Skill UI

This comprehensive skill guides the deployment and utilization of MISP, a powerful open-source threat intelligence platform. It covers configuring various threat feeds (TAXII, CSV, etc.) and using the PyMISP Python API to programmatically automate the collection, storage, and correlation of Indicators of Compromise (IOCs) and threat events from diverse community and commercial sources.

This skill guides SOC analysts and detection engineers on how to correlate complex, multi-stage attacks within the IBM QRadar SIEM platform. It covers advanced usage of AQL (Ariel Query Language) for deep event investigation, building custom correlation rules (Building Blocks and Offenses), and cross-source data correlation (e.g., auth failures with network flows). It is essential for reducing false positives and improving threat detection accuracy.

This skill provides comprehensive detection methods for credential dumping techniques, a critical post-exploitation phase in cyber attacks. It targets the extraction of sensitive credentials from LSASS memory, SAM registry hives, and NTDS.dit using advanced security visibility. Detection relies on analyzing Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and complex SIEM correlation rules, making it essential for SOC analysts and threat hunters investigating advanced persistent threats (APTs).

Utilizes SIEM platforms (Splunk/Elastic) and Windows Event Log analysis (ID 4769) to detect indicators of Golden Ticket attacks. This skill analyzes Kerberos logs for specific anomalies such as RC4 encryption downgrades, abnormal ticket lifetimes, and correlation failures between TGT and TGS requests, crucial for advanced threat hunting in Active Directory environments.

A comprehensive guide and framework for detecting attacker lateral movement within enterprise networks. It details the use of network flow analysis (Zeek), authentication log review (Windows Event Logs, Kerberos), and dedicated SIEM correlation rules (Splunk, Elastic) to identify techniques like Pass-the-Hash and RDP hopping. Ideal for threat hunters and security engineers building detection pipelines.

A comprehensive guide and set of detection rules for identifying OS credential dumping techniques (MITRE T1003). It leverages EDR telemetry, Sysmon process access monitoring, and Windows security event correlation to detect attacks targeting LSASS memory, SAM databases, and NTDS.dit files. Essential for proactive threat hunting and incident response.

This guide focuses on developing multi-event correlation rules using Splunk SPL and Sigma format. It teaches how to detect Advanced Persistent Threats (APT) and lateral movement by chaining multiple Windows authentication, process execution, and network connection events across hosts within specified time windows. Use this to surface complex, multi-stage attack sequences that single-event detection rules typically miss.

This tool builds comprehensive forensic super-timelines by using Plaso to correlate events across diverse sources. It aggregates data from file system metadata, event logs, browser history, and registry artifacts into a unified chronological view. This capability is essential for complex digital forensic investigations requiring cross-source event correlation or detailed activity sequence reporting.

This skill provides a comprehensive framework for detecting NTLM relay attacks (T1557.001). It achieves this by correlating Windows Security Event 4624 (LogonType 3) to identify IP-to-hostname mismatches, detecting artifacts from Responder/LLMNR poisoning, and auditing SMB/LDAP protocol signing weaknesses. Use it for proactive threat hunting in Active Directory environments, investigating authentication anomalies, or building SIEM correlation rules.

This skill provides advanced detection methods for credential dumping, covering LSASS memory access, SAM hive extraction, and NTDS.dit theft (e.g., using Mimikatz). It utilizes Sysmon Event ID 10 and Windows Security logs to enable threat hunting, assisting SOC analysts in triaging EDR alerts and building robust SIEM correlation rules.

A comprehensive set of reusable patterns for structured incident triage in AWS environments. Includes pre-built Logs Insights queries for detecting errors, latency spikes, cold starts, and OOM events. Also provides systematic correlation methods linking CloudWatch alarms to deployment events, and a decision tree to narrow the blast radius scope from account to resource.

This guide outlines the rigorous standards for preparing empirical tables and figures for top-tier academic journals, such as the Journal of Accounting and Economics (JAE). It covers the entire research workflow, including variable definition, sample construction, descriptive statistics, correlation matrices, advanced regressions, and event studies. The goal is to ensure all exhibits are self-contained, reproducible, and meet strict academic reviewer expectations.