mukul975 skills on Claude Market

Abusing Dpapi For Credential Access

The Windows Data Protection API (DPAPI) is the operating system's built-in symmetric-encryption service that applications use to protect secrets at rest: saved RDP and Windows Credential Manager credentials, web and Wi-Fi credentials in the Credential Vault, browser saved logins and cookies (Chrome/Edge), KeePass keys, certificate private keys, and Scheduled Task passwords. DPAPI derives a per-user (or per-machine) master key from the user's password (or the machine account secret), and that master key encrypts individual "DPAPI blobs." The encrypted master keys live under %APPDATA%\Microsoft\Protect\<SID>\ (user) and %WINDIR%\System32\Microsoft\Protect\ (machine).

Abusing Shadow Credentials For Privesc

The Shadow Credentials technique abuses the msDS-KeyCredentialLink attribute of Active Directory user and computer objects. This attribute stores raw public keys ("Key Credentials") used by Windows Hello for Business and Azure AD device registration for passwordless certificate-based logon via PKINIT (Public Key Cryptography for Initial Authentication in Kerberos). If an attacker has write permission over a target object's msDS-KeyCredentialLink — typically granted by GenericWrite, GenericAll, WriteProperty, or AddKeyCredentialLink ACEs surfaced in BloodHound — they can append their own attacker-generated public key. They then request a TGT for the target via PKINIT using the matching private key and recover the target's NT hash, achieving complete account takeover without resetting the password, which is far stealthier than a forced password reset.

Achieving Cmmc Level 2 Compliance

- When an organization in the Defense Industrial Base (DIB) stores, processes, or transmits Controlled Unclassified Information (CUI) under a DoD contract. - When a contract includes DFARS 252.204-7012 (safeguarding/incident reporting), -7019/-7020 (NIST 800-171 self-assessment + SPRS), or the new -7021 (CMMC requirement). - When preparing for a C3PAO third-party assessment or a DoD-led assessment. - When you must compute, post, or improve an SPRS score based on the NIST SP 800-171 DoD Assessment Methodology. - When authoring or remediating a System Security Plan (SSP) and POA&M for the 110 requirements. - When scoping which assets fall inside the CUI/FCI boundary (CUI assets, security-protection assets, contractor risk-managed assets, out-of-scope).

Acquiring Disk Image With Dd And Dcfldd

- When you need to create a forensic copy of a suspect drive for investigation - During incident response when preserving volatile disk evidence before analysis - When law enforcement or legal proceedings require a verified bit-for-bit copy - Before performing any destructive analysis on a storage device - When acquiring images from physical drives, USB devices, or memory cards

Analyzing Active Directory Acl Abuse

Active Directory Access Control Lists (ACLs) define permissions on AD objects through Discretionary Access Control Lists (DACLs) containing Access Control Entries (ACEs). Misconfigured ACEs can grant non-privileged users dangerous permissions such as GenericAll (full control), WriteDACL (modify permissions), WriteOwner (take ownership), and GenericWrite (modify attributes) on sensitive objects like Domain Admins groups, domain controllers, or GPOs.

Analyzing Android Malware With Apktool

Android malware distributed as APK files can be statically analyzed to extract permissions, activities, services, broadcast receivers, and suspicious API calls without executing the sample. This skill uses androguard for programmatic APK analysis, identifying dangerous permission combinations, obfuscated code patterns, dynamic code loading, reflection-based API calls, and network communication indicators.

Analyzing Api Gateway Access Logs

- When investigating security incidents that require analyzing api gateway access logs - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Analyzing Apt Group With Mitre Navigator

MITRE ATT&CK Navigator is a web-based tool for annotating and exploring ATT&CK matrices, enabling analysts to visualize threat actor technique coverage, compare multiple APT groups, identify detection gaps, and build threat-informed defense strategies. This skill covers querying ATT&CK data programmatically, mapping APT group TTPs to Navigator layers, creating multi-layer overlays for gap analysis, and generating actionable intelligence reports for detection engineering teams.

Analyzing Azure Activity Logs For Threats

- When investigating security incidents that require analyzing azure activity logs for threats - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Analyzing Bootkit And Rootkit Samples

- A system shows signs of compromise that persist through OS reinstallation - Antivirus and EDR are unable to detect malware despite clear evidence of compromise - UEFI Secure Boot has been disabled or shows integrity violations - Memory forensics reveals rootkit behavior (hidden processes, hooked system calls) - Investigating nation-state level threats known to deploy bootkits (APT28, APT41, Equation Group)

Analyzing Browser Forensics With Hindsight

Hindsight is an open-source browser forensics tool designed to parse artifacts from Google Chrome and other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi). It extracts and correlates data from multiple browser database files to create a unified timeline of web activity. Hindsight can parse URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, Local Storage (HTML5 cookies), login data, and session/tab information. The tool produces chronological timelines in multiple output formats (XLSX, JSON, SQLite) that enable investigators to reconstruct user web activity for incident response, insider threat investigations, and criminal cases.

Analyzing Campaign Attribution Evidence

Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attribution indicators using the Diamond Model and ACH (Analysis of Competing Hypotheses), analyzing infrastructure overlaps, TTP consistency, malware code similarities, operational timing patterns, and language artifacts to build confidence-weighted attribution assessments.

Analyzing Certificate Transparency For Phishing

Certificate Transparency (CT) is an Internet security standard that creates a public, append-only log of all issued SSL/TLS certificates. Monitoring CT logs enables early detection of phishing domains that register certificates mimicking legitimate brands, unauthorized certificate issuance for owned domains, and certificate-based attack infrastructure. This skill covers querying CT logs via crt.sh, real-time monitoring with Certstream, building automated alerting for suspicious certificates, and integrating findings into threat intelligence workflows.

Analyzing Cloud Storage Access Patterns

- When investigating security incidents that require analyzing cloud storage access patterns - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Analyzing Cobalt Strike Beacon Configuration

Cobalt Strike is a commercial adversary simulation tool widely abused by threat actors for post-exploitation operations. Beacon payloads contain embedded configuration data that reveals C2 server addresses, communication protocols, sleep intervals, jitter values, malleable C2 profile settings, watermark identifiers, and encryption keys. Extracting this configuration from PE files, shellcode, or memory dumps is critical for incident responders to map attacker infrastructure and attribute campaigns. The beacon configuration is XOR-encoded using a single byte (0x69 for version 3, 0x2e for version 4) and stored in a Type-Length-Value (TLV) format within the .data section.

Analyzing Cobaltstrike Malleable C2 Profiles

Cobalt Strike Malleable C2 profiles are domain-specific language scripts that customize how Beacon communicates with the team server, defining HTTP request/response transformations, sleep intervals, jitter values, user agents, URI paths, and process injection behavior. Threat actors use malleable profiles to disguise C2 traffic as legitimate services (Amazon, Google, Slack). Analyzing these profiles reveals network indicators for detection: URI patterns, HTTP headers, POST/GET transforms, DNS settings, and process injection techniques. The dissect.cobaltstrike library can parse both profile files and extract configurations from beacon payloads, while pyMalleableC2 provides AST-based parsing using Lark grammar for programmatic profile manipulation and validation.

Analyzing Command And Control Communication

- Reverse engineering a malware sample has revealed network communication that needs protocol analysis - Building network-level detection signatures for a specific C2 framework (Cobalt Strike, Metasploit, Sliver) - Mapping C2 infrastructure including primary servers, fallback domains, and dead drops - Analyzing encrypted or encoded C2 traffic to understand the command set and data format - Attributing malware to a threat actor based on C2 infrastructure patterns and tooling

Analyzing Cyber Kill Chain

Use this skill when: - Conducting post-incident analysis to determine how far an adversary progressed through an attack sequence - Designing layered defensive controls with the goal of interrupting attacks at the earliest possible phase - Producing threat intelligence reports that communicate attack progression to non-technical stakeholders

Analyzing Disk Image With Autopsy

- When you have a forensic disk image and need structured analysis of its contents - During investigations requiring file recovery, keyword searching, and timeline analysis - When non-technical stakeholders need visual reports from forensic evidence - For examining file system metadata, deleted files, and embedded artifacts - When building a comprehensive case from multiple disk images

Analyzing Dns Logs For Exfiltration

Use this skill when: - SOC teams suspect data exfiltration through DNS tunneling to bypass firewall/proxy controls - Threat intelligence indicates adversaries using DNS-based C2 channels (e.g., Cobalt Strike DNS beacon) - UEBA detects anomalous DNS query volumes from specific hosts - Malware analysis reveals DNS-over-HTTPS (DoH) or DNS tunneling capabilities

Analyzing Docker Container Forensics

- When investigating a compromised Docker container or container host - For analyzing malicious Docker images pulled from registries - During incident response involving containerized application breaches - When examining container escape attempts or privilege escalation - For auditing container configurations and identifying misconfigurations

Analyzing Email Headers For Phishing Investigation

- When investigating a suspected phishing email to determine its true origin - For verifying sender authenticity and detecting email spoofing - During incident response when a user has clicked a phishing link - When tracing the delivery path and relay servers of a suspicious email - For validating SPF, DKIM, and DMARC alignment to identify forgery

Analyzing Ethereum Smart Contract Vulnerabilities

Smart contract vulnerabilities have led to billions of dollars in losses across DeFi protocols. Unlike traditional software, deployed smart contracts are immutable and handle real financial assets, making pre-deployment security analysis critical. Slither performs fast static analysis using an intermediate representation to detect over 90 vulnerability patterns in seconds, while Mythril uses symbolic execution and SMT solving to discover complex execution path vulnerabilities like reentrancy and integer overflows. This skill covers running both tools against Solidity contracts, interpreting results, triaging findings by severity, and generating audit reports.

Analyzing Golang Malware With Ghidra

Go (Golang) has become a popular language for malware authors due to its cross-compilation capabilities, static linking that produces self-contained binaries, and the complexity it introduces for reverse engineering. Go binaries contain the entire runtime, standard library, and all dependencies statically linked, resulting in large binaries (often 5-15MB) with thousands of functions. Ghidra struggles with Go-specific string formats (non-null-terminated), stripped function names, and goroutine concurrency patterns. Specialized tools like GoResolver (Volexity, 2025) use control-flow graph similarity to automatically deobfuscate and recover function names in stripped or obfuscated Go binaries.

Analyzing Heap Spray Exploitation

Heap spraying is an exploitation technique that fills large regions of a process's heap with attacker-controlled data (typically NOP sleds followed by shellcode) to increase the reliability of code execution exploits. This skill covers detecting heap spray artifacts in memory dumps using Volatility3's malfind, vadinfo, and memmap plugins, identifying suspicious contiguous memory allocations, scanning for NOP sled patterns (0x90, 0x0c0c0c0c), and extracting embedded shellcode for analysis.

Analyzing Indicators Of Compromise

Use this skill when: - A phishing email or alert generates IOCs (URLs, IP addresses, file hashes) requiring rapid triage - Automated feeds deliver bulk IOCs that need confidence scoring before ingestion into blocking controls - An incident investigation requires contextual enrichment of observed network artifacts

Analyzing Ios App Security With Objection

Use this skill when: - Performing runtime security assessment of iOS applications during authorized penetration tests - Inspecting iOS keychain, filesystem, and memory for sensitive data exposure - Bypassing client-side security controls (SSL pinning, jailbreak detection) during security testing - Evaluating iOS app behavior at runtime without access to source code

Analyzing Kubernetes Audit Logs

- When investigating security incidents that require analyzing kubernetes audit logs - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Analyzing Linux Audit Logs For Intrusion

- Investigating suspected unauthorized access or privilege escalation on Linux hosts - Hunting for evidence of exploitation, backdoor installation, or persistence mechanisms - Auditing compliance with security baselines (CIS, STIG, PCI-DSS) that require system call monitoring - Reconstructing a timeline of attacker actions during incident response - Detecting file tampering on critical system files such as /etc/passwd, /etc/shadow, or SSH keys

Analyzing Linux Elf Malware

- A Linux server or container has been compromised and suspicious ELF binaries are found - Analyzing Linux botnets (Mirai, Gafgyt, XorDDoS), cryptominers, or ransomware - Investigating malware targeting cloud infrastructure, Docker containers, or Kubernetes pods - Reverse engineering Linux rootkits and kernel modules - Analyzing cross-platform malware compiled for Linux x86_64, ARM, or MIPS architectures

Analyzing Linux Kernel Rootkits

Linux kernel rootkits operate at ring 0, modifying kernel data structures to hide processes, files, network connections, and kernel modules from userspace tools. Detection requires either memory forensics (analyzing physical memory dumps with Volatility3) or cross-view analysis (comparing /proc, /sys, and kernel data structures for inconsistencies). This skill covers using Volatility3 Linux plugins to detect syscall table hooks, hidden kernel modules, and modified function pointers, supplemented by live system scanning with rkhunter and chkrootkit.

Analyzing Linux System Artifacts

- When investigating a compromised Linux server or workstation - For identifying persistence mechanisms (cron, systemd, SSH keys) - When tracing user activity through shell history and authentication logs - During incident response to determine the scope of a Linux-based breach - For detecting rootkits, backdoors, and unauthorized modifications

Analyzing Lnk File And Jump List Artifacts

Windows LNK (shortcut) files and Jump Lists are critical forensic artifacts that provide evidence of file access, program execution, and user behavior. LNK files are created automatically when a user opens a file through Windows Explorer or the Open/Save dialog, storing metadata about the target file including its original path, timestamps, volume serial number, NetBIOS name, and MAC address of the host system. Jump Lists, introduced in Windows 7, extend this by maintaining per-application lists of recently and frequently accessed files. These artifacts persist even after the target files are deleted, making them invaluable for establishing that a user accessed specific files at specific times.

Analyzing Macro Malware In Office Documents

- A suspicious Office document (.doc, .docm, .xls, .xlsm, .ppt) has been flagged by email security - Investigating phishing campaigns that deliver weaponized Office documents - Extracting VBA macro code to identify the payload download URL and execution method - Analyzing obfuscated VBA code to understand the full attack chain - Determining if a document uses DDE, ActiveX, or remote template injection instead of macros

Analyzing Malicious Pdf With Peepdf

- When triaging suspicious PDF attachments from phishing emails - During malware analysis of PDF-based exploit documents - When extracting embedded JavaScript, shellcode, or executables from PDFs - For forensic examination of weaponized document artifacts - When building detection signatures for PDF-based threats

Analyzing Malicious Url With Urlscan

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolated environment. This skill covers using URLScan's web interface and API to investigate phishing URLs, credential harvesting pages, and malicious redirects without exposing the analyst's system to risk.

Analyzing Malware Behavior With Cuckoo Sandbox

- A suspicious sample passed static analysis triage and requires behavioral observation in a controlled environment - You need to capture network traffic, file drops, registry modifications, and API calls from a malware execution - Determining the full infection chain including second-stage payload downloads and persistence mechanisms - Generating behavioral signatures and YARA rules based on observed runtime activity - Automated analysis of bulk malware samples requiring consistent reporting

Analyzing Malware Family Relationships With Malpedia

Malpedia is a collaborative platform maintained by Fraunhofer FKIE that catalogs malware families with their aliases, YARA rules, threat actor associations, and reference reports. With over 2,600 malware families documented, it serves as the definitive resource for understanding malware lineages, tracking variant evolution, and linking malware to specific threat groups. This skill covers querying the Malpedia API, mapping malware family relationships, extracting YARA rules for detection, and building intelligence on malware ecosystems used by adversaries.

Analyzing Malware Persistence With Autoruns

Sysinternals Autoruns extracts data from hundreds of Auto-Start Extensibility Points (ASEPs) on Windows, scanning 18+ categories including Run/RunOnce keys, services, scheduled tasks, drivers, Winlogon entries, LSA providers, print monitors, WMI subscriptions, and AppInit DLLs. Digital signature verification filters Microsoft-signed entries. The compare function identifies newly added persistence via baseline diffing. VirusTotal integration checks hash reputation. Offline analysis via -z flag enables forensic disk image examination.

Analyzing Malware Sandbox Evasion Techniques

Sandbox evasion (MITRE ATT&CK T1497) allows malware to detect analysis environments and alter behavior to avoid detection. This skill analyzes behavioral reports from Cuckoo Sandbox and AnyRun for evasion indicators including timing-based checks (GetTickCount, QueryPerformanceCounter, sleep inflation), VM artifact detection (registry keys, MAC address prefixes, process names like vmtoolsd.exe), user interaction checks (mouse movement, keyboard input), and environment fingerprinting (disk size, CPU count, RAM). Detection rules flag samples exhibiting these behaviors for deeper manual analysis.

Analyzing Memory Dumps With Volatility

- A compromised system's RAM has been captured and needs forensic analysis for malware artifacts - Detecting fileless malware that exists only in memory without persistent disk artifacts - Extracting encryption keys, passwords, or decrypted configuration from process memory - Identifying process injection, DLL injection, or process hollowing in a compromised system - Analyzing rootkit activity that hides from standard disk-based forensic tools

Analyzing Memory Forensics With Lime And Volatility

- When investigating security incidents that require analyzing memory forensics with lime and volatility - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Analyzing Mft For Deleted File Recovery

The NTFS Master File Table ($MFT) is the central metadata repository for every file and directory on an NTFS volume. Each file is represented by at least one 1024-byte MFT record containing attributes such as $STANDARD_INFORMATION (timestamps, permissions), $FILE_NAME (name, parent directory, timestamps), and $DATA (file content or cluster run pointers). When a file is deleted, its MFT record is marked as inactive (InUse flag cleared) but the metadata remains until the entry is reallocated by a new file. This persistence makes MFT analysis a primary technique for recovering deleted file evidence, reconstructing file system timelines, and detecting anti-forensic activity such as timestomping.

Analyzing Network Covert Channels In Malware

Malware uses covert channels to disguise C2 communication and data exfiltration within legitimate-looking network traffic. DNS tunneling encodes data in DNS queries and responses (used by tools like iodine, dnscat2, and malware families like FrameworkPOS). ICMP tunneling hides data in echo request/reply payloads (icmpsh, ptunnel). HTTP covert channels embed C2 data in headers, cookies, or steganographic images. Protocol abuse exploits allowed protocols to bypass firewalls. DNS tunneling detection achieves 99%+ recall with modern ML-based approaches, though low-throughput exfiltration remains challenging. Palo Alto Unit42 tracked three major DNS tunneling campaigns (TrkCdn, SecShow, Savvy Seahorse) through 2024, showing the technique's continued prevalence.

Analyzing Network Flow Data With Netflow

- When investigating security incidents that require analyzing network flow data with netflow - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Analyzing Network Packets With Scapy

Scapy is a Python packet manipulation library that enables crafting, sending, sniffing, and dissecting network packets at granular protocol layers. This skill covers using Scapy for security-relevant tasks including TCP/UDP/ICMP packet crafting, pcap file analysis, protocol field extraction, SYN scan implementation, DNS query analysis, and detecting anomalous traffic patterns such as unusually fragmented packets or malformed headers.

Analyzing Network Traffic For Incidents

- SIEM alerts on anomalous network traffic patterns requiring deeper investigation - C2 beaconing is suspected and needs confirmation through packet-level analysis - Data exfiltration volume or destination must be quantified from network evidence - Lateral movement between systems needs to be traced through network connections - An IDS/IPS alert requires packet-level validation to confirm or dismiss

Analyzing Network Traffic Of Malware

- Sandbox execution has captured a PCAP file and the network behavior needs detailed analysis - Identifying the C2 protocol structure for writing network detection signatures - Determining what data the malware exfiltrates and to which external infrastructure - Analyzing DNS tunneling, domain generation algorithms (DGA), or fast-flux behavior - Creating Suricata/Snort signatures based on observed malware network patterns

Analyzing Network Traffic With Wireshark

- Investigating suspected network intrusions by examining packet-level evidence of command-and-control traffic, data exfiltration, or lateral movement - Diagnosing network performance issues such as retransmissions, fragmentation, or DNS resolution failures - Analyzing malware communication patterns by capturing traffic from sandboxed or isolated hosts - Validating firewall and IDS rules by confirming what traffic is actually traversing network segments - Extracting files, credentials, or indicators of compromise from captured network sessions

Analyzing Office365 Audit Logs For Compromise

Business Email Compromise (BEC) attacks often leave traces in Office 365 audit logs: suspicious inbox rule creation, email forwarding to external addresses, mailbox delegation changes, and unauthorized OAuth application consent grants. This skill uses the Microsoft Graph API to query the Unified Audit Log, enumerate inbox rules across mailboxes, detect forwarding configurations, and identify compromised account indicators.

Analyzing Outlook Pst For Email Forensics

Microsoft Outlook PST (Personal Storage Table) and OST (Offline Storage Table) files are critical evidence sources in digital forensics investigations. PST files store email messages, calendar events, contacts, tasks, and notes in a proprietary binary format based on the MAPI (Messaging Application Programming Interface) property system. Forensic analysis of these files enables recovery of deleted emails (from the Recoverable Items folder), extraction of email headers for tracing message routes, analysis of attachments for malware or exfiltrated data, and reconstruction of communication patterns. Modern PST files use Unicode format with 4KB pages and can grow up to 50GB, while legacy ANSI format is limited to 2GB.

Analyzing Packed Malware With Upx Unpacker

- Static analysis reveals high entropy sections and minimal imports indicating the binary is packed - PEiD, Detect It Easy, or PEStudio identifies UPX or another known packer - The import table contains only LoadLibrary and GetProcAddress (runtime import resolution typical of packed binaries) - You need to recover the original binary for proper disassembly and decompilation in Ghidra or IDA - Automated UPX decompression fails because the malware author modified UPX magic bytes or headers

Analyzing Pdf Malware With Pdfid

- A suspicious PDF attachment has been flagged by email security or reported by a user - You need to determine if a PDF contains embedded JavaScript, shellcode, or exploit code - Triaging PDF documents before opening them in a sandbox or analysis environment - Extracting embedded executables, scripts, or URLs from malicious PDF objects - Analyzing PDF exploit kits targeting Adobe Reader or other PDF viewer vulnerabilities

Analyzing Persistence Mechanisms In Linux

Adversaries establish persistence on Linux systems through crontab jobs, systemd service/timer units, LD_PRELOAD library injection, shell profile modifications (.bashrc, .profile), SSH authorized_keys backdoors, and init script manipulation. This skill scans for all known persistence vectors, checks file timestamps and integrity, and correlates findings with auditd logs to build a timeline of persistence installation.

Analyzing Powershell Empire Artifacts

PowerShell Empire is a post-exploitation framework consisting of listeners, stagers, and agents. Its artifacts leave detectable traces in Windows event logs, particularly PowerShell Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103). This skill analyzes event logs for Empire's default launcher string (powershell -noP -sta -w 1 -enc), Base64 encoded payloads containing System.Net.WebClient and FromBase64String, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast, Invoke-TokenManipulation), and staging URL patterns.

Analyzing Powershell Script Block Logging

- When investigating security incidents that require analyzing powershell script block logging - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Analyzing Prefetch Files For Execution History

- When determining which programs were executed on a Windows system and when - During malware investigations to confirm execution of suspicious binaries - For establishing a timeline of application usage during an incident - When correlating program execution with other forensic artifacts - To identify anti-forensic tools or unauthorized software that was run

Analyzing Ransomware Encryption Mechanisms

- A ransomware infection has occurred and recovery requires understanding the encryption scheme used - Assessing whether decryption is possible without paying the ransom (implementation flaws, known decryptors) - Reverse engineering ransomware to identify the encryption algorithm, key derivation, and key storage mechanism - Developing a decryptor tool when a weakness in the ransomware's cryptographic implementation is identified - Classifying a ransomware sample by its encryption approach to attribute it to a known family

Analyzing Ransomware Leak Site Intelligence

Ransomware groups operating under double-extortion models maintain data leak sites (DLS) on Tor hidden services where they post victim names, stolen data samples, and countdown timers to pressure payment. In H1 2025, 96 unique ransomware groups were active, listing approximately 535 victims per month. Monitoring these sites provides intelligence on active threat groups, targeted sectors, geographic patterns, and emerging ransomware families. This skill covers safely collecting DLS intelligence, extracting structured data, tracking group activity trends, and producing sector-specific risk assessments.

Analyzing Ransomware Network Indicators

Before and during ransomware execution, adversaries establish C2 channels, exfiltrate data, and download encryption keys. This skill analyzes Zeek conn.log and NetFlow data to detect beaconing patterns (regular-interval callbacks), connections to known TOR exit nodes, large outbound data transfers, and suspicious DNS activity associated with ransomware families.

Analyzing Ransomware Payment Wallets

- An organization has been hit by ransomware and the ransom note contains a Bitcoin or cryptocurrency wallet address that needs investigation - Law enforcement or incident responders need to trace where ransom payments flowed after the victim paid - Threat intelligence analysts are attributing ransomware campaigns by clustering payment infrastructure across incidents - Investigators need to determine if a ransomware group is reusing wallet infrastructure across multiple victims - Compliance or legal teams need evidence of fund flows for prosecution, sanctions enforcement, or insurance claims

Analyzing Sbom For Supply Chain Vulnerabilities

- A new regulatory requirement (EO 14028, EU CRA) mandates SBOM analysis for software deliveries - Security team needs to assess third-party risk by scanning vendor-provided SBOMs - CI/CD pipeline requires automated vulnerability checks against generated SBOMs - Incident response needs to determine if a newly disclosed CVE affects deployed software - Procurement team requires supply chain risk assessment for a software acquisition

Analyzing Security Logs With Splunk

- Investigating a security incident that requires correlation across multiple log sources - Hunting for adversary activity using known TTPs and IOCs - Building detection rules for specific attack patterns - Reconstructing an incident timeline from disparate log sources - Analyzing authentication anomalies, lateral movement, or data exfiltration patterns

Analyzing Slack Space And File System Artifacts

- When searching for hidden or residual data in file system slack space - For analyzing NTFS Master File Table (MFT) entries for deleted file metadata - When reconstructing file operations from the USN Change Journal - For detecting Alternate Data Streams (ADS) used to hide data or malware - During deep forensic analysis requiring examination beyond standard file recovery

Analyzing Supply Chain Malware Artifacts

Supply chain attacks compromise legitimate software distribution channels to deliver malware through trusted update mechanisms. Notable examples include SolarWinds SUNBURST (2020, affecting 18,000+ customers), 3CX SmoothOperator (2023, a cascading supply chain attack originating from Trading Technologies), and numerous npm/PyPI package poisoning campaigns. Analysis involves comparing trojanized binaries against legitimate versions, identifying injected code in build artifacts, examining code signing anomalies, and tracing the infection chain from initial compromise through payload delivery. As of 2025, supply chain attacks account for 30% of all breaches, a 100% increase from prior years.

Analyzing Threat Actor Ttps With Mitre Attack

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. This skill covers systematically mapping threat actor behavior to the ATT&CK framework, building technique coverage heatmaps using the ATT&CK Navigator, identifying detection gaps, and producing actionable intelligence reports that link observed IOCs to specific adversary techniques across the Enterprise, Mobile, and ICS matrices.

Analyzing Threat Actor Ttps With Mitre Navigator

The MITRE ATT&CK Navigator is a web application for annotating and visualizing ATT&CK matrices. Combined with the attackcti Python library (which queries ATT&CK STIX data via TAXII), analysts can programmatically generate Navigator layer files mapping specific threat group TTPs, compare multiple groups, and assess detection coverage gaps against known adversaries.

Analyzing Threat Intelligence Feeds

Use this skill when: - Ingesting new commercial or OSINT threat feeds and assessing their signal-to-noise ratio - Normalizing heterogeneous IOC formats (STIX 2.1, OpenIOC, YARA, Sigma) into a unified schema - Evaluating feed freshness, fidelity, and relevance to the organization's threat profile - Building automated enrichment pipelines that correlate IOCs against SIEM events

Analyzing Threat Landscape With Misp

- When investigating security incidents that require analyzing threat landscape with misp - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Analyzing Tls Certificate Transparency Logs

- When investigating security incidents that require analyzing tls certificate transparency logs - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Analyzing Typosquatting Domains With Dnstwist

DNSTwist is a domain name permutation engine that generates similar-looking domain names to detect typosquatting, homograph phishing attacks, and brand impersonation. It creates thousands of domain permutations using techniques like character substitution, transposition, insertion, omission, and homoglyph replacement, then checks DNS records (A, AAAA, NS, MX), calculates web page similarity using fuzzy hashing (ssdeep) and perceptual hashing (pHash), and identifies potentially malicious registered domains.

Analyzing Uefi Bootkit Persistence

- A compromised system re-establishes C2 communication after OS reinstallation or disk replacement - Secure Boot has been tampered with, disabled, or shows unexpected Machine Owner Key (MOK) enrollment - Firmware integrity verification fails against vendor-provided baselines - Memory forensics reveals rootkit components loading during early boot phase - Investigating advanced persistent threat (APT) campaigns known to deploy UEFI implants - Auditing firmware security posture for enterprise endpoint hardening

Analyzing Usb Device Connection History

- When investigating potential data exfiltration via removable storage devices - During insider threat investigations to track USB device usage - For compliance audits verifying removable media policy enforcement - When correlating USB connections with file access and copy events - For establishing a timeline of device connections during an incident

Analyzing Web Server Logs For Intrusion

- When investigating security incidents that require analyzing web server logs for intrusion - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Analyzing Windows Amcache Artifacts

- Determining which programs have existed or executed on a Windows system during incident response - Correlating SHA-1 hashes from Amcache against known malware databases (VirusTotal, CIRCL, MISP) - Building an application installation and execution timeline for forensic investigations - Identifying deleted executables that leave traces in Amcache even after file removal - Investigating insider threats by documenting which portable or unauthorized applications were present - Analyzing driver loading history to detect rootkits or malicious kernel modules

Analyzing Windows Event Logs In Splunk

Use this skill when: - SOC analysts investigate alerts related to Windows authentication, process execution, or AD changes - Detection engineers build SPL queries for Windows-based threat detection - Incident responders need forensic timelines of Windows endpoint or domain controller activity - Periodic threat hunting targets Windows-specific ATT&CK techniques

Analyzing Windows Lnk Files For Artifacts

- When reconstructing user file access history from Windows shortcut files - For tracking accessed files, network shares, and removable media - During investigations to prove a user opened specific documents - When correlating file access with other timeline artifacts - For identifying accessed paths on remote systems or USB devices

Analyzing Windows Prefetch With Python

Windows Prefetch files (.pf) record application execution data including executable names, run counts, timestamps, loaded DLLs, and accessed directories. This skill covers parsing Prefetch files using the windowsprefetch Python library to reconstruct execution timelines, detect renamed or masquerading binaries by comparing executable names with loaded resources, and identifying suspicious programs that may indicate malware execution or lateral movement.

Analyzing Windows Registry For Artifacts

- When investigating user activity on a Windows system during an incident - For identifying autorun/persistence mechanisms used by malware - When tracing installed software, USB devices, and network connections - During insider threat investigations to reconstruct user actions - For correlating registry timestamps with other forensic artifacts

Analyzing Windows Shellbag Artifacts

Shellbags are Windows registry artifacts that track how users interact with folders through Windows Explorer, storing view settings such as icon size, window position, sort order, and view mode. From a forensic perspective, Shellbags provide definitive evidence of folder access -- even folders that no longer exist on the system. When a user browses to a folder via Windows Explorer, the Open/Save dialog, or the Control Panel, a Shellbag entry is created or updated in the user's registry hive. These entries persist after folder deletion, drive disconnection, and even across user profile resets, making them invaluable for proving that a user navigated to specific directories on local drives, USB devices, network shares, or zip archives.

Assessing Vector And Embedding Weaknesses

Retrieval-Augmented Generation (RAG) systems convert documents into embedding vectors stored in a vector database (Pinecone, Qdrant, Weaviate, Chroma, pgvector, FAISS) and retrieve the nearest vectors to ground LLM responses. OWASP LLM08:2025 Vector and Embedding Weaknesses covers the security risks unique to this layer:

Attacking Entra Id With Roadtools

ROADtools (by Dirk-jan Mollema) is the de facto offensive toolkit for Microsoft Entra ID. It has two main components:

Attacking Oauth With Device Code Phishing

The OAuth 2.0 Device Authorization Grant (RFC 8628) was designed for input-constrained devices (smart TVs, CLI tools) that cannot easily present a browser-based login. A device requests a short user_code and a device_code, displays the user_code and a verification URL to the user, and polls the token endpoint while the user authenticates on a separate, fully-featured device. Attackers weaponize this flow: instead of a smart TV, the "device" is the attacker's machine. The attacker initiates the device-code request, then phishes a victim to visit the legitimate Microsoft verification page (https://microsoft.com/devicelogin) and enter the attacker-generated user_code. Because the victim authenticates on the genuine Microsoft login page — completing MFA — the resulting tokens are minted to the attacker's polling session. This bypasses MFA entirely: the second factor is satisfied by the victim, but the bearer tokens land with the attacker (mapped to MITRE ATT&CK T1528 – Steal Application Access Token).

Auditing Aws S3 Bucket Permissions

- When conducting a security assessment of AWS environments to identify publicly exposed data - When onboarding a new AWS account and establishing a security baseline for storage resources - When responding to an alert about potential S3 data exposure from AWS Trusted Advisor or Security Hub - When compliance frameworks (SOC 2, PCI DSS, HIPAA) require periodic review of data access controls - When a breach or credential compromise necessitates immediate review of all accessible S3 resources

Auditing Azure Active Directory Configuration

- When performing a security assessment of an Azure tenant's identity configuration - When compliance audits require review of authentication policies, MFA enforcement, and role assignments - When onboarding a new Azure tenant after merger or acquisition - When investigating suspicious sign-in activity or compromised accounts - When validating conditional access policies adequately protect against identity-based attacks

Auditing Cloud With Cis Benchmarks

- When performing initial security audits of cloud environments against industry-standard benchmarks - When preparing for SOC 2, ISO 27001, or regulatory audits that reference CIS controls - When establishing a measurable security baseline for new cloud accounts or subscriptions - When tracking compliance improvement over time with periodic reassessment - When evaluating the security posture of acquired or inherited cloud environments

Auditing Entra Id With Aadinternals

AADInternals is the most comprehensive offensive/administrative PowerShell toolkit for Microsoft Entra ID (formerly Azure AD), Azure AD Connect, and Active Directory Federation Services (AD FS), authored by Dr. Nestori Syynimaa (Gerenios / Secureworks). It exposes hundreds of cmdlets (all prefixed AADInt) covering unauthenticated outsider reconnaissance, access-token acquisition for every Microsoft API, directory manipulation, AD FS/PTA attacks, and the technique it is most famous for: federation backdoors that abuse the Set-MsolDomainFederationSettings / ConvertTo-AADIntBackdoor path so an attacker who controls a federated domain's IssuerUri can mint SAML tokens for arbitrary users — mapping to MITRE ATT&CK T1606.002 (Forge Web Credentials: SAML Tokens), the same class of technique used in the SolarWinds (Golden SAML) intrusions.

Auditing Foundry Smart Contract Security

Deployed smart contracts are immutable and custody real funds, so a bug shipped to mainnet cannot be patched — it can only be exploited. Most catastrophic DeFi losses come from a small set of recurring classes: reentrancy, broken access control, oracle/price manipulation, and unchecked arithmetic or external calls.

Auditing Gcp Iam Permissions

- When performing security assessments of GCP organization or project IAM configurations - When identifying service accounts with excessive permissions or unused access - When compliance requirements mandate review of access controls and role assignments - When investigating potential lateral movement through IAM misconfigurations - When reducing the blast radius of compromised credentials by scoping down permissions

Auditing Kubernetes Cluster Rbac

- When performing security assessments of Kubernetes clusters (EKS, GKE, AKS, or self-managed) - When validating that RBAC policies enforce least privilege for users and service accounts - When investigating potential lateral movement or privilege escalation within a Kubernetes cluster - When compliance audits require documentation of access controls and permissions - When onboarding new teams to a shared cluster and defining appropriate RBAC policies

Auditing Kubernetes Rbac Privilege Escalation

Kubernetes Role-Based Access Control (RBAC, MITRE ATT&CK T1078 Valid Accounts) governs what every user and service account may do via Role/ClusterRole rules bound by RoleBinding/ClusterRoleBinding. Because workloads run with a mounted service-account token by default, an attacker who compromises one pod inherits that account's RBAC rights. Over-permissive bindings turn a single compromised pod into a cluster takeover: certain verbs and resources are "RBAC-equivalent to cluster-admin."

Auditing Mcp Servers For Tool Poisoning

The Model Context Protocol (MCP) lets AI agents discover and call external tools advertised by MCP servers. Each tool exposes a name and a natural-language description that the agent's LLM reads *before* deciding to call it. In early 2025, Invariant Labs disclosed that this description field is an attack surface: a malicious server can embed hidden instructions in a tool's description (a tool poisoning attack, OWASP MCP03:2025), and a capable model will silently follow them — exfiltrating files, leaking secrets, or redirecting tool calls — while returning a normal-looking response to the user. Because tool descriptions are loaded into the agent's context, tool poisoning is effectively indirect prompt injection delivered through the supply chain (MITRE ATLAS AML.T0010 ML Supply Chain Compromise).

Auditing Terraform Infrastructure For Security

- When integrating security scanning into CI/CD pipelines for Terraform deployments - When reviewing Terraform plans and modules for security best practices before applying - When building policy-as-code guardrails for cloud infrastructure provisioning - When auditing existing Terraform state files to identify deployed misconfigurations - When enforcing organizational security standards across multiple Terraform projects

Auditing Tls Certificate Transparency Logs

- Monitoring owned domains for unauthorized or unexpected certificate issuance by unknown Certificate Authorities - Discovering subdomains and hidden services through certificates logged in public CT logs - Detecting phishing infrastructure that uses look-alike domain certificates (typosquatting, homograph attacks) - Auditing Certificate Authority compliance by verifying all issued certificates appear in CT logs as required by browser policies - Building continuous certificate monitoring into a security operations pipeline with alerting for new issuances

Auditing Uefi Firmware With Chipsec

CHIPSEC is the open-source Platform Security Assessment Framework created by Intel's Advanced Threat Research team. It inspects the low-level security configuration of x86 platform firmware and hardware — the layer below the operating system where bootkits and firmware implants live. CHIPSEC loads a signed kernel driver (Linux, Windows, or it can run from the UEFI shell) to read and write hardware registers, Model-Specific Registers (MSRs), PCI config space, SPI flash, and UEFI variables, then runs an automated test suite that checks whether the platform's defensive locks are actually engaged.

Automating Ioc Enrichment

Use this skill when: - Building a SOAR playbook that automatically enriches SIEM alerts with threat intelligence context before routing to analysts - Creating a Python pipeline for bulk IOC enrichment from phishing email submissions - Reducing analyst mean time to triage (MTTT) by pre-populating alert context with VT, Shodan, and MISP data

Benchmarking Kubernetes With Kube Bench

kube-bench (by Aqua Security) is an open-source tool that checks whether a Kubernetes cluster is deployed securely by running the checks documented in the CIS Kubernetes Benchmark. It inspects the control-plane components (API server, controller manager, scheduler, etcd), the kubelet and worker-node configuration, and cluster-wide policy settings, then reports each check as PASS, FAIL, WARN, or INFO with a remediation recommendation drawn directly from the CIS guidance. Tests are configuration-driven YAML files, so kube-bench tracks new Kubernetes versions and benchmark revisions and supports managed distributions (EKS, GKE, AKS, ACK, OpenShift, RKE, k3s).

Building Adversary Infrastructure Tracking System

Adversary infrastructure tracking uses passive DNS records, certificate transparency logs, WHOIS registration data, and IP enrichment to discover, map, and monitor threat actor command-and-control (C2) networks. Attackers frequently reuse hosting providers, registrars, SSL certificates, and naming patterns across campaigns, enabling analysts to pivot from known indicators to discover new infrastructure. This skill covers building an automated tracking system that identifies infrastructure relationships, detects newly registered domains matching adversary patterns, and maintains a continuously updated map of threat actor networks.

