Skill UI

This skill provides a structured approach to detecting kernel-level rootkits in Linux environments. It utilizes memory forensics with Volatility3 (checking syscalls, hidden modules) and compares system views (/proc vs /sys) to identify tampered kernel structures, hooked syscalls, and concealed processes. It also integrates live scanning tools like rkhunter for comprehensive security incident investigation.

Detects container escape attempts at runtime by monitoring namespace manipulation, capability abuse, kernel exploits, sensitive mounts, and anomalous syscalls. Explains which signals matter for Falco, Sysdig, auditd, or EDR collection. Use when investigating suspected Docker/Kubernetes breakouts or comparing runtime sensor coverage.

Detects and prevents privilege escalation in Kubernetes pods by combining admission control, runtime monitoring, and audit log analysis. Covers security contexts, Linux capabilities, and syscall patterns. Use when investigating pods running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope.

This skill guides users on performing deep runtime threat detection and forensics in cloud-native environments using Falco. It leverages Falco YAML rules to monitor syscalls, detecting critical security events such as shell spawning, file tampering (e.g., /etc/shadow), network anomalies, and privilege escalation within containers and Kubernetes clusters. Ideal for incident response, security auditing, and validating container runtime security controls.

This comprehensive checklist provides a deep dive into Endpoint Detection and Response (EDR) architecture and monitoring mechanisms. It details advanced evasion techniques, such as direct syscalls, AMSI bypass, kernel patching, and memory manipulation. This skill is essential for red team engagements, penetration testing, and advanced malware research to thoroughly assess and bypass modern security defenses.

This comprehensive guide serves as a reference for offensive security professionals developing custom x86/x64 shellcode. It details advanced concepts including Position-Independent Code (PIC), PEB traversal for API resolution, safe memory allocation (avoiding RWX), and sophisticated process injection methods (e.g., APC injection, threadless techniques). Learn how to bypass modern AV/EDR detection using advanced evasion techniques like API hashing, encryption, direct syscalls, and abusing PE structures.

Deploy and operate Falco with the modern eBPF driver in Kubernetes and Docker. Covers driver selection, Helm installation, output channels, and the built-in ruleset that detects container escape, namespace abuse, privileged mounts, and anomalous syscalls. Ideal for enabling runtime security, routing alerts to SIEM or Falcosidekick, and upgrading existing deployments.

This skill provides a comprehensive guide to the full lifecycle operation of the Havoc Command and Control (C2) framework. It covers setting up the team server, writing Yaotl profiles, and generating highly evasive Demon agents using sophisticated techniques like indirect syscalls and sleep obfuscation. It is critical for authorized red-team engagements, adversary emulation, and validating EDR detection capabilities.

A comprehensive methodology for advanced red teaming and adversary emulation. This skill details how to bypass modern Endpoint Detection and Response (EDR) solutions (e.g., Defender, CrowdStrike, SentinelOne). Techniques include unhooking ntdll, utilizing indirect syscalls (Hell's Gate), patching ETW providers, and AMSI context blinding. Essential for authorized penetration testing and self-developed implant development, aligning with MITRE ATT&CK T1562.

Use eBPF to trace syscalls, network flows, and application behavior with Cilium, Tetragon, and bpftrace for deep kernel-level observability and security enforcement without code changes.