Skill UI

This skill detects command-and-control (C2) traffic hidden using domain fronting techniques. It analyzes proxy and web gateway logs by comparing discrepancies between the TLS SNI field and the HTTP Host header. By inspecting these mismatches and correlating them with known CDN provider properties, it helps security analysts hunt for sophisticated network evasion tactics.

A comprehensive threat hunting guide designed to detect adversary persistence and execution mechanisms hidden within Windows scheduled tasks (T1053.005). This skill analyzes Security Event ID 4698, suspicious task properties, and unusual execution patterns from tools like schtasks.exe. It is vital for incident response, proactive threat hunting, and enumerating persistence on compromised endpoints.

This skill covers implementing robust API abuse detection using advanced rate-limiting algorithms like Token Bucket and Sliding Window. It uses Redis for distributed counting and allows for adaptive limits, dynamically tightening during detected attacks and relaxing during normal traffic. Ideal for securing APIs against DDoS, brute force, and scraping attacks.

This comprehensive guide details how to establish AWS Security Hub as a centralized Cloud Security Posture Management (CSPM) platform. It aggregates security findings from multiple AWS services (GuardDuty, Inspector, Macie) and third-party tools. Users can enforce compliance against industry standards (CIS, PCI-DSS, NIST), automate remediation workflows via EventBridge, and generate comprehensive evidence for compliance audits.

This comprehensive guide details how to deploy and configure AWS Security Hub across multi-account AWS Organizations. It aggregates security findings from various AWS services (GuardDuty, Inspector, Macie, etc.) to enforce continuous compliance against industry standards like CIS, PCI DSS, and NIST. Use this skill to build centralized compliance dashboards and automated remediation workflows for robust security posture management.

This skill covers the deployment and fine-tuning of Web Application Firewall (WAF) rules across major cloud platforms like AWS, Azure, and Cloudflare. It addresses critical security needs such as mitigating OWASP vulnerabilities (SQLi, XSS), managing bot traffic, implementing rate limiting, and ensuring compliance (e.g., PCI-DSS). The workflow guides users through deploying managed rule sets, creating custom rate-based logic, and minimizing false positives.

A comprehensive guide to configuring multi-layered DDoS protection using Cloudflare. This skill covers mitigating volumetric (L3/4) and application-layer (L7) attacks by setting up managed rulesets, Web Application Firewall (WAF) rules, rate limiting, and Bot Management. Ideal for strengthening security architecture and meeting compliance standards.

This guide details how to implement coverage-guided fuzz testing using AFL++ within CI/CD pipelines. It covers building the fuzzing harness, utilizing advanced instrumentation (like AddressSanitizer), and configuring automated runs to discover memory corruption and input handling vulnerabilities in compiled applications. Ideal for strengthening DevSecOps practices and ensuring code reliability.

Learn how to implement and manage Google Cloud Platform (GCP) Organization Policy constraints using gcloud and Terraform. This guide covers enforcing critical security guardrails at the organization, folder, or project level, such as restricting external IP addresses, defining allowed resource locations, and disabling sensitive services. It is essential for achieving strong compliance and hardening cloud security architecture.

This skill provides comprehensive implementation for secure JWT (RFC 7519) signing and verification using multiple algorithms (HMAC-SHA256, RSA-PSS, ES256, EdDSA). It covers token expiration, claims validation, and crucial defenses against common attacks like algorithm confusion and 'none' algorithm bypass, essential for hardening web application authentication systems.

This skill provides a comprehensive guide to implementing advanced memory protection mechanisms on Windows endpoints. It covers critical techniques like Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG). Use this when hardening systems against various memory corruption exploits, such as buffer overflows and ROP chains, to significantly boost overall security posture.

Provides a structured, risk-based framework for managing patches in Operational Technology (OT) and Industrial Control Systems (ICS). It addresses the critical difference between IT and OT environments, prioritizing safety and availability over immediate remediation. The guide covers risk scoring, vendor compatibility testing, staged deployment, and defining compensating controls for unpatchable assets.