Skill UI

A comprehensive guide to hardening Windows Active Directory environments using Group Policy Objects (GPO). This skill configures multiple layers of defense, including AppLocker, Controlled Folder Access, and Attack Surface Reduction (ASR) rules, to prevent ransomware execution paths, block unauthorized file modifications, and restrict lateral movement across the domain.

This comprehensive guide implements External Attack Surface Management (EASM). It integrates leading industry tools like Shodan, Censys, subfinder, httpx, and nuclei for deep reconnaissance. Users can systematically discover assets, enumerate subdomains, fingerprint services, scan for vulnerabilities, and calculate weighted exposure scores based on professional OWASP methodology. Ideal for continuous security monitoring and deep penetration testing.

This guide details establishing confidential computing environments using AWS Nitro Enclaves for hardware-level isolation. It covers building secure enclaves for sensitive data (PII, PHI), configuring cryptographic attestation workflows, and integrating KMS policies using PCR-based conditions. Learn to harden workloads by moving secret decryption into isolated, verifiable hardware boundaries.

This guide outlines the implementation of Remote Browser Isolation (RBI) as a core component of a Zero Trust architecture. It details policies for URL risk classification, Data Loss Prevention (DLP) controls, and Content Disarm and Reconstruction (CDR). This is essential for hardening web access, protecting against zero-day exploits, phishing, and preventing data exfiltration from untrusted web content.

This skill details the deployment of various canary tokens (DNS, HTTP, AWS API Keys) across enterprise network infrastructure. It establishes digital tripwires that detect behavioral anomalies, such as unauthorized access, credential leakage, or lateral movement. Tokens are configured with webhook alerts (Slack, SIEM) for real-time, low-false-positive notification, significantly enhancing traditional IDS/IPS capabilities.

This guide provides a comprehensive blueprint for implementing robust Data Loss Prevention (DLP) policies using Microsoft Purview. It covers the configuration of sensitivity labels (encryption, content marking) and the creation of custom DLP rules using regex patterns. The workflow extends to endpoint DLP deployment for controlling file operations on Windows and macOS devices, ensuring sensitive data protection across SharePoint, Exchange, and OneDrive. It leverages PowerShell and the Microsoft Graph API for advanced, programmatic compliance management.

A comprehensive guide on implementing advanced security observability using eBPF and Cilium Tetragon. This skill covers real-time tracking of process execution, network connections, and file system access directly in the kernel. Learn how to author TracingPolicy CRDs, utilize kprobe/tracepoint hooks for in-kernel filtering, and enforce runtime security policies (e.g., process killing) on Linux hosts or Kubernetes clusters.

This tool automates the end-to-end workflow for GDPR Data Subject Access Requests (DSAR). It handles identity verification, discovers PII across structured and unstructured data sources using NER and regex, maps data to Article 15 requirements, and generates auditable compliance reports, ensuring adherence to ICO/EDPB guidelines and scaling compliance efforts.

A comprehensive guide for implementing phishing-resistant multi-factor authentication using FIDO2/WebAuthn protocols. Learn to build a complete relying party server using Python, supporting both roaming hardware keys (e.g., YubiKey) and platform biometrics. Covers registration ceremonies, credential storage, and migrating to passwordless authentication.

This framework implements robust input and output validation guardrails for LLM-powered applications. It prevents prompt injection, detects and redacts PII, filters toxic content, and validates model outputs against defined schemas. Use it when deploying AI agents that handle sensitive data or require strict adherence to corporate policies, ensuring a secure and trustworthy AI interaction layer.

A comprehensive guide and technical framework for detecting and mitigating ransomware kill switch mechanisms. It details methods for analyzing mutex guards, domain-based communication, and registry checks. Learn how to deploy proactive mutex vaccination and use Sysmon/DNS monitoring to prevent malware execution during incident response and analysis.

`jq` is the standard and powerful CLI tool for querying, filtering, and reshaping JSON data. This skill provides expert-level practical patterns for working with deeply nested structures, handling complex transformations (like flattening, renaming, and grouping), and integrating JSON logic into shell pipelines. Essential for parsing API outputs (AWS, GitHub), log files, and building robust Bash scripts.