Skill UI

A comprehensive guide for digital forensics analysts to investigate compromised Linux systems. This workflow details the collection and analysis of critical system artifacts, including authentication logs, shell histories, SSH keys, and system configurations. Use this methodology during incident response to detect rootkits, unauthorized persistence mechanisms, and reconstruct full attacker activity.

This skill outlines the comprehensive process of memory forensics on compromised Linux systems. It guides users through acquiring volatile memory using the LiME kernel module and analyzing the resulting image with the Volatility 3 framework. Key artifacts extracted include process lists, network connections, bash history, and loaded kernel modules, making it an essential technique for incident response, threat hunting, and security investigations.

This comprehensive skill scans Linux systems for various persistence vectors, including crontab entries, systemd units, LD_PRELOAD injections, and shell profile modifications. It correlates these findings with auditd logs to build a detailed installation timeline, which is critical for incident response and threat hunting to detect hidden backdoors.

A comprehensive guide for deploying and configuring CrowdStrike Falcon EDR agents across diverse endpoints (Windows, macOS, Linux). This skill covers silent installation via SCCM, Intune, GPO, and command-line methods, alongside establishing robust prevention and response policies. Ideal for onboarding endpoints, enhancing threat detection capabilities, and integrating Falcon telemetry into SIEM platforms for advanced security operations.

A comprehensive guide to deploying and configuring osquery across diverse endpoints (Windows, macOS, Linux). This tool allows security teams to gather deep, SQL-based insights into endpoint state, including running processes, network connections, system configuration, and installed software. It is essential for threat hunting, compliance auditing, and building centralized fleet visibility.

This guide details how to write and tune Falco rules to monitor Linux syscalls in real-time. It is designed to detect critical container escape techniques, such as mounting host filesystems, accessing sensitive host paths, loading kernel modules, and exploiting privileged container capabilities. Ideal for security hardening, threat hunting, and incident response in Kubernetes or containerized environments.

A comprehensive guide for threat hunting, detailing detection methods for the abuse of elevation controls (T1548). It covers both Windows environments (UAC bypass via registry modification and auto-elevating binaries like fodhelper.exe) and Linux systems (sudo/setuid abuse). Use this to monitor system events, registry changes, and process relationships to identify unauthorized privilege escalation attempts.

A comprehensive guide detailing the systematic process of eradicating malware, backdoors, and attacker persistence mechanisms from compromised Windows and Linux systems. This workflow covers mapping persistence (Autoruns, registry, scheduled tasks), identifying artifacts (YARA, AV scans), removing threats, resetting credentials, and patching vulnerabilities to restore a clean state.

This skill automates the hardening of Linux endpoints (Ubuntu, RHEL, CentOS) by implementing industry-standard security best practices guided by CIS Benchmarks. It systematically secures various layers, including filesystem permissions, network parameters (sysctl), SSH configuration, user access controls (PAM), and integrates deep auditing using auditd and OpenSCAP. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This comprehensive skill guides the setup and deployment of File Integrity Monitoring (FIM) using AIDE on Linux systems. It covers generating the initial baseline database, configuring monitoring rules, running scheduled checks via cron, and parsing change reports to detect unauthorized file modifications. Essential for meeting strict compliance requirements and enhancing endpoint security.

This skill covers performing comprehensive vulnerability assessments across diverse environments, including on-premises infrastructure, cloud VMs, and container registries. It leverages standard network protocols like SSH (Linux) and WMI (Windows), coupled with advanced cloud provider APIs for analyzing disk snapshots without requiring local endpoint agents. Ideal for security auditing and compliance checks.

This guide details how to perform authenticated (credentialed) vulnerability scans using industry-leading tools like Nessus, Qualys, and OpenVAS. By utilizing service credentials (SSH, SMB, WinRM, SNMPv3), the scan moves beyond superficial banner checks to deeply inspect installed patches, configurations, and local system settings on Linux, Windows, and network devices. This is crucial for detecting vulnerabilities that unauthenticated scans often miss, significantly improving security assessment accuracy.