Skill UI

This skill provides a structured approach to detecting kernel-level rootkits in Linux environments. It utilizes memory forensics with Volatility3 (checking syscalls, hidden modules) and compares system views (/proc vs /sys) to identify tampered kernel structures, hooked syscalls, and concealed processes. It also integrates live scanning tools like rkhunter for comprehensive security incident investigation.

This skill provides methods and rules for detecting advanced container escape attempts, where an adversary attempts to break out of container isolation. Detection relies on monitoring critical system activities such as namespace manipulation, capability abuse (e.g., CAP_SYS_ADMIN), kernel exploits, and access to sensitive host paths. Tools like Falco, Sysdig, and eBPF are leveraged to monitor syscalls and process behavior in real-time, crucial for security incident response and threat hunting in containerized environments like Kubernetes or Docker.

This guide details how to write and tune Falco rules to monitor Linux syscalls in real-time. It is designed to detect critical container escape techniques, such as mounting host filesystems, accessing sensitive host paths, loading kernel modules, and exploiting privileged container capabilities. Ideal for security hardening, threat hunting, and incident response in Kubernetes or containerized environments.

Tetragon is a CNCF project that provides advanced, high-performance runtime security observability and enforcement for Kubernetes clusters. By utilizing eBPF, it operates directly at the Linux kernel level to monitor and enforce policies on process execution, file system access, network traffic, and dangerous system calls (syscalls). It offers low-overhead threat detection, making it essential for securing containerized environments against container escapes and unauthorized activity.

This skill guides users on performing deep runtime threat detection and forensics in cloud-native environments using Falco. It leverages Falco YAML rules to monitor syscalls, detecting critical security events such as shell spawning, file tampering (e.g., /etc/shadow), network anomalies, and privilege escalation within containers and Kubernetes clusters. Ideal for incident response, security auditing, and validating container runtime security controls.

This comprehensive checklist provides a deep dive into Endpoint Detection and Response (EDR) architecture and monitoring mechanisms. It details advanced evasion techniques, such as direct syscalls, AMSI bypass, kernel patching, and memory manipulation. This skill is essential for red team engagements, penetration testing, and advanced malware research to thoroughly assess and bypass modern security defenses.

This comprehensive guide serves as a reference for offensive security professionals developing custom x86/x64 shellcode. It details advanced concepts including Position-Independent Code (PIC), PEB traversal for API resolution, safe memory allocation (avoiding RWX), and sophisticated process injection methods (e.g., APC injection, threadless techniques). Learn how to bypass modern AV/EDR detection using advanced evasion techniques like API hashing, encryption, direct syscalls, and abusing PE structures.

Falco is a powerful CNCF project for real-time runtime security monitoring. This guide teaches authors how to write and deploy custom detection rules using Falco's robust YAML rule engine and modern eBPF driver. It is designed to detect critical threats such as container escapes, namespace manipulation, privileged mounts, and anomalous syscalls in Kubernetes and Docker environments, significantly hardening the overall container security posture.

This skill provides a comprehensive guide to the full lifecycle operation of the Havoc Command and Control (C2) framework. It covers setting up the team server, writing Yaotl profiles, and generating highly evasive Demon agents using sophisticated techniques like indirect syscalls and sleep obfuscation. It is critical for authorized red-team engagements, adversary emulation, and validating EDR detection capabilities.

A comprehensive methodology for advanced red teaming and adversary emulation. This skill details how to bypass modern Endpoint Detection and Response (EDR) solutions (e.g., Defender, CrowdStrike, SentinelOne). Techniques include unhooking ntdll, utilizing indirect syscalls (Hell's Gate), patching ETW providers, and AMSI context blinding. Essential for authorized penetration testing and self-developed implant development, aligning with MITRE ATT&CK T1562.