Skill UI

This skill provides structured procedures for detecting Golden Ticket attacks, a severe threat involving forging Kerberos Tickets in Active Directory. It analyzes Windows Event ID 4769 for indicators such as RC4 encryption downgrades, abnormal ticket lifetimes, and inconsistencies in TGS/TGT requests. Designed for SOC analysts and threat hunters using SIEM platforms (Splunk/Elastic) to enhance security monitoring coverage against credential theft.

This skill provides structured procedures and Python examples for detecting internal data exfiltration. It analyzes endpoint, cloud, and email logs by establishing behavioral baselines and performing statistical anomaly detection. Use cases include investigating insider threats, monitoring DLP policy violations, and building robust User and Entity Behavior Analytics (UEBA) rules for SOC teams.

This skill provides a structured methodology for detecting persistence and lateral movement via malicious scheduled tasks. It utilizes Sysmon Event IDs (1, 11) and Windows Security Events (4698/4702) to correlate process creation, task file writes, and task registration details. Ideal for threat hunting and building robust detection rules for T1053.005.

This skill provides a comprehensive guide to deploying Zeek (formerly Bro) for passive network security monitoring. It details how to generate structured logs (DNS, HTTP, SSL, etc.) and write custom Zeek scripts to detect sophisticated anomalies like DNS tunneling and beaconing. Ideal for threat hunting, security incident response, and complementing traditional IDS solutions.

This skill provides a structured approach to detecting Pass-the-Ticket (PtT) attacks, a severe credential theft technique utilizing stolen Kerberos tickets (TGT/TGS). It involves analyzing Windows Security Event IDs (4768, 4769, 4771) within SIEM platforms like Splunk or Elastic. Use cases include incident response, building advanced threat hunting queries, and validating security monitoring coverage against MITRE ATT&CK techniques.

This skill transforms a refined research proposal or method idea into a detailed, structured, and claim-driven experiment roadmap. It helps users determine exactly which experiments to run, in what order, and what evidence is needed to support the core claims of a research paper, ensuring focus on novelty, simplicity, and genuine contribution.

The Metasploit Framework is the industry standard platform for penetration testing and vulnerability validation. It provides numerous modules (exploits, payloads, auxiliaries) used to confirm if identified security weaknesses are genuinely exploitable. This guide details using Metasploit in a structured, risk-based workflow for authorized testing, including vulnerability checking, post-exploitation assessment, and patch verification.

This skill guides the creation of high-quality, finished cyber threat intelligence reports. It tails content for specific audiences—from C-suite executives (strategic risk) to SOC analysts (tactical IOCs). Use it when synthesizing raw data into actionable intelligence products, generating threat briefings, or conducting post-incident assessments, ensuring adherence to industry standards like TLP and NIST.

This skill provides structured methods for detecting credential stuffing attacks by analyzing authentication logs. It focuses on identifying complex patterns such as login velocity anomalies, high IP diversity, password spray techniques, and suspicious geographical distributions of failed logins. It is essential for SOC analysts conducting threat hunting or building robust detection rules against account takeover attempts.

Provides a structured methodology for proactive threat hunting against Living-off-the-Land Binaries (LOLBins). It guides practitioners in identifying techniques where adversaries abuse legitimate system tools (like certutil, mshta, rundll32) to execute payloads while bypassing traditional security controls (AV/EDR). Ideal for incident response, red team validation, and improving detection coverage against fileless attacks.

This skill provides a structured methodology for detecting process injection techniques (MITRE ATT&CK T1055), which adversaries use for defense evasion and privilege escalation. It analyzes granular security logs, specifically utilizing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess), alongside source-target process relationship mapping to identify suspicious malicious behavior over general system activity.

This guide provides a structured methodology for proactively hunting adversaries who establish persistence using Windows Scheduled Tasks (T1053). It outlines the necessary prerequisites (EDR, SIEM, Sysmon) and a comprehensive workflow—from hypothesis formulation to threat correlation—for detecting suspicious task creation, unusual scheduling patterns, and attacker TTPs during incident response or red teaming.