Building Attack Pattern Library From Cti Reports

Cyber threat intelligence (CTI) reports from vendors like Mandiant, CrowdStrike, Talos, and Microsoft contain detailed descriptions of adversary behaviors that can be extracted, normalized, and cataloged into a structured attack pattern library. This skill covers parsing CTI reports to extract adversary techniques, mapping behaviors to MITRE ATT&CK technique IDs, creating STIX 2.1 Attack Pattern objects, building a searchable library indexed by tactic, technique, and threat actor, and generating detection rule templates from documented patterns.

Building Automated Malware Submission Pipeline

Use this skill when: - SOC teams face high volume of suspicious file alerts requiring sandbox analysis - Manual sandbox submission creates bottlenecks in alert triage workflow - Endpoint and email security tools quarantine files needing automated verdict determination - Incident response requires rapid malware family identification and IOC extraction

Building C2 Infrastructure With Sliver Framework

Sliver is an open-source, cross-platform adversary emulation framework developed by BishopFox, written in Go. It provides red teams with implant generation, multi-protocol C2 channels (mTLS, HTTP/S, DNS, WireGuard), multi-operator support, and extensive post-exploitation capabilities. Sliver supports beacon (asynchronous) and session (interactive) modes, making it suitable for both long-haul operations and interactive exploitation. A properly architected Sliver infrastructure uses redirectors, domain fronting, and HTTPS certificates to maintain operational resilience and avoid detection.

Building C2 Redirector Infrastructure

A C2 redirector is an intermediary host that sits between victim implants and the real team server. Beacons connect to the redirector's public domain/IP; the redirector inspects each request and either proxies legitimate C2 traffic back to the hidden team server or diverts everything else (scanners, blue-team analysts, sandboxes) to a benign decoy site. This protects the team server from discovery, takedown, and attribution, and lets operators rotate the public edge without rebuilding the backend. The technique maps to MITRE ATT&CK T1090.002 (Proxy: External Proxy) — adversaries route C2 through an intermediary node to obscure the true origin.

Building Cloud Siem With Sentinel

- When establishing a centralized security operations center for multi-cloud environments - When migrating from legacy SIEM platforms (Splunk, QRadar) to cloud-native architecture - When building automated incident response workflows for cloud-specific threats - When performing large-scale threat hunting across petabytes of security telemetry - When integrating threat intelligence feeds with cloud security log analysis

Building Detection Rule With Splunk Spl

Splunk Search Processing Language (SPL) is the primary query language used in Splunk Enterprise Security for building correlation searches that detect suspicious events and patterns. A well-crafted detection rule aggregates, correlates, and enriches security events to generate actionable notable events for SOC analysts. Enterprise SIEMs on average cover only 21% of MITRE ATT&CK techniques, making skilled SPL rule writing essential for closing detection gaps.

Building Detection Rules With Sigma

Use this skill when: - SOC engineers need to create detection rules portable across multiple SIEM platforms - Threat intelligence reports describe TTPs requiring new detection coverage - Existing vendor-specific rules need standardization into a shareable format - The team adopts Sigma as a detection-as-code standard in CI/CD pipelines

Building Devsecops Pipeline With Gitlab Ci

GitLab provides an integrated DevSecOps platform that embeds security testing directly into the CI/CD pipeline. By leveraging GitLab's built-in security scanners---SAST, DAST, container scanning, dependency scanning, secret detection, and license compliance---teams can shift security left, catching vulnerabilities during development rather than post-deployment. GitLab Duo AI assists with false positive detection for SAST vulnerabilities, helping security teams focus on genuine issues.

Building Identity Federation With Saml Azure Ad

Identity federation enables users authenticated by one identity provider to access resources managed by another without maintaining separate credentials. This skill covers establishing SAML 2.0 federation between an organization's on-premises Active Directory (via AD FS or third-party IdP) and Microsoft Entra ID (formerly Azure AD), as well as configuring federated SSO for third-party SaaS applications. Federation eliminates password synchronization concerns and keeps authentication authority on-premises while extending SSO to cloud resources.

Building Identity Governance Lifecycle Process

- Organization lacks automated joiner-mover-leaver (JML) processes for identity management - Access provisioning is manual and takes days, creating productivity loss and security gaps - Former employees retain access to systems after termination (orphaned accounts) - Role explosion has created thousands of roles with unclear ownership and overlapping entitlements - Compliance requirements mandate documented identity lifecycle processes (SOX, HIPAA, GDPR) - No centralized visibility into who has access to what across the enterprise

Building Incident Response Dashboard

Use this skill when: - IR teams need real-time dashboards during active incidents for coordination and tracking - SOC leadership requires operational dashboards showing incident status and analyst workload - Post-incident reviews need visual timelines and impact assessments - Executive briefings require high-level incident metrics and trend analysis

Building Incident Response Playbook

- Establishing or maturing an incident response program from scratch - Documenting procedures for a new incident type after a novel attack - Automating response workflows in a SOAR platform (Cortex XSOAR, Splunk SOAR) - Preparing for compliance audits requiring documented IR procedures (SOC 2, PCI-DSS, HIPAA) - Conducting a gap analysis of existing IR capabilities against specific threat scenarios

Building Incident Timeline With Timesketch

Timesketch is an open-source collaborative forensic timeline analysis tool developed by Google that enables security teams to visualize and analyze chronological data from multiple sources during incident investigations. It ingests logs and artifacts from endpoints, servers, and cloud services, normalizes them into a unified searchable timeline, and provides powerful analysis capabilities including built-in analyzers, tagging, sketch annotations, and story building. Timesketch integrates with Plaso (log2timeline) for artifact parsing and supports direct CSV/JSONL ingestion for rapid timeline construction during active incidents.

Building Ioc Defanging And Sharing Pipeline

IOC defanging modifies potentially malicious indicators (URLs, IP addresses, domains, email addresses) to prevent accidental clicks or execution while preserving readability for analysis and sharing. This skill covers building an automated pipeline that ingests raw IOCs from multiple sources, normalizes and deduplicates them, applies defanging for safe human consumption, converts them to STIX 2.1 format for machine consumption, and distributes through TAXII servers, MISP instances, and email reports.

Building Ioc Enrichment Pipeline With Opencti

OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its native data model. This skill covers building an automated IOC enrichment pipeline using OpenCTI's connector ecosystem to enrich indicators with context from VirusTotal, Shodan, AbuseIPDB, GreyNoise, and other sources. The pipeline automatically enriches newly ingested indicators, correlates them with known threat actors and campaigns, and scores them for analyst prioritization.

Building Malware Incident Communication Template

Effective communication during malware incidents is critical for coordinated response, stakeholder management, and regulatory compliance. A structured communication framework ensures the right people receive appropriate information at the right time, preventing panic while maintaining transparency. Communication templates should cover internal escalation, executive briefings, technical advisories for IT teams, customer notifications, regulatory disclosures, and media statements. The framework must account for different malware types (ransomware, wiper, trojan, worm) and severity levels that drive escalation speed and audience.

Building Patch Tuesday Response Process

Microsoft releases security updates on the second Tuesday of each month ("Patch Tuesday"), addressing vulnerabilities across Windows, Office, Exchange, SQL Server, Azure services, and other products. In 2025, Microsoft patched over 1,129 vulnerabilities across the year -- an 11.9% increase from 2024 -- making a structured response process critical. The leading risk types include elevation of privilege (49%), remote code execution (34%), and information disclosure (7%). This skill covers building a repeatable Patch Tuesday response workflow from initial advisory review through testing, deployment, and validation.

Building Phishing Reporting Button Workflow

A phishing reporting button empowers users to flag suspicious emails directly from their email client, creating a critical feedback loop between end users and the security operations center. Microsoft's built-in Report button is now the recommended approach, replacing the deprecated Report Message and Report Phishing add-ins. When combined with automated triage using SOAR platforms, reported emails can be classified, IOCs extracted, and remediation actions taken within minutes. Organizations with effective phishing reporting programs see 70%+ report rates in phishing simulations.

Building Ransomware Playbook With Cisa Framework

- An organization needs to create or update its ransomware incident response playbook following CISA guidelines - A security team is conducting a ransomware readiness assessment against the CISA StopRansomware framework - Compliance requires documenting ransomware response procedures aligned with NIST CSF and CISA recommendations - During tabletop exercises to validate that the organization's ransomware response steps match industry best practices - After a ransomware incident to update the playbook with lessons learned and close identified gaps

Building Red Team C2 Infrastructure With Havoc

Havoc is a modern, open-source post-exploitation command and control (C2) framework created by C5pider. It provides a collaborative multi-operator interface similar to Cobalt Strike, featuring the Demon agent for Windows post-exploitation, customizable profiles for traffic malleable configurations, and support for HTTP/HTTPS/SMB listeners. This skill covers deploying production-grade Havoc C2 infrastructure with proper OPSEC considerations for authorized red team engagements.

Building Role Mining For Rbac Optimization

Role mining is the process of analyzing existing user-permission assignments to discover optimal roles for a Role-Based Access Control (RBAC) system. Organizations accumulate excessive permissions over time through job changes, project assignments, and ad-hoc access grants, leading to "role explosion" where thousands of granular roles exist with significant overlap. Role mining uses data analysis -- including clustering algorithms, formal concept analysis, and graph-based methods -- to consolidate permissions into a minimal set of roles that accurately represent business functions while enforcing least privilege.

Building Soc Escalation Matrix

A SOC escalation matrix defines how security incidents move through the organization based on severity, impact, and response requirements. Modern SOCs use context-driven escalation combining business risk, asset criticality, and data sensitivity rather than purely severity-based models. Organizations using AI and automation in their SOC cut detection-and-containment lifecycle to approximately 161 days, an 80-day improvement over the 241-day industry average.

Building Soc Metrics And Kpi Tracking

Use this skill when: - SOC leadership needs data-driven visibility into operational performance - Continuous improvement programs require baseline measurements and trend tracking - Executive reporting demands quantified security posture and ROI metrics - Staffing decisions need objective workload and capacity data - Compliance audits require documented SOC performance evidence

Building Soc Playbook For Ransomware

Use this skill when: - SOC teams need a standardized ransomware response playbook for Tier 1-3 analysts - An organization lacks documented procedures for ransomware containment and recovery - Tabletop exercises reveal gaps in ransomware response coordination - Compliance requirements (NIST CSF, ISO 27001) mandate documented incident playbooks

Building Super Timelines With Plaso

Plaso (Plaso Langar Að Safna Öllu) is the open-source engine behind log2timeline, the standard for building forensic *super timelines* — a single chronological, normalized view fusing hundreds of artifact types (file-system MACB times, registry, EVTX, browser history, prefetch, LNK, $UsnJrnl, syslog, and more) into one timeline. Plaso has three core CLI tools:

Building Threat Actor Profile From Osint

Threat actor profiling using OSINT systematically gathers and analyzes publicly available information to build comprehensive profiles of adversary groups. This skill covers collecting intelligence from public sources (security vendor reports, paste sites, dark web forums, social media, code repositories), correlating indicators across platforms, mapping adversary infrastructure using tools like Maltego and SpiderFoot, and producing structured threat actor dossiers that inform defensive strategies and attribution assessments.

Building Threat Feed Aggregation With Misp

MISP is the leading open-source threat intelligence platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat intelligence. It aggregates feeds from OSINT sources, commercial providers, and sharing communities into a unified platform with automatic correlation, STIX/TAXII export, and direct integration with SIEMs and security tools. This skill covers deploying MISP via Docker, configuring feeds from sources like abuse.ch, AlienVault OTX, and CIRCL, setting up automated feed synchronization, and integrating with Splunk, Elasticsearch, and SOAR platforms.

Building Threat Hunt Hypothesis Framework

- When proactively hunting for indicators of building threat hunt hypothesis framework in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Building Threat Intelligence Enrichment In Splunk

Splunk's Threat Intelligence Framework in Enterprise Security enables SOC teams to automatically correlate indicators of compromise (IOCs) against security events. The framework ingests threat feeds, normalizes indicators into KV Store collections, and uses lookup-based correlation searches to flag matching events. Splunk Threat Intelligence Management centralizes collection, normalization, and enrichment from multiple sources, reducing triage time by providing analysts with immediate context.

Building Threat Intelligence Feed Integration

Use this skill when: - SOC teams need automated ingestion of threat intelligence feeds into SIEM platforms - Multiple TI sources require normalization into a common format (STIX 2.1) - Detection systems need real-time IOC matching against network and endpoint telemetry - TI feed quality assessment and deduplication processes need to be established

Building Threat Intelligence Platform

Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. This skill covers designing TIP architecture using open-source tools (MISP, OpenCTI, TheHive, Cortex), configuring feed ingestion pipelines, establishing enrichment workflows, implementing STIX/TAXII interoperability, and building analyst dashboards for CTI operations.

Building Vulnerability Aging And Sla Tracking

With over 30,000 new vulnerabilities identified in 2024 (a 17% increase from the prior year), organizations must track how long vulnerabilities remain unpatched and whether remediation occurs within defined Service Level Agreements (SLAs). Vulnerability aging measures the time between discovery and remediation, while SLA tracking enforces severity-based deadlines. Industry benchmarks indicate standard SLAs of 14 days for critical, 30 days for high, 60 days for medium, and 90 days for low vulnerabilities, though more aggressive timelines (24-48 hours for actively exploited critical CVEs) are increasingly common. This skill covers designing SLA policies, building aging dashboards, implementing automated escalations, and generating compliance metrics.

Building Vulnerability Dashboard With Defectdojo

DefectDojo is an open-source application vulnerability management platform that aggregates findings from 200+ security tools, deduplicates results, tracks remediation progress, and provides executive dashboards. It serves as a central hub for vulnerability management, integrating with CI/CD pipelines, Jira for ticketing, and Slack for notifications. DefectDojo supports OWASP-based categorization and provides REST API for automation.

Building Vulnerability Exception Tracking System

A vulnerability exception tracking system manages cases where vulnerabilities cannot be remediated within SLA timelines. It provides structured workflows for requesting exceptions, documenting compensating controls, obtaining risk acceptance approvals, and automatically expiring exceptions when their validity period ends. This ensures organizations maintain visibility into accepted risks while complying with frameworks like PCI DSS, SOC 2, and NIST CSF.

Building Vulnerability Scanning Workflow

Use this skill when: - SOC teams need to establish or improve recurring vulnerability scanning programs - Scan results require prioritization beyond raw CVSS scores using asset context and threat intelligence - Vulnerability data must be integrated into SIEM for correlation with exploitation attempts - Remediation tracking needs formalization with SLA-based dashboards and reporting

Bypassing Authentication With Forced Browsing

- During authorized penetration tests to discover hidden or unprotected administrative pages - When testing whether authentication is consistently enforced across all application endpoints - For identifying backup files, configuration files, and debug interfaces left exposed in production - When assessing access control on API endpoints that should require authentication - During security audits to validate that all sensitive resources enforce session validation

Coercing Authentication With Coercer Petitpotam

Many Windows RPC interfaces expose methods that take a UNC path and cause the receiving server to authenticate to that path using its machine account. An attacker who can reach these interfaces can force a target (commonly a Domain Controller) to authenticate to an attacker-controlled host. On its own this is "Forced Authentication"; combined with an NTLM relay, the coerced machine credential is relayed to a service that does not enforce signing/EPA, most famously AD CS Web Enrollment (ESC8), yielding a certificate for the Domain Controller and ultimately domain compromise.

Collecting Indicators Of Compromise

- During active incident response to identify and block adversary infrastructure - Post-incident to document all observed adversary artifacts for future detection - When sharing threat intelligence with ISACs, sector partners, or law enforcement - When building detection rules in SIEM, EDR, or network security tools - When enriching IOCs with threat intelligence context for risk scoring

Collecting Open Source Intelligence

Use this skill when: - Investigating external infrastructure associated with a phishing campaign targeting your organization - Enriching threat actor profiles with publicly observable indicators (WHOIS, ASN data, SSL certificates) - Conducting authorized attack surface discovery to understand your organization's external exposure

Collecting Threat Intelligence With Misp

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat intelligence, financial fraud information, vulnerability information, or counter-terrorism information. This skill covers deploying MISP, configuring threat feeds, using the PyMISP API for programmatic access, and building automated collection pipelines that aggregate IOCs from multiple community and commercial sources.

Collecting Volatile Evidence From Compromised Host

- Security incident confirmed and compromised host identified - Before system isolation, shutdown, or remediation begins - Memory-resident malware suspected (fileless attacks) - Need to capture network connections, running processes, and system state - Legal proceedings may require forensic evidence preservation - Incident requires root cause analysis with volatile data

Conducting Api Security Testing

- Testing API endpoints for authorization flaws, injection vulnerabilities, and business logic bypasses - Assessing the security of microservices architecture where APIs are the primary communication method - Validating that API gateway protections (rate limiting, authentication, input validation) are properly enforced - Testing third-party API integrations for data exposure and insecure configurations - Evaluating GraphQL APIs for introspection disclosure, query complexity attacks, and authorization bypasses

Conducting Cloud Incident Response

- Cloud security posture management (CSPM) alerts on unauthorized resource changes - CloudTrail, Azure Activity Logs, or GCP Audit Logs show suspicious API calls - Cloud access keys or service principal credentials are suspected compromised - Unauthorized compute instances, storage buckets, or IAM changes are detected - A cloud-hosted application is breached and attacker activity spans cloud services

Conducting Cloud Penetration Testing

- When performing authorized security assessments of cloud environments before production deployment - When validating cloud security controls after a major architectural change or migration - When compliance requirements mandate annual penetration testing of cloud infrastructure - When testing incident response readiness by simulating realistic cloud-based attack scenarios - When assessing lateral movement risk across multi-account or multi-cloud environments

Conducting Cyber Risk Assessment With Nist 800 30

- When the organization needs a real risk *assessment* — an analysis of specific threats, likelihoods, and impacts — rather than a maturity score against a framework. (Maturity tells you how mature your practices are; a risk assessment tells you what could hurt you and how badly.) - When another framework requires a documented risk analysis as a mandatory input: NIST CSF (ID.RA), ISO 27001 (Clause 6.1.2), NIST RMF / 800-37 (the Prepare and Select steps), SOC 2 (CC3), PCI DSS, or HIPAA (§164.308(a)(1)(ii)(A)). - When standing up or significantly changing a system and you must understand its risk before authorization or go-live. - When leadership asks for the organization's top risks, ranked, with a rationale they can defend to a board or regulator. - When building or refreshing an enterprise risk register.

Conducting Domain Persistence With Dcsync

DCSync is an attack technique that abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller and request password data from the target DC. The attack was introduced by Benjamin Delpy (Mimikatz author) and Vincent Le Toux, leveraging the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights. Any principal (user or computer) with these rights can replicate password hashes for any account in the domain, including the KRBTGT account. With the KRBTGT hash, attackers can forge Golden Tickets for indefinite domain persistence. DCSync is categorized as MITRE ATT&CK T1003.006 and is a critical post-exploitation technique used by APT groups including APT28 (Fancy Bear), APT29 (Cozy Bear), and FIN6.

Conducting External Reconnaissance With Osint

- Performing the initial reconnaissance phase of a penetration test to gather intelligence before active scanning - Mapping an organization's external attack surface to identify unknown or shadow IT assets - Collecting employee information, email formats, and organizational structure for social engineering campaigns - Identifying exposed credentials, leaked data, or sensitive documents published on the internet - Scoping the breadth of an organization's digital footprint prior to a red team engagement

Conducting Full Scope Red Team Engagement

A full-scope red team engagement simulates real-world adversary behavior across all phases of the cyber kill chain — from initial reconnaissance through data exfiltration — to evaluate an organization's detection, prevention, and response capabilities. Unlike penetration testing, red team operations prioritize stealth, persistence, and objective-based scenarios that mimic advanced persistent threats (APTs).

Conducting Internal Network Penetration Test

An internal network penetration test simulates an attacker who has already gained access to the internal network or a malicious insider. The tester operates from an "assumed breach" position — typically a standard domain workstation or network jack — and attempts lateral movement, privilege escalation, credential harvesting, and data exfiltration to determine the blast radius of a compromised endpoint.

Conducting Internal Reconnaissance With Bloodhound Ce

BloodHound Community Edition (CE) is a modern, web-based Active Directory reconnaissance platform developed by SpecterOps that uses graph theory to reveal hidden relationships and attack paths within AD environments. Unlike the legacy BloodHound application, BloodHound CE uses a PostgreSQL backend with a dedicated graph database, providing improved performance, a modern web UI, and enhanced API capabilities. Red teams use BloodHound CE to collect AD objects, ACLs, sessions, group memberships, and trust relationships, then visualize attack paths from compromised low-privileged accounts to high-value targets like Domain Admins. The SharpHound collector (v2 for CE) gathers data from Active Directory, while AzureHound collects from Azure AD / Entra ID environments.

Conducting Malware Incident Response

- EDR or antivirus detects malware execution on one or more endpoints - A user reports suspicious system behavior indicative of malware infection - Threat intelligence indicates a malware campaign targeting the organization's industry - Network monitoring detects beaconing traffic consistent with known malware C2 patterns - A file detonation in a sandbox returns a malicious verdict

Conducting Man In The Middle Attack Simulation

- Testing whether applications properly validate TLS certificates and enforce encrypted communications - Demonstrating the risk of cleartext protocols (HTTP, FTP, Telnet, SMTP) to organization stakeholders - Validating that HSTS, certificate pinning, and other anti-MITM controls are correctly implemented - Assessing network detection capabilities for ARP spoofing, DHCP spoofing, and DNS spoofing attacks - Training incident response teams to identify and respond to MITM attack indicators

Conducting Memory Forensics With Volatility

- An endpoint has been contained during an active incident and volatile evidence must be preserved - EDR alerts suggest process injection or fileless malware that only exists in memory - Encryption keys need to be recovered from a ransomware-infected system before shutdown - Credential theft (Mimikatz, LSASS dumping) is suspected and evidence must be confirmed - A rootkit or kernel-level compromise is suspected and disk-based analysis is insufficient

Conducting Mobile App Penetration Test

- Testing mobile applications before release to identify security vulnerabilities and data protection issues - Conducting compliance assessments against OWASP MASVS (Mobile Application Security Verification Standard) levels L1 and L2 - Evaluating the security of mobile banking, healthcare, or government applications handling sensitive data - Testing mobile apps that interact with backend APIs to assess the end-to-end security of the mobile ecosystem - Assessing mobile application resistance to reverse engineering, tampering, and runtime manipulation

Conducting Network Penetration Test

- Assessing the security posture of internal or external network infrastructure before or after deployment - Validating firewall rules, network segmentation, and access controls under realistic attack conditions - Identifying exploitable vulnerabilities in network services, protocols, and configurations - Meeting compliance requirements for PCI-DSS, HIPAA, SOC 2, or ISO 27001 that mandate periodic penetration testing - Evaluating the effectiveness of IDS/IPS, SIEM, and SOC detection capabilities against real attack traffic

Conducting Pass The Ticket Attack

Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password. By extracting Kerberos tickets from memory (LSASS) on a compromised host, an attacker can inject those tickets into their own session to impersonate the ticket owner and access resources as that user.

Conducting Phishing Incident Response

- A user reports receiving a suspicious email via the phishing report button or abuse mailbox - Email gateway detects a malicious email that bypassed initial filtering - Threat intelligence indicates an active phishing campaign targeting the organization - A user confirms they clicked a link or opened an attachment from a suspicious email - Credentials have been entered on a suspected phishing page

Conducting Post Incident Lessons Learned

- After any security incident has been fully resolved and recovery completed - Following tabletop exercises or IR simulations - After significant near-miss events - Quarterly review of accumulated incident trends - When IR playbooks need updating based on real-world experience

Conducting Social Engineering Penetration Test

Social engineering penetration testing assesses an organization's human attack surface through controlled simulation of real-world deception techniques. According to Verizon DBIR 2024, the human element is involved in approximately 68% of all breaches, with phishing remaining the dominant initial access vector. This skill covers phishing, vishing (voice phishing), smishing (SMS phishing), and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx.

Conducting Social Engineering Pretext Call

A pretext call (vishing) is a social engineering technique where an attacker impersonates a trusted authority figure over the phone to manipulate targets into divulging sensitive information, performing actions, or granting access. In red team engagements, pretext calls test the human element of security controls, measuring employee adherence to verification procedures and security awareness training effectiveness. MITRE ATT&CK maps this to T1566.004 (Phishing for Information: Voice) and T1598 (Phishing for Information).

Conducting Spearphishing Simulation Campaign

Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craft highly personalized messages targeting specific individuals. This skill covers developing pretexts, building payloads, setting up email infrastructure, executing the campaign, and tracking results.

Conducting Wireless Network Penetration Test

- Assessing the security of enterprise wireless networks including guest, corporate, and IoT WiFi segments - Testing whether attackers within physical proximity can compromise wireless authentication and access internal networks - Validating wireless intrusion detection/prevention system (WIDS/WIPS) capabilities against known attack techniques - Evaluating the effectiveness of WPA3 migration and transition mode configurations - Testing network segmentation between wireless and wired networks after a wireless network compromise

Configuring Active Directory Tiered Model

Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory. Covers Tier 0/1/2 separation, privileged access workstations (PAWs), administrative forest design, authentication policy silos, and credential theft mitigation.

Configuring Aws Verified Access For Ztna

AWS Verified Access is a Zero Trust Network Access (ZTNA) service that provides secure, VPN-less access to corporate applications hosted in AWS. It evaluates each access request in real-time against granular conditional access policies written in the Cedar policy language, ensuring access is granted per-application only when specific security requirements such as user identity and device security posture are met and maintained. Verified Access integrates with AWS IAM Identity Center, third-party identity providers (Okta, CrowdStrike, JumpCloud, Jamf), and device management solutions. For multi-account deployments, AWS Resource Access Manager (RAM) enables sharing Verified Access groups across organizational units.

Configuring Certificate Authority With Openssl

A Certificate Authority (CA) is the trust anchor in a PKI hierarchy, responsible for issuing, signing, and revoking digital certificates. This skill covers building a two-tier CA hierarchy (Root CA + Intermediate CA) using OpenSSL and the Python cryptography library, including CRL distribution, OCSP responder configuration, and certificate policy management.

Configuring Host Based Intrusion Detection

Use this skill when: - Deploying HIDS agents (Wazuh, OSSEC, AIDE) across Windows and Linux endpoints - Configuring file integrity monitoring (FIM) for compliance (PCI DSS 11.5, NIST SI-7) - Monitoring system configuration changes, rootkit detection, and security policy violations - Integrating HIDS alerts with SIEM platforms for centralized monitoring

Configuring Hsm For Key Storage

Hardware Security Modules (HSMs) are tamper-resistant physical devices that safeguard cryptographic keys and perform cryptographic operations in a hardened environment. Keys stored in an HSM never leave the device boundary, providing the highest level of key protection. This skill covers configuring HSMs using the PKCS#11 standard interface, including key generation, signing, encryption, and key management using both physical HSMs and SoftHSM2 for development.

Configuring Identity Aware Proxy With Google Iap

- When protecting Google Cloud applications (App Engine, Cloud Run, GKE, Compute Engine) with identity-based access - When implementing context-aware access requiring device posture and location verification - When providing secure access to internal tools without VPN or public IP exposure - When needing per-request authentication and authorization for web applications and TCP services - When configuring programmatic access to IAP-protected resources using service accounts

Configuring Ldap Security Hardening

Harden LDAP directory services against common attacks including credential harvesting, LDAP injection, anonymous binding, and channel binding bypass. Covers LDAPS enforcement, channel binding, LDAP signing, access control lists, and monitoring for LDAP-based attacks.

Configuring Microsegmentation For Zero Trust

- Understanding of zero trust principles (NIST SP 800-207) - Knowledge of network segmentation concepts - Familiarity with firewall and SDN technologies - Experience with VMware NSX, Illumio, Guardicore, or Cisco ACI

Configuring Multi Factor Authentication With Duo

Deploy Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points. This skill covers Duo integration methods, adaptive authentication policies, device trust assessment, and phishing-resistant MFA deployment aligned with NIST 800-63B AAL2/AAL3 requirements.

Configuring Network Segmentation With Vlans

- Segmenting an enterprise network into isolated security zones (corporate, servers, DMZ, guest, IoT) - Meeting compliance requirements (PCI-DSS, HIPAA, SOC 2) that mandate network isolation for sensitive data - Reducing blast radius of security incidents by preventing lateral movement between network segments - Isolating high-risk devices (IoT, BYOD, legacy systems) from critical infrastructure - Implementing defense-in-depth by combining VLANs with firewall rules and access control lists

Configuring Oauth2 Authorization Flow

Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token lifecycle management, scope design, and alignment with OAuth 2.1 security requirements.

Configuring Pfsense Firewall Rules

- Deploying a perimeter or internal firewall to segment and protect network zones (DMZ, internal, guest, IoT) - Creating granular access control rules to restrict traffic between VLANs and network segments - Configuring NAT rules for port forwarding to internal services exposed to the internet - Setting up site-to-site or remote access VPN tunnels using IPsec or OpenVPN - Implementing traffic shaping and bandwidth management for quality-of-service requirements

Configuring Snort Ids For Intrusion Detection

- Deploying a network-based intrusion detection system to monitor traffic at key network boundaries - Writing custom Snort rules to detect organization-specific threats, attack patterns, or policy violations - Tuning existing rulesets to reduce false positives while maintaining detection coverage - Integrating Snort alerts with SIEM platforms for centralized security monitoring - Validating network security controls by generating test traffic and confirming detection

Configuring Suricata For Network Monitoring

- Deploying a high-performance IDS/IPS capable of multi-threaded packet processing for 10+ Gbps network links - Monitoring network traffic with protocol-aware inspection for HTTP, TLS, DNS, SMB, and other protocols - Generating structured EVE JSON logs for direct SIEM ingestion without custom parsers - Running in inline (IPS) mode to actively block malicious traffic at network choke points - Combining signature-based detection with protocol anomaly detection and file extraction

Configuring Tls 1 3 For Secure Communications

TLS 1.3 (RFC 8446) is the latest version of the Transport Layer Security protocol, providing significant improvements over TLS 1.2 in both security and performance. It reduces handshake latency to 1-RTT (and 0-RTT for resumed sessions), removes obsolete cipher suites, and mandates perfect forward secrecy. This skill covers configuring TLS 1.3 on servers, validating configurations, and testing for common misconfigurations.

Configuring Windows Defender Advanced Settings

Use this skill when: - Configuring Microsoft Defender for Endpoint (MDE) beyond default settings for enhanced protection - Implementing Attack Surface Reduction (ASR) rules to block common attack techniques - Enabling controlled folder access for ransomware protection - Configuring network protection and exploit protection features - Deploying Defender settings via Intune, SCCM, or Group Policy at enterprise scale

Configuring Windows Event Logging For Detection

Use this skill when: - Configuring Windows Advanced Audit Policy for security monitoring - Enabling process creation auditing with command line logging (Event 4688) - Setting up logon/logoff auditing for authentication monitoring - Sizing event log storage and forwarding to SIEM platforms

Configuring Zscaler Private Access For Ztna

- When replacing traditional VPN concentrators with application-level zero trust access - When providing remote users secure access to internal applications without network-level connectivity - When implementing least-privilege access where users only see authorized applications - When needing to make internal applications invisible to unauthorized users and the internet - When integrating ZTNA with existing SASE architecture using Zscaler Internet Access (ZIA)

Containing Active Breach

- A confirmed intrusion is in progress with an active adversary on the network - Malware is spreading laterally across endpoints or servers - A compromised account is being used for unauthorized access to systems - Ransomware encryption has been detected and is actively propagating - An attacker has established command-and-control communications from internal hosts

Continuous Llm Red Teaming With Promptfoo

Promptfoo is an open-source LLM evaluation and red-teaming framework (used by OpenAI and Anthropic per its README) that generates adversarial test cases, runs them against your model/agent, and grades the responses. DeepTeam (by Confident AI) is a complementary open-source framework offering 50+ ready-to-use vulnerabilities and 10+ research-backed attack methods. Together they let you treat LLM security as a regression test: every commit re-runs the same adversarial suite, and the pipeline fails when a previously-safe behavior regresses.

Correlating Security Events In Qradar

Use this skill when: - SOC analysts need to investigate QRadar offenses and correlate events across multiple log sources - Detection engineers build custom correlation rules to identify multi-stage attacks - Alert tuning is required to reduce false positive offenses and improve signal quality - The team migrates from basic event monitoring to behavior-based correlation

Correlating Threat Campaigns

Use this skill when: - Multiple unrelated-appearing incidents share IOCs (same C2 IP, same malware hash, similar TTPs) - An ISAC partner shares indicators from an incident that match your own historical events - Building a campaign report linking adversary activity over weeks or months to a single operation

Defending Llms With Guardrails

Large language model (LLM) applications are exposed to adversarial input (jailbreaks, prompt injection, toxic content) and can emit unsafe, biased, or sensitive output. A guardrail is a runtime control that inspects and constrains the data flowing into and out of an LLM. Three production-grade, open-source guardrail systems dominate the ecosystem and are complementary rather than mutually exclusive:

Deobfuscating Javascript Malware

- Investigating a phishing page with obfuscated JavaScript that performs credential harvesting or redirect - Analyzing a web skimmer (Magecart-style) injected into an e-commerce site - Deobfuscating a JavaScript dropper that downloads and executes second-stage malware - Examining malicious email attachments containing HTML files with embedded obfuscated scripts - Analyzing browser exploit kits that use heavy JavaScript obfuscation to hide exploit delivery

Deobfuscating Powershell Obfuscated Malware

PowerShell is heavily abused by malware authors due to its deep Windows integration and powerful scripting capabilities. Obfuscation techniques include string concatenation, Base64 encoding, character substitution, Invoke-Expression layering, SecureString abuse, environment variable manipulation, and tick-mark insertion. Modern malware uses multiple obfuscation layers requiring iterative deobfuscation. Tools like PSDecode, PowerDecode, and PowerPeeler automate much of this process, while manual AST (Abstract Syntax Tree) analysis handles custom obfuscation. PowerPeeler achieves a 95% deobfuscation correctness rate using instruction-level dynamic analysis of expression-related AST nodes.

Deploying Active Directory Honeytokens

- When deploying deception-based detection in Active Directory environments - When detecting Kerberoasting attacks via fake SPN honeytokens (honeyroasting) - When creating tripwire accounts to detect credential theft and lateral movement - When building decoy GPOs to detect Group Policy Preference password harvesting - When creating deceptive BloodHound paths to misdirect and detect attackers - When supplementing existing AD monitoring with high-fidelity detection signals

Deploying Cloud Deception With Decoy Resources

- When cloud accounts (AWS/Azure/GCP) hold crown-jewel data or infrastructure and you need a tripwire that fires the moment an attacker who has gained access starts to operate. - When the only deception in place is on-prem honeypots, leaving the cloud control plane uninstrumented. - When seeding fake credentials to catch credential theft, accidental code-repo leaks, or secrets exposed in build pipelines. - When detecting cloud reconnaissance (enumeration of IAM, storage, or secrets) and lateral movement that legitimate users would never perform. - When you want detections that survive into incident response with strong fidelity — a touch on a decoy resource almost always means malicious or unauthorized activity.

Deploying Cloudflare Access For Zero Trust

- When replacing VPN infrastructure with identity-aware application access using Cloudflare One - When exposing self-hosted internal applications through Cloudflare Tunnel without opening inbound ports - When implementing ZTNA for a distributed workforce accessing web applications, SSH, and RDP services - When needing a cost-effective zero trust solution with integrated DLP, CASB, and SWG capabilities - When securing contractor and third-party access to specific applications without full network access

Deploying Decoy Files For Ransomware Detection

- Setting up early-warning detection for ransomware on file servers or endpoints - Supplementing EDR/AV with a deception-based detection layer that catches unknown ransomware variants - Creating high-fidelity ransomware alerts that have very low false-positive rates (legitimate users have no reason to touch decoy files) - Testing ransomware response procedures by validating that canary file modifications trigger the expected alerting pipeline - Protecting high-value file shares (finance, HR, legal) with tripwire files that indicate unauthorized encryption activity

Deploying Edr Agent With Crowdstrike

Use this skill when: - Deploying CrowdStrike Falcon sensors to Windows, macOS, or Linux endpoints - Configuring Falcon prevention and detection policies for different endpoint groups - Integrating CrowdStrike telemetry with SIEM (Splunk, Elastic, Sentinel) for correlated detection - Troubleshooting sensor connectivity, performance, or detection issues

Deploying Honeytokens And Canarytokens

Honeytokens (a.k.a. canarytokens) are decoy artifacts — credentials, files, URLs, API keys, DNS names, database connection strings, documents — that have no legitimate operational use. Because no authorized user or process should ever touch them, any interaction is a high-fidelity signal of an intrusion, insider misuse, or reconnaissance. Unlike signature- or anomaly-based detection, honeytokens generate near-zero false positives: the alert *is* the compromise.

Deploying Osquery For Endpoint Monitoring

Use this skill when: - Deploying osquery across Windows, macOS, and Linux endpoints for fleet-wide visibility - Building threat hunting queries using osquery's SQL interface - Monitoring endpoint compliance (installed software, open ports, running services) - Integrating osquery data with SIEM or Kolide/Fleet for centralized management

Deploying Palo Alto Prisma Access Zero Trust

- When implementing enterprise-grade SASE with integrated ZTNA, SWG, CASB, and FWaaS - When replacing both VPN and branch office firewalls with cloud-delivered security - When needing advanced threat prevention (WildFire, DNS Security) for remote access traffic - When deploying zero trust for both mobile users and remote network (branch) connections - When integrating ZTNA with existing Palo Alto NGFW infrastructure via Strata Cloud Manager

Deploying Ransomware Canary Files

- Deploying proactive ransomware detection on file servers, NAS devices, or endpoint systems - Building an early-warning system that detects ransomware before it encrypts business-critical data - Supplementing EDR solutions with lightweight canary file monitoring on systems where agents cannot be deployed - Testing ransomware incident response procedures by simulating canary file triggers - Monitoring shared drives, home directories, and backup volumes for unauthorized file operations

Deploying Software Defined Perimeter

- Understanding of zero trust principles (NIST SP 800-207) - Knowledge of CSA Software-Defined Perimeter specification - Familiarity with PKI and mutual TLS authentication - Experience with network security architecture

Deploying Tailscale For Zero Trust Vpn

Tailscale is a zero trust mesh VPN built on WireGuard that creates encrypted peer-to-peer connections between devices without requiring traditional VPN servers or complex network configuration. Every connection in a Tailscale network (tailnet) is end-to-end encrypted using WireGuard's Noise protocol framework with Curve25519 key exchange. Tailscale implements zero trust networking by authenticating every connection request through identity providers, enforcing granular Access Control Lists (ACLs), and supporting features like exit nodes, subnet routers, MagicDNS, and Tailscale SSH. For organizations preferring self-hosted infrastructure, Headscale provides an open-source implementation of the Tailscale control server.

Designing Adversary Engagement With Mitre Engage

- When an organization owns deception tooling (honeypots, honeytokens, canary tokens, decoy files) but deploys it tactically with no unifying strategy or measurable outcome. - When leadership asks whether the organization *should* engage adversaries, and what the legal, operational, and resourcing implications are. - When writing a formal adversary engagement operation plan that must justify every deployed deceptive artifact against a strategic goal. - When selecting which specific deception Activities to deploy against a known or suspected threat actor based on that actor's ATT&CK TTPs. - When building a denial, deception, and adversary engagement (DD&AE) program that must integrate with existing SOC, threat intel, and incident response functions. - When a deception deployment generates alerts that nobody knows how to act on, because Expose was never connected to Affect or Elicit goals.

