a robust security baseline when onboarding new cloud subscriptions.

This script automates the detection and exploitation of Broken Function Level Authorization (BFLA) in APIs, following OWASP API Top 10 guidelines. It simulates low-privilege users attempting to access or modify restricted administrative endpoints (e.g., user management, system settings) using techniques like role switching, path manipulation, and parameter tampering. Essential for assessing vertical privilege escalation risks and verifying robust Role-Based Access Control (RBAC).

This tool automates the extraction of embedded configuration details from Agent Tesla Remote Access Trojan (RAT) samples. It is designed to recover crucial exfiltration credentials (SMTP, FTP, Telegram), keylogger settings, and Command and Control (C2) endpoints by analyzing and deobfuscating the .NET assembly structure. Essential for threat intelligence, incident response, and malware reverse engineering.

This guide teaches how to implement and audit Google Cloud Platform (GCP) VPC firewall rules using gcloud. It covers creating restrictive ingress and egress rules, enforcing network segmentation using tags and service accounts, and auditing for overly permissive settings. Ideal for compliance, zero-trust architectures, and responding to security findings.

This skill guides users through implementing and managing Kubernetes Pod Security Standards (PSS) using the Pod Security Admission (PSA) controller. Learn how to assign security profiles (Privileged, Baseline, Restricted) to namespaces, audit existing workloads for compliance, plan migrations from deprecated PSPs, and adjust securityContext settings to meet high hardening and compliance requirements.

This skill guides comprehensive Active Directory (AD) security assessment using industry-standard tools like PingCastle, BloodHound, and Purple Knight. It helps identify critical misconfigurations, excessive privileges, weak Kerberos settings, and potential lateral movement paths. Ideal for penetration testing, security audits, and incident response to proactively secure enterprise identity management systems.

This guide details how to perform authenticated (credentialed) vulnerability scans using industry-leading tools like Nessus, Qualys, and OpenVAS. By utilizing service credentials (SSH, SMB, WinRM, SNMPv3), the scan moves beyond superficial banner checks to deeply inspect installed patches, configurations, and local system settings on Linux, Windows, and network devices. This is crucial for detecting vulnerabilities that unauthenticated scans often miss, significantly improving security assessment accuracy.

This tool audits Kubernetes pod configurations to detect potential container escape misconfigurations. It checks for dangerous settings like privileged flags, excessive capabilities, host path mounts, shared namespaces, and cgroup abuses. Use it for comprehensive security assessments, compliance checking, or generating pre-enforcement security posture reports.