Skill UI

A comprehensive guide for deploying and configuring CrowdStrike Falcon EDR agents across diverse endpoints (Windows, macOS, Linux). This skill covers silent installation via SCCM, Intune, GPO, and command-line methods, alongside establishing robust prevention and response policies. Ideal for onboarding endpoints, enhancing threat detection capabilities, and integrating Falcon telemetry into SIEM platforms for advanced security operations.

This tool deploys decoy canary files in critical system directories to provide early warning against ransomware attacks. Utilizing Python's watchdog library, it monitors for any read, modify, rename, or delete operations on these decoy files. Detection triggers immediate alerts via multiple channels (Email, Slack, Syslog), helping security teams identify and respond to malicious activity before full data encryption occurs. It serves as a crucial detection layer in a layered security defense.

Utilizes User and Entity Behavior Analytics (UEBA), statistical baselines, and machine learning models to monitor authentication logs. This skill identifies sophisticated security threats such as impossible travel, credential stuffing, brute force attacks, and compromised accounts in real-time. Essential for security operations and identity access management.

A comprehensive guide for security teams on detecting and responding to unauthorized crypto mining operations in cloud environments (AWS, Azure). It details a multi-layered approach, utilizing cost anomaly detection, compute utilization monitoring, GuardDuty findings, and network flow log analysis (VPC/KQL) to identify resource hijacking attempts and suspicious activity across EC2, ECS, and EKS workloads.

This guide details how to detect T1055 process injection techniques, including DLL injection, process hollowing, and remote thread creation. By analyzing specific Sysmon Event IDs (1, 7, 8, 10, 25) that track cross-process memory operations and handle access, security teams can proactively hunt for defense-evasion activities, investigate EDR alerts, or validate security monitoring coverage.

This skill guides penetration testers on detecting and exploiting race condition (TOCTOU) flaws in web applications. It details advanced techniques, such as using Burp Suite's Turbo Intruder and single-packet attacks, to bypass rate limits, duplicate transactions (e.g., coupon redemption), or manipulate state-changing operations. Essential for comprehensive security assessments and bug bounty hunting.

This skill provides a structured methodology for mitigating alert fatigue within Security Operations Centers (SOCs). It guides users through advanced techniques, including implementing Risk-Based Alerting (RBA) to replace high-volume, low-fidelity alerts with consolidated risk scores. It emphasizes quantifying alert quality by analyzing True Positive (TP) and False Positive (FP) rates, and systematically tuning detection rules to maintain analyst effectiveness.

This skill guides the deployment and configuration of the Dragos Platform for specialized Operational Technology (OT) and Industrial Control System (ICS) network monitoring. It leverages industrial protocol parsers and threat intelligence to detect sophisticated threats (e.g., VOLTZITE). It is essential for establishing OT Security Operations Centers (SOCs) or integrating dedicated ICS monitoring capabilities into enterprise SIEM solutions.

This tool builds a tamper-evident, append-only log chain using SHA-256 hash chaining. By incorporating the previous entry's hash into the current entry, any modification to an old log entry will invalidate all subsequent hashes, enabling pinpoint tamper detection. It supports various log formats (syslog, JSON, plain text) and is essential for compliance, digital forensics, and verifying log authenticity in security operations.

This methodology provides SOC teams with an adversary-centric framework to evaluate security detection capabilities against the MITRE ATT&CK framework. By systematically mapping existing SIEM rules and data sources, users can identify critical detection gaps, prioritize rule development efforts, and measure the overall maturity of their security operations center (SOC) defenses over time.

A guide and implementation pattern for deploying Nozomi Networks Guardian sensors. This solution enables passive, non-disruptive monitoring of Operational Technology (OT) and Industrial Control Systems (ICS). It provides critical asset visibility, behavioral anomaly detection, protocol-aware monitoring, and vulnerability assessment, making it essential for building robust OT Security Operations Centers (SOCs) and ensuring compliance without risking live operations.

This skill guides the implementation of security chaos engineering experiments. It involves deliberately degrading or disabling security controls (like WAF, firewalls, or log pipelines) in a controlled environment to rigorously verify the detection, alerting, and response capabilities of the Security Operations Center (SOC). Users learn to use tools like boto3 and Python to simulate failure scenarios and assess system resilience and compliance posture.