Detecting Ai Model Prompt Injection Attacks

- Scanning user inputs to LLM-powered applications before they are forwarded to the model - Building an input validation layer for chatbots, AI agents, or retrieval-augmented generation (RAG) pipelines - Monitoring logs of LLM interactions to retrospectively identify prompt injection attempts - Evaluating the effectiveness of existing prompt injection defenses through red-team testing - Classifying prompt injection payloads during security incident investigations involving AI systems

Detecting Anomalies In Industrial Control Systems

- When deploying continuous monitoring for OT environments that lack intrusion detection - When building behavior-based detection to complement signature-based IDS in OT networks - When establishing baselines for deterministic SCADA communications to detect deviations - When integrating machine learning anomaly detection with OT security monitoring platforms - When investigating alerts from Nozomi Guardian or Dragos Platform that require deeper analysis

Detecting Anomalous Authentication Patterns

- Security operations needs to identify compromised accounts from authentication log analysis - Implementing impossible travel detection to flag geographically inconsistent logins - Detecting brute force, password spraying, and credential stuffing attacks in real time - Building behavioral baselines for users to identify deviations indicating account compromise - Correlating authentication anomalies with threat intelligence for lateral movement detection - Investigating alerts from SIEM or IdP for suspicious sign-in activity

Detecting Api Enumeration Attacks

API enumeration attacks occur when attackers systematically probe API endpoints with sequential or predictable identifiers to discover and access unauthorized resources. Broken Object Level Authorization (BOLA), ranked as API1:2023 in the OWASP API Security Top 10, is the most critical API vulnerability. Attackers manipulate object identifiers (user IDs, order numbers, account references) in API requests to bypass authorization and access other users' data. Detection requires monitoring for patterns of rapid sequential access attempts, authorization failures, and abnormal API usage behavior.

Detecting Arp Poisoning In Network Traffic

ARP poisoning (ARP spoofing) is a Layer 2 attack where an adversary sends falsified ARP messages to associate their MAC address with the IP address of a legitimate host, enabling man-in-the-middle (MitM) interception, session hijacking, or denial of service. Since ARP has no built-in authentication mechanism, any device on a broadcast domain can forge ARP replies. Detection requires monitoring ARP traffic for anomalies such as gratuitous ARP floods, IP-to-MAC mapping changes, and duplicate IP addresses. This skill covers deploying multiple detection layers including ARPWatch, Dynamic ARP Inspection (DAI), Wireshark-based analysis, and custom Python monitoring tools.

Detecting Attacks On Historian Servers

- When monitoring historian servers that bridge IT and OT networks for compromise indicators - When detecting unauthorized queries or data manipulation in process historian databases - When investigating lateral movement through historian servers between IT and OT zones - When responding to alerts about exploitation of historian-specific vulnerabilities (CVE-2025-0921) - When validating historian data integrity after a suspected OT security incident

Detecting Attacks On Scada Systems

- When deploying intrusion detection capabilities in a SCADA environment for the first time - When investigating suspected cyber attacks against industrial control systems - When building detection rules for OT-specific attack patterns (Stuxnet, TRITON, Industroyer) - When integrating OT network monitoring with an enterprise SOC for unified threat visibility - When responding to alerts from OT security monitoring tools (Dragos, Nozomi, Claroty)

Detecting Aws Cloudtrail Anomalies

AWS CloudTrail records API calls across AWS services. This skill covers querying CloudTrail events with boto3's lookup_events API, building statistical baselines of normal API activity, detecting anomalies such as unusual event sources, geographic anomalies, high-frequency API calls, and first-time API usage patterns that indicate compromised credentials or insider threats.

Detecting Aws Credential Exposure With Trufflehog

- When integrating secrets detection into CI/CD pipelines to prevent credential commits reaching production - When performing a security audit of existing repositories for historically committed AWS credentials - When responding to an AWS GuardDuty alert about credential usage from an unexpected IP or region - When onboarding repositories from acquired companies or third-party vendors - When validating that credential rotation processes have removed all references to old access keys

Detecting Aws Guardduty Findings Automation

Amazon GuardDuty is a threat detection service that continuously monitors AWS accounts for malicious activity and unauthorized behavior. By integrating GuardDuty with Amazon EventBridge and AWS Lambda, security teams achieve automated, real-time responses to threats, reducing mean time to response (MTTR) from hours to seconds. GuardDuty analyzes VPC Flow Logs, CloudTrail management and data events, DNS logs, EKS audit logs, and S3 data events.

Detecting Aws Iam Privilege Escalation

This skill uses boto3 and Cloudsplaining-style analysis to identify IAM privilege escalation paths in AWS accounts. It downloads the account authorization details, analyzes each policy for dangerous permission combinations (iam:PassRole + lambda:CreateFunction, iam:CreatePolicyVersion, sts:AssumeRole), and flags policies that violate least-privilege principles.

Detecting Azure Lateral Movement

Lateral movement in Azure AD/Entra ID differs from on-premises environments. Attackers pivot through OAuth application consent grants, service principal abuse, cross-tenant access policies, and stolen refresh tokens rather than SMB/RDP connections. Detection requires correlating Microsoft Graph API audit logs, Azure AD sign-in logs, and Entra ID protection risk events using KQL queries in Microsoft Sentinel. This skill covers building detection analytics for common Azure lateral movement techniques including application impersonation, mailbox delegation abuse, and conditional access policy bypasses.

Detecting Azure Service Principal Abuse

Azure service principals are identity objects used by applications, services, and automation tools to access Azure resources. Attackers exploit service principals for privilege escalation, lateral movement, and persistent access. Key abuse patterns include: adding credentials to existing principals, assigning privileged roles, bypassing admin consent, and enumerating service principals for attack paths. Application ownership grants the ability to manage credentials and configure permissions, creating hidden privilege escalation paths.

Detecting Azure Storage Account Misconfigurations

Azure Storage accounts are a frequent target for attackers due to misconfigured public access, long-lived SAS tokens, missing encryption, and outdated TLS versions. This skill uses the azure-mgmt-storage Python SDK with StorageManagementClient to enumerate all storage accounts in a subscription, inspect their security properties, list blob containers for public access settings, and generate a risk-scored audit report identifying critical misconfigurations.

Detecting Beaconing Patterns With Zeek

- When investigating security incidents that require detecting beaconing patterns with zeek - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Detecting Bluetooth Low Energy Attacks

This skill is intended for authorized security testing, penetration testing engagements, CTF competitions, and educational purposes only. Sniffing, intercepting, or manipulating Bluetooth communications without authorization may violate federal wiretapping laws and local regulations. Always obtain explicit written permission before conducting any wireless security assessment.

Detecting Broken Object Property Level Authorization

Broken Object Property Level Authorization (BOPLA), classified as API3:2023 in the OWASP API Security Top 10, combines two related vulnerability classes: Excessive Data Exposure (API returning more data than needed) and Mass Assignment (API accepting more data than intended). Even when APIs enforce object-level authorization correctly, they may fail to control which specific properties of an object a user can read or modify. Attackers exploit this by reading sensitive properties from API responses or injecting additional properties into request bodies to modify fields they should not have access to.

Detecting Business Email Compromise

Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors, or trusted partners to trick employees into transferring funds, sharing sensitive data, or changing payment details. Unlike traditional phishing, BEC often contains no malicious links or attachments, relying purely on social engineering. This skill covers detection techniques using email gateway rules, behavioral analytics, and financial process controls.

Detecting Business Email Compromise With Ai

AI-powered BEC detection uses machine learning, NLP, and behavioral analytics to identify sophisticated impersonation attacks that contain no malicious links or attachments. Traditional rule-based filters miss these attacks because BEC relies purely on social engineering. Modern AI approaches analyze writing style, tone, vocabulary, grammatical patterns, and behavioral context to determine if an email genuinely comes from the stated sender. BERT-based models achieve 98.65% accuracy in BEC detection, and AI-enhanced platforms show a 25% increase in phishing identification over keyword-based rules.

Detecting Cloud Threats With Guardduty

- When establishing continuous threat detection for new or existing AWS accounts - When investigating GuardDuty findings related to compromised instances, credential abuse, or data exfiltration - When building automated incident response playbooks triggered by GuardDuty findings - When extending threat coverage to container workloads running on EKS, ECS, or Fargate - When enabling malware scanning for EBS volumes attached to suspicious EC2 instances

Detecting Command And Control Over Dns

- Investigating suspected DNS tunneling used for C2 communication or data exfiltration - Analyzing DNS query logs for signs of encoded payloads in subdomain strings - Classifying domains as DGA-generated vs. legitimate using statistical or ML methods - Detecting DNS beaconing patterns (regular intervals, consistent query sizes) - Hunting for Iodine, dnscat2, dns2tcp, Cobalt Strike DNS, or Sliver DNS traffic - Monitoring TXT record abuse for command delivery or staged payload download - Building DNS anomaly detection rules for SOC/SIEM deployment

Detecting Compromised Cloud Credentials

- When investigating alerts about unusual cloud API activity from unfamiliar locations - When building detection rules for credential theft and abuse across cloud environments - When responding to notifications from cloud providers about exposed credentials - When monitoring for credential stuffing or brute force attacks against cloud identities - When assessing the scope of a credential compromise after initial detection

Detecting Container Drift At Runtime

Container drift occurs when running containers deviate from their original image state through unauthorized file modifications, unexpected binary execution, configuration changes, or package installations. Since containers should be treated as immutable infrastructure, any drift is a potential indicator of compromise. Detection techniques leverage the DIE (Detect, Isolate, Evict) model -- an immutable workload should not change during runtime, so any observed change is potentially evidence of malicious activity.

Detecting Container Escape Attempts

Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators such as namespace manipulation, capability abuse, kernel exploits, mounted sensitive paths, and anomalous syscall patterns using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.

Detecting Container Escape With Falco Rules

Falco is a CNCF-graduated runtime security tool that monitors Linux syscalls to detect anomalous container behavior. It uses a rules engine to identify container escape techniques such as mounting host filesystems, accessing sensitive host paths, loading kernel modules, and exploiting privileged container capabilities.

Detecting Container Runtime Threats With Falco

Falco is the CNCF graduated runtime-security project (originally by Sysdig) that consumes Linux kernel syscalls and Kubernetes audit events through a driver, evaluates them against a YAML rule engine, and emits real-time alerts. It is the de facto open-source detection tool for runtime threats inside containers, including container escape (MITRE ATT&CK T1611, Escape to Host), namespace manipulation (setns), privileged mounts, reverse shells, and unexpected outbound connections.

Detecting Credential Dumping Techniques

Credential dumping (MITRE ATT&CK T1003) is a post-exploitation technique where adversaries extract authentication credentials from OS memory, registry hives, or domain controller databases. This skill covers detection of LSASS memory access via Sysmon Event ID 10 (ProcessAccess), SAM registry hive export via reg.exe, NTDS.dit extraction via ntdsutil/vssadmin, and comsvcs.dll MiniDump abuse. Detection rules analyze GrantedAccess bitmasks, suspicious calling processes, and known tool signatures.

Detecting Cryptomining In Cloud

- When cloud billing alerts indicate unexpected compute cost spikes - When GuardDuty generates CryptoCurrency or Impact finding types - When investigating compromised IAM credentials that may be used to launch mining instances - When monitoring container workloads for unauthorized process execution - When establishing proactive detection controls against resource hijacking attacks

Detecting Data And Model Poisoning

Data poisoning and model backdooring attack the *integrity* of an ML system at training time rather than at inference. In data poisoning (MITRE ATLAS AML.T0020 Poison Training Data), an adversary injects manipulated samples into the training, fine-tuning, or RAG corpus so the resulting model misbehaves — degraded accuracy, targeted misclassification, or an attacker-chosen bias. In model backdooring (MITRE ATLAS AML.T0018 Backdoor ML Model), the model behaves normally on clean inputs but produces an attacker-chosen output whenever a hidden *trigger* (a pixel patch, a rare token, a phrase) is present. Both are amplified by ML supply-chain compromise (AML.T0010): poisoned public datasets, trojaned pre-trained weights downloaded from a hub, or a malicious model serialization. This is OWASP LLM04:2025 Data and Model Poisoning.

Detecting Dcsync Attack In Active Directory

- When hunting for credential theft in Active Directory environments - After compromise of accounts with Replicating Directory Changes permissions - When investigating suspected use of Mimikatz or Impacket secretsdump - During incident response involving lateral movement with domain admin credentials - When auditing AD replication permissions as part of security hardening

Detecting Deepfake Audio In Vishing Attacks

- A suspected vishing call used an AI-cloned executive voice to authorize a wire transfer - Security operations received a voicemail that sounds like the CEO but the tone seems off - Incident response needs to determine whether a recorded phone call contains synthetic speech - Fraud investigation requires forensic proof that audio was AI-generated - Red team exercises use voice cloning and blue team needs detection capability

Detecting Dependency Confusion

Dependency confusion (also called a substitution or namespace-shadowing attack) was popularized by Alex Birsan in 2021 when he forced malicious code into the internal build systems of Apple, Microsoft, PayPal, and dozens of others. The root cause is that many package managers, when configured to resolve from both an internal/private registry and a public one, will prefer whichever copy has the higher version number rather than honoring the source. An attacker who learns the name of a private package (@acme/internal-utils, acme-billing-sdk) can publish a malicious package of the same name to the public registry (npmjs.com, PyPI, Maven Central) with a very high version (e.g. 99.0.0). When the victim's CI/CD runner or a developer machine resolves dependencies, it pulls the attacker's public package, executes its install scripts, and the supply chain is compromised.

Detecting Dll Sideloading Attacks

- When investigating potential DLL hijacking in enterprise environments - After EDR alerts on unsigned DLLs loaded by signed applications - When hunting for APT persistence using legitimate application wrappers - During incident response to identify trojanized applications - When threat intel indicates DLL sideloading campaigns targeting specific software

Detecting Dnp3 Protocol Anomalies

- When monitoring SCADA systems in the energy sector where DNP3 is the primary protocol - When building detection rules for DNP3-based attacks against RTUs and substations - When investigating suspected unauthorized control commands sent via DNP3 - When deploying IDS with DNP3 deep packet inspection at utility substations - When responding to alerts from OT monitoring platforms about DNP3 traffic anomalies

Detecting Dns Exfiltration With Dns Query Analysis

DNS exfiltration exploits the Domain Name System as a covert channel to extract data from compromised networks. Attackers encode stolen data into DNS query names (subdomains) or DNS response records (TXT, CNAME, NULL), bypassing traditional security controls that typically allow DNS traffic unrestricted. Tools like iodine, dnscat2, and dns2tcp enable full TCP tunneling over DNS. Detection requires analyzing DNS query patterns for anomalies including excessive query length, high entropy subdomain strings, abnormal query volumes to single domains, and oversized TXT record responses. This skill covers building a comprehensive DNS exfiltration detection capability using passive DNS analysis, statistical methods, and machine learning approaches.

Detecting Email Account Compromise

Email account compromise (EAC) is a prevalent attack vector where adversaries gain unauthorized access to mailboxes to exfiltrate sensitive data, conduct business email compromise (BEC), or establish persistence through inbox rule manipulation. Attackers commonly create forwarding rules to siphon emails, delete rules to hide evidence, or use OAuth tokens for persistent access. Detection relies on analyzing Microsoft 365 Unified Audit Logs, Azure AD sign-in logs for impossible travel or suspicious locations, inbox rule creation events (Set-InboxRule, New-InboxRule), and Microsoft Graph API access patterns. Key indicators include forwarding rules to external addresses, rules that delete or move messages matching keywords like "invoice" or "payment", and sign-ins from unusual user agents such as python-requests.

Detecting Email Forwarding Rules Attack

- When proactively hunting for indicators of detecting email forwarding rules attack in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Detecting Entra Offensive Tools In Graph Logs

For nearly a decade the legacy Azure AD Graph API (graph.windows.net) was a defender blind spot: requests to it produced no first-class activity log, so tools like ROADtools (roadrecon) and AADInternals — which lean heavily on AAD Graph — could enumerate an entire tenant with little trace. That changed when Microsoft shipped AADGraphActivityLogs (general availability in 2026), the counterpart to the already-available MicrosoftGraphActivityLogs (graph.microsoft.com). Together these two tables give SOCs request-level visibility into directory API traffic: the caller identity, app, source IP, HTTP method, request URI, and crucially the User-Agent.

Detecting Evasion Techniques In Endpoint Logs

Use this skill when: - Hunting for adversary defense evasion techniques (MITRE ATT&CK TA0005) in endpoint telemetry - Building detection rules for common evasion methods (process injection, timestomping, log clearing) - Investigating incidents where adversaries disabled or bypassed security tools - Analyzing endpoint logs for indicators of living-off-the-land binary (LOLBin) abuse

Detecting Exfiltration Over Dns With Zeek

DNS tunneling and exfiltration is a technique used by attackers to bypass firewalls and DLP controls by encoding stolen data into DNS query subdomains. Legitimate DNS queries have predictable entropy and length patterns, while exfiltration queries contain encoded data with high Shannon entropy, unusually long subdomain labels, and high volumes of unique subdomains per parent domain.

Detecting Fileless Attacks On Endpoints

Use this skill when: - Building detection rules for fileless malware that operates entirely in memory - Hunting for PowerShell-based attacks, reflective DLL injection, and WMI abuse - Configuring endpoint telemetry (Sysmon, AMSI, PowerShell logging) to capture fileless indicators - Investigating incidents where traditional AV found no malicious files

Detecting Fileless Malware Techniques

- EDR alerts indicate suspicious behavior from trusted system binaries (PowerShell, mshta, wmic, regsvr32) - Investigating attacks that leave no traditional malware files on disk - Analyzing WMI event subscriptions, registry-stored payloads, or scheduled task abuse for persistence - Building detection rules for LOLBin (Living Off the Land Binary) abuse in enterprise environments - Memory forensics reveals malicious code but no corresponding files exist on the filesystem

Detecting Golden Ticket Attacks In Kerberos Logs

- When KRBTGT account hash may have been compromised via DCSync or NTDS.dit extraction - When hunting for forged Kerberos tickets used for persistent domain access - After incident response reveals credential theft at the domain level - When investigating impossible logon patterns (users logging in from multiple locations simultaneously) - During post-breach assessment to determine if Golden Tickets are in use

Detecting Golden Ticket Forgery

A Golden Ticket attack (MITRE ATT&CK T1558.001) involves forging a Kerberos Ticket Granting Ticket (TGT) using the krbtgt account NTLM hash, granting unrestricted access to any service in the Active Directory domain. This skill detects Golden Ticket usage by analyzing Event ID 4769 for RC4 encryption type (0x17) in environments enforcing AES, identifying tickets with abnormal lifetimes exceeding domain policy, correlating TGS requests with missing corresponding TGT requests (Event ID 4768), and detecting krbtgt password age anomalies.

Detecting Indirect Prompt Injection

Indirect prompt injection (MITRE ATLAS AML.T0051.001, OWASP LLM01:2025) occurs when an LLM-powered agent ingests external content — a web page it browses, a PDF or email it summarizes, an image it OCRs, a tool result it reads — and that content contains hidden instructions the model then follows as if they came from the developer or user. Because the agent treats *all* tokens in its context window as equally authoritative, an attacker who controls any consumed artifact can hijack the agent's behavior: exfiltrate conversation history, redirect tool calls, leak secrets, or pivot through connected systems.

Detecting Insider Data Exfiltration Via Dlp

- When investigating security incidents that require detecting insider data exfiltration via dlp - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Detecting Insider Threat Behaviors

- When proactively hunting for indicators of detecting insider threat behaviors in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Detecting Insider Threat With Ueba

User and Entity Behavior Analytics (UEBA) moves beyond static rule-based detection to model normal behavior for users, hosts, and applications, then flag statistically significant deviations that may indicate insider threats. Using Elasticsearch as the analytics backend, this skill covers building behavioral baselines from authentication logs, file access events, and network activity, computing risk scores using statistical deviation and peer group comparison, and correlating multiple low-confidence indicators into high-confidence insider threat alerts.

Detecting Kerberoasting Attacks

- When proactively hunting for indicators of detecting kerberoasting attacks in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Detecting Lateral Movement In Network

- Monitoring enterprise networks for post-compromise lateral movement patterns (pass-the-hash, RDP hopping, PSExec) - Building SIEM detection rules and alerts for common MITRE ATT&CK lateral movement techniques (T1021, T1570) - Investigating suspected breaches by analyzing authentication patterns and network connections between internal hosts - Hunting for anomalous east-west traffic patterns that indicate an attacker pivoting through the network - Validating that network segmentation and access controls effectively limit lateral movement paths

Detecting Lateral Movement With Splunk

- When hunting for adversary movement between compromised systems - After detecting credential theft to trace subsequent lateral activity - When investigating unusual authentication patterns across the network - During incident response to scope the breadth of compromise - When proactively hunting for TA0008 (Lateral Movement) techniques

Detecting Lateral Movement With Zeek

Analyze Zeek network logs to identify lateral movement techniques including SMB admin share access, DCE/RPC remote service creation, NTLM account spray, Kerberos ticket anomalies, and large internal data transfers indicative of staging or exfiltration between hosts.

Detecting Living Off The Land Attacks

Monitor for suspicious use of legitimate Windows binaries (LOLBins) including certutil, mshta, rundll32, regsvr32, and others used in fileless and living-off-the-land attack techniques.

Detecting Living Off The Land With Lolbas

Living Off the Land Binaries, Scripts, and Libraries (LOLBAS) are legitimate system utilities abused by attackers to execute malicious actions while evading detection. This skill covers detecting abuse of certutil.exe, regsvr32.exe, mshta.exe, rundll32.exe, msbuild.exe, and other LOLBins using process telemetry from Sysmon and Windows Event Logs, combined with Sigma rule-based detection.

Detecting Malicious Npm Packages

The npm registry is the largest software package ecosystem in the world and the most heavily targeted by supply-chain attackers. Malicious packages reach victims through typosquatting (expresss, crossenv), dependency confusion, account/maintainer takeover (the 2025 Shai-Hulud worm and the event-stream compromise are canonical examples), and starjacking. The defining danger of npm is that npm install automatically runs preinstall, install, and postinstall lifecycle scripts with the developer's full privileges before any application code is invoked — so simply installing a package is enough to be compromised. Roughly 2% of npm packages use install scripts, which makes them both common and a powerful malware delivery vehicle.

Detecting Malicious Scheduled Tasks With Sysmon

Adversaries abuse Windows Task Scheduler (schtasks.exe, at.exe) for persistence (T1053.005) and lateral movement. Sysmon Event ID 1 captures schtasks.exe process creation with full command-line arguments, while Event ID 11 captures task XML files written to C:\Windows\System32\Tasks\. Windows Security Event 4698 logs task registration details. This skill covers building detection rules that correlate these events to identify malicious scheduled tasks created from suspicious paths, with encoded payloads, or targeting remote systems.

Detecting Mimikatz Execution Patterns

- When proactively hunting for indicators of detecting mimikatz execution patterns in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Detecting Misconfigured Azure Storage

- When performing a security audit of Azure Storage accounts across subscriptions - When responding to Microsoft Defender for Storage alerts about anonymous access or data exfiltration - When compliance requires verification of encryption, network restrictions, and access logging - When investigating potential data exposure through publicly accessible blob containers - When onboarding Azure subscriptions and establishing storage security baselines

Detecting Mobile Malware Behavior

Use this skill when: - Analyzing suspicious mobile applications submitted by users or discovered during incident response - Monitoring enterprise mobile fleet for malicious app indicators - Performing malware triage on APK/IPA samples - Investigating data exfiltration or unauthorized device access from mobile apps

Detecting Modbus Command Injection Attacks

- When deploying intrusion detection for environments using Modbus TCP (port 502) or Modbus RTU - When investigating suspected unauthorized modifications to PLC registers or coils - When building detection analytics for OT SOC monitoring Modbus-heavy environments - When responding to FrostyGoop-style attacks that leverage Modbus TCP for operational impact - When performing baseline validation after a suspected compromise of a Modbus master

Detecting Modbus Protocol Anomalies

- When deploying Modbus-specific intrusion detection in an OT environment - When building baseline models for deterministic Modbus polling patterns - When investigating suspicious Modbus traffic flagged by OT monitoring tools - When implementing function code allowlisting on industrial firewalls - When detecting unauthorized Modbus write commands that could manipulate process setpoints

Detecting Model Extraction Attacks

Model extraction is the family of attacks in which an adversary abuses a model's inference API to steal value that the model owner intended to keep private. MITRE ATLAS catalogs these under AML.T0024 — Exfiltration via AI Inference API, in the *Exfiltration* tactic, with three sub-techniques:

Detecting Network Anomalies With Zeek

- Deploying passive network security monitoring at key network choke points for continuous visibility - Generating structured connection, DNS, HTTP, SSL, and file transfer logs for SIEM ingestion and threat hunting - Writing custom Zeek scripts to detect organization-specific threats, policy violations, or beaconing behavior - Performing retrospective analysis on network metadata to investigate security incidents - Complementing IDS solutions with protocol-level metadata analysis that signature-based tools may miss

Detecting Network Scanning With Ids Signatures

Network scanning is typically the first phase of an attack, where adversaries enumerate live hosts, open ports, running services, and OS versions using tools like Nmap, Masscan, ZMap, and custom scanners. Detecting this reconnaissance activity provides early warning of potential attacks. IDS/IPS systems like Suricata and Snort can identify scanning through signature-based detection (matching known scanner packet patterns), threshold-based detection (counting connection attempts over time), and anomaly detection (identifying unusual traffic patterns). This skill covers writing and deploying IDS signatures for scan detection, configuring threshold-based alerting, and correlating scan activity with downstream attack indicators.

Detecting Ntlm Relay With Event Correlation

NTLM relay attacks intercept NTLM authentication messages and forward them to a target service to gain unauthorized access. Attackers use tools like Responder for LLMNR/NBT-NS/mDNS poisoning, ntlmrelayx (Fox-IT/Impacket) for multi-protocol relay, and coercion techniques like PetitPotam (MS-EFSRPC) and DFSCoerce to force authentication from high-value targets like domain controllers. This skill provides a comprehensive event correlation framework using Windows Security Event 4624 LogonType 3 analysis, IP-to-hostname mismatch detection, Responder traffic identification, SMB/LDAP signing audit, and NTLM downgrade detection to identify relay attacks across Active Directory environments.

Detecting Oauth Token Theft

- Investigating alerts for impossible travel or anomalous token usage in Microsoft Entra ID - Responding to a suspected session hijacking or pass-the-cookie attack - Configuring proactive defenses against OAuth token theft in an Azure/M365 environment - Detecting OAuth device code phishing campaigns that bypass MFA - Analyzing sign-in logs for token replay indicators - Implementing Token Protection conditional access policies to bind tokens to devices

Detecting Pass The Hash Attacks

- When proactively hunting for indicators of detecting pass the hash attacks in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Detecting Pass The Ticket Attacks

Pass-the-Ticket (PtT) is a credential theft technique (MITRE ATT&CK T1550.003) where adversaries steal Kerberos tickets (TGT or TGS) from one system and replay them on another to authenticate without knowing the user's password. This skill teaches detection of PtT attacks by correlating Windows Security Event IDs 4768 (TGT request), 4769 (TGS request), and 4771 (pre-authentication failure) for anomalies such as ticket reuse across different hosts, RC4 encryption downgrades, and unusual service ticket request volumes.

Detecting Port Scanning With Fail2ban

- Automatically blocking IP addresses that perform port scans against internet-facing servers - Defending SSH, HTTP, FTP, and other services against brute force attacks with automated IP banning - Creating custom detection filters for organization-specific attack patterns in log files - Reducing noise from automated scanning bots before traffic reaches IDS/IPS for deeper analysis - Implementing defense-in-depth by adding host-based automated response to network monitoring

Detecting Privilege Escalation Attempts

- When proactively hunting for indicators of detecting privilege escalation attempts in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Detecting Privilege Escalation In Kubernetes Pods

Privilege escalation in Kubernetes occurs when a pod or container gains elevated permissions beyond its intended scope. This includes running as root, using privileged mode, mounting host filesystems, enabling dangerous Linux capabilities, or exploiting kernel vulnerabilities. Detection combines admission control (prevention), runtime monitoring (detection), and audit logging (investigation).

Detecting Process Hollowing Technique

- When investigating suspected fileless malware or in-memory threats - After EDR alerts on process injection or suspicious memory operations - When hunting for defense evasion techniques in a compromised environment - When threat intel reports indicate process hollowing in active campaigns - During purple team exercises validating T1055.012 detection coverage

Detecting Process Injection Techniques

- EDR alerts on suspicious API call sequences (VirtualAllocEx + WriteProcessMemory + CreateRemoteThread) - A legitimate process (explorer.exe, svchost.exe) exhibits unexpected network connections or file operations - Memory forensics reveals executable code in memory regions that should not contain it - Investigating living-off-the-land attacks where malware hides inside trusted processes - Building detection logic for specific injection techniques in EDR or SIEM rules

Detecting Qr Code Phishing With Email Security

QR code phishing (quishing) is a rapidly growing attack vector where malicious URLs are embedded in QR code images within phishing emails. Quishing incidents grew fivefold from 46,000 to 250,000 between August and November 2025, with credential phishing comprising 89.3% of detected incidents. Traditional email security filters struggle because QR codes cannot be read by humans or standard URL scanners, and when scanned, users typically use personal mobile devices that lack corporate security controls. Attackers have evolved to use split QR codes (two separate images), nested QR codes, and ASCII text-based QR codes to evade detection.

Detecting Ransomware Encryption Behavior

- Building or tuning a behavioral detection layer for ransomware that catches unknown/zero-day variants - Monitoring file servers and endpoints for mass encryption activity that evades signature-based detection - Implementing entropy-based detection to identify when files are being replaced with encrypted (high-entropy) content - Analyzing suspicious process behavior patterns: rapid sequential file opens, writes, renames, and deletes - Validating EDR detection rules against actual ransomware encryption patterns during red team exercises

Detecting Ransomware Precursors In Network

- Building detection rules for pre-ransomware network activity (the average time from Cobalt Strike deployment to encryption is 17 minutes) - Monitoring for initial access broker (IAB) indicators that precede ransomware deployment - Creating SIEM correlation rules that chain multiple precursor events into high-confidence alerts - Tuning network detection systems to distinguish ransomware staging from normal administrative activity - Investigating suspicious network patterns that may indicate ransomware operators have established a foothold

Detecting Rdp Brute Force Attacks

RDP brute force attacks target Windows Remote Desktop Protocol services by attempting rapid credential guessing against exposed RDP endpoints. Detection relies on analyzing Windows Security Event Logs for Event ID 4625 (failed logon with Logon Type 10 or 3) and correlating with Event ID 4624 (successful logon) to identify compromised accounts. This skill covers parsing EVTX files with python-evtx, identifying attack patterns through source IP frequency analysis, detecting NLA bypass attempts, and generating actionable detection reports.

Detecting Rootkit Activity

- System shows signs of compromise but standard tools (Task Manager, netstat) show nothing abnormal - Antivirus/EDR detects rootkit signatures but cannot identify the specific hiding mechanism - Memory forensics reveals discrepancies between kernel data structures and user-mode tool output - Investigating a persistent threat that survives remediation attempts and system reboots - Validating system integrity after a suspected kernel-level compromise

Detecting S3 Data Exfiltration Attempts

- When GuardDuty detects anomalous S3 access patterns such as bulk downloads from unusual IPs - When investigating suspected data breach involving S3-stored sensitive data - When building detection rules for S3 data loss prevention monitoring - When responding to Macie alerts about sensitive data being accessed or moved - When compliance requires monitoring and logging of all access to classified data stores

Detecting Secure Boot Bypass

UEFI Secure Boot is the firmware-enforced trust chain that only permits boot components signed by keys in the platform's allow-list (db) and not present in the revocation list (dbx). Bootkits defeat this layer to gain pre-OS, persistent, kernel-level control that survives OS reinstalls and disk wipes. BlackLotus (2023) was the first publicly observed UEFI bootkit to bypass Secure Boot on fully patched Windows 11, abusing CVE-2022-21894 ("baton drop") in a vulnerable, signed Windows boot manager to neutralize Secure Boot and disable BitLocker, HVCI, and Defender. Bootkitty (2024) was the first PoC UEFI bootkit targeting Linux. Microsoft's CVE-2023-24932 addressed a related Secure Boot bypass that required a phased dbx (revocation) rollout because revoking the vulnerable boot managers can render systems unbootable if applied carelessly.

Detecting Serverless Function Injection

- Auditing Lambda/Cloud Functions for code injection vulnerabilities where unsanitized event data flows into dangerous runtime functions (eval, exec, child_process.exec, os.system) - Investigating incidents where an attacker modified function code or layers to establish persistence or exfiltrate data from the serverless environment - Detecting privilege escalation paths where an adversary with lambda:UpdateFunctionCode and iam:PassRole can assume higher-privilege execution roles - Analyzing event source poisoning attacks where malicious payloads are injected through S3 object uploads, SQS messages, DynamoDB stream records, or API Gateway requests that trigger function execution - Building detection rules for SOC teams monitoring serverless workloads for unauthorized function modifications, layer additions, and suspicious invocation patterns

Detecting Service Account Abuse

- When proactively hunting for indicators of detecting service account abuse in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Detecting Shadow Api Endpoints

Shadow APIs are API endpoints operating within an organization's environment that are not tracked, documented, or secured. They emerge from rapid development cycles, forgotten test environments, deprecated API versions left running, third-party integrations, or developer side projects deployed without governance. Shadow APIs bypass authentication and monitoring controls, creating hidden entry points for attackers. Studies show that up to 30% of API endpoints in large organizations are undocumented, making shadow API detection a critical component of API security posture management.

Detecting Shadow It Cloud Usage

Shadow IT refers to unauthorized SaaS applications and cloud services used without IT approval. This skill analyzes proxy logs, DNS query logs, and firewall/netflow data to identify unauthorized cloud service usage, classify discovered domains against known SaaS categories, measure data transfer volumes, and flag high-risk services based on security posture and compliance requirements.

Detecting Spearphishing With Email Gateway

Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint, Mimecast, and Barracuda provide advanced detection capabilities including behavioral analysis, URL detonation, attachment sandboxing, and impersonation detection. This skill covers configuring these gateways to detect and block targeted phishing attacks.

Detecting Sql Injection Via Waf Logs

- When investigating security incidents that require detecting sql injection via waf logs - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Detecting Stuxnet Style Attacks

- When implementing advanced threat detection for high-value OT targets (nuclear, chemical, critical infrastructure) - When building detection for APT-style attacks targeting PLC logic and process manipulation - When establishing PLC logic integrity monitoring to detect unauthorized modifications - When investigating suspected process anomalies that may indicate cyber-physical attacks - When designing defense-in-depth strategies against nation-state level OT threats

Detecting Supply Chain Attacks In Ci Cd

- When investigating security incidents that require detecting supply chain attacks in ci cd - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Detecting Suspicious Oauth Application Consent

Illicit consent grant attacks trick users into granting excessive permissions to malicious OAuth applications in Azure AD / Microsoft Entra ID. This skill uses the Microsoft Graph API to enumerate OAuth2 permission grants, analyze application permissions for overly broad scopes, review directory audit logs for consent events, and flag high-risk applications based on publisher verification status and permission scope.

Detecting Suspicious Powershell Execution

- When proactively hunting for indicators of detecting suspicious powershell execution in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Detecting T1003 Credential Dumping With Edr

- When hunting for credential theft activity in the environment - After compromise indicators suggest attacker has elevated privileges - When EDR alerts fire for LSASS access or suspicious process memory reads - During incident response to determine scope of credential compromise - When auditing LSASS protection controls (Credential Guard, RunAsPPL)

Detecting T1055 Process Injection With Sysmon

- When hunting for defense evasion techniques that hide malicious code inside legitimate processes - After EDR alerts for suspicious cross-process memory access or remote thread creation - When investigating malware that injects into svchost.exe, explorer.exe, or other system processes - During purple team exercises testing detection of process injection variants - When validating Sysmon configuration coverage for injection detection

Detecting T1548 Abuse Elevation Control Mechanism

- When hunting for privilege escalation via UAC bypass in Windows environments - After threat intelligence indicates use of UAC bypass exploits by active threat groups - When investigating how attackers achieved administrative access without triggering UAC prompts - During security assessments to validate UAC bypass detection coverage - When monitoring for setuid/setgid abuse on Linux systems

Detecting Typosquatting Packages

Typosquatting is a software-supply-chain attack (MITRE ATT&CK T1195.002 — Supply Chain Compromise: Compromise Software Supply Chain) in which an adversary publishes a malicious package whose name is a near-miss of a popular legitimate package — reqeusts for requests, python-sqlite for sqlite3, crossenv for cross-env. A developer who fat-fingers the name, copies a name from a poisoned tutorial, or trusts an AI-generated dependency list (the "slopsquatting" variant, where models hallucinate package names attackers then register) installs the squat instead. Because most ecosystems execute install-time scripts (postinstall in npm, setup.py/build hooks in PyPI), the payload runs immediately with the developer's privileges.

Detecting Typosquatting Packages In Npm Pypi

- Auditing project dependencies to identify packages whose names are suspiciously similar to popular libraries - Proactively scanning package registries for newly published packages that may be typosquats of your organization's packages - Investigating a suspected supply chain compromise where a developer installed a misspelled package name - Building automated monitoring that alerts when new packages appear with names close to critical dependencies - Assessing the risk profile of unfamiliar packages before adding them to a project's dependency tree

Detecting Wmi Persistence

- When hunting for WMI event subscription persistence (MITRE ATT&CK T1546.003) - After detecting suspicious WMI activity in endpoint telemetry - During incident response to identify attacker persistence mechanisms - When Sysmon alerts trigger on Event IDs 19, 20, or 21 - During purple team exercises testing WMI-based persistence

Emulating Cloud Attacks With Stratus Red Team

Stratus Red Team is an open-source "Atomic Red Team for the cloud," maintained by Datadog. It is a self-contained Go binary that programmatically *detonates* granular, well-documented offensive techniques against AWS, Azure, GCP, and Kubernetes, then lets you cleanly revert and remove everything it created. Unlike a full exploitation framework, Stratus is purpose-built for detection engineering and purple teaming: each technique maps to a MITRE ATT&CK tactic and ships with a precise description of the cloud API calls it generates, so a blue team can confirm whether their CloudTrail/GuardDuty/Sentinel/Falco detections actually fire.

Enumerating Cloud With Cloudfox

CloudFox is an open-source command-line tool from Bishop Fox that helps penetration testers and red teamers gain *situational awareness* in unfamiliar cloud environments. Where tools like ScoutSuite focus on a defender-style configuration audit, CloudFox is built from the attacker's perspective: it answers questions like "what are the most attackable secrets, endpoints, and instances in this account, and what can the identity I just compromised actually reach?" It is read-only — it only performs Describe/List/Get style calls — and writes its findings to per-command CSV/TXT/loot files plus a combined report directory, so output can be triaged offline.

Eradicating Malware From Infected Systems

- Malware infection confirmed and containment is in place - Forensic investigation has identified all persistence mechanisms - All compromised systems have been identified and scoped - Ready to remove attacker artifacts and restore clean state - Post-containment phase requires systematic cleanup

Escaping Containers To Host

Container escape (MITRE ATT&CK T1611, Escape to Host) is the act of breaking the isolation boundary between a container and the host operating system, giving an attacker code execution in the host namespace — and, on Kubernetes, frequently a route to the entire node and then the cluster. Containers share the host kernel and rely on namespaces, cgroups, capabilities, seccomp, and LSMs (AppArmor/SELinux) for isolation. When any of these controls are weakened (a --privileged container, a mounted Docker socket, a hostPath mount of /, excess Linux capabilities such as CAP_SYS_ADMIN) or when a runtime contains a vulnerability, that boundary collapses.

Evaluating Threat Intelligence Platforms

Use this skill when: - Conducting a formal RFP or vendor evaluation for a TIP solution - Assessing whether the current TIP (e.g., MISP) needs to be replaced or augmented as the CTI program scales - Establishing evaluation criteria aligned to organizational maturity and budget

Executing Active Directory Attack Simulation

- Assessing the security of an Active Directory domain and forest against common and advanced attack techniques - Identifying attack paths from low-privilege domain user to Domain Admin using privilege relationship analysis - Validating that Kerberos security configurations, credential policies, and delegation settings resist known attacks - Testing detection capabilities of the SOC and EDR tools against Active Directory-specific TTPs - Evaluating the effectiveness of tiered administration models and privileged access workstations

Executing Nist Rmf Authorization To Operate

- When a federal or federally-aligned system (or a FedRAMP cloud service) needs an Authorization to Operate, a re-authorization, or has fallen out of authorization. - When you must produce or review the core authorization artifacts: System Security Plan (SSP), Security Assessment Report (SAR), and Plan of Action & Milestones (POA&M). - When categorizing a system's impact level (Low / Moderate / High) under FIPS 199. - When selecting, tailoring, or implementing a NIST SP 800-53 Rev 5 control baseline. - When standing up continuous monitoring (ConMon) or pursuing ongoing authorization / cATO after an initial ATO.

