Skill UI

This guide details how to detect advanced process injection techniques (T1055) by analyzing rich Sysmon telemetry. It focuses on identifying cross-process memory operations, such as remote thread creation (Event 8), suspicious process access (Event 10), and memory divergence (ProcessTampering/Event 25), which are hallmarks of DLL injection and process hollowing. Ideal for threat hunters and security analysts investigating sophisticated defense evasion.

A multi-layered defense system designed to detect sophisticated prompt injection attacks targeting LLM-powered applications. It combines regex pattern matching for known signatures, heuristic scoring for structural anomalies, and advanced DeBERTa-based classification. Ideal for building robust input validation layers, securing RAG pipelines, and performing proactive AI security scanning.

This skill defines canonical, ordered middleware patterns for LangChain and LangGraph agents. It addresses critical production-level LLM deployment issues, including PII leakage across tenants, token budget overconsumption, prompt injection defense (Guardrails), and cache key corruption. Use this to build secure, scalable, and cost-aware AI applications.

This skill outlines the implementation of advanced runtime defenses for production Large Language Model (LLM) applications. It covers using multiple industry-leading guardrail systems—including Llama Guard, NeMo Guardrails, and LLM Guard—to detect and block adversarial attacks such as prompt injection, jailbreaks, and toxic content. It provides a comprehensive defense-in-depth strategy for ensuring model safety and output integrity in real-world deployments.