Skill UI

This tool parses API Gateway access logs from various providers (AWS, Kong, Nginx). It performs statistical analysis using pandas to detect critical security threats such as Broken Object Level Authorization (BOLA/IDOR), credential stuffing, rate limit bypass attempts, and injection vulnerabilities. Ideal for SOC analysts or security engineers investigating API abuse and building advanced threat detection rules.

This skill provides a programmatic method for analyzing Advanced Persistent Threat (APT) groups using the MITRE ATT&CK framework. By querying TTPs and generating multi-layer JSON files compatible with ATT&CK Navigator, analysts can visualize threat actor coverage, map detection capabilities, and identify critical security gaps to build highly targeted, threat-informed defenses.

This comprehensive guide details advanced forensic techniques for detecting and analyzing sophisticated malware that operates at the system's deepest levels, such as the Master Boot Record (MBR), Volume Boot Record (VBR), and UEFI firmware. It covers boot sector disassembly, UEFI module inspection, and memory forensics (SSDT/DKOM). Use this when standard security tools fail or when investigating nation-state level compromises.

This skill provides a systematic framework for analyzing cyber campaign attribution. It involves collecting, weighting, and correlating diverse indicators—such as infrastructure overlaps, TTP consistency, malware code similarities, and operational patterns—to determine the responsible threat actor. Utilizing structured methodologies like Analysis of Competing Hypotheses (ACH) and the Diamond Model, users can build confidence-weighted assessments to enhance threat intelligence accuracy.

Leverage Certificate Transparency (CT) logs via crt.sh and Certstream to proactively monitor for suspicious SSL/TLS certificates. This skill helps detect lookalike domains, unauthorized certificate issuance, and potential phishing infrastructure targeting your organization before attacks launch. Includes querying logic and threat intelligence integration.

Detects abnormal access patterns across major cloud storage platforms, including AWS S3, GCS, and Azure Blob Storage. By analyzing cloud audit logs (CloudTrail, etc.), this tool identifies critical security threats such as after-hours bulk data downloads, sudden spikes in API calls (GetObject spikes), access from new geographic IPs, and potential data exfiltration. It utilizes statistical baselines and time-series anomaly detection for proactive threat hunting and security incident investigation.

A specialized tool designed for incident responders and threat hunters. It extracts critical configuration data—such as C2 server addresses, malleable profiles, watermarks, and communication settings—from Cobalt Strike beacon payloads found in PE files or memory dumps. This analysis is crucial for mapping attacker infrastructure and improving defensive detection rules.

Parses Cobalt Strike malleable C2 profiles via pyMalleableC2 to pull beacon configs, HTTP communication patterns, sleep/jitter settings, and combines JARM scans for C2 detection when hunting suspected infrastructure or building IDS signatures.

A comprehensive toolset for analyzing Cobalt Strike Malleable C2 profiles. It parses advanced C2 communication configurations to extract crucial Indicators of Compromise (IOCs) such as HTTP headers, DNS settings, URI patterns, and user agents. The analysis is vital for threat hunting, developing network detection signatures (Suricata/Snort), and understanding evasion techniques used by advanced persistent threats (APTs).

A comprehensive guide and toolkit for analyzing malware Command-and-Control (C2) communication. This method helps security analysts reverse engineer network traffic captured from malware samples, identifying beaconing patterns, decoding custom protocols (HTTP, DNS, etc.), and mapping C2 infrastructure for advanced threat detection and threat intelligence gathering.

This skill analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework. It identifies which attack phases an adversary has completed, points where defenses failed or succeeded, and recommends controls to disrupt the attack at earlier stages. It is essential for post-incident analysis, threat intelligence reporting, and designing robust defense-in-depth strategies.

This comprehensive guide details the professional workflow for performing digital forensic analysis on disk images using Autopsy and The Sleuth Kit. It covers environment setup, data source ingestion, recovering deleted files, extracting critical metadata (EXIF, MFT timestamps), and performing advanced keyword searches to build a complete investigative timeline and detailed case report.