← all publishers

26zl

@26zl source repo

Report this profile Claim this profile

• 844 skills
• 0 followers
• 15 hours ago last updated

1. ▌
   Performing Alert Triage With Elastic Siem · 26zl bundle

   Perform systematic alert triage in Elastic Security SIEM to rapidly classify, prioritize, and investigate security alerts for SOC operations.
   0
   installs
2. ▌
   Performing Arp Spoofing Attack Simulation · 26zl bundle

   Simulates ARP spoofing attacks in authorized lab or pentest environments using arpspoof, Ettercap, and Scapy to demonstrate man-in-the-middle risks, test network detection capabilities, and validate ARP inspection countermeasures.
   0
   installs
3. ▌
   Performing Content Security Policy Bypass · 26zl bundle

   Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives, and policy injection techniques.
   0
   installs
4. ▌
   Performing Indicator Lifecycle Management · 26zl bundle

   Indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes f
   0
   installs
5. ▌
   Performing Kubernetes Penetration Testing · 26zl bundle

   Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools
   0
   installs
6. ▌
   Performing Ot Network Security Assessment · 26zl bundle

   This skill covers conducting comprehensive security assessments of Operational Technology (OT) networks including SCADA systems, DCS architectures, and industrial control system communication paths. It addresses the Purdue Reference Model layers, identifies IT/OT convergence risks, evaluates firewall rules between zones, and maps industrial protocol traffic (Modbus, DNP3, OPC UA, EtherNet/IP) to detect misconfigurations, unauthorized connections, and attack surfaces in critical infrastructure.
   0
   installs
7. ▌
   Performing Plc Firmware Security Analysis · 26zl bundle

   This skill covers analyzing Programmable Logic Controller (PLC) firmware for security vulnerabilities including hardcoded credentials, insecure update mechanisms, backdoor functions, memory corruption flaws, and undocumented debug interfaces. It addresses firmware extraction from common PLC platforms (Siemens S7, Allen-Bradley, Schneider Modicon), static analysis of firmware images, dynamic analysis in emulated environments, and comparison against known-good baselines to detect tampering.
   0
   installs
8. ▌
   Performing Supply Chain Attack Simulation · 26zl bundle

   Simulate and detect software supply chain attacks including typosquatting detection via Levenshtein distance, dependency confusion testing against private registries, package hash verification with pip, and known vulnerability scanning with pip-audit.
   0
   installs
9. ▌
   Performing Threat Hunting With Yara Rules · 26zl bundle

   Use YARA pattern-matching rules to hunt for malware, suspicious files, and indicators of compromise across filesystems and memory dumps. Covers rule authoring, yara-python scanning, and integration with threat intel feeds.
   0
   installs
10. ▌
    Testing For Open Redirect Vulnerabilities · 26zl bundle

    Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters, bypass techniques, and exploitation chains for phishing and token theft.
    0
    installs
11. ▌
    Testing For XML Injection Vulnerabilities · 26zl bundle

    Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.
    0
    installs
12. ▌
    Testing For Xxe Injection Vulnerabilities · 26zl bundle

    Discovering and exploiting XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.
    0
    installs
13. ▌
    Analyzing Browser Forensics With Hindsight · 26zl bundle

    Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.
    0
    installs
14. ▌
    Analyzing Lnk File And Jump List Artifacts · 26zl bundle

    Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.
    0
    installs
15. ▌
    Analyzing Packed Malware With Upx Unpacker · 26zl bundle

    Identifies and unpacks UPX-packed and other packed malware samples to expose the original executable code for static analysis. Covers both standard UPX unpacking and handling modified UPX headers that prevent automated decompression. Activates for requests involving malware unpacking, UPX decompression, packer removal, or preparing packed samples for analysis.
    0
    installs
16. ▌
    Auditing Tls Certificate Transparency Logs · 26zl bundle

    Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned domains. Uses the crt.sh API and direct CT log querying based on RFC 6962 to build continuous monitoring pipelines that catch rogue certificates, track CA behavior, and map the external attack surface. Activates for requests involving certificate transparency monitoring, CT log auditing, subdomain discovery via certificates, or certificate issuance alerting.
    0
    installs
17. ▌
    Building Devsecops Pipeline With Gitlab CI · 26zl bundle

    Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.
    0
    installs
18. ▌
    Building Incident Timeline With Timesketch · 26zl bundle

    Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.
    0
    installs
19. ▌
    Building Role Mining For Rbac Optimization · 26zl bundle

