Skill UI

This guide teaches security teams how to proactively detect and respond to unauthorized cryptocurrency mining operations across major cloud platforms (AWS, Azure). It utilizes a multi-layered approach by analyzing compute cost anomalies, monitoring GuardDuty findings, inspecting network traffic to known mining pools, and analyzing runtime process execution in EC2, ECS, and EKS environments.

A comprehensive tool designed to discover and map adversary-controlled assets, including C2 servers, phishing domains, and exploit kits. It utilizes sophisticated pivoting techniques across passive DNS records, Certificate Transparency logs, Shodan/Censys scans, and network fingerprints (JARM/JA3S) to generate actionable threat intelligence, perfect for CTI investigations and security operations.

This guide details setting up advanced Command and Control (C2) redirectors, acting as protective intermediaries between implant beacons and the hidden team server. It covers using Nginx and Apache for request filtering based on Malleable C2 profiles, layering Let's Encrypt TLS, and implementing advanced OPSEC controls like domain fronting, geo/UA filtering, and decoy diversion. Essential for red-teaming operations requiring high resilience against blue-team detection and takedown.

This skill provides a comprehensive guide to the full lifecycle operation of the Havoc Command and Control (C2) framework. It covers setting up the team server, writing Yaotl profiles, and generating highly evasive Demon agents using sophisticated techniques like indirect syscalls and sleep obfuscation. It is critical for authorized red-team engagements, adversary emulation, and validating EDR detection capabilities.

Sliver is an open-source, cross-platform Command and Control (C2) framework used for adversary emulation in authorized red-team engagements. This skill guides users through deploying the C2 server, establishing multi-protocol listeners (mTLS, DNS, HTTPS), generating cross-platform implants, and executing advanced post-exploitation techniques, including pivoting and in-memory execution via the Armory.

This tool provides comprehensive querying and analysis of structured federation audit logs. It is essential for security and compliance teams, allowing filtering by specific regulatory frameworks (HIPAA, SOC2, GDPR), date ranges, and event severity. Users can summarize key findings including total events, PII detections, threat blocks, and trust changes to ensure adherence to strict industry and governmental standards.

This utility initializes a node for participation in a federated network. It automatically generates a secure ed25519 keypair, creates the necessary federation configuration, and allows users to optionally set a compliance mode (such as HIPAA, GDPR, or SOC2). It is a fundamental step for integrating a node into a secure, shared infrastructure.

Tool to embed C2PA (Content Provenance) manifests into AI-generated multimedia assets (image, video, audio, PDF). This mechanism adds a machine-readable provenance trail detailing the generator, prompt, and review history. Essential for complying with global regulations like the EU AI Act Article 50, ensuring verifiable digital authenticity, and building brand trust.

A comprehensive quality gate designed to validate all marketing content (ads, blogs, emails, etc.) before publication. It checks for factual accuracy (hallucination detection, claim verification), brand voice consistency, structural adherence, and compliance (C2PA provenance). Use this skill as the final checkpoint for all client-facing copy.

A highly specialized, downstream skill for advanced threat analysis. This tool is used to recover hidden configurations, decode C2 (Command and Control) parameters, unpack staged payloads, and extract Indicators of Compromise (IOCs) from complex malware samples. It focuses on identifying the exact decode chains—including compression, encoding, and crypto steps—and linking recovered fields to observed behavioral outcomes within a sandbox environment.

This specialized skill automates advanced forensic network analysis on captured packet data (PCAP). It is designed for reconstructing complex network sessions (TCP/UDP), decoding obscure or custom protocols (e.g., C2, custom binary), and correlating packet sequences with host or malware behavior. Use when evidence is embedded in protocol framing, timing, or session state, requiring reassembly beyond simple packet inspection.

A comprehensive guide to advanced Command and Control (C2) frameworks used in professional red teaming. This skill covers deployment, configuration, and operational tradecraft for tools like Cobalt Strike, Sliver, and Mythic. Topics include creating malleable profiles to mimic legitimate traffic, utilizing DNS/SMB beacons for stealth, implementing BOF for in-memory execution, and building resilient infrastructure via domain fronting and redirectors.