Skill UI

Systematically tune SIEM rules, thresholds, allowlists, correlations, and enrichment so SOC analysts can focus on genuine threats instead of alert fatigue, especially during security assessments and incident response cycles.

Analyze Linux system logs (syslog, auth.log, kern.log, systemd journal, audit records, cron and application logs) to reconstruct user sessions, detect unauthorized access, and build event timelines for incident response and security assessments.

Analyzes malware to extract file hashes, C2 domains, IPs, URLs, registry hits and behavioral artifacts, blending static PE parsing, sandbox detonations, YARA-based IOC spotting, and STIX 2.1 formatting for CTI sharing during assessments or incident response.

Systematically map Windows and Linux persistence vectors to reveal how malware survives reboots, enumerating autoruns, services, scheduled tasks, and WMI entries during incident response and threat hunting.

Guide to using Volatility 3 on volatile memory dumps to enumerate processes, network activity, modules, and extracted artifacts for malware and incident response.

Capture and analyze PCAP traffic with Wireshark/tshark to reconstruct suspicious sessions, extract artifacts, and detect malicious communications during incident response and malware investigations.

Automates tshark and pyshark to parse PCAPs for protocol stats, suspicious flows, DNS anomalies, and IOC extraction during security assessments or incident response drills.

Deploy Zeek to passively capture network packets, parse protocol metadata, and derive high-fidelity logs for threat hunting, anomaly detection, and SIEM ingestion during security assessments or incident response.

Performs comprehensive assessments of OT networks (SCADA/DCS) by mapping Purdue layers, evaluating OT/IT convergence risks, analyzing industrial protocols, and validating firewall zones to detect misconfigurations or attack paths during compliance or incident response work.

Continuously scrape Pastebin, GitHub Gists and similar paste services to detect leaked credentials or API keys through keyword alerts and regex-based pattern matching, enabling swift incident response before stolen data is weaponized.

GoPhish is an open-source framework designed for security teams to conduct authorized phishing awareness campaigns. This skill guides users through the entire process: deploying GoPhish, setting up realistic phishing scenarios (templates, landing pages), executing the campaign, and analyzing results to measure and improve organizational resilience against social engineering attacks. It is crucial for proactive security testing and incident response validation.

Guide for executing a structured ransomware incident response covering detection, containment, eradication, backup recovery, and post-recovery validation, ensuring teams with IR plans and segmented networks can act swiftly.