    Apply bottom-up and top-down role mining techniques to discover optimal RBAC roles from existing user-permission assignments, reducing role explosion and enforcing least privilege.
    0
    installs
20. ▌
    Building Threat Feed Aggregation With Misp · 26zl bundle

    Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate, and distribute threat intelligence feeds from multiple sources for centralized IOC management and automated SIEM integration.
    0
    installs
21. ▌
    Configuring Host Based Intrusion Detection · 26zl bundle

    Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC/Wazuh deployment, or host-based detection.
    0
    installs
22. ▌
    Deploying Cloudflare Access For Zero Trust · 26zl bundle

    Deploying Cloudflare Access with Cloudflare Tunnel to provide zero trust access to self-hosted and private applications, configuring identity-aware access policies, device posture checks, and WARP client enrollment for VPN replacement.
    0
    installs
23. ▌
    Detecting Arp Poisoning In Network Traffic · 26zl bundle

    Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom monitoring scripts to protect against man-in-the-middle interception.
    0
    installs
24. ▌
    Detecting Modbus Command Injection Attacks · 26zl bundle

    Detect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines using ICS-aware IDS and protocol deep packet inspection.
    0
    installs
25. ▌
    Exploiting Insecure Data Storage In Mobile · 26zl bundle

    Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including unencrypted databases, world-readable files, insecure SharedPreferences, plaintext credential storage, and improper keychain/keystore usage. Use when performing mobile penetration testing focused on OWASP M9 (Insecure Data Storage) or assessing compliance with MASVS-STORAGE requirements. Activates for requests involving mobile data storage security, local storage exploitation, SharedPreferences analysis, or mobile data leakage assessment.
    0
    installs
26. ▌
    Hardening Docker Containers For Production · 26zl bundle

    Hardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce leas
    0
    installs
27. ▌
    Implementing API Gateway Security Controls · 26zl bundle

    Implements security controls at the API gateway layer including authentication enforcement, rate limiting, request validation, IP allowlisting, TLS termination, and threat protection. The engineer configures API gateways (Kong, AWS API Gateway, Azure APIM, Apigee) to act as a centralized security enforcement point that validates, throttles, and monitors all API traffic before it reaches backend services. Activates for requests involving API gateway security, API management security, gateway authentication, or centralized API protection.
    0
    installs
28. ▌
    Implementing AWS Iam Permission Boundaries · 26zl bundle

    Configure IAM permission boundaries in AWS to delegate role creation to developers while enforcing maximum privilege limits set by the security team.
    0
    installs
29. ▌
    Implementing Cloud Dlp For Data Protection · 26zl bundle

    Implementing Cloud Data Loss Prevention (DLP) using Amazon Macie, Azure Information Protection, and Google Cloud DLP API to discover, classify, and protect sensitive data across cloud storage, databases, and data pipelines.
    0
    installs
30. ▌
    Implementing Dmarc Dkim Spf Email Security · 26zl bundle

    SPF, DKIM, and DMARC form the three pillars of email authentication. Together they prevent domain spoofing, validate message integrity, and define policies for handling unauthenticated mail. Proper im
    0
    installs
31. ▌
    Implementing Endpoint Detection With Wazuh · 26zl bundle

    Deploy and configure Wazuh SIEM/XDR for endpoint detection including agent management, custom decoder and rule XML creation, alert querying via the Wazuh REST API, and automated response actions.
    0
    installs
32. ▌
    Implementing Gdpr Data Protection Controls · 26zl bundle

    The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's comprehensive data protection law governing the collection, processing, storage, and transfer of personal data. This skill cover
    0
    installs
33. ▌
    Implementing Log Integrity With Blockchain · 26zl bundle

    Build an append-only log integrity chain using SHA-256 hash chaining for tamper detection. Each log entry is hashed with the previous entry's hash to create a blockchain-like structure where modifying any entry invalidates all subsequent hashes. Implements log ingestion, chain verification, tamper detection with pinpoint identification, and periodic checkpoint anchoring to external timestamping services.
    0
    installs
34. ▌
    Implementing Mitre Attack Coverage Mapping · 26zl bundle

    Implement MITRE ATT&CK coverage mapping to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.
    0
    installs
35. ▌
    Implementing Mobile Application Management · 26zl bundle