Executing Phishing Simulation Campaign

- Measuring employee susceptibility to phishing attacks as part of a security awareness program - Testing the effectiveness of email security controls (secure email gateway, DMARC, SPF, DKIM) - Conducting the social engineering component of a red team exercise to gain initial access - Establishing a baseline for phishing susceptibility before deploying security awareness training - Validating that incident response procedures work when employees report suspicious emails

Executing Red Team Engagement Planning

Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins. A well-structured engagement plan ensures the red team simulates realistic adversary behavior while maintaining safety guardrails that prevent unintended business disruption.

Executing Red Team Exercise

- Assessing an organization's ability to detect, respond to, and contain a realistic adversary operation - Testing the effectiveness of the security operations center (SOC), incident response team, and threat hunting capabilities - Validating security investments by simulating attacks that chain multiple vulnerabilities and techniques - Evaluating the organization's security posture against specific threat actors (nation-state, ransomware groups, insider threats) - Meeting regulatory requirements for adversary simulation (TIBER-EU, CBEST, AASE, iCAST)

Exploiting Active Directory Certificate Services Esc1

ESC1 (Escalation Scenario 1) is a critical misconfiguration in Active Directory Certificate Services where a certificate template allows a low-privileged user to request a certificate on behalf of any other user, including Domain Admins. The vulnerability exists when a template has the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag enabled (also called "Supply in Request"), combined with an Extended Key Usage (EKU) that permits client authentication (Client Authentication, PKINIT Client Authentication, Smart Card Logon, or Any Purpose). This allows an attacker to specify an arbitrary Subject Alternative Name (SAN) in the certificate request, effectively impersonating any domain user. ESC1 was documented by SpecterOps researchers Will Schroeder and Lee Christensen in their "Certified Pre-Owned" whitepaper (2021) and remains one of the most common AD CS attack paths. The MITRE ATT&CK framework tracks this as T1649 (Steal or Forge Authentication Certificates).

Exploiting Active Directory With Bloodhound

BloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments. Red teams use BloodHound to identify attack paths from compromised accounts to high-value targets such as Domain Admins, identifying privilege escalation chains that would be nearly impossible to find manually. SharpHound is the official data collector that gathers AD objects, relationships, ACLs, sessions, and group memberships.

Exploiting Adcs With Certipy

Active Directory Certificate Services (AD CS) is Microsoft's public-key infrastructure role used to issue certificates for authentication, encryption, and signing inside a Windows domain. SpecterOps researchers Will Schroeder and Lee Christensen documented a family of privilege-escalation primitives in their 2021 whitepaper *Certified Pre-Owned*, naming them ESC1 through ESC8. The community has since extended the catalog through ESC16. Because a certificate that maps to a privileged principal can be used for PKINIT Kerberos authentication, an attacker who obtains such a certificate can authenticate as a Domain Admin or Domain Controller without ever knowing the password — and the certificate remains valid even after a password reset.

Exploiting Api Injection Vulnerabilities

- Testing API endpoints that accept user input for database queries, system commands, or external requests - Assessing APIs that interact with SQL databases, NoSQL stores (MongoDB, Redis), LDAP directories, or external URLs - Evaluating input validation and parameterized query usage across all API endpoints - Testing for SSRF where API parameters accept URLs or hostnames that trigger server-side requests - Identifying injection points in headers, path parameters, query strings, and JSON/XML request bodies

Exploiting Aws With Pacu

Pacu is the open-source AWS exploitation framework from Rhino Security Labs. It is the cloud-pentest analogue of Metasploit: a modular Python console that manages target sessions, enumerates an AWS account, identifies privilege-escalation paths, and executes persistence/backdooring/exfiltration modules — all backed by a local SQLite database that records every enumerated resource so modules can chain off one another's findings.

Exploiting Bgp Hijacking Vulnerabilities

- Assessing an organization's exposure to BGP prefix hijacking and route leak attacks - Testing RPKI (Resource Public Key Infrastructure) deployment and route origin validation effectiveness - Validating BGP monitoring and alerting systems detect unauthorized route announcements - Simulating BGP hijacking in isolated lab environments to train network operations teams - Evaluating ISP prefix filtering and route origin authorization (ROA) configurations

Exploiting Broken Function Level Authorization

- Testing whether regular users can access administrative API endpoints by direct URL access - Assessing APIs for vertical privilege escalation where users can invoke functions above their role - Evaluating if API gateways and middleware consistently enforce function-level access controls - Testing role-based access control (RBAC) implementation across all API endpoints and HTTP methods - Validating that API documentation does not expose admin endpoint paths that lack authorization

Exploiting Broken Link Hijacking

- When auditing web applications for references to expired or unclaimed external resources - During supply chain security assessments of third-party script and resource dependencies - When testing for subdomain takeover opportunities via dangling CNAME records - During bug bounty hunting for broken link hijacking vulnerabilities - When assessing the security of external resource dependencies in production applications

Exploiting Constrained Delegation Abuse

Kerberos Constrained Delegation (KCD) is a Windows Active Directory feature that allows a service to impersonate a user and access specific services on their behalf. The delegation targets are defined in the msDS-AllowedToDelegateTo attribute. When an attacker compromises an account configured with Constrained Delegation (particularly with the TRUSTED_TO_AUTH_FOR_DELEGATION flag), they can use the S4U2self and S4U2proxy Kerberos protocol extensions to request service tickets as any user (including Domain Admins) to the delegated services. If the delegation target includes services like CIFS, HTTP, or LDAP on a Domain Controller, this results in full domain compromise. The S4U2self extension requests a forwardable ticket on behalf of any user to the compromised service, and S4U2proxy forwards that ticket to the allowed delegation target.

Exploiting Deeplink Vulnerabilities

Use this skill when: - Assessing mobile app deep link handling for injection and redirect vulnerabilities - Testing Android intent filters and iOS URL scheme handlers for unauthorized access - Evaluating App Links (Android) and Universal Links (iOS) verification - Testing for link hijacking via competing app registrations

Exploiting Excessive Data Exposure In Api

- Testing APIs where the frontend displays a subset of data but the API response includes additional fields - Assessing mobile application APIs where responses are designed for multiple client types and may contain excess data - Identifying PII leakage in API responses that include email addresses, phone numbers, SSNs, or payment data not shown in the UI - Testing GraphQL APIs where clients can request arbitrary fields including sensitive attributes - Evaluating APIs after microservice refactoring where internal service-to-service data leaks into public endpoints

Exploiting Http Request Smuggling

- During authorized penetration tests when the application sits behind a reverse proxy, load balancer, or CDN - When testing infrastructure with multiple HTTP processors in the request chain (nginx + Apache, HAProxy + Gunicorn) - For assessing applications for HTTP desynchronization vulnerabilities - When other attack vectors are limited and you need to bypass front-end security controls - During security assessments of multi-tier web architectures

Exploiting Idor Vulnerabilities

- During authorized penetration tests when testing access control on resource endpoints - When APIs or web pages use predictable identifiers (numeric IDs, UUIDs, slugs) in URLs or request bodies - For validating that object-level authorization is enforced across all CRUD operations - When testing multi-tenant applications where users should only access their own data - During bug bounty programs targeting broken access control vulnerabilities

Exploiting Insecure Data Storage In Mobile

Use this skill when: - Assessing whether mobile applications store sensitive data securely on the device filesystem - Testing for credential leakage through SharedPreferences, SQLite databases, or plists - Evaluating keychain/keystore implementation for proper access control attributes - Performing data-at-rest security assessment during mobile penetration tests

Exploiting Insecure Deserialization

- During authorized penetration tests when applications process serialized data (cookies, API parameters, message queues) - When identifying Java serialization markers (ac ed 00 05 / rO0AB) in HTTP traffic - For testing PHP applications that use unserialize() on user-controlled input - When evaluating .NET applications using BinaryFormatter, ObjectStateFormatter, or ViewState - During security assessments of applications using pickle (Python), Marshal (Ruby), or YAML deserialization

Exploiting Ipv6 Vulnerabilities

- Testing whether dual-stack networks have consistent security controls for both IPv4 and IPv6 traffic - Demonstrating risks from unmanaged IPv6 on networks where only IPv4 is officially supported - Exploiting SLAAC and Router Advertisement mechanisms to perform man-in-the-middle attacks via IPv6 - Testing IPv6-aware firewall rules and IDS/IPS detection for IPv6-specific attack patterns - Identifying IPv6 tunneling protocols (6to4, Teredo, ISATAP) that bypass IPv4-only security controls

Exploiting Jwt Algorithm Confusion Attack

- Testing APIs that use RS256 (asymmetric) JWT tokens for authentication to check for algorithm downgrade to HS256 - Assessing JWT implementations for alg:none bypass where the server skips signature verification - Evaluating JWT libraries for key confusion vulnerabilities where the public key is used as HMAC secret - Testing kid (Key ID), jku (JWK Set URL), and x5u (X.509 URL) header parameters for injection - Validating that the API server enforces a specific algorithm and does not trust the JWT header

Exploiting Kerberoasting With Impacket

Kerberoasting (MITRE ATT&CK T1558.003) is a credential access technique that targets Active Directory service accounts by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names (SPNs). The TGS ticket is encrypted with the service account's NTLM hash (RC4 or AES), enabling offline brute-force cracking. Impacket's GetUserSPNs.py is the standard tool for Linux-based Kerberoasting attacks.

Exploiting Mass Assignment In Rest Apis

- When testing REST APIs that accept JSON input for creating or updating resources - During API security assessments of applications using ORM frameworks (Rails, Django, Laravel, Spring) - When testing user registration, profile update, or account management endpoints - During bug bounty hunting on applications with CRUD API operations - When evaluating role-based access control implementation in API-driven applications

Exploiting Ms17 010 Eternalblue Vulnerability

MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it was used in the WannaCry and NotPetya ransomware campaigns. Despite patches being available since March 2017, many organizations still have unpatched systems, making it a viable red team exploitation vector especially in legacy environments.

Exploiting Nopac Cve 2021 42278 42287

noPac is a critical exploit chain combining two Active Directory vulnerabilities: CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). Together, they allow any authenticated domain user to escalate to Domain Admin privileges, potentially achieving full domain compromise in under 60 seconds. CVE-2021-42278 allows an attacker to modify a machine account's sAMAccountName attribute to match a Domain Controller's name (minus the trailing $). CVE-2021-42287 exploits a flaw in the Kerberos PAC validation where the KDC, unable to find the renamed account, falls back to appending $ and issues a ticket for the Domain Controller account. Microsoft patched both vulnerabilities in November 2021 (KB5008380 and KB5008602), but many environments remain unpatched. The exploit was publicly released by cube0x0 and Ridter in December 2021.

Exploiting Nosql Injection Vulnerabilities

- During web application penetration testing of applications using NoSQL databases - When testing authentication mechanisms backed by MongoDB or similar databases - When assessing APIs that accept JSON input for database queries - During bug bounty hunting on applications with NoSQL backends - When performing security code review of database query construction

Exploiting Oauth Misconfiguration

- During authorized penetration tests when the application uses OAuth 2.0 or OpenID Connect for authentication - When assessing "Sign in with Google/Facebook/GitHub" social login implementations - For testing single sign-on (SSO) flows between applications - When evaluating API authorization using OAuth bearer tokens - During security assessments of applications acting as OAuth providers or consumers

Exploiting Prototype Pollution In Javascript

- When testing Node.js or JavaScript-heavy web applications - During assessment of APIs accepting deep-merged JSON objects - When testing client-side JavaScript frameworks for DOM XSS via prototype pollution - During code review of object merge/clone/extend operations - When evaluating npm packages for prototype pollution gadgets

Exploiting Race Condition Vulnerabilities

- When testing applications with transaction-based functionality (payments, transfers, coupons) - During assessment of rate-limiting or attempt-limiting mechanisms - When testing multi-step workflows (registration, password reset, MFA) - During bug bounty hunting for logic flaws in state-changing operations - When evaluating applications with inventory or balance management systems

Exploiting Server Side Request Forgery

- During authorized penetration tests when the application fetches URLs provided by users (webhooks, URL previews, file imports) - When testing cloud-hosted applications for access to instance metadata services - For assessing PDF generators, screenshot services, or any feature that renders external content - When evaluating microservice architectures for internal service access via SSRF - During security assessments of APIs that accept URL parameters for data fetching

Exploiting Smb Vulnerabilities With Metasploit

- Testing Windows systems for critical SMB vulnerabilities (EternalBlue, EternalRomance, PrintNightmare) during authorized penetration tests - Demonstrating lateral movement risks via SMB relay, pass-the-hash, and credential spraying - Validating that patch management processes have addressed known SMB vulnerabilities - Assessing SMB signing enforcement and share permission configurations across the domain - Testing network segmentation by attempting SMB exploitation across VLAN boundaries

Exploiting Sql Injection Vulnerabilities

- Testing web application input parameters for SQL injection vulnerabilities during an authorized penetration test - Validating that parameterized queries and input sanitization are properly implemented across all database interactions - Demonstrating the business impact of a confirmed SQL injection vulnerability by extracting sensitive data - Verifying that WAF rules and input validation controls effectively block SQL injection payloads - Testing stored procedures, dynamic SQL, and ORM bypass scenarios in enterprise applications

Exploiting Sql Injection With Sqlmap

- During authorized web application penetration testing engagements - When manual testing reveals potential SQL injection points in parameters, headers, or cookies - For validating SQL injection findings from automated scanners like Burp Suite or OWASP ZAP - When you need to demonstrate the impact of SQL injection by extracting data from backend databases - During CTF challenges involving SQL injection exploitation

Exploiting Template Injection Vulnerabilities

- During authorized penetration tests when user input is rendered through a server-side template engine - When testing error pages, email templates, PDF generators, or report builders that include user-supplied data - For assessing applications that allow users to customize templates or notification messages - When identifying potential SSTI in parameters that reflect arithmetic results (e.g., {{7*7}} returns 49) - During security assessments of CMS platforms, marketing tools, or any application with templating functionality

Exploiting Type Juggling Vulnerabilities

- When testing PHP web applications for authentication bypass vulnerabilities - During assessment of password comparison and hash verification logic - When testing applications using loose comparison (== instead of ===) - During code review of PHP applications handling JSON or deserialized input - When evaluating input validation that relies on type-dependent comparison

Exploiting Vulnerabilities With Metasploit Framework

The Metasploit Framework is the world's most widely used penetration testing platform, maintained by Rapid7. It contains over 2,300 exploits, 1,200 auxiliary modules, and 400 post-exploitation modules. Within vulnerability management, Metasploit serves as a validation tool to confirm that identified vulnerabilities are actually exploitable, enabling risk-based prioritization and demonstrating real-world impact to stakeholders.

Exploiting Websocket Vulnerabilities

- During authorized penetration tests when the application uses WebSocket connections for real-time features - When assessing chat applications, live notifications, trading platforms, or collaborative editing tools - For testing WebSocket API endpoints for authentication and authorization flaws - When evaluating real-time data streams for injection vulnerabilities - During security assessments of applications using Socket.IO, SignalR, or native WebSocket APIs

Exploiting Zerologon Vulnerability Cve 2020 1472

Zerologon (CVE-2020-1472) is a critical elevation of privilege vulnerability (CVSS 10.0) in the Microsoft Netlogon Remote Protocol (MS-NRPC). The flaw exists in the cryptographic implementation of AES-CFB8 mode, where the initialization vector (IV) is incorrectly set to all zeros. This allows an unauthenticated attacker with network access to a domain controller to establish a Netlogon session and reset the DC machine account password to empty, achieving full domain compromise. Microsoft patched this vulnerability in August 2020 (KB4571694).

Extracting Browser History Artifacts

- When investigating user web activity as part of a forensic examination - During insider threat investigations to establish patterns of data exfiltration - When tracing user visits to malicious or policy-violating websites - For correlating browser activity with other forensic artifacts and timelines - When investigating phishing attacks to identify which links were clicked

Extracting Config From Agent Tesla Rat

Agent Tesla is a .NET-based Remote Access Trojan (RAT) and keylogger that ranked among the top 10 malware variants in 2024, impacting 6.3% of corporate networks globally. It exfiltrates stolen credentials via SMTP email, FTP upload, Telegram bot API, or Discord webhooks. The malware configuration is embedded in the .NET assembly, typically obfuscated using string encryption, resource encryption, or custom loaders that decrypt and execute Agent Tesla in memory via .NET Reflection (fileless). Configuration extraction involves decompiling the .NET assembly with dnSpy or ILSpy, identifying the decryption routine for configuration strings, and extracting SMTP server addresses, credentials, FTP endpoints, Telegram bot tokens, and targeted applications.

Extracting Credentials From Memory Dump

- During incident response to determine what credentials an attacker had access to - When assessing the scope of credential compromise after a breach - For identifying accounts that need immediate password resets - When investigating lateral movement and pass-the-hash/pass-the-ticket attacks - For recovering encryption keys or authentication tokens from process memory

Extracting Iocs From Malware Samples

- A malware analysis (static or dynamic) is complete and actionable indicators need to be extracted for defense teams - Building blocklists for firewalls, proxies, and DNS sinkholes from analyzed samples - Creating YARA rules, Snort/Suricata signatures, or SIEM detection content from malware artifacts - Contributing to threat intelligence sharing platforms (MISP, OTX, ThreatConnect) - Tracking malware campaigns by correlating IOCs across multiple samples

Extracting Memory Artifacts With Rekall

- When performing authorized security testing that involves extracting memory artifacts with rekall - When analyzing malware samples or attack artifacts in a controlled environment - When conducting red team exercises or penetration testing engagements - When building detection capabilities based on offensive technique understanding

Extracting Windows Event Logs Artifacts

- When investigating security incidents on Windows systems through event log analysis - For detecting lateral movement, privilege escalation, and persistence mechanisms - When performing threat hunting across Windows event log data - During compliance audits requiring review of authentication and access events - When building forensic timelines from Windows system activity

Fleet Hunting With Velociraptor

Velociraptor is an open-source endpoint visibility and digital-forensics platform from Rapid7/Velocidex. A single Go binary acts as server, client (agent), and CLI depending on how it is invoked and configured. Its power comes from VQL (Velociraptor Query Language) — an SQL-like language whose plugins query the live state of an endpoint (processes, files, registry, event logs, WMI, network connections, prefetch, etc.). VQL queries are packaged into reusable Artifacts, and Artifacts are run at scale as Hunts that fan out across every connected client and stream results back to the server as structured rows.

Generating And Analyzing Sboms

A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of every component, library, and dependency in a piece of software — the supply-chain equivalent of an ingredients label. SBOMs are central to defending against supply-chain compromise (CISA's SBOM initiative, US Executive Order 14028) because you cannot patch what you cannot see. The two dominant SBOM standards are:

Generating Forensic Timelines With Hayabusa

Hayabusa (隼, Japanese for "peregrine falcon") is a Sigma-based threat-hunting and fast-forensics timeline generator for Windows event logs, developed by Yamato Security in Rust. It parses .evtx files (offline or via live analysis of a local host), applies a large built-in library of Sigma detection rules plus Hayabusa-specific rules, and produces a single, readable, chronological timeline of high-signal events with severity levels, MITRE ATT&CK tactics, and rule references. This collapses thousands of raw event-log records into a prioritized incident timeline that an analyst can review quickly.

Generating Threat Intelligence Reports

Use this skill when: - Producing weekly, monthly, or quarterly threat intelligence summaries for security leadership - Creating a rapid intelligence assessment in response to a breaking threat (e.g., new zero-day, active ransomware campaign) - Generating sector-specific threat briefings for executive decision-making on security investments

Hardening Docker Containers For Production

Hardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce least-privilege principles across Docker daemon, images, containers, and runtime configurations.

Hardening Docker Daemon Configuration

The Docker daemon (dockerd) runs with root privileges and controls all container operations. Hardening its configuration through /etc/docker/daemon.json, TLS certificates, user namespace remapping, and network restrictions is essential to prevent privilege escalation, lateral movement, and container breakout attacks.

Hardening Linux Endpoint With Cis Benchmark

Use this skill when: - Hardening Linux servers (Ubuntu, RHEL, CentOS, Debian) against CIS benchmarks - Automating Linux security baselines using Ansible, OpenSCAP, or shell scripts - Meeting compliance requirements (PCI DSS, HIPAA, SOC 2) for Linux endpoints - Remediating findings from vulnerability scans or security audits

Hardening Windows Endpoint With Cis Benchmark

Use this skill when: - Deploying new Windows 10/11 or Server 2019/2022 endpoints that require security hardening - Establishing organization-wide security baselines using CIS Level 1 or Level 2 profiles - Remediating findings from compliance audits (PCI DSS, HIPAA, SOC 2) that reference CIS benchmarks - Validating existing endpoint configurations against current CIS benchmark versions

Hunting Advanced Persistent Threats

Use this skill when: - Conducting proactive threat hunting sprints (typically 2–4 week cycles) based on newly published APT intelligence - A UEBA alert or anomaly detection system flags behavioral deviations warranting deeper investigation - A peer organization or ISAC sharing partner reports active APT compromise and you need to validate your own exposure

Hunting Bootkits In Efi System Partition

The EFI System Partition (ESP) is a small FAT32-formatted partition that the platform firmware reads at power-on to locate and execute the operating system's boot loader. Because it executes *before* the operating system, kernel, and any EDR agent, the ESP is one of the most coveted persistence locations for advanced adversaries. UEFI bootkits that live on the ESP survive OS reinstallation, disk reformatting of the OS partition, and most endpoint defenses.

Hunting Credential Stuffing Attacks

- When investigating security incidents that require hunting credential stuffing attacks - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques

Hunting Evtx With Chainsaw

Chainsaw is a fast, Rust-based forensic artifact search and hunting tool from WithSecure Labs. It provides first-response capability to rapidly identify threats within Windows Event Logs (.evtx) and other artifacts. Chainsaw can hunt with the full SigmaHQ rule corpus (translating Sigma to its internal Tau engine), run its own built-in detection rules, perform high-speed keyword/regex search across logs, and analyse specialized artifacts such as the AppCompatCache (shimcache), SRUM database, and event-log gaps. Output can be a colorized table, CSV, or JSON for downstream tooling.

Hunting For Anomalous Powershell Execution

PowerShell Script Block Logging (Event ID 4104) records the full deobfuscated script text executed on a Windows endpoint, making it the primary data source for hunting malicious PowerShell. Combined with Module Logging (4103) and process creation events, analysts can detect encoded commands, AMSI bypass patterns, download cradles, credential theft tools, and fileless attack techniques even when the attacker uses obfuscation layers.

Hunting For Beaconing With Frequency Analysis

- When proactively searching for compromised endpoints calling back to C2 infrastructure - After threat intelligence reports indicate active C2 frameworks targeting your sector - When network logs show periodic outbound connections to unfamiliar destinations - During purple team exercises validating C2 detection capabilities - When investigating a potential breach and need to identify active C2 channels

Hunting For Cobalt Strike Beacons

Cobalt Strike is the most prevalent command-and-control framework used by both red teams and threat actors. Beacon, its primary payload, communicates with team servers using configurable HTTP/HTTPS/DNS profiles that can mimic legitimate traffic. However, default configurations and behavioral patterns remain detectable through TLS certificate analysis (default serial 8BB00EE), JA3/JA3S fingerprinting, beacon interval jitter analysis, and HTTP malleable profile pattern matching. This skill covers building detection capabilities using Zeek network logs, Suricata IDS rules, and Python-based PCAP analysis to identify beacon callbacks in network traffic.

Hunting For Command And Control Beaconing

- When proactively hunting for compromised systems in the network - After threat intel indicates C2 frameworks targeting your industry - When investigating periodic outbound connections to suspicious domains - During incident response to identify active C2 channels - When DNS query logs show unusual patterns to specific domains

Hunting For Data Exfiltration Indicators

- When hunting for data theft in compromised environments - After detecting unusual outbound data volumes or patterns - When investigating potential insider threat data theft - During incident response to determine what data was stolen - When threat intel indicates data exfiltration campaigns targeting your sector

Hunting For Data Staging Before Exfiltration

Before exfiltrating data, adversaries typically stage collected files in a central location (MITRE ATT&CK T1074). This involves creating archives with tools like 7-Zip, RAR, or tar, consolidating files from multiple directories, and using temporary or hidden staging directories. This skill detects staging behavior by analyzing process creation logs for archiver activity, monitoring file system events in common staging paths, and identifying anomalous file consolidation patterns.

Hunting For Dcom Lateral Movement

Distributed Component Object Model (DCOM) enables remote execution of COM objects across a network using RPC. Adversaries abuse specific DCOM objects -- MMC20.Application (CLSID {49B2791A-B1AE-4C90-9B8E-E860BA07F889}), ShellBrowserWindow (CLSID {C08AFD90-F2A1-11D1-8455-00A0C91F3880}), and ShellWindows (CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39}) -- to execute commands on remote hosts without dropping files, making this a stealthy lateral movement technique mapped to MITRE ATT&CK T1021.003. This skill provides detection strategies using Sysmon telemetry, Windows Security Event correlation, network monitoring, and SIEM detection rules to identify DCOM abuse in enterprise environments.

Hunting For Dcsync Attacks

- When hunting for DCSync credential theft (MITRE ATT&CK T1003.006) - After detecting Mimikatz or similar tools in the environment - During incident response involving Active Directory compromise - When monitoring for unauthorized domain replication requests - During purple team exercises testing AD attack detection

Hunting For Defense Evasion Via Timestomping

Detect timestamp manipulation by analyzing NTFS MFT entries for discrepancies between $STANDARD_INFORMATION and $FILE_NAME attributes.

Hunting For Dns Based Persistence

Attackers establish DNS-based persistence by hijacking DNS records, creating unauthorized subdomains, abusing wildcard DNS entries, or modifying NS delegations to redirect traffic through attacker-controlled infrastructure. These techniques survive credential rotations, endpoint reimaging, and traditional remediation because DNS changes persist independently of compromised hosts. Detection requires passive DNS historical analysis, zone file auditing, and monitoring for unauthorized record modifications. This skill covers hunting methodologies using SecurityTrails passive DNS API, DNS audit logs from Route53/Azure DNS/Cloudflare, and zone transfer analysis.

Hunting For Dns Tunneling With Zeek

- When hunting for data exfiltration over DNS covert channels - After threat intelligence indicates DNS-based C2 frameworks targeting your industry - When dns.log shows unusually high query volumes to specific domains - During investigation of suspected data theft where no HTTP/S exfiltration is found - When monitoring for tools like iodine, dnscat2, DNSExfiltrator, or DNS-over-HTTPS tunneling

Hunting For Domain Fronting C2 Traffic

Domain fronting (MITRE ATT&CK T1090.004) is a technique where attackers use different domain names in the TLS SNI field and the HTTP Host header to disguise C2 traffic behind legitimate CDN-hosted domains. This skill detects domain fronting by parsing proxy/web gateway logs for SNI-Host header mismatches, analyzing TLS certificates for CDN provider identification, flagging connections where the SNI points to a high-reputation domain but the Host header targets an attacker-controlled domain, and correlating with known CDN provider IP ranges.

Hunting For Lateral Movement Via Wmi

Windows Management Instrumentation (WMI) is commonly abused for lateral movement via wmic process call create or Win32_Process.Create() to execute commands on remote hosts. Detection focuses on identifying WmiPrvSE.exe spawning child processes (cmd.exe, powershell.exe) in Windows Security Event ID 4688 and Sysmon Event ID 1 logs, along with WMI-Activity/Operational events (5857, 5860, 5861) for event subscription persistence.

Hunting For Living Off The Cloud Techniques

- When proactively hunting for indicators of hunting for living off the cloud techniques in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Hunting For Living Off The Land Binaries

- When investigating fileless malware campaigns that bypass traditional AV - During proactive threat hunts targeting defense evasion techniques - When EDR alerts fire on legitimate binaries executing unusual child processes - After threat intelligence reports indicate LOLBin abuse in active campaigns - During red team/purple team exercises validating detection coverage for T1218

Hunting For Lolbins Execution In Endpoint Logs

- When hunting for fileless attack techniques that abuse built-in Windows binaries - After threat intelligence indicates LOLBin-based campaigns targeting your industry - When investigating alerts for suspicious use of certutil, mshta, rundll32, or regsvr32 - During purple team exercises testing detection of defense evasion techniques - When assessing endpoint detection coverage for MITRE ATT&CK T1218 sub-techniques

Hunting For Ntlm Relay Attacks

NTLM relay attacks intercept and forward NTLM authentication messages to gain unauthorized access to network resources. Attackers use tools like Responder for LLMNR/NBT-NS poisoning and ntlmrelayx for credential relay. This skill detects relay activity by querying Windows Security Event 4624 (successful logon) for type 3 network logons with NTLMSSP authentication, identifying mismatches between WorkstationName and source IpAddress, detecting rapid multi-host authentication from single accounts, and auditing SMB signing configuration across domain hosts.

Hunting For Persistence Mechanisms In Windows

- During periodic proactive threat hunts for dormant backdoors - After an incident to identify all persistence mechanisms an attacker planted - When investigating unusual services, scheduled tasks, or startup entries - When threat intel reports describe new persistence techniques in the wild - During security posture assessments to identify unauthorized persistent software

Hunting For Persistence Via Wmi Subscriptions

- When proactively searching for fileless persistence mechanisms in Windows environments - After threat intelligence reports indicate WMI-based persistence by APT groups (APT29, APT32, FIN8) - When investigating systems where malware persists across reboots despite cleanup attempts - During incident response when standard persistence locations (Run keys, scheduled tasks) are clean - When WmiPrvSe.exe is observed spawning unexpected child processes

Hunting For Process Injection Techniques

Process injection (MITRE ATT&CK T1055) allows adversaries to execute code in the address space of another process, enabling defense evasion and privilege escalation. This skill detects injection techniques via Sysmon Event ID 8 (CreateRemoteThread), Event ID 10 (ProcessAccess with suspicious access rights), and analysis of source-target process relationships to distinguish legitimate from malicious injection.

Hunting For Registry Persistence Mechanisms

- When proactively hunting for indicators of hunting for registry persistence mechanisms in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Hunting For Registry Run Key Persistence

Registry Run keys (T1547.001) are one of the most commonly used persistence mechanisms by adversaries. When a program is added to a Run key in the Windows registry, it executes automatically when a user logs in. Attackers abuse keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Run, HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and their RunOnce counterparts to maintain persistence. Sysmon Event ID 13 (RegistryEvent - Value Set) captures registry value modifications including the target object path, the process that made the change, and the new value. Detection involves monitoring these events for suspicious executables in temp directories, encoded PowerShell commands, LOLBin paths, and processes that do not normally create Run key entries. Chaining Event 13 with Event 1 (Process Creation) and Event 11 (FileCreate) strengthens detection by confirming payload creation and execution.

Hunting For Scheduled Task Persistence

- When proactively hunting for indicators of hunting for scheduled task persistence in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Hunting For Shadow Copy Deletion

- When proactively hunting for indicators of hunting for shadow copy deletion in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Hunting For Spearphishing Indicators

- When proactively hunting for indicators of hunting for spearphishing indicators in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Hunting For Startup Folder Persistence

Attackers use Windows startup folders for persistence (MITRE ATT&CK T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder). Files placed in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup or C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup execute automatically at user logon. This skill scans startup directories for suspicious files, monitors for real-time changes using Python watchdog, and analyzes file metadata to detect persistence implants.

Hunting For Supply Chain Compromise

- When proactively hunting for indicators of hunting for supply chain compromise in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Hunting For Suspicious Scheduled Tasks

- When proactively hunting for persistence mechanisms in Windows environments - After detecting schtasks.exe or at.exe usage in process creation logs - When investigating malware that survives reboots and user logoffs - During incident response to enumerate all persistence on compromised systems - When Windows Security Event ID 4698 (Scheduled Task Created) fires for unusual tasks

Hunting For T1098 Account Manipulation

MITRE ATT&CK T1098 (Account Manipulation) covers adversary actions to maintain or expand access to compromised accounts, including adding credentials, modifying group memberships, SID history injection, and creating shadow admin accounts. This skill covers detecting these techniques through Windows Security Event Log analysis (Event IDs 4738, 4728, 4732, 4756, 4670, 5136), correlating group membership changes with privilege escalation indicators, and identifying anomalous account modification patterns.

Hunting For Unusual Network Connections

- When proactively hunting for indicators of hunting for unusual network connections in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Hunting For Unusual Service Installations

Attackers frequently install malicious Windows services for persistence and privilege escalation (MITRE ATT&CK T1543.003 — Create or Modify System Process: Windows Service). Event ID 7045 in the System event log records every new service installation. This skill parses .evtx log files to extract service installation events, flags suspicious binary paths (temp directories, PowerShell, cmd.exe, encoded commands), and correlates with known attack patterns.

Hunting For Webshell Activity

- When proactively hunting for indicators of hunting for webshell activity in the environment - After threat intelligence indicates active campaigns using these techniques - During incident response to scope compromise related to these techniques - When EDR or SIEM alerts trigger on related indicators - During periodic security assessments and purple team exercises

Hunting Saas Sso Token Abuse

Adversaries increasingly bypass MFA not by defeating it but by stealing the artifacts issued *after* a successful authentication — session cookies, OAuth access/refresh tokens, and Primary Refresh Tokens (PRTs). With a stolen token an attacker replays the existing session ("pass-the-cookie" / token replay), inheriting the victim's authenticated state across federated SaaS without ever prompting for credentials or MFA. Mandiant's M-Trends reporting and Microsoft/Okta incident data both highlight token theft as a dominant cloud lateral-movement technique, mapped to MITRE ATT&CK T1550.001 Use Alternate Authentication Material: Application Access Token.

Implementing Aes Encryption For Data At Rest

AES (Advanced Encryption Standard) is a symmetric block cipher standardized by NIST (FIPS 197) used to protect classified and sensitive data. This skill covers implementing AES-256 encryption in GCM mode for encrypting files and data stores at rest, including proper key derivation, IV/nonce management, and authenticated encryption.

Implementing Alert Fatigue Reduction

Use this skill when: - SOC analysts face more alerts than they can reasonably investigate (>100 alerts/analyst/shift) - False positive rates exceed 70% on key detection rules - True positives are being missed or dismissed due to alert volume - Management reports declining analyst morale or increasing turnover related to workload

Implementing Anti Phishing Training Program

Security awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positive reinforcement to build a security-conscious culture. This skill covers designing, deploying, and measuring a comprehensive phishing awareness program using platforms like KnowBe4, Proofpoint Security Awareness, and open-source alternatives.

Implementing Anti Ransomware Group Policy

- Hardening a Windows Active Directory environment against ransomware execution and propagation - Implementing defense-in-depth by blocking ransomware execution paths via Group Policy - Configuring AppLocker or WDAC rules to prevent unauthorized executables from running in user-writable directories - Enabling Controlled Folder Access to protect critical directories from unauthorized file modifications - Restricting lateral movement vectors (RDP, SMB, WMI) that ransomware uses to spread across the domain

Implementing Api Abuse Detection With Rate Limiting

API rate limiting is a critical security control that restricts the number of requests a client can make within a defined time period. It defends against denial-of-service (DDoS), brute force login attempts, credential stuffing, API scraping, and resource exhaustion attacks. Modern implementations use algorithms like token bucket, sliding window, and fixed window counters, often backed by distributed stores like Redis. Adaptive rate limiting dynamically tightens limits during detected attacks and relaxes during normal operation, achieving a 94% reduction in successful DDoS attempts compared to static IP-based approaches.

Implementing Api Gateway Security Controls

- Deploying a centralized authentication and authorization layer for microservice APIs - Implementing rate limiting, throttling, and quota management across all API endpoints - Configuring request/response validation against OpenAPI specifications at the gateway level - Setting up TLS termination, mutual TLS, and certificate management for API traffic - Integrating WAF rules with the API gateway to block injection, XSS, and known attack patterns

Implementing Api Key Security Controls

- Designing secure API key generation with sufficient entropy and identifiable prefixes for leak detection - Implementing server-side API key hashing (never storing keys in plaintext) with SHA-256 or bcrypt - Building key rotation workflows that allow zero-downtime key replacement for API consumers - Configuring per-key scoping to limit each API key to specific endpoints, IP ranges, and rate limits - Setting up automated monitoring for API key leakage in GitHub repos, logs, and client-side code

Implementing Api Rate Limiting And Throttling

- Protecting authentication endpoints against brute force and credential stuffing attacks - Preventing API abuse and resource exhaustion from automated scripts and bots - Implementing fair usage quotas for different API consumer tiers (free, premium, enterprise) - Defending against denial-of-service attacks at the application layer - Meeting compliance requirements that mandate API abuse prevention controls

Implementing Api Schema Validation Security

API schema validation enforces that all data exchanged through APIs conforms to a predefined structure defined in OpenAPI Specification (OAS) or JSON Schema documents. This prevents injection attacks (SQLi, XSS, XXE), blocks mass assignment by rejecting unknown properties, prevents data leakage by validating response schemas, and ensures type safety across all API interactions. Schema validation operates at both the API gateway level (runtime enforcement) and during development (shift-left security).

Implementing Api Security Posture Management

API Security Posture Management (API-SPM) provides continuous visibility into an organization's API attack surface by automatically discovering, classifying, and risk-scoring all APIs including internal, external, partner, and shadow endpoints. Unlike point-in-time testing tools, API-SPM operates continuously to detect configuration drift, policy violations, missing security controls, sensitive data exposure, and compliance gaps. It aggregates findings from DAST, SAST, SCA, and runtime monitoring tools to provide a unified view of API risk posture across the organization.

Implementing Api Security Testing With 42crunch

42Crunch is an API security platform that combines Shift-Left security testing with Shield-Right runtime protection. It provides API Audit for static security analysis of OpenAPI definitions, API Conformance Scan for dynamic vulnerability detection, and API Protect for real-time threat prevention. The platform integrates into CI/CD pipelines and IDEs to identify OWASP API Security Top 10 vulnerabilities before and after deployment.

Implementing Api Threat Protection With Apigee

Google Apigee is an enterprise API management platform that provides native security policies for threat protection, including JSON and XML content validation, OAuth 2.0 enforcement, SpikeArrest rate limiting, regular expression threat protection, and Advanced API Security for detecting malicious clients and API abuse patterns. Apigee operates as a reverse proxy that intercepts all API traffic, applying security policies before requests reach backend services, effectively shielding APIs against the OWASP API Security Top 10 threats.

Implementing Application Whitelisting With Applocker

Use this skill when: - Implementing application control to prevent unauthorized software execution on Windows endpoints - Meeting compliance requirements (PCI DSS 6.4.3, NIST 800-53 CM-7, ACSC Essential Eight) - Blocking common attack vectors: living-off-the-land binaries (LOLBins), script-based attacks, unauthorized admin tools - Restricting software installation in kiosk, POS, or high-security environments

Implementing Aqua Security For Container Scanning

Aqua Security provides Trivy, the world's most popular open-source universal security scanner, designed to find vulnerabilities, misconfigurations, secrets, SBOM data, and license issues in containers, Kubernetes, code repositories, and cloud environments. Trivy covers OS packages (Alpine, Debian, Ubuntu, RHEL, etc.) and language-specific dependencies (npm, pip, Maven, Go modules, Cargo, etc.) with vulnerability databases sourced from NVD, vendor advisories, and GitHub Security Advisories. The enterprise Aqua Platform extends Trivy with centralized policy management, runtime protection, and compliance reporting.

Implementing Attack Path Analysis With Xm Cyber

XM Cyber is a continuous exposure management platform that uses attack graph analysis to identify how adversaries can chain together exposures -- vulnerabilities, misconfigurations, identity risks, and credential weaknesses -- to reach critical business assets. According to XM Cyber's 2024 research analyzing over 40 million exposures across 11.5 million entities, organizations typically have around 15,000 exploitable exposures, but traditional CVEs account for less than 1% of total exposures. The platform identifies that only 2% of exposures reside on "choke points" of converging attack paths, enabling security teams to focus on fixes that eliminate the most risk with the least effort.

