Skill UI

This guide provides a comprehensive framework for debugging and analyzing AgentCore runtime sessions using CloudWatch Logs Insights. It details advanced techniques like OpenTelemetry (OTEL) span correlation, resolving session IDs to trace IDs, and structuring complex query queries. Use this when investigating agent execution flows, diagnosing tool call failures, analyzing latency, or building detailed behavioral timelines.

This guide provides a deep-dive solution for migrating comprehensive CRM data from various sources (like Salesforce, Pipedrive, or spreadsheets) into HubSpot. It supports data mapping, creating custom properties, and executes robust batch imports via API, ensuring data integrity and seamless re-platforming for marketing and sales workflows.

This comprehensive checklist provides a deep dive into Endpoint Detection and Response (EDR) architecture and monitoring mechanisms. It details advanced evasion techniques, such as direct syscalls, AMSI bypass, kernel patching, and memory manipulation. This skill is essential for red team engagements, penetration testing, and advanced malware research to thoroughly assess and bypass modern security defenses.

This skill provides a deep dive into the architecture of low-level keyloggers. It covers techniques such as kernel driver hooks, using WH_KEYBOARD_LL, ETW-based input capture, and analyzing user-mode vs. kernel-mode approaches. Use this methodology to understand input capture mechanisms, research EDR evasion methods, or analyze malware architecture for advanced security threat detection.

This comprehensive guide serves as a reference for offensive security professionals developing custom x86/x64 shellcode. It details advanced concepts including Position-Independent Code (PIC), PEB traversal for API resolution, safe memory allocation (avoiding RWX), and sophisticated process injection methods (e.g., APC injection, threadless techniques). Learn how to bypass modern AV/EDR detection using advanced evasion techniques like API hashing, encryption, direct syscalls, and abusing PE structures.

A comprehensive guide detailing the reference architecture for connecting to OneNote via the Microsoft Graph API. It covers the distinct API paths, permission models, and object hierarchies for personal (OneDrive), SharePoint, and Microsoft 365 Group notebooks, ensuring seamless design for multi-tenant, enterprise-level integrations.

Methodology for assessing Bluetooth Classic BR/EDR targets, including device discovery, SDP service enumeration, profile abuse, legacy pairing weaknesses like KNOB, and BlueBorne-style flaws in older embedded, automotive, and accessory devices.

A comprehensive playbook for identifying and exploiting clickjacking vulnerabilities (UI redress). Learn how to test if target pages can be framed, bypass security headers like X-Frame-Options and CSP frame-ancestors, and execute high-impact actions through invisible iframes. This guide covers single-click, multi-step, and drag-and-drop attack vectors, applicable to sensitive endpoints like account deletion or admin panels.

A comprehensive playbook detailing advanced techniques for bypassing modern Endpoint Detection and Response (EDR) and Antivirus (AV) solutions on Windows. Covers exploiting vulnerabilities in AMSI, ETW, and implementing sophisticated process injection methods (e.g., Process Hollowing, Early Bird) to execute payloads while maintaining stealth.

A comprehensive guide to executing the NIST Risk Management Framework (RMF) to achieve an Authorization to Operate (ATO). This covers the full lifecycle, including preparation, system categorization (FIPS 199), control selection and tailoring (SP 800-53 Rev 5), implementation, assessment (SAR), and continuous monitoring. Essential for organizations working under FISMA or FedRAMP.

This skill guides the deployment of decoy files, or "canary tokens," across critical file systems. These files act as tripwires, monitoring for unauthorized changes (modification, deletion, renaming). By tracking these high-value decoys, systems can detect ransomware encryption activity in real-time, providing a low false-positive, high-fidelity detection layer that complements traditional EDR and backup solutions.