Latest Agent Skills

Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports.

Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate network detection signatures.

Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.

Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.

Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage.

Hardens and secures process historian servers (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environments, covering network placement, access control, data replication through DMZ, SQL injection prevention, and data integrity protection.

Systematically tests web applications for vulnerabilities following the OWASP Web Security Testing Guide (WSTG) methodology, covering authentication, authorization, input validation, session management, and business logic using Burp Suite and manual techniques.

Proactively search for threats in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection.

Configure SSL/TLS inspection on network security devices to decrypt, inspect, and re-encrypt HTTPS traffic for threat detection while managing certificates, exemptions, and privacy compliance.

Conduct systematic reviews of privileged accounts to validate access rights, identify excessive permissions, and enforce least privilege across PAM infrastructure.

Deploy GoPhish, create phishing scenarios, and analyze campaign results to measure organizational resilience against phishing attacks.

Perform vulnerability scanning in OT/ICS environments safely using passive monitoring, native protocol queries, and carefully controlled active scanning with Tenable OT Security to identify vulnerabilities without disrupting industrial processes or crashing legacy controllers.

Conduct cybersecurity assessments for oil and gas facilities, covering upstream, midstream, and downstream operations, including SCADA, DCS, and safety systems, with compliance mapping to API 1164, TSA Pipeline Security Directives, IEC 62443, and NIST CSF.

Capture and analyze network traffic using Wireshark and tshark to reconstruct network events, extract artifacts, and identify malicious communications.

Discover and inventory ICS/OT assets using Claroty xDome, including passive monitoring, active queries, and integration with CMDB tools.

Extracts and analyzes firmware images using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis, recursive extraction, filesystem mounting, and string analysis for credential and configuration discovery.

Systematically reduce SIEM false positives through rule tuning, threshold adjustment, correlation refinement, and threat intelligence enrichment to combat alert fatigue.

Conducts digital forensics investigations on compromised endpoints, including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction for incident response and evidence collection.

Audits Docker host and daemon configuration against the CIS Docker Benchmark, generating compliance reports with pass/fail/warn results and remediation steps.

Execute a phased DMARC rollout from p=none monitoring through p=quarantine to p=reject enforcement, ensuring all legitimate email sources are authenticated before blocking unauthorized senders.

Run authenticated vulnerability scans using valid credentials to deeply inspect target systems for missing patches, misconfigurations, and security weaknesses.

Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without installing endpoint agents.

Parse Windows forensic artifacts including registry, prefetch, shellbags, MFT, and event logs using Eric Zimmerman's tools and analyze results in Timeline Explorer.

Integrates OWASP ZAP for Dynamic Application Security Testing in CI/CD pipelines, configuring baseline, full, and API scans, interpreting findings, tuning policies, and establishing quality gates in GitHub Actions and GitLab CI.

Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments.

Automates incident ticketing by connecting SIEM alerts to ServiceNow, Jira, or TheHive for structured tracking, SLA management, escalation workflows, and compliance documentation.

Detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts using Splunk SPL and Sigma rule format.

Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and policy enforcement.

Conduct HIPAA Security Rule risk analysis, implement administrative, physical, and technical safeguards, manage Business Associate Agreements, and establish breach-notification readiness for covered entities and business associates.

Encrypts Windows endpoints using Microsoft BitLocker to protect data at rest, covering TPM configuration, GPO settings, Intune deployment, and recovery key management for compliance requirements.

Assess and implement the CISA Zero Trust Maturity Model v2.0 across identity, devices, networks, applications, and data pillars to achieve progressive zero trust maturity.

Enforce API input/output contracts using OpenAPI specifications and JSON Schema to prevent injection, mass assignment, and data leakage attacks.

Design, deploy, and measure a comprehensive phishing awareness program using platforms like KnowBe4, Proofpoint, and open-source alternatives.

Hunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking in Windows environments.

Hunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration across Azure, AWS, GCP, and SaaS platforms.

Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements.

Generate Sigma-based forensic timelines from Windows EVTX files using Hayabusa for incident response triage.

Graph-based Active Directory reconnaissance tool that reveals hidden relationships and attack paths from compromised accounts to high-value targets like Domain Admins.

Guide federal systems through the NIST Risk Management Framework (SP 800-37 Rev 2) to achieve an Authorization to Operate (ATO), covering categorization, control selection, assessment, and continuous monitoring.

Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.

Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, and auditing SMB and LDAP signing enforcement.

Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs using pandas for behavioral analytics and statistical baselines.

Detects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features and classifying samples with machine learning models.

Detect DCSync attacks by monitoring Active Directory replication requests from non-domain-controller accounts via Event ID 4662 and associated GUIDs.

Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.

Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.

Automate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.

Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs.

Detects prompt injection attacks targeting LLM-based applications using regex pattern matching, heuristic scoring, and DeBERTa transformer classification.

Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

Replace traditional VPNs with zero trust network access by deploying Zscaler Private Access, configuring App Connectors, defining application segments, and setting identity-based access policies.

Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms.

Designs and implements VLAN-based network segmentation on managed switches to isolate network zones, enforce access control between segments, and reduce the attack surface by limiting lateral movement paths in enterprise network environments.

Analyze RAM dumps with Volatility 3 to detect malware, process injection, network connections, and credential theft during incident response.

Deploy a phishing report button in email clients and build an automated triage workflow that analyzes user-reported suspicious emails, extracts IOCs, and provides feedback to reporters.

Build an automated pipeline to defang indicators of compromise (URLs, IPs, domains, emails) for safe sharing and distribute them in STIX format through TAXII feeds and threat intelligence platforms.

Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance.

Monitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence on group tactics, and assess sector-specific ransomware risk for proactive defense.

Identify and analyze malware persistence mechanisms on Windows systems using Sysinternals Autoruns, covering registry keys, scheduled tasks, services, drivers, and startup locations.

Extracts and analyzes malicious VBA macros, XLM macros, DDE, and remote template injections in Microsoft Office documents using olevba, oledump, and deobfuscation techniques to identify download cradles, payload execution, and persistence mechanisms.