Implementing Attack Surface Management

- When building an external attack surface management (EASM) program from scratch - When performing authorized external reconnaissance for penetration testing engagements - When continuously monitoring organizational exposure across internet-facing assets - When scoring and prioritizing external attack surface risks for remediation - When integrating multiple discovery tools into an automated ASM pipeline

Implementing Aws Config Rules For Compliance

- When establishing continuous compliance monitoring for AWS resources against regulatory standards - When implementing automated detection and remediation of configuration drift - When building a compliance dashboard across multiple AWS accounts using AWS Organizations - When audit teams require evidence of continuous compliance rather than point-in-time assessments - When deploying guardrails that detect non-compliant resources within minutes of creation

Implementing Aws Iam Permission Boundaries

IAM permission boundaries are an advanced AWS feature that sets the maximum permissions an identity-based policy can grant to an IAM entity (user or role). They enable centralized security teams to safely delegate IAM role and policy creation to application developers without risking privilege escalation. The effective permissions of an entity are the intersection of its identity-based policies and its permission boundary -- even if an identity policy grants AdministratorAccess, the permission boundary restricts it to only the allowed actions.

Implementing Aws Macie For Data Classification

Amazon Macie is a fully managed data security and privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Macie automatically evaluates your S3 bucket inventory on a daily basis and identifies objects containing PII, financial information, credentials, and other sensitive data types. It provides two discovery approaches: automated sensitive data discovery for broad visibility and targeted discovery jobs for deep analysis.

Implementing Aws Nitro Enclave Security

- Processing sensitive data (PII, PHI, financial records, cryptographic secrets) that must be isolated from EC2 instance operators and administrators - Building confidential computing pipelines where even root-level access on the parent instance cannot read enclave memory or state - Implementing cryptographic attestation workflows that tie KMS decryption rights to a specific, verified enclave image hash - Deploying multi-party computation environments where two or more enclaves authenticate each other via attestation before exchanging data - Hardening existing workloads that currently decrypt secrets on the parent instance by migrating decryption into an enclave boundary

Implementing Aws Security Hub

- When establishing a centralized security findings dashboard across multiple AWS accounts - When enabling automated compliance checks against CIS, PCI-DSS, NIST, or AWS Foundational Security Best Practices - When integrating findings from GuardDuty, Inspector, Macie, and third-party security tools - When building automated remediation workflows for recurring security misconfigurations - When preparing compliance evidence for auditors requiring continuous posture monitoring

Implementing Aws Security Hub Compliance

- When establishing centralized security posture management across multiple AWS accounts - When compliance requirements demand continuous monitoring against CIS, PCI DSS, or NIST 800-53 standards - When aggregating findings from GuardDuty, Inspector, Macie, Firewall Manager, and third-party tools - When building automated remediation workflows triggered by security findings - When executive stakeholders require a security compliance dashboard across the organization

Implementing Azure Ad Privileged Identity Management

Microsoft Entra Privileged Identity Management (PIM) provides time-based and approval-based role activation to mitigate risks from excessive, unnecessary, or misused access to critical resources. PIM replaces permanent (standing) privilege assignments with eligible assignments that require users to explicitly activate their role before use, with configurable duration, MFA enforcement, approval workflows, and justification requirements. This is a core component of Zero Trust identity governance in Microsoft environments.

Implementing Azure Defender For Cloud

- When enabling comprehensive security monitoring across Azure subscriptions - When implementing cloud workload protection for VMs, containers, SQL, storage, and Key Vault - When compliance requirements demand continuous assessment against regulatory frameworks - When building adaptive security controls that respond to detected threats - When centralizing security findings from Azure-native and hybrid workloads

Implementing Beyondcorp Zero Trust Access Model

- When replacing traditional VPN infrastructure with identity-based application access - When migrating to Google Cloud and requiring zero trust access for internal applications - When implementing device trust verification as a prerequisite for resource access - When needing context-aware access policies based on user identity, device posture, and location - When securing access for remote and hybrid workforce without network-level trust

Implementing Bgp Security With Rpki

Resource Public Key Infrastructure (RPKI) provides cryptographic validation of BGP route origins to prevent route hijacking and accidental route leaks. RPKI enables network operators to create Route Origin Authorizations (ROAs) that declare which Autonomous Systems (ASes) are authorized to originate specific IP prefixes. BGP routers validate received route announcements against RPKI data through Route Origin Validation (ROV), rejecting routes with invalid origins. This skill covers creating ROAs through Regional Internet Registries (RIRs), deploying RPKI validator software, configuring ROV on Cisco IOS-XE and Juniper Junos routers, and implementing BGP filtering policies based on RPKI validation state.

Implementing Browser Isolation For Zero Trust

- When deploying remote browser isolation as part of a Zero Trust security architecture - When protecting users from zero-day browser exploits and drive-by downloads - When implementing content disarming and reconstruction for file downloads - When enforcing data loss prevention policies for web browsing sessions - When securing access to untrusted or uncategorized websites - When integrating browser isolation with existing SWG and ZTNA infrastructure - When protecting against phishing and credential theft via isolated rendering

Implementing Canary Tokens For Network Intrusion

- When deploying deception-based tripwires across network infrastructure to detect intrusions - When building early warning systems that alert on unauthorized access to sensitive resources - When planting fake AWS credentials, DNS beacons, or HTTP tokens to catch attackers during lateral movement - When integrating canary token alerts with SOC workflows via Slack, Microsoft Teams, or SIEM webhooks - When complementing traditional IDS/IPS with zero-false-positive deception technology

Implementing Cisa Zero Trust Maturity Model

The CISA Zero Trust Maturity Model (ZTMM) Version 2.0, released in April 2023, provides federal agencies and organizations with a structured roadmap for adopting zero trust architecture. The model defines five core pillars -- Identity, Devices, Networks, Applications & Workloads, and Data -- each progressing through four maturity stages: Traditional, Initial, Advanced, and Optimal. Three cross-cutting capabilities (Visibility and Analytics, Automation and Orchestration, and Governance) span all pillars. This skill covers assessment, gap analysis, and progressive implementation across all pillars and maturity levels.

Implementing Cloud Dlp For Data Protection

- When compliance frameworks (GDPR, HIPAA, PCI DSS) require automated sensitive data discovery and protection - When building data governance programs that classify and label data across cloud storage - When implementing data loss prevention controls for cloud-based data pipelines - When auditing cloud environments for unprotected sensitive data (PII, PHI, financial data) - When integrating DLP scanning into CI/CD pipelines to prevent sensitive data from reaching production

Implementing Cloud Security Posture Management

- When establishing continuous security monitoring across AWS, Azure, and GCP environments - When compliance requirements demand automated posture assessment against CIS, SOC 2, or PCI DSS - When security teams need visibility into cloud misconfigurations across multiple accounts and subscriptions - When building a security operations workflow that detects and remediates drift from security baselines - When migrating workloads to the cloud and need to enforce security guardrails

Implementing Cloud Trail Log Analysis

- When building security monitoring pipelines for AWS API activity - When investigating security incidents to trace attacker actions across AWS services - When compliance requires audit logging of all administrative and data access operations - When creating detection rules for known attack patterns in AWS environments - When establishing baseline API behavior for anomaly detection

Implementing Cloud Vulnerability Posture Management

Cloud Security Posture Management (CSPM) continuously monitors cloud infrastructure for misconfigurations, compliance violations, and security risks. Unlike traditional vulnerability scanning, CSPM focuses on cloud-native risks: IAM over-permissions, exposed storage buckets, unencrypted data, missing network controls, and service misconfigurations. This skill covers multi-cloud CSPM using AWS Security Hub, Azure Defender for Cloud, and open-source tools like Prowler and ScoutSuite.

Implementing Cloud Waf Rules

- When deploying new web applications or APIs behind cloud load balancers requiring OWASP protection - When application penetration testing reveals SQL injection, XSS, or other injection vulnerabilities - When experiencing brute force, credential stuffing, or bot attacks against authentication endpoints - When compliance requirements mandate a WAF for PCI-DSS or similar standards - When tuning WAF rules to reduce false positives blocking legitimate application traffic

Implementing Cloud Workload Protection

- When deploying or configuring implementing cloud workload protection capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation

Implementing Code Signing For Artifacts

- When establishing artifact integrity verification to prevent supply chain tampering - When compliance requires cryptographic proof that build artifacts are authentic and unmodified - When distributing software to customers who need to verify publisher identity - When implementing zero-trust deployment pipelines that reject unsigned artifacts - When meeting SLSA Level 2+ requirements for provenance and integrity

Implementing Conditional Access Policies Azure Ad

Configure Microsoft Entra ID (Azure AD) Conditional Access policies for zero trust access control. Covers signal-based policy design, device compliance requirements, risk-based authentication, named locations, session controls, and integration with NIST SP 1800-35 zero trust architecture.

Implementing Conduit Security For Ot Remote Access

- When replacing direct VPN connections from IT or vendors into OT control networks - When implementing IEC 62443-compliant conduit architecture for remote access paths - When deploying secure remote access for third-party vendor maintenance of ICS equipment - When building approval-based access workflows for privileged OT system access - When remediating audit findings about uncontrolled remote access to SCADA systems

Implementing Container Image Minimal Base With Distroless

Google distroless images contain only your application and its runtime dependencies, without package managers, shells, or other programs found in standard Linux distributions. By eliminating unnecessary OS components, distroless images achieve up to 95% reduction in attack surface compared to traditional base images like ubuntu or debian. Major projects including Kubernetes itself, Knative, and Tekton use distroless images in production. As of 2025, Docker also offers Hardened Images (DHI) as an open-source alternative for minimal container bases.

Implementing Container Network Policies With Calico

Calico provides Kubernetes-native and extended network policy enforcement through its CNI plugin. This skill covers creating and auditing Calico NetworkPolicy and GlobalNetworkPolicy resources to implement pod-to-pod traffic control, namespace isolation, egress restrictions, and DNS-based policy rules using calicoctl and the Kubernetes API.

Implementing Continuous Security Validation With Bas

Breach and Attack Simulation (BAS) is an automated, continuous approach to validating security control effectiveness by safely executing real-world attack techniques against production security infrastructure. Unlike traditional penetration testing (point-in-time), BAS platforms continuously simulate threats mapped to MITRE ATT&CK, testing endpoint protection, network security, email gateways, SIEM detection, and incident response capabilities. Leading platforms include SafeBreach, AttackIQ, Picus Security (2024 Gartner Customers' Choice), Cymulate, Pentera, and SCYTHE. BAS 2.0 solutions safely emulate real attacker behavior across the entire IT environment without requiring pre-deployed agents on every endpoint.

Implementing Data Loss Prevention With Microsoft Purview

- Deploying DLP policies to prevent sensitive data (PII, PHI, PCI, intellectual property) from leaving the organization through email, cloud storage, chat, or endpoint file operations - Configuring sensitivity labels with encryption, content marking, and auto-labeling to classify documents and emails by confidentiality level - Creating custom sensitive information types with regex patterns to detect organization-specific data formats (employee IDs, project codes, internal account numbers) - Deploying endpoint DLP to control copy-to-USB, print, upload-to-cloud, and copy-to-clipboard actions for labeled or sensitive content on managed devices - Investigating DLP incidents through Activity Explorer to analyze policy match events, user activity patterns, and false positive rates for policy tuning

Implementing Ddos Mitigation With Cloudflare

Cloudflare provides multi-layer DDoS protection across its global network of over 300 data centers with 477+ Tbps of capacity. The platform protects against L3/4 volumetric attacks (SYN floods, UDP amplification, DNS reflection), protocol attacks (Ping of Death, Smurf), and L7 application-layer attacks (HTTP floods, Slowloris, cache-busting). Cloudflare's autonomous detection systems identify and mitigate attacks within approximately 3 seconds using traffic profiling, machine learning, and adaptive rulesets. This skill covers configuring Cloudflare's DDoS protection stack including managed rulesets, WAF rules, rate limiting, Bot Management, and origin server hardening.

Implementing Deception Based Detection With Canarytoken

Canary Tokens are lightweight tripwire mechanisms that alert when an attacker accesses a resource. This skill uses the Thinkst Canary REST API to programmatically create tokens (web bugs, DNS tokens, MS Word documents, AWS API keys), deploy them to strategic locations, monitor for triggered alerts, and generate deception coverage reports.

Implementing Delinea Secret Server For Pam

- Organization needs centralized privileged credential management across hybrid infrastructure - Compliance requirements mandate privileged access controls (SOX, PCI-DSS, HIPAA, NIST 800-53) - Service accounts and shared credentials are stored in spreadsheets or plaintext files - Need to implement automated password rotation for privileged accounts - Require session recording and keystroke logging for privileged user activity - Migrating from manual PAM processes to an enterprise vault solution

Implementing Device Posture Assessment In Zero Trust

- When enforcing device health as a prerequisite for accessing corporate applications - When integrating CrowdStrike ZTA scores, Intune compliance, or Jamf device status into access decisions - When implementing CISA Zero Trust Maturity Model device pillar requirements - When building conditional access policies that adapt based on real-time endpoint security posture - When detecting and blocking access from compromised, unmanaged, or non-compliant devices

Implementing Devsecops Security Scanning

- Setting up automated security scanning in a new or existing CI/CD pipeline - Shifting security left by catching vulnerabilities before code reaches production - Meeting compliance requirements (SOC 2, PCI-DSS, ISO 27001) that mandate automated security testing - Integrating SAST, DAST, and SCA together to achieve comprehensive application security coverage - Establishing security gates that block deployments containing critical or high-severity vulnerabilities

Implementing Diamond Model Analysis

The Diamond Model of Intrusion Analysis provides a structured framework for analyzing cyber intrusions by examining four core features: Adversary, Capability, Infrastructure, and Victim. This skill covers implementing the Diamond Model programmatically to classify and correlate intrusion events, build activity threads linking related events, create activity-attack graphs, and generate pivot-ready intelligence from intrusion data.

Implementing Digital Signatures With Ed25519

Ed25519 is a high-performance digital signature algorithm using the Edwards curve Curve25519. It provides 128-bit security with 64-byte signatures and 32-byte keys, offering significant advantages over RSA and ECDSA including deterministic signatures (no random nonce needed), resistance to side-channel attacks, and fast verification. This skill covers implementing Ed25519 for document signing, code signing, and API authentication.

Implementing Disk Encryption With Bitlocker

Use this skill when: - Encrypting Windows endpoints to protect data at rest for compliance (PCI DSS, HIPAA, GDPR) - Deploying BitLocker across enterprise fleet via Intune, SCCM, or GPO - Configuring TPM-based encryption with PIN or USB startup key for enhanced security - Managing BitLocker recovery keys in Active Directory or Azure AD

Implementing Dmarc Dkim Spf Email Security

SPF, DKIM, and DMARC form the three pillars of email authentication. Together they prevent domain spoofing, validate message integrity, and define policies for handling unauthenticated mail. Proper implementation drastically reduces phishing attacks that impersonate your organization's domain.

Implementing Dragos Platform For Ot Monitoring

- When deploying an OT-specific network detection and response (NDR) solution for industrial environments - When needing threat intelligence-driven detection against known ICS threat groups (VOLTZITE, CHERNOVITE, KAMACITE) - When building an OT SOC capability with purpose-built industrial security tooling - When requiring asset discovery and vulnerability management alongside threat detection in a single platform - When integrating OT security monitoring with an enterprise SIEM (Splunk, Sentinel, QRadar)

Implementing Ebpf Security Monitoring

- When deploying kernel-level runtime security monitoring on Linux hosts or Kubernetes clusters - When you need sub-millisecond visibility into process execution, network connections, and file access - When traditional userspace monitoring tools introduce unacceptable performance overhead - When building detection pipelines that require in-kernel filtering before events reach userspace - When enforcing runtime security policies (kill process, send signal) at the kernel level

Implementing Email Sandboxing With Proofpoint

Email sandboxing detonates suspicious attachments and URLs in isolated environments to detect zero-day malware and evasive phishing payloads. Proofpoint Targeted Attack Protection (TAP) is an industry-leading solution that uses multi-stage sandboxing, URL rewriting, and predictive analysis. This skill covers configuring Proofpoint TAP, integrating with email flow, analyzing sandbox reports, and tuning detection policies.

Implementing End To End Encryption For Messaging

End-to-end encryption (E2EE) ensures that only the communicating parties can read messages, with no intermediary (including the server) able to decrypt them. This skill implements a simplified version of the Signal Protocol's Double Ratchet algorithm, using X25519 for key exchange, HKDF for key derivation, and AES-256-GCM for message encryption.

Implementing Endpoint Detection With Wazuh

Wazuh is an open-source SIEM and XDR platform for endpoint monitoring, threat detection, and compliance. This skill covers managing agents via the Wazuh REST API, creating custom decoders and rules in XML for organization-specific detections, querying alerts, and testing rule logic using the logtest endpoint.

Implementing Endpoint Dlp Controls

Use this skill when: - Deploying endpoint DLP to prevent sensitive data (PII, PHI, PCI) from leaving the organization - Configuring content inspection rules for email attachments, USB transfers, and cloud uploads - Implementing Microsoft Purview DLP or Symantec DLP endpoint policies - Meeting compliance requirements for data protection (GDPR, HIPAA, PCI DSS)

Implementing Envelope Encryption With Aws Kms

Envelope encryption is a strategy where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a master key (KEK) managed by AWS KMS. This approach allows encrypting large volumes of data locally while keeping the master key secure in a hardware security module (HSM) managed by AWS. This skill covers implementing envelope encryption using AWS KMS GenerateDataKey API.

Implementing Epss Score For Vulnerability Prioritization

The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST (Forum of Incident Response and Security Teams) that estimates the probability of a CVE being exploited in the wild within the next 30 days. EPSS produces scores from 0.0 to 1.0 (0% to 100%) using machine learning trained on real-world exploitation data. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation, making it essential for risk-based vulnerability prioritization.

Implementing File Integrity Monitoring With Aide

AIDE (Advanced Intrusion Detection Environment) is a host-based intrusion detection system that monitors file and directory integrity using cryptographic checksums. This skill covers generating AIDE configuration files, initializing baseline databases, running integrity checks, parsing change reports, and setting up automated cron-based monitoring with alerting.

Implementing Fuzz Testing In Cicd With Aflplusplus

AFL++ (American Fuzzy Lop Plus Plus) is a community-maintained fork of AFL that provides state-of-the-art coverage-guided fuzz testing for discovering vulnerabilities in compiled applications. AFL++ uses genetic algorithms to mutate inputs, tracking code coverage to find new execution paths that trigger crashes, hangs, and undefined behavior. In CI/CD environments, AFL++ can be integrated to continuously test parsers, protocol handlers, file format processors, and any code that handles untrusted input. AFL++ supports persistent mode for high-speed fuzzing (up to 100,000+ executions per second), custom mutators, QEMU mode for binary-only fuzzing, and CmpLog/RedQueen for automatic dictionary extraction.

Implementing Gcp Binary Authorization

Binary Authorization is a Google Cloud deploy-time security control that ensures only trusted container images are deployed on GKE or Cloud Run. It works through a policy-based model where images must have cryptographic attestations confirming they passed predefined requirements such as vulnerability scans, code reviews, or build pipeline verification. Continuous validation (CV) monitors running pods against policies and logs violations.

Implementing Gcp Organization Policy Constraints

The GCP Organization Policy Service provides centralized and programmatic control over cloud resources. Organization policies configure constraints that restrict one or more Google Cloud services, enforced at organization, folder, or project levels. They improve security by blocking external IPs, requiring encryption, and minimizing unauthorized access. Changes can take up to 15 minutes to propagate.

Implementing Gcp Vpc Firewall Rules

- When deploying new GCP workloads that require network-level access controls - When auditing existing firewall configurations for overly permissive rules - When implementing zero trust network segmentation within GCP VPC networks - When responding to Security Command Center findings about open firewall rules - When building hierarchical firewall policies across a GCP organization

Implementing Gdpr Data Protection Controls

The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's comprehensive data protection law governing the collection, processing, storage, and transfer of personal data. This skill covers implementing the technical and organizational measures required by GDPR, including data protection by design and by default, Data Protection Impact Assessments (DPIAs), data subject rights management, breach notification procedures, and cross-border data transfer mechanisms.

Implementing Gdpr Data Subject Access Request

- When building automated DSAR processing pipelines for GDPR/UK GDPR compliance - When implementing PII discovery across structured and unstructured data sources - When creating response templates that satisfy Article 15 disclosure requirements - When auditing existing DSAR handling for regulatory compliance gaps - When scaling DSAR processing from manual to automated workflows

Implementing Github Advanced Security For Code Scanning

GitHub Advanced Security (GHAS) integrates CodeQL-powered static application security testing directly into the GitHub development workflow. CodeQL treats code as data, enabling semantic analysis that identifies security vulnerabilities such as SQL injection, cross-site scripting, buffer overflows, and authentication flaws with significantly fewer false positives than traditional pattern-matching scanners. GHAS encompasses code scanning, secret scanning, dependency review, and Dependabot alerts to provide a comprehensive security posture for repositories.

Implementing Google Workspace Admin Security

- Deploying or hardening a Google Workspace environment for enterprise use - CIS benchmark compliance assessment for Google Workspace configuration - Protecting against business email compromise (BEC) and phishing attacks targeting Google accounts - Implementing Data Loss Prevention controls for Gmail and Google Drive - Restricting OAuth application access and third-party integrations - Configuring admin account security with Advanced Protection Program enrollment

Implementing Google Workspace Phishing Protection

Google Workspace provides advanced phishing and malware protection through the Admin Console under Apps > Google Workspace > Gmail > Safety. Key features include Enhanced Pre-Delivery Scanning that examines messages more thoroughly before they reach inboxes, attachment and link protection that scans for malware and checks against known malicious sites, and spoofing detection for domain and employee name impersonation. Google's Advanced Protection Program (APP) provides the strongest account security for high-privilege users.

Implementing Google Workspace Sso Configuration

Single Sign-On (SSO) for Google Workspace allows organizations to authenticate users through their existing identity provider (IdP) such as Okta, Azure AD (Microsoft Entra ID), or ADFS, rather than managing separate Google passwords. This is implemented using SAML 2.0 protocol where Google Workspace acts as the Service Provider (SP) and the organization's IdP handles authentication. SSO centralizes credential management, enforces MFA policies at the IdP, and enables immediate access revocation when users leave the organization.

Implementing Hardware Security Key Authentication

- Deploying phishing-resistant multi-factor authentication (MFA) using FIDO2 hardware security keys for high-value accounts (administrators, developers, privileged users) - Building a WebAuthn relying party server that supports both roaming authenticators (USB/NFC security keys) and platform authenticators (Windows Hello, Touch ID, Android biometrics) - Migrating an existing password-based authentication system to support passkeys (discoverable credentials) as a primary or secondary authentication factor - Enrolling YubiKey devices for an organization's workforce, including PIN setup, credential registration, and backup key provisioning - Implementing passwordless authentication flows that comply with NIST SP 800-63B AAL3 (authenticator assurance level 3) requirements

Implementing Hashicorp Vault Dynamic Secrets

- Applications use static database credentials stored in configuration files or environment variables - AWS IAM access keys are long-lived and shared across services - Need to eliminate credential sprawl by generating short-lived, per-request secrets - Compliance requirements mandate credential rotation (PCI-DSS Requirement 8, NIST 800-53 IA-5) - Implementing zero-trust secret management where credentials are never stored at rest - Migrating from manual credential management to automated secrets lifecycle

Implementing Hipaa Security Rule Safeguards

- When an organization is a covered entity (health plan, clearinghouse, or provider transmitting electronic transactions) or a business associate handling ePHI on their behalf. - When standing up or maturing controls to protect electronic protected health information. - When performing the mandatory HIPAA Security Risk Analysis (§164.308(a)(1)(ii)(A)) — the single most-cited gap in OCR enforcement. - When preparing for an OCR audit/investigation or responding to a suspected breach. - When drafting, reviewing, or remediating a Business Associate Agreement (BAA). - When mapping existing security controls to the HIPAA safeguard standards and implementation specifications.

Implementing Honeypot For Ransomware Detection

- Deploying early-warning detection for ransomware encryption attempts using canary files - Creating honeypot file shares that detect lateral movement and data staging before encryption - Supplementing EDR and SIEM-based detection with deception-layer alerts that have near-zero false positives - Detecting ransomware variants that evade signature-based detection by triggering on file modification behavior - Validating that ransomware detection capabilities work by testing with controlled encryption tools

Implementing Honeytokens For Breach Detection

- When deploying or configuring implementing honeytokens for breach detection capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation

Implementing Ics Firewall With Tofino

- When deploying zone-level firewall protection directly in front of critical PLCs or RTUs - When requiring deep packet inspection of industrial protocols (Modbus, EtherNet/IP, OPC, S7comm) - When implementing IEC 62443 zone and conduit boundaries with protocol-aware enforcement - When protecting legacy PLCs that cannot be patched and need compensating controls - When segmenting control network zones without disrupting existing industrial communications

Implementing Identity Governance With Sailpoint

Deploy SailPoint IdentityNow or IdentityIQ for identity governance and administration. Covers identity lifecycle management, access request workflows, certification campaigns, role mining, SOD policy enforcement, and compliance reporting for enterprise IAM.

Implementing Identity Verification For Zero Trust

- Understanding of zero trust principles (NIST SP 800-207) - Familiarity with identity providers (Azure AD, Okta, Ping Identity) - Knowledge of authentication protocols (SAML 2.0, OIDC, FIDO2) - Understanding of MFA and passwordless authentication

Implementing Iec 62443 Security Zones

- When designing a greenfield OT network architecture for a new industrial facility - When retrofitting security zones into an existing flat OT network after an assessment finding - When implementing network segmentation to comply with IEC 62443-3-2 certification requirements - When upgrading from basic VLAN segmentation to policy-enforced zone/conduit architecture - When an IT/OT convergence project requires defining security boundaries between enterprise and operational networks

Implementing Image Provenance Verification With Cosign

Cosign is a Sigstore tool for signing, verifying, and attaching metadata to container images and OCI artifacts. It supports both key-based and keyless (OIDC) signing, integrates with Fulcio (certificate authority) and Rekor (transparency log), and enables supply chain security for container images.

Implementing Immutable Backup With Restic

- Establishing ransomware-resistant backup infrastructure with cryptographic integrity verification - Implementing 3-2-1-1-0 backup strategy where the extra 1 is an immutable copy - Automating backup verification workflows that test restore capability on a schedule - Protecting backup repositories from deletion or modification by compromised admin accounts - Meeting compliance requirements for data retention with tamper-proof storage

Implementing Infrastructure As Code Security Scanning

- When provisioning cloud infrastructure with Terraform, CloudFormation, or Pulumi and needing automated security validation - When compliance frameworks require evidence of infrastructure configuration review before deployment - When preventing common cloud misconfigurations like public S3 buckets, open security groups, or unencrypted storage - When establishing guardrails that block insecure infrastructure changes in pull requests - When managing multi-cloud environments requiring consistent security policies across AWS, Azure, and GCP

Implementing Iso 27001 Information Security Management

ISO/IEC 27001:2022 is the international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). This skill covers the complete lifecycle from scoping through certification, including Annex A control selection, risk assessment methodology, Statement of Applicability (SoA) creation, and continuous improvement processes.

Implementing Just In Time Access Provisioning

Implement Just-In-Time (JIT) access provisioning to eliminate standing privileges by granting temporary, time-bound access only when needed. This skill covers JIT architecture design, approval workflows, automatic expiration, integration with PAM and IGA platforms, and alignment with zero trust principles.

Implementing Jwt Signing And Verification

JSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens used for authentication and authorization in web applications. This skill covers implementing secure JWT signing with HMAC-SHA256, RSA-PSS, and EdDSA algorithms, along with verification, token expiration, claims validation, and defense against common JWT attacks (algorithm confusion, none algorithm, key injection).

Implementing Kubernetes Network Policy With Calico

Calico is an open-source CNI plugin that provides fine-grained network policy enforcement for Kubernetes clusters. It implements the full Kubernetes NetworkPolicy API and extends it with Calico-specific GlobalNetworkPolicy, supporting policy ordering, deny rules, and service-account-based selectors.

Implementing Kubernetes Pod Security Standards

Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PSA replaces the deprecated PodSecurityPolicy and provides namespace-level enforcement with three modes: enforce, audit, and warn.

Implementing Llm Guardrails For Security

- Deploying a new LLM-powered application that processes user input and needs input/output safety controls - Adding content policy enforcement to an existing chatbot or AI agent to comply with organizational policies - Implementing PII detection and redaction in LLM pipelines handling sensitive customer data - Building topic-restricted AI assistants that must refuse off-topic or disallowed queries - Validating that LLM responses conform to expected schemas before they reach downstream systems or users - Protecting RAG pipelines from indirect prompt injection in retrieved documents

Implementing Log Forwarding With Fluentd

This skill covers configuring Fluentd and Fluent Bit for centralized log collection, routing, and enrichment. Fluent Bit acts as a lightweight log forwarder on endpoints, while Fluentd serves as the central aggregator and processor. The configuration covers input plugins for syslog, file tailing, and application logs, with output routing to Elasticsearch, S3, and Splunk.

Implementing Log Integrity With Blockchain

- When deploying or configuring implementing log integrity with blockchain capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation

Implementing Memory Protection With Dep Aslr

Use this skill when hardening endpoints against memory-based exploits by configuring DEP, ASLR, CFG, and Windows Exploit Protection system-wide and per-application mitigations.

Implementing Microsegmentation With Guardicore

- When implementing east-west traffic controls to prevent lateral movement within data centers - When needing application-level visibility into network communication patterns before writing segmentation policies - When segmenting workloads across heterogeneous environments (VMs, containers, bare metal, cloud) - When compliance frameworks (PCI DSS, HIPAA) require network segmentation validation - When deploying zero trust at the network layer with process-level granularity

Implementing Mimecast Targeted Attack Protection

Mimecast Targeted Threat Protection (TTP) is a suite of advanced email security services designed to protect against sophisticated phishing, spearphishing, and targeted attacks. TTP consists of four core modules: URL Protect (real-time URL rewriting and click-time analysis), Attachment Protect (sandbox detonation of suspicious attachments), Impersonation Protect (BEC and whaling detection), and Internal Email Protect (scanning internal/outbound email for threats). As of November 2025, Mimecast enabled URL Pre-Delivery Action with Hold setting for all customers by default.

Implementing Mitre Attack Coverage Mapping

MITRE ATT&CK coverage mapping gives SOC teams a structured, adversary-centric lens to evaluate detection capabilities. Enterprise SIEMs on average have detection coverage for only 21% of ATT&CK techniques (2025 CardinalOps report), with 13% of existing rules being non-functional due to misconfigured data sources. Systematic coverage mapping identifies gaps, prioritizes rule development, and tracks detection maturity over time. ATT&CK v18.1 (December 2025) is the latest version.

Implementing Mobile Application Management

Use this skill when: - Deploying enterprise mobile app protection without full device management (MDM) - Implementing BYOD policies that protect corporate data while respecting personal privacy - Configuring Microsoft Intune App Protection Policies for iOS and Android - Enforcing data loss prevention controls on managed mobile applications

Implementing Mtls For Zero Trust Services

- When deploying or configuring implementing mtls for zero trust services capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation

Implementing Nerc Cip Compliance Controls

- When a registered entity must achieve or maintain NERC CIP compliance for BES cyber systems - When preparing for a NERC CIP compliance audit by the Regional Entity - When implementing the 2025 CIP standard updates (CIP-003-9, CIP-005-7, CIP-010-4, CIP-013-2) - When categorizing BES cyber systems after commissioning new generation, transmission, or control center assets - When developing a compliance monitoring and evidence collection program

Implementing Network Access Control

- Enforcing identity-based network access where only authenticated and compliant devices connect to the network - Implementing zero-trust networking at the access layer with dynamic VLAN assignment based on user role - Quarantining non-compliant devices that fail endpoint posture checks (missing patches, disabled AV) - Meeting compliance requirements (PCI-DSS, HIPAA, SOC 2) for network access controls - Onboarding BYOD devices with automated provisioning and limited network access

Implementing Network Access Control With Cisco Ise

Cisco Identity Services Engine (ISE) provides centralized network access control through 802.1X authentication, MAC Authentication Bypass (MAB), posture assessment, and guest access management. ISE acts as a RADIUS policy server that evaluates authentication requests from network devices (switches, wireless controllers) and returns authorization policies including VLAN assignments, downloadable ACLs (dACLs), and Security Group Tags (SGTs). This skill covers deploying ISE for enterprise wired 802.1X authentication with Active Directory integration, MAB fallback, posture compliance enforcement, and TrustSec segmentation.

Implementing Network Deception With Honeypots

- When deploying deception technology to detect lateral movement - To create early warning indicators for network intrusion - During security architecture design to add detection depth - When monitoring for unauthorized internal scanning or credential theft - To gather threat intelligence on attacker techniques and tools

Implementing Network Intrusion Prevention With Suricata

Suricata is a high-performance, open-source network threat detection engine developed by the Open Information Security Foundation (OISF). It functions as an IDS (Intrusion Detection System), IPS (Intrusion Prevention System), and network security monitoring tool. Suricata performs deep packet inspection using extensive rule sets, protocol analysis, and file extraction capabilities. In IPS mode, Suricata inspects packets inline and can actively block malicious traffic. This skill covers deploying Suricata in IPS mode, configuring rulesets, writing custom rules, performance tuning, and integration with logging infrastructure.

Implementing Network Policies For Kubernetes

Kubernetes NetworkPolicies provide pod-level network segmentation by defining ingress and egress rules that control traffic flow between pods, namespaces, and external endpoints. Combined with CNI plugins like Calico or Cilium, network policies enforce zero-trust microsegmentation to prevent lateral movement within the cluster.

Implementing Network Segmentation For Ot

- When an OT security assessment reveals a flat network with no segmentation between Purdue levels - When implementing IEC 62443 zone/conduit architecture after completing risk assessment (IEC 62443-3-2) - When separating IT and OT networks as part of an IT/OT convergence security initiative - When deploying a DMZ between corporate IT and OT to protect industrial systems from IT-originating threats - When segmenting safety instrumented systems (SIS) from basic process control systems (BPCS)

Implementing Network Segmentation With Firewall Zones

Network segmentation divides a flat network into isolated security zones with firewall-enforced boundaries to contain breaches, restrict lateral movement, and enforce least-privilege access between workloads. Segmentation is a foundational control required by PCI DSS, HIPAA, NIST 800-53, and zero trust architectures. Modern segmentation combines traditional VLAN-based approaches with microsegmentation at the workload level for granular east-west traffic control. This skill covers designing zone architectures, configuring inter-zone firewall policies, implementing VLAN segmentation on switches, and deploying microsegmentation for dynamic environments.

Implementing Network Traffic Analysis With Arkime

- When deploying or configuring implementing network traffic analysis with arkime capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation

Implementing Network Traffic Baselining

Network traffic baselining establishes normal communication patterns by analyzing historical NetFlow/IPFIX data to create statistical profiles of expected behavior. This skill uses Python pandas to compute hourly and daily traffic distributions, per-host byte/packet counts, protocol ratios, and top-N talker profiles. Anomalies are detected using z-score thresholds and IQR (interquartile range) outlier methods, enabling SOC analysts to identify deviations such as data exfiltration spikes, beaconing patterns, and unusual port usage.

Implementing Next Generation Firewall With Palo Alto

Palo Alto Networks Next-Generation Firewalls (NGFWs) move beyond traditional port-based rule enforcement to application-aware, identity-driven security policies. By leveraging App-ID for traffic classification, User-ID for identity-based enforcement, Content-ID for threat inspection, and SSL decryption for encrypted traffic visibility, organizations gain comprehensive control over network traffic. This skill covers end-to-end deployment from initial configuration through advanced threat prevention profiles.

Implementing Opa Gatekeeper For Policy Enforcement

OPA Gatekeeper is a Kubernetes admission controller that enforces policies written in Rego. It uses ConstraintTemplates (policy blueprints with Rego logic) and Constraints (instantiated policies with parameters) to validate, mutate, or deny Kubernetes resource requests at admission time.

Implementing Ot Incident Response Playbook

- When building OT-specific incident response procedures for the first time - When existing IT IR playbooks do not address ICS/SCADA-specific requirements - When preparing for OT ransomware scenarios like EKANS or LockerGoga - When aligning IR procedures with IEC 62443 and NERC CIP incident reporting requirements - When conducting post-incident reviews to improve OT IR capabilities

Implementing Ot Network Traffic Analysis With Nozomi

- When deploying passive OT network monitoring using Nozomi Networks Guardian sensors - When requiring asset visibility without active scanning in sensitive ICS environments - When building a Nozomi-based OT SOC with centralized management via Vantage or CMC - When integrating OT network monitoring with Fortinet, Splunk, or ServiceNow ecosystems - When monitoring compliance with IEC 62443 network segmentation policies

Implementing Pam For Database Access

Deploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL. Covers session proxy configuration, credential vaulting, query auditing, dynamic credential generation, and least-privilege database roles.

Implementing Passwordless Auth With Microsoft Entra

- Organization wants to eliminate password-based attacks (phishing, credential stuffing, brute force) - Regulatory or internal mandate requires phishing-resistant MFA (Executive Order 14028, CISA guidance) - Deploying FIDO2 security keys or Windows Hello for Business across the enterprise - Migrating from legacy MFA (SMS, phone call) to phishing-resistant authentication methods - Implementing passkey support for hybrid or cloud-joined Windows devices - Reducing helpdesk costs from password reset requests

Implementing Passwordless Authentication With Fido2

Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators. Covers WebAuthn API integration, FIDO2 server configuration, passkey enrollment, biometric authentication, and migration from password-based systems aligned with NIST SP 800-63B AAL3.

Implementing Patch Management For Ot Systems

- When establishing a formal OT patch management program for the first time - When responding to critical ICS-CERT advisories affecting deployed OT systems - When preparing for NERC CIP-007-6 or IEC 62443 patch management compliance audits - When planning patch deployment during limited maintenance windows in continuous operations - When evaluating compensating controls for systems that cannot be patched

Implementing Patch Management Workflow

Patch management is the systematic process of identifying, testing, deploying, and verifying software updates to remediate vulnerabilities across an organization's IT infrastructure. An effective patch management workflow reduces the attack surface while minimizing operational disruption through structured testing, approval gates, and phased rollouts.

Implementing Pci Dss Compliance Controls

PCI DSS 4.0.1 establishes 12 requirements across 6 control objectives for organizations that store, process, or transmit cardholder data. With PCI DSS 3.2.1 retiring April 2024 and 51 new requirements becoming mandatory March 31, 2025, this skill covers implementing all requirements including the new customized validation approach, enhanced authentication, and continuous monitoring controls.

Implementing Pod Security Admission Controller

Pod Security Admission (PSA) is a built-in Kubernetes admission controller (stable since v1.25) that enforces Pod Security Standards at the namespace level. It replaces the deprecated PodSecurityPolicy (PSP) and provides three security profiles: Privileged, Baseline, and Restricted, with three enforcement modes: enforce, audit, and warn.

Implementing Policy As Code With Open Policy Agent

- When enforcing organizational security policies across Kubernetes clusters programmatically - When requiring admission control that blocks non-compliant resources from being created - When implementing policy governance that can be version-controlled, tested, and audited - When standardizing security rules across multiple clusters and environments - When needing a flexible policy engine that extends beyond Kubernetes to APIs and CI/CD

Implementing Privileged Access Management With Cyberark

Deploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across enterprise infrastructure. This skill covers vault architecture, session isolation, credential rotation policies, and integration with NIST 800-53 access control requirements.

Implementing Privileged Access Workstation

A Privileged Access Workstation (PAW) is a hardened device dedicated to performing sensitive administrative tasks. This skill covers PAW design using the tiered administration model, device compliance enforcement via Microsoft Intune or Group Policy, just-in-time (JIT) access provisioning, and integration with privileged access management (PAM) platforms like CyberArk and BeyondTrust.

