Skill UI

A comprehensive guide and toolkit for performing digital forensic analysis on network packet captures (PCAP/PCAPNG). It details techniques using Wireshark, tshark, and tcpdump to reconstruct communications, extract sensitive data, identify malicious C2 traffic, and establish irrefutable evidence of security breaches or data exfiltration.

This skill automates deep packet capture (PCAP) analysis using tshark and pyshark. It is invaluable for security assessments and incident response, enabling the extraction of protocol statistics, identification of suspicious network flows (e.g., port scanning, beaconing), and comprehensive extraction of Indicators of Compromise (IOCs), including IPs, domains, and URLs. It also specializes in detecting complex anomalies like DNS tunneling.

Zeek is a powerful, open-source network security monitoring framework that generates high-fidelity structured logs and metadata from raw network traffic. This skill covers deploying Zeek, analyzing various protocol logs (HTTP, DNS, TLS, etc.), writing custom detection scripts to identify anomalies, and integrating resulting security insights with SIEM platforms for comprehensive threat detection and forensic investigation.

A comprehensive guide to conducting security assessments on thick client (desktop) applications. This skill details techniques ranging from static analysis (using tools like dnSpy, IDA Pro) to dynamic analysis (process monitoring with Procmon, network interception via Burp Suite). It covers finding hardcoded credentials, identifying insecure local storage, mitigating DLL hijacking, and analyzing memory manipulation within local applications.

A comprehensive guide and workflow demonstrating how to use YARA rules for proactive threat hunting. This method helps detect unknown malware, suspicious patterns, and Indicators of Compromise (IOCs) across filesystems, memory dumps, and network artifacts, making it essential for incident response and security analysis.

A comprehensive guide and Python tool for reverse engineering Rust-compiled malware. It addresses unique Rust binary challenges, such as non-null-terminated strings and monomorphization. The script extracts crate dependencies, identifies suspicious capabilities (like networking or encryption), and filters for malware-related strings, assisting security researchers in deep binary analysis.

A comprehensive guide detailing the use of Tenable Nessus, an industry-leading vulnerability scanner. Learn how to configure advanced scan policies, perform both authenticated and unauthenticated scans across servers, network devices, and web applications. This skill covers end-to-end processes from execution to result analysis and reporting.

This skill detects stealthy lateral movement by monitoring the abuse of DCOM objects (MMC20.Application, ShellBrowserWindow, ShellWindows). It correlates Sysmon telemetry (Process Creation, Network Connections), WMI analysis, and RPC traffic to identify unauthorized remote command execution, aiding threat hunters and red teams.

This skill detects malicious Command and Control (C2) communications tunneled through the DNS protocol. It analyzes DNS query logs for indicators such as DNS tunneling tools (Iodine, dnscat2), Domain Generation Algorithms (DGA), and encoded payloads within TXT/CNAME records. Techniques include Shannon entropy analysis of subdomains, statistical anomaly detection, and machine learning classification. Ideal for network security analysts conducting deep threat hunting and forensic investigations.

SimPy is a powerful Python library designed for building, inspecting, testing, and analyzing bounded process-based discrete-event simulations. It supports modeling complex systems like queues, logistics networks, and service operations by providing an event scheduler and modeling primitives. It is essential for academic and industrial applications requiring robust system analysis.

This guide provides a systematic approach to deep debugging complex HubSpot API issues. It includes layer-by-layer network testing (DNS, TCP, TLS), correlation ID tracking, and timing analysis to isolate intermittent or hard-to-reproduce errors. Use this when standard troubleshooting fails or when compiling detailed evidence for technical support.

A comprehensive toolkit for debugging complex Adobe API issues that resist standard troubleshooting. Covers advanced techniques such as IMS token introspection, Firefly async job failure analysis, mapping PDF Services error codes, and deep network-layer diagnostics (DNS, TLS). Essential for resolving difficult, production-level integration bugs.