Skill UI

A comprehensive guide for authorized security assessments, detailing systematic methods to escalate user privileges from low-level access to root control on Linux systems. Techniques covered include comprehensive system enumeration, exploiting kernel vulnerabilities (e.g., dirty pipe), abusing misconfigured sudo permissions (using gtfobins), and exploiting vulnerable SUID binaries.

Provides production-ready bash templates for Linux admins to automate backups, monitor resources, manage users, and handle security tasks across servers and pen-testing setups.

Production-ready shell scripts covering Linux backups, monitoring, user management, log analysis, and automation for security and pentest environments.

Provides production-ready bash templates for Linux admins to automate backups, monitor resources, manage users, and handle security tasks across servers and pen-testing setups.

This expert skill performs non-intrusive static analysis to thoroughly audit AI skills and bundles. It identifies malicious patterns, data leaks, system stability risks, and obfuscated payloads across major operating systems (Windows, macOS, Linux/Unix) and mobile platforms (Android/iOS). Use it when verifying skill legitimacy or performing deep cross-platform security reviews.

This guide details the comprehensive process of using the Linux Audit framework (auditd) to detect advanced security threats. It covers deploying specific rules to monitor critical system files, detecting unauthorized privilege escalation, process injection, and suspicious system calls. Users can then leverage ausearch and aureport to efficiently query, reconstruct timelines, and summarize findings for forensic analysis and compliance auditing.

This skill provides a structured approach to detecting kernel-level rootkits in Linux environments. It utilizes memory forensics with Volatility3 (checking syscalls, hidden modules) and compares system views (/proc vs /sys) to identify tampered kernel structures, hooked syscalls, and concealed processes. It also integrates live scanning tools like rkhunter for comprehensive security incident investigation.

This skill outlines the comprehensive process of memory forensics on compromised Linux systems. It guides users through acquiring volatile memory using the LiME kernel module and analyzing the resulting image with the Volatility 3 framework. Key artifacts extracted include process lists, network connections, bash history, and loaded kernel modules, making it an essential technique for incident response, threat hunting, and security investigations.

A comprehensive guide for deploying and configuring CrowdStrike Falcon EDR agents across diverse endpoints (Windows, macOS, Linux). This skill covers silent installation via SCCM, Intune, GPO, and command-line methods, alongside establishing robust prevention and response policies. Ideal for onboarding endpoints, enhancing threat detection capabilities, and integrating Falcon telemetry into SIEM platforms for advanced security operations.

A comprehensive guide to deploying and configuring osquery across diverse endpoints (Windows, macOS, Linux). This tool allows security teams to gather deep, SQL-based insights into endpoint state, including running processes, network connections, system configuration, and installed software. It is essential for threat hunting, compliance auditing, and building centralized fleet visibility.

This guide details how to write and tune Falco rules to monitor Linux syscalls in real-time. It is designed to detect critical container escape techniques, such as mounting host filesystems, accessing sensitive host paths, loading kernel modules, and exploiting privileged container capabilities. Ideal for security hardening, threat hunting, and incident response in Kubernetes or containerized environments.

This skill provides a comprehensive framework for detecting various privilege escalation techniques across Windows and Linux. It covers access token manipulation, UAC bypass, unquoted service path abuse, and kernel exploits. It is essential for threat hunting, scoping compromise during incident response, and validating detection coverage in proactive security assessments.