Implementing Privileged Session Monitoring

- Deploying or configuring session recording for all privileged access to critical servers and databases - Meeting compliance requirements (PCI-DSS 10.2, SOX, HIPAA, ISO 27001) that mandate privileged activity monitoring - Investigating an incident where an administrator or third-party vendor may have performed unauthorized actions - Implementing real-time alerting for high-risk commands executed during privileged sessions - Establishing a forensic audit trail of all administrative actions on production infrastructure

Implementing Proofpoint Email Security Gateway

Proofpoint Email Protection is a cloud-native secure email gateway (SEG) that acts as a security checkpoint where all inbound and outbound mail traffic routes through the gateway before reaching user inboxes. It combines signature-based detection for known malware, machine learning algorithms for emerging threats, real-time threat intelligence feeds, URL rewriting with time-of-click sandboxing, and behavioral analysis for BEC detection. Proofpoint processes over 2.8 billion emails daily and blocks over 1 million extortion attempts per day.

Implementing Purdue Model Network Segmentation

- When designing or retrofitting network architecture for an ICS/SCADA environment - When implementing IEC 62443 zone and conduit requirements in a brownfield plant - When creating the IT/OT DMZ (Level 3.5) to control data flow between enterprise and control networks - When remediating audit findings about flat OT networks or direct IT-to-OT connectivity - When segmenting a converged IT/OT network after an acquisition or merger

Implementing Ransomware Backup Strategy

- Designing backup architecture that withstands ransomware encryption and deletion attempts - Migrating from traditional backup to ransomware-resilient backup with immutable storage - Establishing RPO/RTO targets for critical systems and validating them through restore testing - Isolating backup credentials and infrastructure from the production Active Directory domain - Meeting cyber insurance requirements for backup resilience and tested recovery capabilities

Implementing Ransomware Kill Switch Detection

- Analyzing a ransomware sample to determine if it contains a kill switch mechanism (mutex, domain, registry) - Deploying proactive mutex vaccination across endpoints to prevent known ransomware families from executing - Monitoring DNS for kill switch domain lookups that indicate ransomware attempting to check before encrypting - During incident response to quickly determine if a ransomware variant can be stopped by activating its kill switch - Building detection signatures for ransomware mutex creation events using Sysmon or EDR telemetry

Implementing Rapid7 Insightvm For Scanning

Rapid7 InsightVM (formerly Nexpose) is an enterprise vulnerability management platform that combines on-premises scanning via Security Console and Scan Engines with cloud-based analytics through the Insight Platform. InsightVM leverages Rapid7's vulnerability research library, Metasploit exploit knowledge, global attacker behavior data, internet-wide scanning telemetry, and real-time reporting to provide comprehensive vulnerability visibility. This skill covers deploying the Security Console, configuring Scan Engines, setting up scan templates, credentialed scanning, and integrating with the Insight Agent for continuous assessment.

Implementing Rbac Hardening For Kubernetes

Kubernetes RBAC regulates access to cluster resources based on roles assigned to users, groups, and service accounts. Default configurations often grant excessive permissions, and without active hardening, RBAC becomes a primary attack vector for privilege escalation, lateral movement, and data exfiltration. Hardening requires implementing least-privilege principles, eliminating unnecessary ClusterRole bindings, separating service accounts, integrating external identity providers, and continuous auditing.

Implementing Rsa Key Pair Management

RSA (Rivest-Shamir-Adleman) is the most widely deployed asymmetric cryptographic algorithm, used for digital signatures, key exchange, and encryption. This skill covers generating, storing, rotating, and managing RSA key pairs following NIST SP 800-57 key management guidelines, including key serialization formats (PEM, DER, PKCS#8), passphrase protection, and key strength validation.

Implementing Runtime Application Self Protection

Runtime Application Self-Protection (RASP) instruments application code at runtime to detect and block attacks by examining actual execution context rather than relying solely on network traffic patterns. Unlike WAFs that inspect HTTP requests externally, RASP agents intercept dangerous operations (SQL queries, file operations, command execution, deserialization) at the function level inside the application, achieving near-zero false positives. This skill covers deploying OpenRASP for Java applications, configuring detection policies for OWASP Top 10 attacks, tuning alerting thresholds, and integrating RASP telemetry with SIEM platforms.

Implementing Runtime Security With Tetragon

Tetragon is a CNCF project under Cilium that provides flexible Kubernetes-aware security observability and runtime enforcement using eBPF. By operating at the Linux kernel level, Tetragon can monitor and enforce policies on process execution, file access, network connections, and system calls with less than 1% performance overhead -- far more efficient than traditional user-space security agents.

Implementing Saml Sso With Okta

Implement SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP). This skill covers end-to-end configuration of SAML authentication flows, attribute mapping, certificate management, and security hardening for enterprise SSO deployments.

Implementing Scim Provisioning With Okta

SCIM (System for Cross-domain Identity Management) is an open standard protocol (RFC 7644) that automates the exchange of user identity information between identity providers like Okta and service providers. This skill covers building a SCIM 2.0-compliant API endpoint and integrating it with Okta for automated user lifecycle management including provisioning, deprovisioning, profile updates, and group management.

Implementing Secret Scanning With Gitleaks

- When developers may accidentally commit API keys, passwords, tokens, or private keys to repositories - When establishing pre-commit gates that prevent secrets from entering the git history - When scanning existing repository history for previously committed secrets that need rotation - When compliance requirements mandate secret detection across all source code repositories - When migrating from manual secret audits to automated continuous scanning

Implementing Secrets Management With Vault

- When applications store database passwords, API keys, or certificates in environment variables or config files - When migrating from static long-lived credentials to dynamic short-lived secrets - When Kubernetes workloads need secure access to database credentials or cloud provider APIs - When compliance requirements mandate centralized credential management with audit logging - When CI/CD pipelines contain hardcoded secrets that represent supply chain risk

Implementing Secrets Scanning In Ci Cd

This skill covers implementing automated secrets scanning in CI/CD pipelines using gitleaks and trufflehog. It enables security teams to detect API keys, tokens, passwords, and other credentials that have been accidentally committed to source code repositories, providing a CI gate that blocks deployments containing high-severity findings.

Implementing Security Chaos Engineering

- When deploying or configuring implementing security chaos engineering capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation

Implementing Security Information Sharing With Stix2

Build and share structured threat intelligence using STIX 2.1 objects with the stix2 Python library and TAXII 2.1 transport protocol.

Implementing Security Monitoring With Datadog

- Deploying Cloud SIEM to detect real-time threats across cloud infrastructure (AWS, Azure, GCP) - Creating custom detection rules for attacker techniques, credential abuse, or anomalous behavior - Enabling Workload Protection (CSM Threats) to monitor file, process, and network activity on hosts and containers - Meeting compliance requirements (PCI-DSS, SOC 2, HIPAA) that mandate centralized log monitoring and alerting - Building security dashboards to provide SOC visibility into threat signals, investigation context, and response metrics

Implementing Semgrep For Custom Sast Rules

Semgrep is an open-source static analysis tool that uses pattern-matching to find bugs, enforce code standards, and detect security vulnerabilities. Custom rules are written in YAML using Semgrep's pattern syntax, making it accessible without requiring compiler knowledge. It supports 30+ languages including Python, JavaScript, Go, Java, and C.

Implementing Siem Correlation Rules For Apt

- When deploying or configuring implementing siem correlation rules for apt capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation

Implementing Siem Use Case Tuning

SIEM use case tuning reduces alert fatigue by systematically analyzing detection rules for false positive rates, adjusting thresholds based on environmental baselines, creating context-aware whitelists, and measuring detection efficacy through precision/recall metrics. This skill covers tuning workflows for Splunk correlation searches and Elastic detection rules, including statistical baselining, exclusion list management, and alert-to-incident conversion tracking.

Implementing Siem Use Cases For Detection

Use this skill when: - SOC teams need to build or expand their SIEM detection library from scratch - Threat assessments identify ATT&CK technique gaps requiring new detection rules - Detection engineers need a structured process for use case design, testing, and deployment - Compliance requirements mandate specific detection capabilities (PCI DSS, HIPAA, SOX)

Implementing Sigstore For Software Signing

- Signing container images and software artifacts without managing long-lived cryptographic keys - Establishing verifiable provenance for build outputs in CI/CD pipelines using OIDC identity binding - Querying the Rekor transparency log to audit when and by whom an artifact was signed - Verifying that container images pulled from registries were signed by authorized identities and issuers - Integrating Sigstore verification into Kubernetes admission controllers to enforce signed-image policies

Implementing Soar Automation With Phantom

Use this skill when: - SOC teams need to automate repetitive triage and enrichment tasks for high-volume alerts - Manual response times exceed SLA requirements and automation can reduce MTTR - Multiple security tools (SIEM, EDR, firewall, TIP) need orchestrated response actions - Playbook standardization is required to ensure consistent analyst response across shifts

Implementing Soar Playbook For Phishing

This skill implements a phishing incident response workflow using the Splunk SOAR (formerly Phantom) REST API. When a suspected phishing email is reported, the agent parses email headers and body, creates a SOAR container representing the incident, attaches artifacts containing indicators of compromise (sender address, URLs, IP addresses, file hashes), triggers an automated investigation playbook, and polls for action results.

Implementing Soar Playbook With Palo Alto Xsoar

Cortex XSOAR (formerly Demisto) is Palo Alto Networks' Security Orchestration, Automation, and Response platform. Playbooks are the core automation engine in XSOAR, enabling SOC teams to automate repetitive incident response tasks. XSOAR provides 900+ prebuilt integration packs, 87 common playbooks, and a visual drag-and-drop editor for building custom workflows. Organizations using SOAR automation reduce mean time to respond (MTTR) by 80% on average.

Implementing Stix Taxii Feed Integration

STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence. This skill covers implementing a STIX/TAXII 2.1 feed consumer and producer using Python, configuring TAXII server discovery, collection management, polling for new intelligence, parsing STIX 2.1 objects, and integrating feeds into SIEM and TIP platforms.

Implementing Supply Chain Security With In Toto

in-toto is a CNCF graduated project that ensures the integrity of software supply chains from initiation to end-user installation. It creates a verifiable record of the entire software development lifecycle by generating cryptographically signed attestations (called "link metadata") at each step, proving what happened, who performed it, and what artifacts were produced. For container environments, in-toto verifies that images deployed to Kubernetes followed approved build processes and have not been tampered with.

Implementing Syslog Centralization With Rsyslog

- When deploying or configuring implementing syslog centralization with rsyslog capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation

Implementing Taxii Server With Opentaxii

TAXII (Trusted Automated eXchange of Intelligence Information) is an OASIS standard protocol for exchanging cyber threat intelligence over HTTPS. OpenTAXII is an open-source TAXII server implementation by EclecticIQ that supports TAXII 1.x, while the OASIS cti-taxii-server provides a TAXII 2.1 reference implementation. This skill covers deploying a TAXII server, configuring collections for threat intelligence feeds, publishing STIX 2.1 bundles, and integrating with SIEM/SOAR platforms for automated indicator ingestion.

Implementing Threat Intelligence Lifecycle Management

The threat intelligence lifecycle is a structured, iterative process for transforming raw data into actionable intelligence. Based on the intelligence cycle used by military and government agencies, it comprises six phases: Direction (requirements gathering), Collection (data acquisition), Processing (normalization and deduplication), Analysis (contextualization and assessment), Dissemination (distribution to stakeholders), and Feedback (evaluation and refinement). This skill covers building each phase with tooling, metrics, and integration points for a mature CTI program.

Implementing Threat Modeling With Mitre Attack

Use this skill when: - SOC teams need to assess detection coverage against relevant threat actors and their TTPs - Security leadership requires threat-informed defense prioritization - New environments (cloud migration, OT integration) need detection strategy planning - Purple team exercises require structured adversary emulation based on threat models - Annual risk assessments need ATT&CK-based threat landscape analysis

Implementing Ticketing System For Incidents

Use this skill when: - SOC teams need to formalize incident tracking beyond SIEM notable event management - Compliance requirements mandate documented incident lifecycle with timestamps and audit trails - Multi-team coordination requires ticket-based workflows with assignment and escalation - SLA tracking needs automated measurement of response and resolution times - Post-incident reviews require structured data for trend analysis and reporting

Implementing Usb Device Control Policy

Use this skill when: - Restricting USB storage devices to prevent data exfiltration or malware introduction - Implementing device control policies via GPO, Intune, or EDR device control modules - Creating USB whitelists for authorized devices while blocking all others - Meeting compliance requirements for removable media control (PCI DSS, HIPAA)

Implementing Velociraptor For Ir Collection

Velociraptor is an advanced open-source endpoint monitoring, digital forensics, and incident response platform developed by Rapid7. It uses the Velociraptor Query Language (VQL) to create custom artifacts that collect, query, and monitor almost any aspect of an endpoint. Velociraptor enables incident response teams to rapidly collect and examine forensic artifacts from across a network, supporting large-scale deployments with minimal performance impact. The client-server architecture with Fleetspeak communication enables real-time data collection from thousands of endpoints simultaneously, with offline endpoints picking up hunts when they reconnect.

Implementing Vulnerability Management With Greenbone

Greenbone Vulnerability Management (GVM) is the open-source framework behind OpenVAS, providing comprehensive vulnerability scanning with over 100,000 Network Vulnerability Tests (NVTs). The python-gvm library provides a Python API to interact with GVM through the Greenbone Management Protocol (GMP), enabling programmatic creation of scan targets, task management, scan execution, and report retrieval. This skill covers connecting to GVM via Unix socket or TLS, authenticating, creating scan configs and targets, launching scans, and parsing XML-based vulnerability reports to produce actionable findings.

Implementing Vulnerability Remediation Sla

Vulnerability remediation SLAs define mandatory timeframes for patching or mitigating identified vulnerabilities based on severity, asset criticality, and exploit availability. Effective SLA programs drive accountability, ensure consistent remediation timelines, and provide measurable KPIs for vulnerability management maturity.

Implementing Vulnerability Sla Breach Alerting

Vulnerability remediation SLAs define maximum timeframes for addressing security findings based on severity. This skill covers building an automated alerting system that tracks remediation timelines, detects SLA breaches, sends escalation notifications, and generates compliance reports. Industry-standard SLA targets are: Critical (24-48 hours), High (15-30 days), Medium (60 days), Low (90 days).

Implementing Web Application Logging With Modsecurity

ModSecurity is an open-source WAF engine that works with Apache, Nginx, and IIS. The OWASP Core Rule Set (CRS) provides generic attack detection rules covering SQL injection, XSS, RCE, LFI, and other OWASP Top 10 attacks. ModSecurity logs full request/response data in audit logs for forensic analysis and generates alerts that feed into SIEM platforms.

Implementing Zero Knowledge Proof For Authentication

Zero-Knowledge Proofs (ZKPs) allow a prover to demonstrate knowledge of a secret (such as a password or private key) without revealing the secret itself. This skill implements the Schnorr identification protocol and a simplified ZKPP (Zero-Knowledge Password Proof) using the discrete logarithm problem, enabling authentication where the server never learns the user's password.

Implementing Zero Standing Privilege With Cyberark

Zero Standing Privileges (ZSP) is a security model where no user or identity retains persistent privileged access. Instead, elevated access is provisioned dynamically on a just-in-time (JIT) basis and automatically revoked after use. CyberArk implements ZSP through its Secure Cloud Access (SCA) module, which creates ephemeral, scoped roles in cloud environments (AWS, Azure, GCP) that exist only for the duration of a session. The TEA framework -- Time, Entitlements, and Approvals -- governs every privileged access session.

Implementing Zero Trust Dns With Nextdns

NextDNS is a cloud-based DNS resolver that provides encrypted DNS resolution (DNS-over-HTTPS and DNS-over-TLS), real-time threat intelligence blocking, ad and tracker filtering, and granular DNS policy enforcement. In a zero trust architecture, DNS is a critical control point -- every network connection begins with a DNS query, making DNS filtering an effective layer for blocking malicious domains, preventing data exfiltration via DNS tunneling, enforcing acceptable use policies, and gaining visibility into all network communications. NextDNS processes queries using threat intelligence feeds containing millions of malicious domains updated in real-time, blocks cryptojacking and phishing domains, detects DNS rebinding attacks, and supports CNAME cloaking protection. For enterprise environments, Microsoft's Zero Trust DNS (ZTDNS) feature on Windows 11 extends this concept by enforcing that endpoints can only resolve domains through approved protected DNS servers.

Implementing Zero Trust For Saas Applications

- When securing access to SaaS applications (Microsoft 365, Google Workspace, Salesforce, Slack) - When implementing conditional access policies requiring MFA and device compliance for SaaS - When deploying CASB for shadow IT discovery and unsanctioned app blocking - When enforcing session-level controls (DLP, download restrictions) for sensitive SaaS data - When governing OAuth application permissions and detecting excessive consent grants

Implementing Zero Trust In Cloud

- When migrating from traditional perimeter-based security to identity-centric access controls - When eliminating VPN dependencies for remote workforce access to cloud applications - When implementing continuous verification for every access request regardless of network location - When designing micro-segmentation strategies for multi-cloud workloads - When regulatory requirements mandate zero trust architecture adoption (federal mandates, NIST guidelines)

Implementing Zero Trust Network Access

- When replacing traditional VPN-based remote access with identity-based access controls - When implementing micro-segmentation to limit lateral movement within cloud networks - When compliance or security strategy requires zero trust architecture adoption - When providing secure access to cloud workloads without exposing them to the public internet - When building context-aware access policies based on user identity, device health, and location

Implementing Zero Trust Network Access With Zscaler

- Understanding of zero trust principles (NIST SP 800-207) - Familiarity with identity providers (Okta, Azure AD, Ping Identity) - Knowledge of network security fundamentals - Access to Zscaler Private Access (ZPA) tenant

Implementing Zero Trust With Beyondcorp

Google BeyondCorp Enterprise implements the zero trust security model by eliminating the concept of a trusted network perimeter. Instead of relying on VPNs and network location, BeyondCorp authenticates and authorizes every request based on user identity, device posture, and contextual attributes. Identity-Aware Proxy (IAP) serves as the enforcement point, intercepting all requests to protected resources and evaluating them against Access Context Manager policies. This skill covers configuring IAP for web applications, defining access levels based on device trust and network attributes, and auditing access policies for compliance.

Implementing Zero Trust With Hashicorp Boundary

HashiCorp Boundary is an identity-aware proxy that provides secure, zero trust access to infrastructure resources without traditional VPNs or direct network access. Boundary operates on a default-deny model -- users start with no access and must be explicitly granted permissions for specific resources. When integrated with HashiCorp Vault, Boundary can dynamically broker credentials, ensuring users never see or manage underlying secrets. This eliminates credential sprawl and enables just-in-time access with automatic credential revocation when sessions end. Boundary supports session recording for audit compliance, OIDC/LDAP authentication, and manages access through a hierarchical scope model of organizations and projects.

Integrating Dast With Owasp Zap In Pipeline

- When testing running web applications for vulnerabilities like XSS, SQLi, CSRF, and misconfigurations - When SAST alone is insufficient and runtime behavior testing is required - When compliance mandates dynamic security testing of web applications before production - When testing APIs (REST/GraphQL) for authentication, authorization, and injection flaws - When establishing continuous DAST scanning in staging environments before production deployment

Integrating Sast Into Github Actions Pipeline

- When development teams need automated code-level vulnerability detection on every pull request - When security teams require consistent SAST enforcement across all repositories in an organization - When migrating from manual or periodic security reviews to continuous security testing - When compliance frameworks (SOC 2, PCI DSS, NIST SSDF) require evidence of automated code analysis - When multiple languages coexist in a monorepo and need unified scanning under one workflow

Intercepting Mobile Traffic With Burpsuite

Use this skill when: - Testing mobile application API endpoints for authentication, authorization, and injection vulnerabilities - Analyzing data transmitted between mobile apps and backend servers during penetration tests - Evaluating certificate pinning implementations and their bypass difficulty - Identifying sensitive data leakage in mobile network traffic

Investigating Insider Threat Indicators

Use this skill when: - HR refers a departing employee for monitoring during their notice period - DLP alerts indicate bulk data downloads or transfers to personal storage - UEBA detects anomalous access patterns deviating significantly from peer baselines - Management reports concerns about an employee accessing sensitive data outside their role

Investigating Phishing Email Incident

Use this skill when: - A user reports a suspicious email via the phishing report button or helpdesk ticket - Email security gateway flags a message that bypassed initial filters - Automated detection identifies credential harvesting URLs or malicious attachments - A phishing campaign targeting the organization requires scope assessment

Investigating Ransomware Attack Artifacts

- Immediately after discovering ransomware encryption on systems - When performing forensic analysis to understand the full scope of a ransomware incident - For identifying the ransomware variant and determining if decryption is possible - When tracing the attack chain from initial access to encryption - For documenting evidence to support law enforcement and insurance claims

Managing Cloud Identity With Okta

- When centralizing authentication across AWS, Azure, and GCP console access through a single identity provider - When implementing phishing-resistant MFA to replace SMS or TOTP-based authentication - When automating user provisioning and deprovisioning across cloud platforms and SaaS applications - When enforcing adaptive access policies based on device compliance, user risk, and network context - When auditing identity-related security controls for SOC 2 or zero trust compliance

Managing Intelligence Lifecycle

Use this skill when: - Establishing a formal CTI program and defining its operational model - Conducting quarterly intelligence requirements reviews with business stakeholders - Evaluating CTI program maturity against established frameworks (FIRST CTI-SIG maturity model)

Managing Third Party Vendor Risk

- When assessing a new vendor before onboarding, especially one that will handle sensitive data, connect to your network, or be embedded in a critical process. - When standing up or maturing a third-party risk management (TPRM) program and you need a repeatable tiering + assessment workflow. - When tiering an existing vendor portfolio so effort matches risk. - When reviewing vendor evidence — a SOC 2 Type II report, ISO 27001 certificate, CAIQ, or pen-test summary — and you need to know what to look for. - When writing security and privacy requirements into a contract / DPA, including breach-notification SLAs and right-to-audit. - When a vendor (or their subcontractor) suffers a breach and you must assess exposure. - When managing software supply-chain and Nth-party (fourth-party and beyond) risk.

Mapping Attack Paths With Bloodhound Ce

BloodHound Community Edition (CE) is SpecterOps's graph-based attack-path-management platform. It models security principals (users, computers, groups, OUs, GPOs, Entra ID users/groups/apps/roles) as nodes and the permissions, group memberships, sessions, trusts, and ACLs between them as edges. By framing Active Directory and Entra ID as a directed graph, BloodHound turns the question "can this low-privileged account reach Domain Admins / Global Administrator?" into a shortest-path query that finds escalation chains a human reviewer would miss.

Mapping Mitre Attack Techniques

Use this skill when: - Generating an ATT&CK coverage heatmap to show which techniques your detection stack addresses - Tagging existing SIEM use cases or Sigma rules with ATT&CK technique IDs for structured reporting - Aligning your security program roadmap to specific adversary groups known to target your sector

Migrating To Post Quantum Cryptography

A cryptographically relevant quantum computer (CRQC) running Shor's algorithm will break the public-key cryptography that secures almost all of today's communications and signatures: RSA, finite-field and elliptic-curve Diffie-Hellman (DH/ECDH), and ECDSA. Symmetric primitives (AES) and hashes (SHA-2/3) are only weakened (Grover gives a quadratic speedup, mitigated by larger key/output sizes), but asymmetric algorithms are catastrophically broken. The most urgent threat is harvest-now, decrypt-later (HNDL): adversaries capturing encrypted traffic today to decrypt once a CRQC exists, which puts long-lived secrets (health records, state secrets, intellectual property, root-of-trust keys) at risk *now*.

Modeling Threats With Opencti

OpenCTI (Open Cyber Threat Intelligence) is an open-source threat-intelligence platform developed by Filigran that lets analysts store, organize, visualize, and share structured cyber threat intelligence as a knowledge graph. Every object — Threat Actors, Intrusion Sets, Campaigns, Attack Patterns, Malware, Indicators, Observables, Vulnerabilities — is modeled on the STIX 2.1 standard, and the relationships between them (uses, attributed-to, targets, indicates) form a graph that reveals how adversaries operate end to end.

Monitoring Darkweb Sources

Use this skill when: - Establishing continuous monitoring for organizational domain names, executive names, and product brands on dark web forums - Investigating a reported data breach claim found on a ransomware leak site or paste site - Enriching an incident investigation with context about stolen credentials or planned attacks

Monitoring Scada Modbus Traffic Anomalies

- Monitoring OT/ICS networks for unauthorized Modbus commands targeting PLCs, RTUs, or HMIs - Detecting reconnaissance activity such as Modbus device enumeration (function code 43, Read Device Identification) - Identifying unauthorized write operations (function codes 05, 06, 15, 16) to coils and holding registers that could alter physical process parameters - Baselining normal Modbus communication patterns and alerting on deviations in function code distribution, register access ranges, or timing intervals - Investigating suspected sabotage or insider threats manipulating SCADA process values through Modbus register writes

Moving Laterally With Netexec

NetExec (nxc) is the actively maintained successor to CrackMapExec, a network-service swiss-army knife for assessing and exploiting Windows/Active Directory and Linux environments. It wraps Impacket and other libraries behind a unified CLI so an operator can authenticate against many hosts at once, validate harvested credentials, spray passwords, enumerate shares/users/policies, execute commands, and dump credentials — all while logging cleanly for reporting.

Operating Havoc C2

Havoc is an open-source, modern command-and-control framework created by @C5pider (https://github.com/HavocFramework/Havoc). Its primary implant, the Demon, is written in C and assembly and was designed from the ground up for evasion: it supports indirect syscalls (Hell's Gate / Halo's Gate), return-address and stack spoofing, and sleep obfuscation techniques (Ekko / FOLIAGE) that encrypt the agent in memory while it sleeps. The team server is the backend that starts listeners, queues tasks, manages agent check-ins, and brokers operator connections over an encrypted WebSocket. Operators connect with the Havoc client, a Qt GUI.

Operating Sliver C2

Sliver is an open-source, cross-platform adversary emulation and command-and-control (C2) framework developed by BishopFox (https://github.com/BishopFox/sliver). It is written in Go and is widely used by red teams as a modern, open alternative to commercial frameworks such as Cobalt Strike. Sliver supports two implant interaction models: sessions (interactive, real-time) and beacons (asynchronous check-in with configurable jitter), and it speaks C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS. Each implant is dynamically compiled with per-binary, asymmetric encryption keys, so no two implants share static signatures.

Operationalizing Misp Threat Feeds

MISP (Malware Information Sharing Platform) is the de-facto open-source threat-intelligence platform for storing, correlating, and sharing structured indicators (IOCs), events, galaxies (threat-actor/technique knowledge), and objects. Running a MISP instance is only the first step; the value comes from *operationalizing* it — curating high-quality feeds, suppressing false positives with warninglists, and pushing the resulting IOCs into detection tooling so intelligence actually drives blocking and alerting.

Orchestrating Llm Attacks With Pyrit

PyRIT (Python Risk Identification Tool for generative AI) is an open-source automation framework from Microsoft's AI Red Team, distributed at github.com/microsoft/PyRIT. Where a single-shot scanner sends one prompt and checks the answer, PyRIT automates *multi-turn* adversarial conversations: an attacker model and a scorer model collaborate in a loop to drive a target model toward a defined objective (for example, eliciting restricted content, leaking a system prompt, or making an agent perform an unauthorized tool call). This mirrors how real adversaries iterate against a chatbot rather than relying on one magic prompt.

Parsing Artifacts With Eric Zimmerman Tools

Eric Zimmerman's Tools (EZ Tools) are a free, open-source suite of high-fidelity Windows forensic parsers, each focused on a specific artifact class and each producing analyst-ready CSV/JSON output. They are the de facto standard for Windows artifact analysis and are what KAPE's !EZParser module invokes under the hood. Key tools include:

Performing Access Recertification With Saviynt

Access recertification (also called access certification or access review) is a periodic process where designated reviewers validate that users have appropriate access to systems and data. Saviynt Enterprise Identity Cloud (EIC) automates this process through certification campaigns that present reviewers with current access assignments and collect approve/revoke/conditionally-certify decisions. Campaigns can be triggered on schedule (quarterly, semi-annually), event-driven (department transfer, role change), or on-demand. Saviynt provides intelligence features including risk scoring, usage analytics, and peer-group analysis to help reviewers make informed decisions.

Performing Access Review And Certification

Conduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles. This skill covers review campaign design, reviewer selection, risk-based prioritization, micro-certification strategies, and remediation tracking for compliance with SOX, HIPAA, and PCI DSS requirements.

Performing Active Directory Bloodhound Analysis

BloodHound is an open-source Active Directory reconnaissance tool that uses graph theory to reveal hidden relationships, attack paths, and privilege escalation opportunities within AD environments. By collecting data with SharpHound (or AzureHound for Azure AD), BloodHound visualizes how an attacker can escalate from a low-privilege user to Domain Admin through chains of misconfigurations, group memberships, ACL abuses, and trust relationships. MITRE ATT&CK classifies BloodHound as software S0521.

Performing Active Directory Compromise Investigation

Active Directory (AD) compromise investigation is a critical incident response capability that focuses on identifying how attackers gained access to domain services, what persistence mechanisms they established, and the scope of credential compromise. Since 88% of breaches involve compromised credentials (Verizon 2025 DBIR), AD is the primary target for enterprise-wide attacks. Investigators must analyze NTDS.dit database integrity, Kerberos ticket-granting activity, Group Policy modifications, replication metadata, and privileged group membership changes to reconstruct the attack chain and determine full compromise scope.

Performing Active Directory Forest Trust Attack

Active Directory forest trusts enable authentication across organizational boundaries but introduce attack surface if misconfigured. This skill uses impacket to enumerate trust relationships, analyze SID filtering configuration, detect SID history abuse vectors, perform cross-forest SID lookups via LSA/LSAT RPC calls, and assess inter-realm Kerberos ticket configurations for trust ticket forgery risks.

Performing Active Directory Penetration Test

Active Directory (AD) penetration testing targets the central identity and access management system used by over 95% of Fortune 500 companies. The test identifies misconfigurations, weak credentials, dangerous delegation settings, vulnerable certificate templates, and attack paths that enable an attacker to escalate from a standard domain user to Domain Admin or Enterprise Admin.

Performing Active Directory Vulnerability Assessment

Active Directory (AD) is the primary identity and access management system in most enterprise environments, making it a critical attack target. This skill covers comprehensive AD security assessment using PingCastle for health checks, BloodHound for attack path analysis, and Purple Knight for security posture scoring. These tools identify misconfigurations, excessive privileges, Kerberos weaknesses, and lateral movement opportunities.

Performing Adversary In The Middle Phishing Detection

Adversary-in-the-Middle (AiTM) phishing attacks use reverse-proxy infrastructure to sit between the victim and the legitimate authentication service, intercepting both credentials and session cookies in real time. This allows attackers to bypass multi-factor authentication (MFA). The most prevalent PhaaS kits in 2025 include Tycoon 2FA, Sneaky 2FA, EvilProxy, and Evilginx. Over 1 million PhaaS attacks were detected in January-February 2025 alone. These attacks have evolved from QR codes to HTML attachments and SVG files for link distribution.

Performing Agentless Vulnerability Scanning

Agentless vulnerability scanning assesses systems for security weaknesses without requiring endpoint agent installation. This approach leverages existing network protocols (SSH for Linux, WMI for Windows), cloud provider APIs for snapshot-based analysis, and authenticated remote checks. Modern cloud platforms like Microsoft Defender for Cloud, Wiz, Datadog, and Tenable perform out-of-band analysis by taking disk snapshots and examining OS configurations and installed packages offline. The open-source tool Vuls provides agentless scanning based on NVD and OVAL data for Linux/FreeBSD systems. This skill covers configuring agentless scans across on-premises, cloud, and containerized environments.

Performing Ai Driven Osint Correlation

- You have collected raw OSINT data from multiple tools and sources but need to identify connections, contradictions, and patterns across them. - You need to build a unified intelligence profile for a target entity (person, organization, or infrastructure) from fragmented data. - Traditional manual correlation is too slow or error-prone for the volume of data collected. - You want confidence-scored assessments of identity linkage across platforms rather than simple keyword matching.

Performing Alert Triage With Elastic Siem

Alert triage in Elastic Security is the systematic process of reviewing, classifying, and prioritizing security alerts to determine which represent genuine threats. Elastic's AI-driven Attack Discovery feature can triage hundreds of alerts down to discrete attack chains, but skilled analyst triage remains essential. A structured triage workflow typically takes 5-10 minutes per alert cluster using Elastic's built-in tools.

Performing Android App Static Analysis With Mobsf

Use this skill when: - Conducting security assessment of Android APK or AAB files before production release - Integrating automated mobile security scanning into CI/CD pipelines - Performing initial triage of Android applications during penetration testing engagements - Reviewing third-party Android applications for supply chain security risks

Performing Api Fuzzing With Restler

- Performing automated security testing of REST APIs using their OpenAPI/Swagger specifications - Discovering bugs that only manifest through specific sequences of API calls (stateful testing) - Finding 500 Internal Server Error responses that indicate unhandled exceptions or crash conditions - Testing API input validation by fuzzing parameters with malformed, boundary, and injection payloads - Running continuous security regression testing in CI/CD pipelines for API changes

Performing Api Inventory And Discovery

- Mapping the complete API attack surface of an organization before a security assessment - Identifying shadow APIs deployed by development teams without security review - Discovering deprecated or zombie API versions that remain accessible but unmaintained - Finding undocumented API endpoints exposed through mobile applications, SPAs, or microservices - Building an API inventory for compliance requirements (PCI-DSS, SOC2, GDPR)

Performing Api Rate Limiting Bypass

- Testing whether API rate limiting can be circumvented to enable brute force attacks on authentication endpoints - Assessing the effectiveness of API throttling controls against credential stuffing or account enumeration - Evaluating if rate limits are enforced consistently across all API versions, methods, and encoding formats - Testing if API gateway rate limiting can be bypassed through header manipulation or IP rotation - Validating that rate limits protect against resource exhaustion and denial-of-service conditions

Performing Api Security Testing With Postman

- Building repeatable API security test suites for OWASP API Security Top 10 coverage - Creating automated security regression tests that run in CI/CD pipelines via Newman - Testing API authentication and authorization across multiple user roles systematically - Integrating Postman with OWASP ZAP proxy for combined manual and automated security testing - Establishing a baseline security test collection for new API endpoints before deployment

Performing Arp Spoofing Attack Simulation

- Testing whether network switches and infrastructure properly implement Dynamic ARP Inspection (DAI) - Demonstrating man-in-the-middle attack risks to stakeholders during authorized security assessments - Validating that network monitoring tools (IDS/IPS, SIEM) detect ARP cache poisoning attempts - Assessing the effectiveness of port security, 802.1X, and VLAN segmentation controls - Training SOC analysts to recognize ARP spoofing indicators in network traffic

Performing Asset Criticality Scoring For Vulns

Asset criticality scoring assigns a business impact rating to each IT asset so that vulnerability remediation efforts focus on systems with the greatest organizational risk. Without criticality context, a CVSS 9.0 vulnerability on a test server receives the same urgency as the same vulnerability on a payment processing database. This skill covers building a multi-factor scoring model incorporating data sensitivity, business function dependency, regulatory scope, network exposure, and recoverability to create a 1-5 criticality tier that directly modifies vulnerability remediation SLAs.

Performing Authenticated Scan With Openvas

OpenVAS (Open Vulnerability Assessment Scanner) is the scanner component of the Greenbone Vulnerability Management (GVM) framework. Authenticated scans use valid credentials (SSH for Linux, SMB for Windows, ESXi for VMware) to log into target systems, enabling detection of local vulnerabilities, missing patches, and misconfigurations that unauthenticated scans cannot identify. Authenticated scans typically find 10-50x more vulnerabilities than unauthenticated scans.

Performing Authenticated Vulnerability Scan

Authenticated (credentialed) vulnerability scanning uses valid system credentials to log into target hosts and perform deep inspection of installed software, patches, configurations, and security settings. Compared to unauthenticated scanning, credentialed scans detect 45-60% more vulnerabilities with significantly fewer false positives because they can directly query installed packages, registry keys, and file system contents.

Performing Automated Malware Analysis With Cape

CAPE (Config And Payload Extraction) is an open-source malware sandbox derived from Cuckoo that automates behavioral analysis, payload dumping, and configuration extraction. CAPEv2 features API hooking for behavioral instrumentation, captures files created/modified/deleted during execution, records network traffic in PCAP format, and includes 70+ custom configuration extractors (cape-parsers) for families like Emotet, TrickBot, Cobalt Strike, AsyncRAT, and Rhadamanthys. The signature system includes 1000+ behavioral signatures detecting evasion techniques, persistence, credential theft, and ransomware behavior. CAPE's debugger enables dynamic anti-evasion bypasses combining debugger actions within YARA signatures. Recommended deployment: Ubuntu LTS host with Windows 10 21H2 guest VM.

Performing Aws Account Enumeration With Scout Suite

ScoutSuite is an open-source multi-cloud security auditing tool developed by NCC Group that enables comprehensive security posture assessment of AWS environments. It queries AWS APIs to gather configuration data across all services, stores results locally, and generates interactive HTML reports highlighting high-risk areas. ScoutSuite is agentless and works by analyzing how cloud resources are configured, accessed, and monitored.

Performing Aws Privilege Escalation Assessment

- When conducting authorized penetration testing of AWS IAM configurations - When validating that IAM policies follow the principle of least privilege - When assessing the blast radius of a compromised AWS credential - When building security reviews for IAM role and policy changes in CI/CD pipelines - When evaluating cross-account trust relationships for privilege escalation risks

Performing Bandwidth Throttling Attack Simulation

- Testing application resilience to degraded network conditions during authorized security assessments - Validating QoS policies detect and mitigate unauthorized traffic shaping on the network - Simulating network slowloris-style attacks that degrade bandwidth rather than causing complete outages - Assessing the impact of bandwidth-based attacks on VoIP, video conferencing, and real-time applications - Testing network monitoring tools' ability to detect abnormal bandwidth utilization patterns

Performing Binary Exploitation Analysis

For authorized security testing and CTF challenges only.

Performing Blind Ssrf Exploitation

- When testing URL/webhook input parameters where server-side responses are not reflected - During assessment of applications that fetch external resources (avatars, previews, imports) - When testing PDF generators, image processors, or document converters for SSRF - During cloud security assessments to detect metadata endpoint access - When evaluating webhook functionality and URL validation implementations

Performing Bluetooth Security Assessment

This skill covers performing Bluetooth Low Energy (BLE) security assessments using the Python bleak library. BLE devices are ubiquitous in IoT, healthcare, fitness, and smart home applications, and many ship with weak or absent security controls. This assessment identifies unencrypted GATT characteristics, devices broadcasting sensitive data, known vulnerable device fingerprints, and improperly secured pairing configurations.

Performing Brand Monitoring For Impersonation

Brand impersonation attacks exploit consumer trust through lookalike domains, fake social media profiles, counterfeit mobile apps, and phishing sites that mimic legitimate brands. In 2025, brand impersonation remained one of the most costly cyber threats, with AI-generated phishing emails achieving a 54% click-through rate. This skill covers building a comprehensive brand monitoring program that detects domain squatting, social media impersonation, fake mobile apps, unauthorized logo usage, and dark web brand mentions using automated scanning and alerting.

Performing Clickjacking Attack Test

- During authorized penetration tests when assessing UI redressing vulnerabilities - When testing whether sensitive actions (delete account, transfer funds, change settings) can be performed via clickjacking - For evaluating the effectiveness of X-Frame-Options and Content-Security-Policy frame-ancestors directives - When assessing applications that process one-click actions without additional confirmation - During security audits of applications handling financial transactions or account management

Performing Cloud Asset Inventory With Cartography

Cartography is a CNCF sandbox project (originally created at Lyft) that consolidates infrastructure assets and their relationships into a Neo4j graph database. It queries cloud APIs to discover resources, maps relationships between them, and enables security teams to identify attack paths, generate asset reports, and find areas for security improvement. The graph model reveals hidden connections such as IAM permission chains, network paths, and cross-account trust relationships.

