Skill UI

A comprehensive methodology for planning, running, and measuring strategic adversary engagement operations using the MITRE Engage framework. It guides teams beyond ad hoc deception by defining measurable Goals (Expose, Affect, Elicit), Operational Objectives, and mapping activities to specific MITRE ATT&CK techniques. Essential for building formal denial and deception programs.

A comprehensive guide to executing the NIST Risk Management Framework (RMF) to achieve an Authorization to Operate (ATO). This covers the full lifecycle, including preparation, system categorization (FIPS 199), control selection and tailoring (SP 800-53 Rev 5), implementation, assessment (SAR), and continuous monitoring. Essential for organizations working under FISMA or FedRAMP.

A comprehensive guide to achieving compliance with the HIPAA Security Rule (45 CFR Part 164). This skill outlines the mandatory steps to protect electronic Protected Health Information (ePHI), including conducting thorough risk analyses, deploying administrative, physical, and technical safeguards, managing Business Associate Agreements (BAAs), and preparing for breach notifications and OCR audits. Essential for Covered Entities and Business Associates.

This skill guides the deployment of decoy files, or "canary tokens," across critical file systems. These files act as tripwires, monitoring for unauthorized changes (modification, deletion, renaming). By tracking these high-value decoys, systems can detect ransomware encryption activity in real-time, providing a low false-positive, high-fidelity detection layer that complements traditional EDR and backup solutions.

A comprehensive framework for managing third-party risk (TPRM) throughout the entire vendor lifecycle. This tool guides users through inventory, risk tiering, running due diligence questionnaires (SIG, CAIQ), reviewing security evidence (SOC 2, ISO 27001), codifying requirements in contracts, and establishing continuous monitoring protocols. It is essential for maintaining compliance, managing supply chain risk, and securing data handled by external vendors.

A comprehensive guide for conducting authorized vishing (voice phishing) pretext calls. This technique, utilized in red-teaming, simulates an attacker impersonating a trusted authority (e.g., IT support, vendor) to test an organization's human security controls. It measures employee adherence to verification protocols and highlights vulnerabilities in staff security awareness.

This guide provides a deep dive into the cryptographic techniques used by ransomware, including AES, RSA, ChaCha20, and hybrid schemes. It covers identifying algorithms, analyzing key management patterns (strong, weak, flawed), and reverse engineering file encryption routines to assess decryption feasibility and support recovery efforts.

Provides a comprehensive guide to implementing Zero Trust Network Architecture on Google Cloud Platform (GCP) using Identity-Aware Proxy (IAP). It enforces rigorous, per-request identity verification and context-aware authorization for services like Compute Engine, App Engine, and Cloud Run. This ensures that only authenticated users who meet specific criteria (e.g., device posture, corporate location, time window) can access protected resources, eliminating reliance on public IPs or VPNs.

A comprehensive guide detailing the systematic workflow for analyzing malicious Linux ELF binaries. It covers essential techniques including static analysis (using readelf, elftools), dynamic tracing (strace, ltrace), and deep reverse engineering (GDB) of various threats like botnets, cryptominers, and ransomware targeting Linux environments, containers, and cloud infrastructure.

This guide outlines a comprehensive workflow for detecting and preventing the exposure of sensitive AWS credentials (access keys, session tokens) within source code repositories, CI/CD pipelines, and configuration files. It utilizes TruffleHog for deep historical scanning and integrates git-secrets for robust pre-commit hooks, significantly reducing the risk of credential theft and unauthorized account access.

This comprehensive tool manages all aspects of a brand's identity, including voice, visual standards, messaging frameworks, and asset management. It helps teams maintain brand integrity by synchronizing guidelines (e.g., markdown) into actionable digital tokens (JSON/CSS) and validating assets, ensuring all content and designs adhere to established rules and standards.

This guide details the architecture and deployment of resilient Command and Control (C2) redirectors. By using tools like Nginx and Apache, operators establish an intermediary layer that filters beacon traffic based on malleable C2 profiles. This setup protects the true team server from detection, takedown, and analysis (OPSEC), enabling advanced techniques like domain fronting and traffic shaping for low attribution.