Skill UI

This skill parses various cyber threat intelligence (CTI) reports (Mandiant, CrowdStrike, etc.) using NLP and specialized libraries (stix2, mitreattack-python, spaCy). It systematically extracts adversary behaviors, maps them to MITRE ATT&CK IDs, and constructs a searchable STIX 2.1 Attack Pattern library. This is essential for threat-informed detection engineering, generating detection rules (Sigma, YARA), and validating security controls.

This skill provides a comprehensive workflow for building vendor-agnostic detection rules using the Sigma format. It empowers security operations center (SOC) engineers to translate raw threat intelligence and MITRE ATT&CK techniques into standardized, portable detection logic. The process guides users through rule validation and conversion into specific queries for major SIEM platforms, including Splunk, Elastic, and Microsoft Sentinel, ensuring robust detection coverage.

This skill provides a comprehensive methodology for detecting Living Off the Land Binaries (LOLBAS) abuse. It analyzes process telemetry (Sysmon, Windows Logs) and parent-child relationships to identify when attackers misuse legitimate Windows utilities (like certutil, mshta, rundll32) to execute malicious code while bypassing traditional security detection. Essential for threat hunting and advanced incident response.

This skill provides a framework for proactively detecting service account abuse, which often occurs through anomalous interactive logons, privilege escalation, or lateral movement. It leverages EDR/SIEM telemetry (e.g., CrowdStrike, Splunk) and advanced threat intelligence rules (Sigma) to identify compromised accounts performing unexpected activities. Ideal for incident response, threat hunting, and security posture assessment.

A comprehensive guide and toolkit for extracting, parsing, and analyzing Windows Event Logs (EVTX). This method utilizes industry-leading tools like Chainsaw and Hayabusa, along with Sigma rules, to perform deep digital forensics. It is specifically designed to detect critical security indicators such as lateral movement, persistence mechanisms, privilege escalation, and unauthorized access attempts on Windows systems.

This guide focuses on developing multi-event correlation rules using Splunk SPL and Sigma format. It teaches how to detect Advanced Persistent Threats (APT) and lateral movement by chaining multiple Windows authentication, process execution, and network connection events across hosts within specified time windows. Use this to surface complex, multi-stage attack sequences that single-event detection rules typically miss.

A specialized tool for internal operations leaders to document complex, end-to-end business workflows (e.g., procurement, onboarding, claims adjudication) using BPMN-style notation. It applies Lean and Six Sigma principles to measure cycle time, quantify value-add ratios, and deterministically identify process bottlenecks and root causes, moving beyond simple pipeline tracking.

Hayabusa is a specialized threat-hunting and fast-forensics tool designed to analyze Windows EVTX event logs. It applies a comprehensive library of Sigma detection rules to raw log data, generating a single, prioritized, chronological timeline. The output includes severity levels, MITRE ATT&CK mappings, and detailed metrics, enabling analysts to perform rapid, SIEM-free incident triage and export results for collaborative analysis.

Chainsaw is a fast, Rust-based forensic tool designed for first-response threat hunting. It analyzes collected Windows EVTX files using the comprehensive Sigma rule corpus, built-in detection rules, and high-speed keyword/regex searching. Furthermore, it uniquely analyzes critical artifacts such as shimcache, SRUM, and event-log gaps, providing robust, offline detection capabilities without needing a SIEM pipeline. It is essential for digital forensic triage and hypothesis confirmation.

This guide details how to mature and operationalize a MISP instance, transforming it from a simple repository into an active threat detection engine. Users learn to enable and cache curated threat feeds, apply warninglists to minimize false positives, query indicators using PyMISP, and automate the export of matching attributes into industry-standard detection rules like Suricata, Sigma, and Wazuh.

This tool performs robust outlier detection on individual session spending. Utilizing Median and Median Absolute Deviation (MAD), it calculates a modified z-score, making it highly resistant to extreme values, unlike mean+sigma methods. It specifically identifies which singular sessions are anomalous, making it crucial for cost monitoring, auditing, and integrating into CI/CD pipelines to prevent unexpected resource overruns.

Comprehensive workflow for analyzing suspected malware via static, dynamic, and behavioral techniques. Covers IOC extraction, YARA/Sigma rule generation, sandbox automation, and anti-analysis bypassing.