Performing Cloud Forensics Investigation

- When investigating a security breach in AWS, Azure, or GCP cloud environments - For collecting volatile and non-volatile evidence from cloud infrastructure - When tracing unauthorized access through cloud service API logs - During incident response requiring preservation of cloud-based evidence - For analyzing compromised virtual machines, containers, or serverless functions

Performing Cloud Forensics With Aws Cloudtrail

- When investigating suspected AWS account compromise - After detecting unauthorized API calls or credential exposure - During incident response involving cloud infrastructure - When analyzing S3 data exfiltration or IAM privilege escalation - For post-incident forensic timeline reconstruction

Performing Cloud Incident Containment Procedures

Cloud incident containment requires cloud-native approaches that differ significantly from traditional on-premises response. Containment procedures must leverage platform-specific controls including security groups, IAM policies, network ACLs, and service-level isolation to restrict compromised resources while preserving forensic evidence. According to the 2025 Unit 42 Global Incident Response Report, responding to cloud incidents requires understanding shared responsibility models, ephemeral infrastructure, and API-driven operations. Effective containment involves credential revocation, resource isolation, evidence snapshot creation, and automated response playbook execution.

Performing Cloud Log Forensics With Athena

- When investigating AWS security incidents that require querying massive volumes of cloud logs - When performing forensic analysis across CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs - When building reusable Athena tables with partition projection for ongoing incident response - When hunting for indicators of compromise across multiple AWS log sources simultaneously - When creating evidence-grade SQL queries for compliance audits or legal proceedings

Performing Cloud Native Forensics With Falco

- When conducting security assessments that involve performing cloud native forensics with falco - When following incident response procedures for related security events - When performing scheduled security testing or auditing activities - When validating security controls through hands-on testing

Performing Cloud Native Threat Hunting With Aws Detective

AWS Detective automatically collects and analyzes log data from AWS CloudTrail, VPC Flow Logs, GuardDuty findings, and EKS audit logs to build interactive behavior graphs. These graphs enable security analysts to investigate entities (IAM users, roles, IP addresses, EC2 instances) across time, identify anomalous API calls, detect lateral movement between accounts, and correlate GuardDuty findings into coherent attack narratives — all without manual log parsing.

Performing Cloud Penetration Testing With Pacu

- When conducting authorized penetration testing of AWS environments - When validating the effectiveness of IAM policies, SCPs, and permission boundaries - When assessing the blast radius of a compromised set of AWS credentials - When testing detection capabilities of GuardDuty, Security Hub, and custom alerting - When building red team exercises against AWS cloud infrastructure

Performing Cloud Storage Forensic Acquisition

Cloud storage forensic acquisition involves collecting digital evidence from services like Google Drive, OneDrive, Dropbox, and Box through both API-based remote acquisition and local endpoint artifact analysis. Modern investigations must address the challenge that cloud-synced files may exist in multiple states: locally synchronized, cloud-only (on-demand), cached, and deleted. Endpoint devices that have synchronized with cloud storage contain a wealth of metadata about locally synced files, files present only in the cloud, and even deleted items recoverable from cache folders. API-based acquisition using service-specific APIs provides direct access to remote data with valid credentials and proper legal authorization.

Performing Container Escape Detection

- When conducting security assessments that involve performing container escape detection - When following incident response procedures for related security events - When performing scheduled security testing or auditing activities - When validating security controls through hands-on testing

Performing Container Image Hardening

- When building production container images that need minimal attack surface - When compliance requires CIS Docker Benchmark adherence for container configurations - When reducing image size to minimize vulnerability exposure from unused packages - When implementing defense-in-depth for containerized workloads - When migrating from fat base images to distroless or minimal images

Performing Container Security Scanning With Trivy

Trivy is an open-source security scanner by Aqua Security that detects vulnerabilities in OS packages and language-specific dependencies, infrastructure-as-code misconfigurations, exposed secrets, and software license issues across container images, filesystems, Git repositories, and Kubernetes clusters. Trivy generates Software Bill of Materials (SBOM) in CycloneDX and SPDX formats for supply chain transparency. This skill covers comprehensive container image scanning, CI/CD pipeline integration, Kubernetes operator deployment, and scan result triage for security operations.

Performing Content Security Policy Bypass

- When XSS is found but execution is blocked by Content Security Policy - During web application security assessments to evaluate CSP effectiveness - When testing the robustness of CSP against known bypass techniques - During bug bounty hunting where CSP prevents direct XSS exploitation - When auditing CSP header configuration for security weaknesses

Performing Credential Access With Lazagne

LaZagne is an open-source post-exploitation tool designed to retrieve credentials stored on local systems. It supports Windows, Linux, and macOS, with the most extensive module library for Windows. LaZagne recovers passwords from browsers (Chrome, Firefox, Edge, Opera), email clients (Outlook, Thunderbird), databases (PostgreSQL, MySQL, SQLite), system stores (Windows Credential Manager, LSA secrets, DPAPI), Wi-Fi profiles, Git credentials, and dozens of other applications. The tool is categorized under MITRE ATT&CK T1555 (Credentials from Password Stores) and is listed as software S0349. Red teams use LaZagne after gaining initial access to harvest stored credentials that enable lateral movement and privilege escalation.

Performing Cryptographic Audit Of Application

A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardcoded keys, insufficient entropy, and protocol misconfigurations. This skill covers building an automated crypto audit tool that scans Python and configuration files for common cryptographic weaknesses.

Performing Csrf Attack Simulation

- During authorized web application penetration tests to identify state-changing actions vulnerable to CSRF - When testing the effectiveness of anti-CSRF token implementations - For validating SameSite cookie attribute enforcement across different browsers - When assessing applications that perform sensitive operations (password change, fund transfer, settings modification) - During security audits of custom authentication and session management mechanisms

Performing Cve Prioritization With Kev Catalog

The CISA Known Exploited Vulnerabilities (KEV) catalog, established through Binding Operational Directive (BOD) 22-01, is a living list of CVEs that have been actively exploited in the wild and carry significant risk. As of early 2026, the catalog contains over 1,484 entries, growing 20% in 2025 alone with 245 new additions. This skill covers integrating the KEV catalog into vulnerability prioritization workflows alongside EPSS (Exploit Prediction Scoring System) and CVSS to create a risk-based approach that prioritizes vulnerabilities with confirmed exploitation activity over theoretical severity alone.

Performing Dark Web Monitoring For Threats

Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked credentials, data breaches, threat actor discussions, vulnerability exploitation tools, and planned attacks. This skill covers setting up monitoring infrastructure, using Tor-based collection tools, implementing automated alerting for brand mentions and credential leaks, and analyzing dark web intelligence for actionable threat indicators.

Performing Deception Technology Deployment

Use this skill when: - SOC teams need high-fidelity detection of post-compromise lateral movement with near-zero false positives - Existing detection tools miss advanced attackers who avoid triggering threshold-based alerts - The organization wants to detect credential abuse by planting fake credentials as honeytokens - Network segmentation gaps need compensating detection controls

Performing Directory Traversal Testing

- During authorized penetration tests when the application handles file paths in URL parameters or request bodies - When testing file download, file view, or file include functionality - For assessing Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities - When evaluating template engines, logging systems, or report generators that reference files - During security assessments of APIs that accept file names or paths as parameters

Performing Disk Forensics Investigation

- A security incident requires forensic analysis of a system's persistent storage - Evidence preservation is needed for potential legal proceedings or HR investigations - Deleted files, browser history, or application artifacts must be recovered - A timeline of user or adversary activity must be reconstructed from file system metadata - Malware persistence mechanisms stored on disk need identification and documentation

Performing Dmarc Policy Enforcement Rollout

Domain-based Message Authentication, Reporting and Conformance (DMARC) is the cornerstone of email anti-spoofing protection. A DMARC rollout progresses through three phases: monitoring (p=none), quarantine (p=quarantine), and full enforcement (p=reject). When configured at p=reject, any email that fails both SPF and DKIM checks is outright rejected. Google and Yahoo now require DMARC for bulk senders (5,000+ emails), driving a 65% reduction in unauthenticated messages. The rollout typically takes 3-6 months for safe deployment.

Performing Dns Enumeration And Zone Transfer

- Mapping the external attack surface of a target organization during authorized penetration tests - Discovering hidden subdomains, internal hostnames, and IP addresses exposed via DNS records - Testing whether DNS servers allow unauthorized zone transfers that leak the entire zone file - Identifying mail servers, name servers, and service records for further targeted testing - Validating DNS security configurations including DNSSEC, SPF, DKIM, and DMARC

Performing Dns Tunneling Detection

- When conducting security assessments that involve performing dns tunneling detection - When following incident response procedures for related security events - When performing scheduled security testing or auditing activities - When validating security controls through hands-on testing

Performing Docker Bench Security Assessment

Docker Bench for Security is an open-source script that checks dozens of common best practices around deploying Docker containers in production. Based on the CIS Docker Benchmark, it audits host configuration, Docker daemon settings, container images, runtime configurations, and security operations to generate a compliance report with pass/fail/warn results.

Performing Dynamic Analysis Of Android App

Use this skill when: - Static analysis results need runtime validation on an actual Android device - The target app uses obfuscation (DexGuard, custom packers) that prevents effective static analysis - Testing requires observing actual API calls, decrypted data, or runtime-generated values - Assessing root detection, tamper detection, or anti-debugging implementations

Performing Dynamic Analysis With Any Run

- Interactive malware analysis is needed where the analyst must click dialogs, enter credentials, or navigate installer screens - Rapid cloud-based sandbox analysis without maintaining local sandbox infrastructure - Malware requires user interaction to proceed past anti-sandbox checks (document macros requiring "Enable Content") - Sharing analysis results with team members via public or private task URLs - Comparing behavior across different OS versions (Windows 7, 10, 11) available in ANY.RUN

Performing Endpoint Forensics Investigation

Use this skill when: - Investigating a confirmed or suspected endpoint compromise requiring forensic analysis - Collecting volatile and non-volatile evidence for incident response or legal proceedings - Analyzing memory dumps for malware, injected code, or credential theft artifacts - Reconstructing attacker timelines from endpoint artifacts (prefetch, shimcache, amcache)

Performing Endpoint Vulnerability Remediation

Use this skill when: - Remediating vulnerabilities identified by scanners (Nessus, Qualys, Rapid7) - Responding to zero-day CVE advisories requiring immediate patching - Maintaining compliance with patch management SLAs (critical within 14 days, high within 30 days) - Building a prioritized remediation plan from vulnerability scan results

Performing Entitlement Review With Sailpoint Iiq

- Quarterly or annual access certification campaigns are required for compliance (SOX, HIPAA, PCI-DSS) - Organization needs automated manager-based access reviews for all direct reports - Targeted entitlement reviews are needed for sensitive applications or high-privilege roles - Separation of Duties (SOD) violations must be identified and remediated - Orphaned accounts and excessive entitlements need to be discovered and cleaned up - Audit findings require evidence of periodic access review and remediation tracking

Performing External Network Penetration Test

An external network penetration test simulates a real-world attacker targeting an organization's internet-facing assets such as firewalls, web servers, mail servers, DNS servers, VPN gateways, and cloud endpoints. The objective is to identify exploitable vulnerabilities before malicious actors do, following frameworks like PTES (Penetration Testing Execution Standard), OSSTMM, and NIST SP 800-115.

Performing False Positive Reduction In Siem

False positive alerts are non-malicious events that trigger security rules, overwhelming SOC analysts with noise. Studies show that up to 45% of SIEM alerts are false positives, and a typical SOC analyst can only investigate 20-25 alerts per shift effectively. Reducing false positives requires systematic tuning across thresholds, correlation logic, allowlists, enrichment, and continuous validation. SIEM rules should be reviewed on a quarterly cycle at minimum.

Performing File Carving With Foremost

- When recovering files from unallocated disk space or corrupted file systems - For extracting evidence from formatted or wiped storage media - When file system metadata is unavailable but raw data sectors contain evidence - During investigations requiring recovery of specific file types from raw images - As a complement to file system-based recovery for maximum evidence extraction

Performing Firmware Extraction With Binwalk

- Analyzing IoT device firmware downloaded from vendor sites or extracted from flash chips - Reverse engineering router, camera, or embedded device firmware for vulnerability research - Identifying embedded filesystems (SquashFS, CramFS, JFFS2, UBIFS) within firmware blobs - Detecting encrypted or compressed regions using entropy analysis - Extracting hardcoded credentials, API keys, certificates, or configuration files from firmware - Performing security assessments of embedded devices in authorized penetration tests

Performing Firmware Malware Analysis

- A compromised IoT device or router needs firmware analysis to identify implanted backdoors - Investigating UEFI/BIOS rootkits that persist across OS reinstallations - Analyzing firmware updates for supply chain compromise or malicious modifications - Extracting and examining embedded Linux filesystems from IoT device firmware images - Verifying firmware integrity after a suspected hardware or firmware-level compromise

Performing Fuzzing With Aflplusplus

AFL++ is a community-maintained fork of American Fuzzy Lop (AFL) that provides coverage-guided fuzzing for compiled binaries. It instruments targets at compile time or via QEMU/Unicorn mode for binary-only fuzzing, then mutates input corpora to discover new code paths. AFL++ includes advanced scheduling (MOpt, rare), custom mutators, CMPLOG for input-to-state comparison solving, and persistent mode for high-throughput fuzzing.

Performing Gcp Penetration Testing With Gcpbucketbrute

This skill covers Google Cloud Platform security testing using GCPBucketBrute for storage bucket enumeration and access permission testing, combined with gcloud CLI IAM enumeration to identify privilege escalation paths. The approach tests for publicly accessible buckets, overly permissive IAM bindings, and service account key exposure.

Performing Gcp Security Assessment With Forseti

- When conducting periodic security assessments of GCP organizations and projects - When onboarding new GCP projects and establishing security baselines - When compliance mandates CIS GCP Foundations Benchmark evaluation - When auditing IAM bindings, firewall rules, and storage ACLs across multiple GCP projects - When building continuous security monitoring for GCP infrastructure

Performing Graphql Depth Limit Attack

GraphQL depth limit attacks exploit the recursive nature of GraphQL schemas to craft deeply nested queries that consume excessive server resources, leading to denial of service. Unlike REST APIs with fixed endpoints, GraphQL allows clients to request arbitrary data structures. When schemas contain circular relationships (e.g., User -> Posts -> Author -> Posts), attackers can create queries that recurse indefinitely, overwhelming the server's CPU, memory, database connections, and network bandwidth.

Performing Graphql Introspection Attack

- Testing GraphQL endpoints for exposed introspection that reveals the complete API schema - Mapping the attack surface of a GraphQL API to identify sensitive queries, mutations, and types - Testing for GraphQL-specific vulnerabilities including query depth abuse, batching attacks, and field-level authorization - Assessing GraphQL implementations where introspection is disabled but schema can be reconstructed through error messages - Evaluating defenses against resource exhaustion through deeply nested or complex GraphQL queries

Performing Graphql Security Assessment

- During authorized penetration tests when the target application uses a GraphQL API - When assessing single-page applications (React, Vue, Angular) that communicate via GraphQL - For evaluating mobile app backends that expose GraphQL endpoints - When testing microservice architectures with a GraphQL gateway or federation - During bug bounty programs targeting GraphQL-based APIs

Performing Hardware Security Module Integration

Hardware Security Modules (HSMs) provide tamper-resistant cryptographic key storage and operations. This skill covers integrating with HSMs via the PKCS#11 standard interface using python-pkcs11, performing key generation, signing, encryption, and verification operations, querying token and slot information, and validating HSM configuration for compliance with FIPS 140-2/3 requirements.

Performing Hash Cracking With Hashcat

Hash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types with GPU acceleration. This skill covers using hashcat for authorized password auditing, understanding attack modes, creating effective rule sets, and generating hash analysis reports. This is strictly for authorized penetration testing and password policy assessment.

Performing Http Parameter Pollution Attack

- When testing web applications for input validation bypass vulnerabilities - During WAF evasion testing to split attack payloads across duplicate parameters - When assessing how different technology stacks handle duplicate HTTP parameters - During API security testing to identify parameter precedence issues - When testing OAuth or payment processing flows for parameter manipulation

Performing Ics Asset Discovery With Claroty

- When gaining initial visibility into an OT environment with unknown or poorly documented assets - When preparing for an IEC 62443 risk assessment requiring a complete asset inventory - When onboarding Claroty xDome into a brownfield industrial environment - When validating existing asset inventory against actual network communications - When identifying shadow OT devices or unauthorized connections in the control network

Performing Indicator Lifecycle Management

Indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes for IOC quality assessment, aging policies, confidence scoring decay, false positive tracking, hit-rate monitoring, and automated expiration to maintain a high-quality, actionable indicator database that minimizes analyst fatigue and maximizes detection efficacy.

Performing Initial Access With Evilginx3

EvilGinx3 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, enabling bypass of multi-factor authentication (MFA). Unlike traditional credential phishing that only captures usernames and passwords, EvilGinx3 operates as a transparent reverse proxy between the victim and the legitimate authentication service, intercepting the full authentication flow including MFA tokens and session cookies. This makes it the primary tool for red teams demonstrating the risk of adversary-in-the-middle (AiTM) attacks against organizations relying solely on MFA for protection.

Performing Insider Threat Investigation

- DLP (Data Loss Prevention) alerts on large data transfers to personal cloud storage or USB devices - User behavior analytics (UBA) detects anomalous access patterns for a user account - HR reports a departing employee suspected of taking proprietary information - A privileged user is observed accessing systems outside their job function - Whistleblower or coworker report alleges policy violations or data theft

Performing Ioc Enrichment Automation

Use this skill when: - SOC analysts need to quickly enrich IOCs from multiple sources during alert triage - High alert volumes require automated enrichment to reduce manual lookup time - Incident investigations need comprehensive IOC context for scope assessment - SOAR playbooks require enrichment actions as part of automated triage workflows

Performing Ios App Security Assessment

This skill is intended for authorized security testing, penetration testing engagements, CTF competitions, and educational purposes only. Unauthorized access to applications or devices is illegal. Always obtain written authorization before performing any security assessment. Misuse of these techniques may violate computer fraud and abuse laws in your jurisdiction.

Performing Iot Security Assessment

- Evaluating the security of IoT devices before deployment in enterprise or critical infrastructure environments - Assessing consumer IoT products for security vulnerabilities as part of product security review or certification - Testing industrial IoT (IIoT) devices for vulnerabilities that could affect operational technology environments - Analyzing firmware for backdoors, hardcoded credentials, and known vulnerabilities in embedded components - Evaluating the security of the complete IoT ecosystem including device, cloud backend, and mobile companion app

Performing Ip Reputation Analysis With Shodan

Shodan is the world's first search engine for internet-connected devices, continuously scanning the IPv4 and IPv6 address space to catalog open ports, running services, SSL certificates, and known vulnerabilities. This skill covers using the Shodan API and InternetDB free API to enrich IP addresses from security alerts, assess threat levels based on exposed services and vulnerabilities, identify hosting infrastructure patterns, and integrate IP reputation data into SOC triage and threat intelligence workflows.

Performing Jwt None Algorithm Attack

The JWT none algorithm attack exploits a vulnerability in JSON Web Token libraries that accept tokens with the alg header set to none, effectively bypassing signature verification. When a server processes a JWT with "alg": "none", it treats the token as valid without checking any cryptographic signature, allowing attackers to forge tokens with arbitrary claims such as escalated privileges, impersonated users, or extended expiration times. This vulnerability was first disclosed by Tim McLean in 2015 and has affected multiple JWT libraries across languages.

Performing Kerberoasting Attack

Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names (SPNs) set. These tickets are encrypted with the service account's NTLM hash, allowing offline brute-force cracking without generating failed login events. It is one of the most common privilege escalation paths in AD environments because any domain user can request TGS tickets.

Performing Kubernetes Cis Benchmark With Kube Bench

kube-bench is an open-source Go tool by Aqua Security that runs the CIS Kubernetes Benchmark checks. It verifies control plane, etcd, worker node, and policy configurations against security best practices, producing actionable pass/fail/warn reports.

Performing Kubernetes Etcd Security Assessment

etcd is the distributed key-value store that serves as Kubernetes' backing store for all cluster data, including Secrets, RBAC policies, ConfigMaps, and workload configurations. Without proper hardening, etcd exposes all cluster secrets in plaintext, making it the highest-value target for attackers who gain control plane access. A comprehensive security assessment covers encryption at rest, TLS for transport, access control, backup security, and network isolation.

Performing Kubernetes Penetration Testing

Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools like kube-hunter, Kubescape, peirates, and manual kubectl exploitation, testers identify misconfigurations that could lead to cluster compromise.

Performing Lateral Movement Detection

Use this skill when: - SOC teams need to detect attackers pivoting between systems after initial compromise - Incident investigations require tracking an attacker's movement path through the network - Detection engineering needs lateral movement rules mapped to ATT&CK TA0008 techniques - Red/purple team exercises identify lateral movement detection gaps

Performing Lateral Movement With Wmiexec

WMI (Windows Management Instrumentation) is a legitimate Windows administration framework that red teams abuse for lateral movement because it provides remote command execution without deploying additional services or leaving obvious artifacts like PsExec. Impacket's wmiexec.py creates a semi-interactive shell over WMI by executing commands through Win32_Process.Create and reading output via temporary files on ADMIN$ share. Unlike PsExec, WMIExec does not install a service on the target, making it stealthier and less likely to trigger security alerts. WMI-based lateral movement maps to MITRE ATT&CK T1047 (Windows Management Instrumentation) and is used by threat actors including APT29, APT32, and Lazarus Group.

Performing Linux Log Forensics Investigation

Linux systems maintain extensive logs that serve as primary evidence sources in forensic investigations. Unlike Windows Event Logs, Linux logs are typically plain-text files stored in /var/log/ and binary journal files managed by systemd-journald. Key forensic logs include auth.log (authentication events, sudo usage, SSH sessions), syslog (system-wide messages), kern.log (kernel events), and application-specific logs. The Linux Audit framework (auditd) provides detailed security event logging comparable to Windows Security Event Logs. Forensic analysis of these logs enables investigators to reconstruct user sessions, identify unauthorized access, detect privilege escalation, trace lateral movement, and establish comprehensive event timelines.

Performing Log Analysis For Forensic Investigation

- When reconstructing the timeline of a security incident from available log sources - During post-breach investigation to identify initial access, lateral movement, and exfiltration - When correlating events across multiple systems and log sources - For establishing evidence of unauthorized access or policy violations - When preparing forensic reports requiring detailed event chronology

Performing Log Source Onboarding In Siem

Log source onboarding is the systematic process of integrating new data sources into a SIEM platform to enable security monitoring and detection. Proper onboarding requires planning data sources, configuring collection agents, building parsers, normalizing fields to a common schema, and validating data quality. According to the UK NCSC, onboarding should prioritize log sources that provide the highest security value relative to their ingestion cost.

Performing Malware Hash Enrichment With Virustotal

VirusTotal is the world's largest crowdsourced malware corpus, scanning files with 70+ antivirus engines and providing behavioral analysis, YARA rule matches, network indicators, and community intelligence. This skill covers using the VirusTotal API v3 to enrich file hashes (MD5, SHA-1, SHA-256) with detection verdicts, sandbox reports, related indicators, and contextual intelligence for SOC triage, incident response, and threat intelligence enrichment workflows.

Performing Malware Ioc Extraction

Malware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise including file hashes, network indicators (C2 domains, IP addresses, URLs), registry modifications, mutex names, embedded strings, and behavioral artifacts. This skill covers static analysis with PE parsing and string extraction, dynamic analysis with sandbox detonation, automated IOC extraction using tools like YARA, and formatting results as STIX 2.1 indicators for sharing.

Performing Malware Persistence Investigation

- When investigating how malware maintains presence on a compromised system after reboots - During incident response to identify all persistence mechanisms for complete remediation - For threat hunting to discover unauthorized autostart entries across endpoints - When analyzing malware behavior to understand its persistence strategy - For verifying that all persistence has been removed after incident remediation

Performing Malware Triage With Yara

- Rapidly classifying a large batch of malware samples against known family signatures - Writing detection rules for a newly analyzed malware family based on unique byte patterns - Scanning file shares, endpoints, or memory dumps for indicators of a specific threat - Building automated triage pipelines that classify samples before manual analysis - Hunting for variants of a known threat across an enterprise using YARA scans

Performing Memory Forensics With Volatility3

- When analyzing a RAM dump from a compromised or suspect system - During incident response to identify running malware, injected code, or rootkits - When you need to extract credentials, encryption keys, or network connections from memory - For detecting process hollowing, DLL injection, or hidden processes - When disk-based forensics alone is insufficient and volatile data is critical

Performing Memory Forensics With Volatility3 Plugins

Volatility3 (v2.26.0+, feature parity release May 2025) is the standard framework for memory forensics, replacing the deprecated Volatility2. It analyzes RAM dumps from Windows, Linux, and macOS to detect malicious processes, code injection, rootkits, credential harvesting, and network connections that disk-based forensics cannot reveal. Key plugins include windows.malfind (detecting RWX memory regions indicating injection), windows.psscan (finding hidden processes), windows.dlllist (enumerating loaded modules), windows.netscan (active network connections), and windows.handles (open file/registry handles). The 2024 Plugin Contest introduced ETW Scan for extracting Event Tracing for Windows data from memory.

Performing Mobile App Certificate Pinning Bypass

Use this skill when: - Mobile app refuses connections through a proxy due to certificate pinning - Performing authorized security testing requiring HTTPS traffic interception - Assessing the strength and bypass difficulty of pinning implementations - Evaluating defense-in-depth of mobile app network security

Performing Mobile Device Forensics With Cellebrite

- When extracting evidence from smartphones or tablets during an investigation - For recovering deleted messages, call logs, and location data from mobile devices - During investigations involving communications via messaging apps - When analyzing mobile application data for evidence of criminal activity - For corporate investigations involving employee mobile device misuse

Performing Network Forensics With Wireshark

- When analyzing captured network traffic (PCAP files) from a security incident - For identifying command-and-control (C2) communications in captured traffic - When reconstructing data exfiltration activities from packet captures - During malware analysis to identify network indicators of compromise - For extracting files, credentials, and artifacts transferred over the network

Performing Network Packet Capture Analysis

Network packet captures (PCAP/PCAPNG files) represent the ultimate source of truth about network activity and provide irrefutable evidence of communications between hosts. PCAP files log every packet transmitted over a network segment, making them vital for forensic investigations involving data exfiltration, command-and-control communications, lateral movement, malware delivery, and unauthorized access. Wireshark is the primary tool for interactive analysis, while tshark provides command-line capabilities for automated processing and scripting. Modern PCAPNG format supports additional metadata including interface descriptions, capture comments, precise timestamps, and per-packet annotations.

Performing Network Traffic Analysis With Tshark

This skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.

Performing Network Traffic Analysis With Zeek

Zeek (formerly Bro) is an open-source network analysis framework that operates as a passive network security monitor. Unlike traditional signature-based IDS tools, Zeek generates high-fidelity structured logs from observed network traffic, capturing detailed metadata for protocols including HTTP, DNS, TLS, SSH, SMTP, FTP, and dozens more. Zeek's extensible scripting language enables custom detection logic, behavioral analysis, and automated response. This skill covers deploying Zeek, understanding its log architecture, writing custom detection scripts, and integrating outputs with SIEM platforms.

Performing Nist Csf Maturity Assessment

The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, provides a comprehensive taxonomy for managing cybersecurity risk through six core Functions: Govern, Identify, Protect, Detect, Respond, and Recover. This skill covers conducting a maturity assessment against the CSF, using the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) to measure organizational cybersecurity posture and create improvement roadmaps.

Performing Oauth Scope Minimization Review

- Annual or quarterly review of third-party application OAuth permissions - After a security incident involving compromised OAuth tokens or unauthorized data access - Compliance audit requiring documentation of third-party data access (GDPR Article 28, SOC 2) - Discovery of shadow IT applications accessing organizational data via OAuth grants - Migration or consolidation of SaaS applications requiring permission cleanup - Implementing least-privilege principle for API integrations

Performing Oil Gas Cybersecurity Assessment

- When conducting a cybersecurity assessment of a refinery, pipeline, or production facility - When preparing for TSA Pipeline Security Directive compliance (SD-01, SD-02) - When assessing cybersecurity posture against API Standard 1164 (Pipeline SCADA Security) - When evaluating the security of remote wellhead SCADA systems and satellite communications - When a merger, acquisition, or regulatory audit requires a comprehensive OT security evaluation

Performing Open Source Intelligence Gathering

Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack surfaces, potential targets for social engineering, technology stacks, and credential exposures. Effective OSINT directly shapes initial access strategies and reduces operational risk.

Performing Osint With Spiderfoot

SpiderFoot is an open-source OSINT automation tool with 200+ modules that integrates with data sources for threat intelligence and attack surface mapping. This skill uses the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) to create and manage scans, select modules by use case (footprint, investigate, passive), parse structured results for domains, IPs, email addresses, leaked credentials, and DNS records, and generate target intelligence profiles.

Performing Ot Network Security Assessment

- When conducting an initial security baseline of an OT/ICS environment for a new client - When evaluating the security posture of a facility after an IT/OT convergence initiative - When preparing for IEC 62443 or NERC CIP compliance audits - When assessing risk following a merger or acquisition involving industrial facilities - When investigating whether an OT network has been compromised or has unmonitored pathways to corporate IT

Performing Ot Vulnerability Assessment With Claroty

- When conducting scheduled OT vulnerability assessments per IEC 62443 or NERC CIP requirements - When deploying Claroty xDome for the first time and performing initial asset discovery and risk assessment - When correlating newly published ICS-CERT advisories against your OT asset inventory - When prioritizing OT vulnerability remediation with limited maintenance windows - When generating compliance evidence for CIP-010-4 vulnerability assessment requirements

Performing Ot Vulnerability Scanning Safely

- When conducting vulnerability assessments in OT environments with legacy controllers - When implementing continuous vulnerability monitoring without impacting process availability - When preparing for IEC 62443 or NERC CIP compliance audits requiring vulnerability data - When evaluating risk-based patching priorities for OT assets - When validating that compensating controls protect unpatched ICS devices

Performing Packet Injection Attack

- Testing IDS/IPS rules by injecting traffic that should trigger specific detection signatures - Validating firewall rules by crafting packets with specific flags, source addresses, and payloads - Assessing network stack resilience to malformed packets, fragmentation attacks, and protocol violations - Simulating spoofed traffic to test anti-spoofing controls (BCP38, uRPF) - Performing TCP reset injection to test connection resilience and session hijacking scenarios

Performing Paste Site Monitoring For Credentials

Paste sites (Pastebin, GitHub Gists, Ghostbin, Dpaste, Hastebin) are frequently used as staging areas for leaked credentials, database dumps, API keys, and sensitive data before wider distribution on dark web forums and Telegram channels. Monitoring these sites provides early breach detection, enabling organizations to respond before stolen data is weaponized. This skill covers building automated paste site monitors using the Pastebin Scraping API, keyword-based alerting, credential pattern matching, and integration with incident response workflows.

Performing Phishing Simulation With Gophish

GoPhish is an open-source phishing simulation framework used by security teams to conduct authorized phishing awareness campaigns. It provides campaign management, email template creation, landing page cloning, and comprehensive reporting. This skill covers deploying GoPhish, creating realistic phishing scenarios, and analyzing campaign results to measure and improve organizational resilience.

Performing Physical Intrusion Assessment

Physical intrusion assessment evaluates an organization's physical security controls by attempting to gain unauthorized access to facilities, server rooms, and restricted areas. This includes tailgating employees, cloning RFID access badges, bypassing locks, deploying rogue network devices, and testing security guard procedures. Physical security testing is a critical component of full-scope red team engagements, as it often provides the most direct path to network access. MITRE ATT&CK maps physical access techniques under T1200 (Hardware Additions) and T1091 (Replication Through Removable Media).

Performing Plc Firmware Security Analysis

- When assessing PLC security as part of an IEC 62443 component security evaluation (IEC 62443-4-2) - When validating firmware integrity after a suspected compromise or supply chain attack - When evaluating the security of a new PLC platform before deployment in critical infrastructure - When performing vulnerability research on industrial control system devices in an authorized lab - When responding to an incident where PLC logic or firmware tampering is suspected

Performing Post Quantum Cryptography Migration

- When assessing organizational readiness for the NIST post-quantum cryptography transition - When building a cryptographic inventory to identify quantum-vulnerable algorithms across infrastructure - When evaluating hybrid TLS 1.3 configurations using X25519MLKEM768 key exchange - When testing CRYSTALS-Kyber (ML-KEM) and CRYSTALS-Dilithium (ML-DSA) algorithm support - When implementing crypto-agility to support both classical and post-quantum algorithms - When preparing migration roadmaps aligned with NIST IR 8547 deprecation timelines - When configuring oqs-provider with OpenSSL 3.x for post-quantum algorithm support

Performing Power Grid Cybersecurity Assessment

- When conducting periodic cybersecurity assessments of power grid facilities per NERC CIP requirements - When assessing substation automation systems using IEC 61850 GOOSE and MMS protocols - When evaluating the security of an Energy Management System (EMS) or SCADA control center - When assessing synchrophasor (PMU) networks and wide-area monitoring systems - When preparing for regional entity compliance audits or internal security reviews

Performing Privacy Impact Assessment

- When launching a new system, product, or processing activity that handles personal data - When conducting GDPR Article 35 Data Protection Impact Assessments (DPIAs) - When evaluating CCPA/CPRA compliance for data processing operations - When performing privacy risk assessments aligned to the NIST Privacy Framework - When mapping data flows across organizational boundaries and third-party processors - When building automated privacy governance and assessment pipelines - When preparing for regulatory audits or demonstrating accountability obligations

Performing Privilege Escalation Assessment

- After gaining initial low-privilege access during a penetration test to demonstrate full system compromise - Assessing the security hardening of Linux and Windows servers against local privilege escalation attacks - Evaluating whether endpoint detection and response (EDR) tools detect common privilege escalation techniques - Testing the effectiveness of least-privilege policies and application whitelisting on endpoints - Validating that container breakout and VM escape controls are properly configured

Performing Privilege Escalation On Linux

Linux privilege escalation involves elevating from a low-privilege user account to root access on a compromised system. Red teams exploit misconfigurations, vulnerable services, kernel exploits, and weak permissions to achieve root. This skill covers both manual enumeration techniques and automated tools for identifying and exploiting privilege escalation vectors.

Performing Privileged Account Access Review

Privileged Account Access Review is a critical identity governance process that validates whether users with elevated permissions still require their access. This review covers domain admins, service accounts, database administrators, cloud IAM roles, and application-level privileged accounts. Regular access reviews are mandated by SOC 2, PCI DSS, HIPAA, and SOX compliance frameworks, typically required quarterly for high-privilege accounts.

Performing Privileged Account Discovery

Discover and inventory all privileged accounts across enterprise infrastructure including domain admins, local admins, service accounts, database admins, cloud IAM roles, and application admin accounts. Covers automated scanning, risk classification, and onboarding to PAM.

Performing Purple Team Atomic Testing

- Validating detection coverage against specific MITRE ATT&CK techniques - Running purple team exercises using Atomic Red Team test library - Performing ATT&CK coverage gap analysis to identify blind spots in SIEM/EDR - Building a detection validation loop: execute atomic test, check SIEM, tune rule, retest - Generating ATT&CK Navigator heatmap layers for executive reporting - Automating continuous atomic testing in CI/CD or scheduled pipelines - Mapping threat intelligence reports to executable atomic tests

Performing Purple Team Exercise

Use this skill when: - SOC teams need to validate that detection rules actually fire for the threats they target - Red team assessments produced findings that need translation into detection improvements - New detection tools or SIEM migrations require validation of detection coverage - Analyst training requires hands-on experience with real attack techniques and SIEM responses - Quarterly or semi-annual detection validation cycles are scheduled

Performing Ransomware Response

- Ransomware has been detected executing or file encryption is actively occurring - Users report inability to open files with unfamiliar extensions appended - A ransom note is discovered on one or more systems - EDR detects mass file modification patterns consistent with encryption behavior - Threat intelligence warns of an imminent ransomware campaign targeting the organization

Performing Ransomware Tabletop Exercise

- Testing organizational ransomware response procedures annually or after major infrastructure changes - Validating decision-making processes for ransom payment, regulatory notification, and public disclosure - Training executives, IT, legal, PR, and operations teams on their roles during a ransomware incident - Meeting cyber insurance policy requirements for documented incident response testing - Identifying gaps in recovery playbooks, communication plans, and backup procedures

Performing Red Team Phishing With Gophish

- When conducting security assessments that involve performing red team phishing with gophish - When following incident response procedures for related security events - When performing scheduled security testing or auditing activities - When validating security controls through hands-on testing

Performing Red Team With Covenant

Covenant is a collaborative .NET C2 framework for red teamers that provides a Swagger-documented REST API for managing listeners, launchers, grunts (agents), and tasks. This skill covers automating Covenant operations through its API for authorized red team engagements: creating HTTP/HTTPS listeners, generating binary and PowerShell launchers, deploying grunts, executing tasks on compromised hosts, and tracking lateral movement.

Performing S7comm Protocol Security Analysis

- When assessing the security posture of Siemens SIMATIC S7 PLC environments - When building detection rules for S7comm-based attacks against S7-300/400/1200/1500 controllers - When performing a security audit of Siemens Step 7/TIA Portal communications - When investigating suspected unauthorized access to Siemens PLC programs - When evaluating S7CommPlus integrity mechanisms and their bypass potential

Performing Sca Dependency Scanning With Snyk

- When applications use open-source packages that may contain known vulnerabilities - When compliance requires tracking and remediating vulnerable dependencies (PCI DSS, SOC 2) - When needing automated fix PRs for vulnerable dependencies in CI/CD - When license compliance requires visibility into open-source license obligations - When continuous monitoring is needed for newly disclosed vulnerabilities in deployed dependencies

Performing Scada Hmi Security Assessment

- When assessing the security posture of HMI systems in SCADA/DCS environments - When evaluating web-based HMI interfaces for common web vulnerabilities - When auditing HMI authentication, authorization, and session management - When testing communication security between HMIs and PLCs/RTUs - When preparing for IEC 62443 or NERC CIP compliance assessments

Performing Second Order Sql Injection

- When first-order SQL injection testing reveals proper input sanitization at storage time - During penetration testing of applications with user-generated content stored in databases - When testing multi-step workflows where stored data feeds subsequent database queries - During assessment of admin panels that display or process user-submitted data - When evaluating stored procedure execution paths that use previously stored data

Performing Security Headers Audit

- During authorized web application security assessments as a standard configuration review - When evaluating browser-level protections against XSS, clickjacking, and data leakage - For compliance assessments requiring security header implementation (PCI DSS, SOC 2) - When performing initial reconnaissance to identify easy-win security improvements - During CI/CD pipeline security gate checks for new deployments

Performing Serverless Function Security Review

- When auditing serverless applications before production deployment - When investigating potential data exposure through function environment variables or logs - When assessing the blast radius of a compromised serverless function execution role - When compliance reviews require documentation of serverless security controls - When building secure-by-default templates for serverless deployments

Performing Service Account Audit

Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud platforms, databases, and applications, assessing privilege levels, identifying missing owners, and enforcing lifecycle policies.

Performing Service Account Credential Rotation

Service accounts are non-human identities used by applications, daemons, CI/CD pipelines, and automated processes to authenticate to systems and APIs. These accounts often have elevated privileges and their credentials (passwords, API keys, certificates, tokens) are frequently long-lived and shared across teams, making them prime targets for attackers. Credential rotation is the systematic process of replacing these secrets on a scheduled basis, propagating new credentials to all dependent systems, and verifying service continuity after rotation.

Performing Soap Web Service Security Testing

SOAP (Simple Object Access Protocol) web services remain widely deployed in enterprise environments, financial systems, healthcare, and government integrations. Security testing of SOAP services involves analyzing WSDL (Web Services Description Language) definitions to understand available methods, testing for XML-based injection attacks (XXE, XPath injection, XML bombs), evaluating WS-Security implementation correctness, SOAPAction header spoofing, and assessing authentication and authorization controls. Unlike REST APIs, SOAP services use XML envelopes and often implement complex security standards that can be misconfigured.

