Skill UI

A comprehensive guide and workflow for digital forensics investigators to analyze raw email headers. This tool helps trace the true origin of suspicious emails, verify sender authenticity, and detect advanced spoofing techniques by validating crucial protocols like SPF, DKIM, and DMARC. It covers everything from header parsing to domain infrastructure analysis and IP reputation checks.

A comprehensive guide for analyzing malicious Linux ELF binaries. Covers static inspection using tools like readelf and elftools, dynamic tracing with strace/ltrace, and deep reverse engineering using Ghidra/IDA. Essential for investigating botnets, ransomware, and rootkits in Linux server or container environments.

A comprehensive toolkit using Splunk's SPL language to analyze Windows Security, System, and Sysmon event logs. It maps advanced detection queries to specific MITRE ATT&CK techniques, enabling SOC analysts to investigate authentication attacks (e.g., brute force, password spraying), detect privilege escalation, locate persistence mechanisms, and trace lateral movement for detailed forensic timeline analysis.

A comprehensive guide for deploying and managing network deception systems using industry-leading honeypot platforms like OpenCanary, T-Pot, and Cowrie. This skill helps security professionals detect unauthorized access attempts, trace lateral movement, and gather critical threat intelligence by simulating vulnerable services within a controlled environment. Ideal for enhancing network security architecture and creating early warning indicators for intrusions.

A comprehensive guide for conducting cloud forensics investigations across AWS, Azure, and GCP. This workflow demonstrates how to preserve volatile and non-volatile evidence, including snapshotting volumes, capturing instance metadata, and collecting critical logs (CloudTrail, Activity Log, Audit Log) to trace unauthorized access and analyze security breaches.

This comprehensive guide details techniques for performing forensic investigations on Linux systems. It covers analyzing critical logs—including auth.log, syslog, systemd journal, and auditd—to reconstruct user sessions, trace unauthorized access, detect privilege escalation, and establish detailed event timelines following a suspected security compromise.

A comprehensive guide and framework for performing digital forensics analysis on PCAP/PCAPNG files. This skill covers using industry-standard tools like Wireshark, tshark, tcpdump, and Python/Scapy to reconstruct network communications, extract evidence of data exfiltration, identify command-and-control (C2) activity, and trace lateral movement during incident response.

This comprehensive guide teaches advanced iOS reverse engineering techniques using Frida dynamic instrumentation. Users can analyze proprietary app logic, extract encryption keys, trace method calls, and bypass anti-tampering or anti-debugging mechanisms without needing source code. It is essential for authorized mobile security testing and protocol analysis.

This command merges the results of the highest-ranked agent from a specified or latest session into the base branch. It automates the finalization of a development cycle by ensuring a clean and traceable history. Functionality includes merging the winner's branch, archiving all losing agents' commits using Git tags, and cleaning up temporary worktrees.

A comprehensive guide to professional Git version control. It covers best practices for branching strategies (GitHub Flow, GitFlow, Trunk-Based), writing standardized commit messages using Conventional Commits, managing merges vs. rebases, and defining effective Pull Request workflows. Ideal for any development team looking to improve code collaboration and maintain a clean, traceable history.

A comprehensive guide on implementing advanced security observability using eBPF and Cilium Tetragon. This skill covers real-time tracking of process execution, network connections, and file system access directly in the kernel. Learn how to author TracingPolicy CRDs, utilize kprobe/tracepoint hooks for in-kernel filtering, and enforce runtime security policies (e.g., process killing) on Linux hosts or Kubernetes clusters.

AWS Detective automatically analyzes log data from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs to build interactive behavior graphs. This tool enables security analysts to investigate suspicious activity, trace lateral movement across accounts, profile compromised entities (IAM users, EC2 instances), and reconstruct complex attack timelines without manual log parsing. Ideal for triaging GuardDuty findings or investigating suspected AWS compromises.