Skill UI

A comprehensive, multi-stage framework for responding to confirmed or suspected malware infections across an enterprise. This guide covers the entire incident lifecycle: detection, scoping, containment, deep analysis (mapping to MITRE ATT&CK), thorough eradication, and system recovery, ensuring all steps are documented for resilience and compliance.

This skill provides comprehensive guidance and PowerShell scripts for hardening Windows endpoints using Microsoft Defender for Endpoint (MDE). It covers advanced features like Attack Surface Reduction (ASR) rules to block common attack techniques, Controlled Folder Access for ransomware protection, and Network Protection. Use this for deploying enterprise-grade, compliance-required security policies via Intune or Group Policy.

A comprehensive guide for implementing enterprise-grade Security Access Service Edge (SASE) architectures using Palo Alto Networks Prisma Access. This skill covers configuring ZTNA connectors, GlobalProtect agents, security policies, and device posture checks (HIP) to provide unified, cloud-delivered security, replacing traditional VPNs and maintaining zero trust principles across remote and branch offices.

A comprehensive guide for advanced threat hunting, focusing on detecting DLL side-loading and search-order hijacking (MITRE T1574). It instructs users to analyze Sysmon Event ID 7 logs, validate file signatures and hashes, and identify path anomalies to uncover APT persistence mechanisms. Essential for incident response and proactive threat detection in enterprise environments.

A comprehensive guide and framework for detecting attacker lateral movement within enterprise networks. It details the use of network flow analysis (Zeek), authentication log review (Windows Event Logs, Kerberos), and dedicated SIEM correlation rules (Splunk, Elastic) to identify techniques like Pass-the-Hash and RDP hopping. Ideal for threat hunters and security engineers building detection pipelines.

A comprehensive guide for authorized penetration testing, demonstrating how to identify and exploit critical vulnerabilities in the SMB protocol (e.g., EternalBlue, PrintNightmare). This skill covers network enumeration, lateral movement techniques (Pass-the-Hash, SMB Relay), and post-exploitation activities using Metasploit and Impacket tools to assess enterprise network security posture.

A proactive, hypothesis-driven skill designed to hunt for Advanced Persistent Threats (APT) within complex enterprise environments. It analyzes endpoint telemetry, network logs, and memory artifacts using frameworks like MITRE ATT&CK. Use this skill when investigating anomalous behavior flagged by UEBA, conducting scheduled threat sprints, or validating exposure to known TTPs using tools like Velociraptor and osquery.

Implements API Security Posture Management (API-SPM) to continuously discover, classify, and risk-score all APIs (internal, external, partner, shadow). It aggregates security findings from DAST, SAST, SCA, and runtime monitoring to provide a unified, continuous view of API risk and compliance across the enterprise.

This skill provides a comprehensive guide to hardening BGP using the Resource Public Key Infrastructure (RPKI). It covers the full lifecycle, including creating Route Origin Authorizations (ROAs) at Regional Internet Registries (RIRs), deploying RPKI validator software (e.g., Routinator), and configuring Route Origin Validation (ROV) on enterprise routers like Cisco IOS-XE and Juniper Junos. Use this when establishing critical network security controls to prevent route hijacking and leaks.

This skill guides the deployment and configuration of the Dragos Platform for specialized Operational Technology (OT) and Industrial Control System (ICS) network monitoring. It leverages industrial protocol parsers and threat intelligence to detect sophisticated threats (e.g., VOLTZITE). It is essential for establishing OT Security Operations Centers (SOCs) or integrating dedicated ICS monitoring capabilities into enterprise SIEM solutions.

Utilizes GitHub Advanced Security (GHAS) and CodeQL to implement comprehensive SAST across enterprise repositories. This solution automates static analysis, detecting vulnerabilities (e.g., SQL injection, XSS) and secrets at scale, enabling true 'shift-left' security by integrating checks directly into pull request workflows and CI/CD pipelines.

This guide provides comprehensive security hardening procedures for enterprise Google Workspace environments. It covers advanced topics such as enforcing phishing-resistant Multi-Factor Authentication (MFA), configuring email authentication (DMARC/SPF/DKIM), implementing Data Loss Prevention (DLP), and securing super admin accounts using Advanced Protection Program enrollment. Ideal for achieving high compliance and defending against BEC and phishing attacks.