Performing Soc Tabletop Exercise

Use this skill when: - Annual or semi-annual incident response testing is required (NIST, ISO 27001, PCI DSS compliance) - New SOC analysts need exposure to major incident scenarios in a controlled environment - Updated playbooks need validation before next real incident - Cross-functional coordination (SOC, IT, Legal, PR, Executive) needs rehearsal - Post-incident reviews reveal gaps requiring scenario-based training

Performing Soc2 Type2 Audit Preparation

- When preparing for a SOC 2 Type II audit engagement with a CPA firm - When conducting a gap assessment against AICPA Trust Services Criteria - When automating evidence collection across cloud infrastructure and identity providers - When validating that controls have operated effectively over the audit period (3-12 months) - When building continuous compliance monitoring to maintain SOC 2 posture between audits - When remediating control gaps identified during readiness assessment

Performing Sqlite Database Forensics

SQLite is the most widely deployed database engine in the world, used by virtually every mobile application, web browser, and many desktop applications to store user data. In digital forensics, SQLite databases are critical evidence sources containing browser history, messaging records, call logs, GPS locations, application preferences, and cached content. Forensic analysis goes beyond simple SQL queries to examine the internal B-tree page structures, freelist pages containing deleted records, Write-Ahead Log (WAL) files preserving transaction history, and unallocated space within database pages where recoverable data may persist after deletion.

Performing Ssl Certificate Lifecycle Management

SSL/TLS certificate lifecycle management encompasses the full process of requesting, issuing, deploying, monitoring, renewing, and revoking X.509 certificates. Poor certificate management is a leading cause of outages and security incidents. This skill covers automating the entire certificate lifecycle using Python and ACME protocol tools.

Performing Ssl Stripping Attack

- Testing whether web applications properly enforce HTTPS through HSTS headers and redirect chains - Validating that HSTS preloading is correctly configured and registered in browser preload lists - Demonstrating the risk of cleartext HTTP to stakeholders during authorized security assessments - Assessing whether internal applications and thick clients validate TLS certificates and reject downgrades - Training SOC teams to detect SSL stripping indicators in network traffic

Performing Ssl Tls Inspection Configuration

SSL/TLS inspection (also called SSL decryption, HTTPS inspection, or TLS break-and-inspect) intercepts encrypted traffic between clients and servers to inspect the cleartext content for malware, data exfiltration, policy violations, and command-and-control communications. The inspection device acts as a trusted man-in-the-middle, terminating the TLS session from the client, inspecting the plaintext content, and establishing a new TLS session to the destination server. With over 95% of web traffic now encrypted, organizations without TLS inspection have a massive blind spot. This skill covers configuring TLS inspection on next-generation firewalls, deploying trusted CA certificates, managing exemptions for certificate-pinned applications, and ensuring compliance with privacy regulations.

Performing Ssl Tls Security Assessment

Assess SSL/TLS server configurations using sslyze, a fast Python-based scanning library. This skill covers evaluating supported protocol versions (SSLv2/3, TLS 1.0-1.3), cipher suite strength, certificate chain validation, HSTS enforcement, OCSP stapling, and scanning for known vulnerabilities including Heartbleed, ROBOT, and session renegotiation weaknesses.

Performing Ssrf Vulnerability Exploitation

- When conducting security assessments that involve performing ssrf vulnerability exploitation - When following incident response procedures for related security events - When performing scheduled security testing or auditing activities - When validating security controls through hands-on testing

Performing Static Malware Analysis With Pe Studio

- A suspicious Windows executable has been collected and needs initial triage before sandbox execution - You need to identify imports, strings, and resources that reveal malware functionality without running the sample - Determining whether a PE file is packed, obfuscated, or contains anti-analysis techniques - Extracting indicators of compromise (hashes, URLs, IPs, registry keys) embedded in a binary - Classifying a sample's capabilities based on its import table and section characteristics

Performing Steganography Detection

- When suspecting covert data hiding in images, audio, or video files - During investigations involving suspected data exfiltration via media files - For analyzing files in espionage or insider threat investigations - When standard file analysis reveals anomalies in media file properties - For detecting communication channels using steganographic techniques

Performing Subdomain Enumeration With Subfinder

- During the reconnaissance phase of penetration testing or bug bounty hunting - When mapping the external attack surface of a target organization - Before performing vulnerability scanning on discovered subdomains - When building an asset inventory for continuous security monitoring - During red team engagements requiring passive information gathering

Performing Supply Chain Attack Simulation

Software supply chain attacks exploit trust in package registries through typosquatting (registering names similar to popular packages), dependency confusion (publishing higher-version public packages matching private names), and compromised package distribution. This skill detects these attack vectors by computing Levenshtein distance between package names and popular PyPI packages, verifying package integrity via SHA-256 hash comparison, scanning for known CVEs with pip-audit, and testing dependency resolution order for confusion vulnerabilities.

Performing Thick Client Application Penetration Test

Thick client (fat client) penetration testing assesses the security of desktop applications that run locally on user machines and communicate with backend servers. Unlike web applications, thick clients present a broader attack surface including local file storage, binary analysis, memory manipulation, DLL injection, process interception, and client-server communication. Common targets include banking applications, ERP clients (SAP GUI), trading platforms, healthcare systems, and legacy enterprise software.

Performing Threat Emulation With Atomic Red Team

- When conducting security assessments that involve performing threat emulation with atomic red team - When following incident response procedures for related security events - When performing scheduled security testing or auditing activities - When validating security controls through hands-on testing

Performing Threat Hunting With Elastic Siem

Use this skill when: - SOC teams need to proactively search for threats not caught by existing detection rules - Threat intelligence reports describe new TTPs requiring validation against historical data - Red team exercises reveal detection gaps that need hunting query development - Periodic hunting cadence requires structured hypothesis-driven investigations

Performing Threat Hunting With Yara Rules

Scan files, directories, and memory dumps using YARA rules to identify malware families, suspicious patterns, and IOC matches.

Performing Threat Intelligence Sharing With Misp

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform designed for collecting, storing, distributing, and sharing cybersecurity indicators and threat information. PyMISP is the official Python library for interacting with MISP instances via the REST API, enabling programmatic event creation, attribute management, tag assignment, galaxy cluster attachment, and feed synchronization. This skill covers using PyMISP to create events with structured IOCs (IP addresses, domains, file hashes, URLs), enrich events with MITRE ATT&CK tags, manage sharing groups and distribution levels, search for existing intelligence, and export in STIX 2.1 format for interoperability with other platforms.

Performing Threat Landscape Assessment For Sector

A sector-specific threat landscape assessment analyzes the cyber threat environment facing a particular industry vertical (healthcare, financial services, energy, government, manufacturing) by examining which threat actors target the sector, their preferred attack vectors and TTPs, common vulnerabilities exploited, historical incident data, and emerging threats. This produces actionable intelligence for risk management, security investment prioritization, and board-level reporting.

Performing Threat Modeling With Owasp Threat Dragon

OWASP Threat Dragon is an open-source threat modeling tool that enables security teams and developers to create threat model diagrams, identify threats using established methodologies (STRIDE, LINDDUN, CIA, DIE, PLOT4ai), and generate comprehensive reports. Threat Dragon runs as both a web application and desktop application (Windows, macOS, Linux), supporting distributed teams working collaboratively on threat models. Version 2.x provides drag-and-drop diagram creation, an auto-generation rule engine for threats and mitigations, and PDF report output for documentation and GRC compliance.

Performing Timeline Reconstruction With Plaso

- When building a comprehensive forensic timeline from multiple evidence sources - For correlating events across file system metadata, event logs, browser history, and registry - During complex investigations requiring chronological reconstruction of activities - When standard log analysis is insufficient to establish the sequence of events - For presenting investigation findings in a visual, chronological format

Performing User Behavior Analytics

Use this skill when: - SOC teams need to detect compromised accounts through abnormal authentication patterns - Insider threat programs require behavioral monitoring beyond rule-based detection - Impossible travel or geographic anomalies indicate credential compromise - Privileged account monitoring requires baseline deviation detection

Performing Vlan Hopping Attack

- Testing the effectiveness of VLAN-based network segmentation during authorized penetration tests - Validating that switch trunk port configurations prevent unauthorized VLAN access - Assessing whether 802.1Q tagging and native VLAN configurations resist double-tagging attacks - Demonstrating to network teams why proper switch hardening is critical for isolation between zones - Verifying that DTP (Dynamic Trunking Protocol) is disabled on all access ports

Performing Vulnerability Scanning With Nessus

- Conducting initial vulnerability assessment during the reconnaissance phase of a penetration test - Performing periodic vulnerability scans to maintain compliance with PCI-DSS (requirement 11.2), HIPAA, or SOC 2 standards - Validating that remediation efforts have successfully addressed previously identified vulnerabilities - Establishing a baseline of known vulnerabilities before targeted manual exploitation - Auditing patch compliance and configuration drift across server and workstation fleets

Performing Web Application Firewall Bypass

- When confirmed vulnerabilities are blocked by WAF signature-based detection - During penetration testing where WAF prevents exploitation of known issues - When evaluating WAF rule effectiveness against evasion techniques - During red team engagements requiring bypass of perimeter security controls - When testing custom WAF rules for completeness and bypass resistance

Performing Web Application Penetration Test

- Testing web applications before production deployment to identify exploitable vulnerabilities - Conducting compliance-driven security assessments (PCI-DSS requirement 6.6, SOC 2 Type II) - Validating remediation of previously identified web application vulnerabilities during retesting - Assessing third-party web applications before integration into the organization's environment - Evaluating custom-developed web applications where automated scanning alone is insufficient

Performing Web Application Scanning With Nikto

Nikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files/programs, checks for outdated versions of over 1,250 servers, and identifies version-specific problems on over 270 servers. It performs comprehensive tests including XSS, SQL injection, server misconfigurations, default credentials, and known vulnerable CGI scripts.

Performing Web Application Vulnerability Triage

Web application vulnerability triage is the process of reviewing findings from DAST (Dynamic Application Security Testing) and SAST (Static Application Security Testing) tools to validate true positives, dismiss false positives, assign risk ratings using the OWASP Risk Rating Methodology, and prioritize remediation. Effective triage reduces alert fatigue and focuses development teams on the vulnerabilities that matter most.

Performing Web Cache Deception Attack

- When testing applications behind CDNs or reverse proxies (Cloudflare, Akamai, Varnish, Nginx) - During assessment of authenticated page caching behavior - When evaluating path normalization differences between caching and origin layers - During bug bounty hunting on applications with aggressive caching policies - When testing for sensitive data exposure through cache layer misconfiguration

Performing Web Cache Poisoning Attack

- During authorized penetration tests when the application uses CDN or reverse proxy caching (Cloudflare, Akamai, Varnish, Nginx) - When assessing web applications for cache-based vulnerabilities that could affect all users - For testing whether unkeyed HTTP headers are reflected in cached responses - When evaluating cache key behavior and cache deception vulnerabilities - During security assessments of applications with aggressive caching policies

Performing Wifi Password Cracking With Aircrack

- Assessing the strength of WPA/WPA2/WPA3 passphrases during authorized wireless penetration tests - Testing whether wireless networks are using weak or default passwords that can be cracked offline - Capturing and analyzing 4-way handshakes to evaluate wireless authentication security - Demonstrating the risks of WEP, weak WPA2 passphrases, and PMKID-based attacks to stakeholders - Validating that enterprise wireless networks use 802.1X/EAP instead of pre-shared keys

Performing Windows Artifact Analysis With Eric Zimmerman Tools

Eric Zimmerman's EZ Tools suite is a collection of open-source forensic utilities that have become the global standard for Windows digital forensics investigations. Originally developed by a former FBI agent and current SANS instructor, these tools parse and analyze critical Windows artifacts including the Master File Table ($MFT), registry hives, prefetch files, event logs, shortcut (LNK) files, and jump lists. The suite integrates with KAPE (Kroll Artifact Parser and Extractor) for automated artifact collection and processing, producing structured CSV output that can be ingested into Timeline Explorer for visual analysis. EZ Tools are widely used by law enforcement, corporate incident responders, and forensic consultants worldwide.

Performing Wireless Network Penetration Test

Wireless penetration testing evaluates the security of an organization's WiFi infrastructure including encryption strength, authentication mechanisms, rogue access point detection, client isolation, and network segmentation. Testing covers 802.11a/b/g/n/ac/ax protocols, WPA2-PSK, WPA2-Enterprise, WPA3-SAE, captive portals, and Bluetooth/BLE where in scope.

Performing Wireless Security Assessment With Kismet

Kismet is an open-source wireless network detector, packet sniffer, and wireless intrusion detection system (WIDS) supporting 802.11a/b/g/n/ac/ax. Unlike active scanners, Kismet operates in passive monitor mode, making it undetectable to the networks being assessed. It captures raw 802.11 frames, identifies access points, clients, probe requests, and encryption types without transmitting any packets. This skill covers deploying Kismet for comprehensive wireless security assessments, identifying rogue access points, detecting weak encryption, mapping hidden networks, and analyzing client behavior.

Performing Yara Rule Development For Detection

YARA is the pattern matching swiss knife for malware researchers, enabling identification and classification of malware based on textual or binary patterns. Effective YARA rules combine unique string patterns, byte sequences, PE header characteristics, import table analysis, and conditional logic to detect malware families while avoiding false positives. Modern YARA-X (rewritten in Rust, stable since June 2025) brings improved performance and new modules. Rules should target unpacked malware artifacts like hardcoded stack strings, C2 URLs, mutex names, encryption constants, and unique code sequences rather than packer signatures.

Post Exploiting Microsoft Graph With Graphrunner

GraphRunner (Beau Bullock / Black Hills Information Security) is a PowerShell post-exploitation toolset built entirely on the Microsoft Graph API. Given a foothold token, it performs recon, establishes persistence, escalates privilege, and pillages M365 data — all through Graph, which blends in with normal traffic and bypasses many endpoint controls. It is the natural follow-on to credential/token theft (e.g., device-code phishing or ROADtools): once you hold Graph access, GraphRunner operationalizes it.

Prioritizing Vulnerabilities With Cvss Scoring

The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (released November 2023) introduces refined metrics for more accurate scoring. This skill covers calculating CVSS scores, interpreting vector strings, and using CVSS alongside contextual factors like EPSS and CISA KEV for effective vulnerability prioritization.

Processing Stix Taxii Feeds

Use this skill when: - Onboarding a new TAXII 2.1 collection from a government feed (CISA AIS, FS-ISAC) or commercial provider - Validating that ingested STIX bundles conform to the OASIS STIX 2.1 specification before import - Building automated pipelines that parse STIX relationship objects to reconstruct campaign context

Profiling Threat Actor Groups

Use this skill when: - Updating the organization's threat model with profiles of adversary groups recently observed targeting your sector - Preparing an executive briefing on APT groups that align with geopolitical events affecting your business - Enabling SOC analysts to understand attacker objectives and TTPs to improve detection tuning

Recovering Deleted Files With Photorec

- When recovering deleted files from a forensic disk image or storage device - When the file system is corrupted, formatted, or overwritten - During investigations requiring recovery of documents, images, videos, or databases - When file system metadata is unavailable but raw data sectors remain intact - For recovering files from memory cards, USB drives, and hard drives

Recovering From Ransomware Attack

- After ransomware has encrypted production systems and the decision has been made to recover from backups - When building or validating a ransomware recovery runbook before an actual incident - After receiving a decryption key (paid ransom or law enforcement provided) and needing to safely decrypt - When partial recovery is needed alongside decryption of remaining systems - Conducting a recovery drill to validate RTO commitments

Red Teaming Llms With Garak

garak (Generative AI Red-teaming and Assessment Kit) is an open-source LLM vulnerability scanner maintained by NVIDIA. It plays the role that a network vulnerability scanner like Nessus plays for hosts, but for large language models: it sends thousands of adversarial prompts ("probes") at a target model, captures the generations, and runs automated "detectors" over the responses to decide whether each attempt succeeded. Probe families cover prompt injection (promptinject, latentinjection), jailbreaks (dan), training-data and system-prompt leakage (leakreplay), malware generation (malwaregen), cross-site-scripting payload emission (xss), encoding-based bypasses (encoding), toxicity, and more. garak is described in the paper "garak: A Framework for Security Probing Large Language Models" (arXiv:2406.11036) and is distributed from the NVIDIA/garak GitHub repository.

Relaying Ntlm For Adcs Esc8

ESC8 is one of the Active Directory Certificate Services (AD CS) escalation paths catalogued by SpecterOps in "Certified Pre-Owned." It abuses the AD CS HTTP web-enrollment endpoint (/certsrv/), which by default supports NTLM authentication and, critically, does not enforce HTTPS channel binding or Extended Protection for Authentication (EPA). Because NTLM over HTTP on that endpoint is unprotected, an attacker can coerce a privileged machine account (typically a domain controller) into authenticating to an attacker-controlled host, then relay that NTLM authentication to the CA's web-enrollment page and request a certificate as the coerced machine.

Remediating S3 Bucket Misconfiguration

- When AWS Config or Security Hub reports S3 buckets with public access or missing encryption - When a security scan reveals S3 bucket policies granting access to Principal "*" (everyone) - When preparing for a data protection audit requiring evidence of storage security controls - When responding to a data exposure incident involving publicly accessible S3 objects - When establishing preventive controls for new S3 bucket creation across an AWS Organization

Reverse Engineering Android Malware With Jadx

- A suspicious Android APK has been reported as malicious or flagged by mobile threat detection - Analyzing Android banking trojans, spyware, SMS stealers, or adware samples - Determining what data an app collects, where it sends it, and what permissions it abuses - Extracting C2 server addresses, encryption keys, and configuration data from Android malware - Understanding overlay attack mechanisms used by banking trojans

Reverse Engineering Dotnet Malware With Dnspy

- A malware sample is identified as a .NET assembly (C#, VB.NET, F#) requiring decompilation - Analyzing .NET-based malware families (AgentTesla, AsyncRAT, RedLine Stealer, Quasar RAT) - Deobfuscating .NET code protected by ConfuserEx, SmartAssembly, or custom obfuscators - Extracting hardcoded C2 configurations, encryption keys, and credentials from managed assemblies - Debugging .NET malware at runtime to observe decryption routines and dynamic behavior

Reverse Engineering Ios App With Frida

Use this skill when: - Analyzing iOS app internals during authorized security assessments without source code - Extracting encryption keys, API secrets, or proprietary protocol details from running iOS apps - Understanding obfuscated Swift/Objective-C logic through runtime method tracing - Bypassing complex security mechanisms (jailbreak detection, anti-tampering, anti-debugging)

Reverse Engineering Malware With Ghidra

- Static and dynamic analysis have identified suspicious functionality that requires deeper code-level understanding - You need to reverse engineer C2 communication protocols, encryption algorithms, or custom obfuscation - Understanding the exact exploit mechanism or vulnerability targeted by a malware sample - Extracting hardcoded configuration data (C2 addresses, encryption keys, campaign IDs) embedded in compiled code - Developing precise YARA rules or detection signatures based on unique code patterns

Reverse Engineering Ransomware Encryption Routine

Modern ransomware uses hybrid encryption combining symmetric algorithms (AES-256-CBC/CTR, ChaCha20, Salsa20) for file encryption with asymmetric algorithms (RSA-2048/4096, Curve25519) for key protection. The encryption routine typically generates a random symmetric key per file, encrypts file contents, then encrypts the symmetric key with the attacker's embedded public key. Reverse engineering these routines identifies the specific algorithms, key derivation methods, initialization vectors, file targeting patterns, and potential implementation flaws that could enable decryption without paying the ransom. Notable examples include Rhysida (AES-256-CTR + RSA-4096), Qilin.B (AES-256-CTR with AES-NI or ChaCha20 fallback), and Medusa (AES-256 + RSA).

Reverse Engineering Rust Malware

Rust has become increasingly popular for malware development due to its cross-compilation, memory safety guarantees, and the complexity it introduces for reverse engineers. Rust binaries contain the entire standard library statically linked, producing large binaries with extensive boilerplate code. Key challenges include non-null-terminated strings (Rust uses fat pointers with pointer+length), monomorphization generating duplicated generic code, complex error handling (Result/Option unwrap chains), and unfamiliar calling conventions. Decompiling Rust to C produces unhelpful output compared to C/C++ binaries. Tools like Ghidra scripts for crate extraction, and training focused on Rust-specific patterns (2024-2025) help address these challenges. Notable Rust malware includes BlackCat/ALPHV ransomware, Hive ransomware variants, and Buer Loader.

Scanning Container Images With Grype

Grype is an open-source vulnerability scanner from Anchore that inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated SBOMs to match packages against multiple vulnerability databases including NVD, GitHub Advisories, and OS-specific feeds.

Scanning Containers With Trivy In Cicd

- When building Docker container images in CI/CD and needing automated vulnerability scanning before registry push - When establishing quality gates that prevent images with critical or high CVEs from reaching production - When compliance requirements mandate vulnerability scanning of all container images before deployment - When scanning IaC files (Dockerfiles, Kubernetes manifests) alongside container image scanning - When needing a single tool to scan OS packages, language-specific dependencies, and misconfigurations

Scanning Docker Images With Trivy

Trivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violations within container images. It integrates into CI/CD pipelines and supports multiple output formats including SARIF, CycloneDX, and SPDX.

Scanning Iac And Images With Trivy

Trivy (by Aqua Security) is a comprehensive, open-source security scanner that finds vulnerabilities (CVEs), misconfigurations (IaC), secrets, software licenses, and software supply-chain weaknesses across a wide range of targets: container images, filesystems, Git repositories, virtual machine images, Kubernetes clusters, and SBOM documents. It is widely adopted as a "shift-left" gate in CI/CD pipelines because it is fast, runs as a single static binary, requires no agent, and supports machine-readable output formats (JSON, SARIF, CycloneDX, SPDX) for integration with code-scanning dashboards.

Scanning Infrastructure With Nessus

Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems. This skill covers configuring scan policies, running authenticated and unauthenticated scans, interpreting results, and integrating Nessus into continuous vulnerability management workflows.

Scanning Kubernetes Manifests With Kubesec

Kubesec is an open-source security risk analysis tool developed by ControlPlane that inspects Kubernetes resource manifests for common exploitable risks such as privilege escalation, writable host mounts, and excessive capabilities. It assigns a numerical security score to each resource and provides actionable recommendations for hardening. Kubesec can be used as a CLI binary, Docker container, kubectl plugin, admission webhook, or REST API endpoint.

Scanning Network With Nmap Advanced

- Performing comprehensive asset discovery across large enterprise networks during authorized assessments - Enumerating service versions and configurations to identify outdated or vulnerable software - Bypassing firewall rules and IDS during authorized penetration tests using scan evasion techniques - Scripting automated vulnerability checks using the Nmap Scripting Engine (NSE) - Generating structured scan output for integration into vulnerability management pipelines

Securing Agentic Ai Tool Invocation

Autonomous (agentic) AI systems decide *which tool to call, with what arguments, and when*, based on model reasoning over untrusted inputs. That makes the tool-invocation boundary the highest-risk control point in an agent: a single successful prompt injection or a poisoned tool can turn the agent into a confused deputy that deletes data, sends money, or pivots into connected systems. The relevant threat is MITRE ATLAS AML.T0053 (LLM Plugin Compromise) and the OWASP Agentic AI Top 10 classes for *Tool Misuse*, *Excessive Agency*, and *Privilege Compromise*.

Securing Api Gateway With Aws Waf

- When deploying API Gateway endpoints that require protection against common web attacks - When implementing rate limiting and throttling to prevent API abuse and DDoS attacks - When building bot detection and mitigation for API endpoints exposed to the internet - When compliance requires WAF protection for all public-facing API endpoints - When customizing access controls based on IP reputation, geolocation, or request patterns

Securing Aws Iam Permissions

- When onboarding new AWS accounts or workloads that require scoped IAM policies - When IAM Access Analyzer reports overly permissive policies or unused permissions - When preparing for a compliance audit requiring least privilege evidence (SOC 2, PCI-DSS) - When migrating from long-lived access keys to short-lived role-based credentials - When remediating findings from AWS Security Hub related to IAM misconfigurations

Securing Aws Lambda Execution Roles

- When deploying new Lambda functions and defining their IAM execution roles - When remediating overly permissive Lambda roles discovered during security audits - When implementing least-privilege access patterns for serverless architectures - When building reusable IAM templates for Lambda functions across teams - When Security Hub or Prowler reports Lambda functions with excessive permissions

Securing Azure With Microsoft Defender

- When deploying cloud workload protection across Azure subscriptions and resource groups - When establishing a Secure Score baseline and prioritizing security recommendations - When extending threat protection to multi-cloud environments including AWS and GCP - When enabling container security for AKS clusters and Azure Container Registry - When integrating AI workload security with the Data and AI security dashboard

Securing Container Registry Images

- When establishing security controls for container image registries (ECR, ACR, GCR, Docker Hub) - When building CI/CD pipelines that enforce vulnerability scanning before image promotion - When implementing image signing and verification to prevent supply chain attacks - When auditing existing registries for vulnerable, unscanned, or unsigned images - When compliance requires software bill of materials (SBOM) for deployed container images

Securing Container Registry With Harbor

Harbor is an open-source container registry that provides security features including vulnerability scanning (integrated Trivy), image signing (Notary/Cosign), RBAC, content trust policies, replication, and audit logging. Securing Harbor involves configuring these features to enforce image provenance, prevent vulnerable image deployment, and maintain registry access control.

Securing Github Actions Workflows

- When GitHub Actions is the CI/CD platform and workflows need hardening against supply chain attacks - When workflows handle secrets, deploy to production, or have elevated permissions - When preventing script injection via untrusted PR titles, branch names, or commit messages - When requiring audit trails and approval gates for workflow modifications - When third-party actions pose supply chain risk through mutable version tags

Securing Helm Chart Deployments

Helm is the Kubernetes package manager. Securing Helm deployments requires validating chart provenance, scanning templates for security misconfigurations, enforcing pod security contexts, managing secrets securely, and controlling RBAC for Helm operations.

Securing Historian Server In Ot Environment

- When deploying a new historian server in an OT environment and configuring it securely from the start - When hardening an existing historian after a security assessment identified it as a high-risk target - When designing historian data replication architecture through a DMZ for IT access to process data - When implementing access controls to prevent unauthorized modification of historical process data - When investigating suspected historian compromise or data integrity issues

Securing Kubernetes On Cloud

- When deploying new managed Kubernetes clusters in production with security requirements - When hardening existing EKS, AKS, or GKE clusters after a security audit or pentest finding - When implementing workload identity to eliminate static cloud credentials in pods - When enforcing pod security policies across namespaces to prevent container escapes - When integrating runtime security monitoring for detecting container-level threats

Securing Remote Access To Ot Environment

- When implementing or upgrading remote access architecture for OT environments - When onboarding vendors who require remote access to OT systems for support and maintenance - When implementing CIP-005-7 R2 requirements for remote access management including MFA - When replacing legacy direct VPN access to OT networks with a secure jump server architecture - When responding to an incident involving unauthorized remote access to industrial control systems

Securing Serverless Functions

- When deploying Lambda functions or Azure Functions with access to sensitive data or cloud APIs - When auditing existing serverless workloads for overly permissive IAM roles - When integrating serverless functions into a DevSecOps pipeline with automated security scanning - When hardcoded secrets or vulnerable dependencies are discovered in function code - When establishing runtime monitoring for serverless workloads to detect injection or credential theft

Testing Android Intents For Vulnerabilities

Use this skill when: - Assessing Android app exported activities, services, receivers, and content providers - Testing for intent injection and unauthorized component invocation - Evaluating broadcast receiver security for sensitive data exposure - Performing IPC-focused penetration testing on Android applications

Testing Api Authentication Weaknesses

- Assessing REST API authentication mechanisms for bypass vulnerabilities before production deployment - Testing JWT token implementation for common weaknesses (none algorithm, key confusion, missing expiration) - Evaluating whether all API endpoints enforce authentication or if some are unintentionally exposed - Testing API key generation, storage, and rotation mechanisms for predictability or leakage - Validating session management including token expiration, revocation, and refresh token security

Testing Api For Broken Object Level Authorization

- Assessing REST or GraphQL APIs that use object identifiers in URL paths, query parameters, or request bodies - Performing OWASP API Security Top 10 assessments where API1:2023 (BOLA) must be tested - Testing multi-tenant SaaS applications where users from different tenants should not access each other's data - Validating that API endpoints enforce per-object authorization checks beyond just authentication - Evaluating APIs after new endpoints are added to ensure authorization middleware is applied consistently

Testing Api For Mass Assignment Vulnerability

- Testing API endpoints that accept JSON/XML request bodies for user profile updates, registration, or object creation - Assessing whether the API binds all client-supplied properties to the data model without an allowlist - Evaluating if users can set privileged attributes (role, permissions, pricing, balance) through regular update endpoints - Testing APIs built with ORMs that auto-bind request parameters to database models - Validating that server-side input validation restricts writeable properties per user role

Testing Api Security With Owasp Top 10

- During authorized API penetration testing engagements - When assessing REST, GraphQL, or gRPC APIs for security vulnerabilities - Before deploying new API endpoints to production environments - When reviewing API security posture against the OWASP API Security Top 10 (2023) - For validating API gateway security controls and rate limiting effectiveness

Testing Cors Misconfiguration

- During authorized penetration tests when assessing API endpoints for cross-origin access controls - When testing single-page applications that make cross-origin API requests - For evaluating whether sensitive data can be exfiltrated from a victim's browser session - When assessing microservice architectures with multiple domains sharing data - During security audits of applications using CORS headers for cross-domain communication

Testing For Broken Access Control

- During authorized penetration tests as the primary assessment for OWASP A01:2021 - Broken Access Control - When evaluating role-based access control (RBAC) implementations across all application endpoints - For testing multi-tenant applications where users in one organization should not access another's data - When assessing API endpoints for missing or inconsistent authorization checks - During security audits where privilege escalation and unauthorized access are primary concerns

Testing For Business Logic Vulnerabilities

- During authorized penetration tests when automated scanners have found few technical vulnerabilities - When assessing e-commerce platforms for pricing, cart, and payment flow manipulations - For testing multi-step workflows (registration, checkout, approval processes) for bypass opportunities - When evaluating rate-limited features like vouchers, coupons, referrals, and rewards systems - During security assessments of financial applications, voting systems, or any application with critical business rules

Testing For Email Header Injection

- When testing contact forms, feedback forms, or "email a friend" functionality - During assessment of password reset email functionality - When testing newsletter subscription or notification email systems - During penetration testing of applications that send emails based on user input - When auditing email-related API endpoints for header injection

Testing For Host Header Injection

- When testing password reset functionality for token theft via host manipulation - During assessment of web caching behavior influenced by Host header values - When testing virtual host routing and server-side request processing - During penetration testing of applications behind reverse proxies or load balancers - When evaluating SSRF potential through Host header manipulation

Testing For Json Web Token Vulnerabilities

- When testing applications using JWT for authentication and session management - During API security assessments where JWTs are used for authorization - When evaluating OAuth 2.0 or OpenID Connect implementations using JWT - During penetration testing of single sign-on (SSO) systems - When auditing JWT library configurations for known vulnerabilities

Testing For Open Redirect Vulnerabilities

- When testing login/logout flows that redirect users to specified URLs - During assessment of OAuth authorization endpoints with redirect_uri parameters - When auditing applications with URL parameters (next, url, redirect, return, goto, target) - During phishing simulation to chain open redirects with credential harvesting - When testing SSO implementations for redirect validation weaknesses

Testing For Sensitive Data Exposure

- During authorized penetration tests when assessing data protection controls - When evaluating applications for GDPR, PCI DSS, HIPAA, or other data protection compliance - For identifying leaked API keys, credentials, tokens, and secrets in application responses - When testing whether sensitive data is properly encrypted in transit and at rest - During security assessments of APIs that handle PII, financial data, or health records

Testing For System Prompt Leakage

A system prompt (a.k.a. developer message, preamble, or instructions) steers an LLM application's behavior. OWASP LLM07:2025 System Prompt Leakage addresses the risk that these prompts contain sensitive material that was never meant to be exposed — API keys, database connection strings, internal role/permission logic, model-routing rules, content policies, and tool definitions. Two principles frame this skill:

Testing For Xml Injection Vulnerabilities

- When testing applications that process XML input (SOAP APIs, XML-RPC, file uploads) - During penetration testing of applications with XML parsers - When assessing SAML-based authentication implementations - When testing file import/export functionality that handles XML formats - During API security testing of SOAP or XML-based web services

Testing For Xss Vulnerabilities

- Testing web applications for client-side injection vulnerabilities as part of OWASP WSTG testing - Evaluating the effectiveness of input sanitization and output encoding across all application features - Assessing the protection provided by Content Security Policy (CSP) headers against XSS exploitation - Demonstrating the impact of XSS through session hijacking, credential theft, or phishing overlay to stakeholders - Testing single-page applications (React, Angular, Vue) for DOM-based XSS in client-side routing and rendering

Testing For Xss Vulnerabilities With Burpsuite

- During authorized web application penetration testing to find reflected, stored, and DOM-based XSS - When validating XSS findings reported by automated vulnerability scanners - For testing the effectiveness of Content Security Policy (CSP) and XSS filters - When assessing client-side security of single-page applications (SPAs) - During bug bounty programs targeting XSS vulnerabilities

Testing For Xxe Injection Vulnerabilities

- During authorized penetration tests when the application processes XML input (SOAP APIs, file uploads, RSS feeds) - When testing APIs that accept Content-Type: application/xml or text/xml - For assessing XML parsers in file upload functionality (DOCX, XLSX, SVG, PDF) - When evaluating SOAP-based web services for entity injection - During security assessments of enterprise applications using XML configuration

Testing Jwt Token Security

- During authorized penetration tests when the application uses JWT for authentication or authorization - When assessing API security where JWTs are passed as Bearer tokens or in cookies - For evaluating SSO implementations that use JWT/JWS/JWE tokens - When testing OAuth 2.0 or OpenID Connect flows that issue JWTs - During security audits of microservice architectures using JWT for inter-service authentication

Testing Mobile Api Authentication

Use this skill when: - Assessing mobile app backend API authentication during penetration tests - Testing JWT token implementation for common vulnerabilities (none algorithm, weak signing) - Evaluating OAuth 2.0 / OIDC flows in mobile applications for redirect, PKCE, and scope issues - Testing for broken object-level authorization (BOLA/IDOR) in API endpoints

Testing Oauth2 Implementation Flaws

- Assessing OAuth 2.0 authorization code flow for redirect URI validation weaknesses - Testing OAuth client applications for CSRF protection (state parameter usage) and PKCE enforcement - Evaluating token storage, transmission, and lifecycle management in OAuth implementations - Testing scope escalation where clients request more permissions than authorized - Assessing OpenID Connect implementations for ID token validation and nonce usage

Testing Prompt Injection In Rag Pipelines

Retrieval-Augmented Generation (RAG) pipelines combine a large language model (LLM) with a retrieval layer (a vector store such as FAISS, Chroma, Pinecone, Milvus, or pgvector) so the model can answer questions over private documents. The retrieval layer is an *injection surface*: any text that the retriever returns is concatenated into the model's context window and is treated by the model as authoritative. An attacker who can influence the document corpus (a poisoned PDF, a malicious wiki edit, a planted support ticket, a crafted email) can plant instructions that the model will follow when that chunk is retrieved. This is indirect prompt injection delivered through the retrieval channel, and it maps to MITRE ATLAS AML.T0051 (LLM Prompt Injection) and OWASP LLM01:2025 Prompt Injection.

Testing Ransomware Recovery Procedures

Use this skill when: - Validating that ransomware recovery plans actually work under realistic conditions - Measuring RTO (Recovery Time Objective) and RPO (Recovery Point Objective) against business requirements - Testing backup restore operations to confirm data integrity and completeness after simulated encryption - Conducting tabletop exercises or live recovery drills for ransomware scenarios - Auditing disaster recovery readiness as part of compliance or cyber insurance requirements

Testing Websocket Api Security

- Assessing real-time communication APIs that use WebSocket (ws://) or Secure WebSocket (wss://) protocols - Testing for Cross-Site WebSocket Hijacking (CSWSH) where an attacker's page connects to a legitimate WebSocket server - Evaluating authentication and authorization enforcement on WebSocket connections and messages - Testing input validation on WebSocket message payloads for injection vulnerabilities - Assessing WebSocket implementations for denial-of-service through message flooding or oversized frames

Tracking Threat Actor Infrastructure

Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, and staging servers. This skill covers using passive DNS, certificate transparency logs, Shodan/Censys scanning, WHOIS analysis, and network fingerprinting to discover, track, and pivot across threat actor infrastructure over time.

Triaging Security Alerts In Splunk

Use this skill when: - SOC Tier 1 analysts need to process the Incident Review queue in Splunk Enterprise Security (ES) - Notable events require rapid severity classification and initial investigation before escalation - Alert volume exceeds capacity and analysts need a systematic triage methodology - Management requests metrics on alert disposition (true positive, false positive, benign)

Triaging Security Incident

- A SIEM or EDR alert fires and requires human classification before escalation - Multiple concurrent alerts arrive and the SOC must prioritize response order - An end user reports suspicious activity and the incident needs initial categorization - A threat intelligence feed matches an IOC observed in the environment

Triaging Security Incident With Ir Playbook

- New security alert received from SIEM, EDR, or other detection sources - SOC analyst needs to determine if an alert is a true positive requiring response - Incident needs severity classification and team assignment - Multiple concurrent incidents require prioritization - Automated triage rules need validation or tuning

Triaging Vulnerabilities With Ssvc Framework

The Stakeholder-Specific Vulnerability Categorization (SSVC) framework, developed by Carnegie Mellon University's Software Engineering Institute (SEI) in collaboration with CISA, provides a structured decision-tree methodology for vulnerability prioritization. Unlike CVSS alone, SSVC accounts for exploitation status, technical impact, automatability, mission prevalence, and public well-being impact to produce one of four actionable outcomes: Track, Track*, Attend, or Act.

Triaging Windows With Kape

KAPE (Kroll Artifact Parser and Extractor) is a free, Windows-native triage tool authored by Eric Zimmerman and distributed by Kroll. It performs two distinct phases controlled by separate configuration sets:

Validating Backup Integrity For Recovery

Use this skill when: - Verifying backup integrity before relying on backups for ransomware recovery - Building automated backup validation pipelines that run after each backup job - Auditing backup infrastructure to confirm recoverability for compliance (SOC 2, ISO 27001, NIST CSF RC.RP-03) - Detecting silent data corruption (bit rot) in backup storage before a disaster occurs - Validating that immutable or air-gapped backups have not been tampered with

Validating Tpm Measured Boot Attestation

A Trusted Platform Module (TPM 2.0) is a hardware root of trust that supports measured boot: each stage of the boot chain hashes ("measures") the next stage and *extends* that measurement into a Platform Configuration Register (PCR) before handing off control. PCRs cannot be set arbitrarily — they can only be extended (new = hash(old || measurement)), so the final PCR value is a tamper-evident summary of everything that executed. The TCG firmware profile assigns specific meanings: UEFI firmware code/config measure into PCR 0–7 (PCR 7 specifically captures Secure Boot policy), bootloaders measure the kernel into PCR 8–9, and Linux IMA measures executables into PCR 10.

Verifying Build Provenance With Slsa Sigstore

Build-provenance verification answers a question that defeats many supply-chain attacks: *was this artifact actually built from the source I think it was, by the builder I trust, without tampering?* Attackers who compromise a build system, swap a compiled release, or inject a malicious step (as in the SolarWinds and 3CX incidents) produce artifacts that look legitimate but lack verifiable provenance. SLSA (Supply-chain Levels for Software Artifacts, https://slsa.dev) defines Build levels (L1–L3) describing increasing provenance integrity, and Sigstore (https://www.sigstore.dev) provides the signing and transparency infrastructure: cosign for signing/verifying artifacts and attestations, Fulcio for short-lived keyless certificates bound to an OIDC identity, and Rekor as a tamper-evident transparency log.