    Implements Mobile Application Management (MAM) policies to protect enterprise data on managed and unmanaged mobile devices through app-level controls including data loss prevention, selective wipe, app configuration, and containerization. Use when securing corporate apps on BYOD devices, implementing Intune App Protection Policies, or enforcing data separation between personal and work apps. Activates for requests involving MAM deployment, app protection policies, mobile containerization, or BYOD security.
    0
    installs
36. ▌
    Implementing Ot Incident Response Playbook · 26zl bundle

    Develop and implement OT-specific incident response playbooks aligned with SANS PICERL framework, IEC 62443, and NIST SP 800-82 that address unique ICS challenges including safety-critical systems, limited downtime tolerance, and coordination between IT SOC, OT engineering, and plant operations teams.
    0
    installs
37. ▌
    Implementing Privileged Access Workstation · 26zl bundle

    Design and implement Privileged Access Workstations (PAWs) with device hardening, just-in-time access, and integration with CyberArk or BeyondTrust for secure administrative operations.
    0
    installs
38. ▌
    Implementing Privileged Session Monitoring · 26zl bundle

    Implements privileged session monitoring and recording using Privileged Access Management (PAM) solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source alternatives. Covers session recording configuration, keystroke logging, real-time monitoring, risk-based session analysis, and compliance audit trail generation. Activates for requests involving privileged session recording, PAM session monitoring, CyberArk PSM configuration, administrator activity monitoring, or compliance session auditing.
    0
    installs
39. ▌
    Implementing Rapid7 Insightvm For Scanning · 26zl bundle

    Deploy and configure Rapid7 InsightVM Security Console and Scan Engines for authenticated and unauthenticated vulnerability scanning across enterprise environments.
    0
    installs
40. ▌
    Implementing Rbac Hardening For Kubernetes · 26zl bundle

    Harden Kubernetes Role-Based Access Control by implementing least-privilege policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating external identity providers.
    0
    installs
41. ▌
    Implementing Secrets Management With Vault · 26zl bundle

    This skill covers deploying HashiCorp Vault for centralized secrets management across cloud environments, including dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes integration. It addresses eliminating hardcoded credentials from application code and CI/CD pipelines by implementing short-lived, automatically rotated secrets.
    0
    installs
42. ▌
    Implementing Semgrep For Custom Sast Rules · 26zl bundle

    Write custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines.
    0
    installs
43. ▌
    Implementing Vulnerability Remediation Sla · 26zl bundle

    Vulnerability remediation SLAs define mandatory timeframes for patching or mitigating identified vulnerabilities based on severity, asset criticality, and exploit availability. Effective SLA programs
    0
    installs
44. ▌
    Intercepting Mobile Traffic With Burpsuite · 26zl bundle

    Intercepts and analyzes HTTP/HTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, Burp Suite mobile proxy, API security testing, or mobile HTTPS analysis.
    0
    installs
45. ▌
    Performing Access Review And Certification · 26zl bundle

    Conduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles. This skill covers review campaign design, reviewer selection, risk-based p
    0
    installs
46. ▌
    Performing Authenticated Scan With Openvas · 26zl bundle

    Configure and execute authenticated vulnerability scans using OpenVAS/Greenbone Vulnerability Management with SSH and SMB credentials for comprehensive host-level assessment.
    0
    installs
47. ▌
    Performing Cloud Log Forensics With Athena · 26zl bundle

    Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs for forensic investigation. Covers CREATE TABLE DDL with partition projection, forensic SQL queries for detecting unauthorized access, data exfiltration, lateral movement, and privilege escalation. Use when investigating AWS security incidents or building cloud-native forensic workflows at scale.
    0
    installs
48. ▌
    Performing Dark Web Monitoring For Threats · 26zl bundle

    Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked cre
    0
    installs
49. ▌
    Performing Deception Technology Deployment · 26zl bundle

    Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates. Use when SOC teams need early warning of lateral movement, credential abuse, or internal reconnaissance by deploying convincing traps across the network.
    0
    installs
50. ▌
    Performing Dynamic Analysis Of Android App · 26zl bundle

    Performs runtime dynamic analysis of Android applications using Frida, Objection, and Android Debug Bridge to observe application behavior during execution, intercept function calls, modify runtime values, and identify vulnerabilities that static analysis misses. Use when testing Android apps for runtime security flaws, hooking sensitive methods, bypassing client-side protections, or analyzing obfuscated applications. Activates for requests involving Android dynamic analysis, runtime hooking, Frida Android instrumentation, or live app behavior analysis.
    0
    installs
51. ▌
    Performing HTTP Parameter Pollution Attack · 26zl bundle

    Execute HTTP Parameter Pollution attacks to bypass input validation, WAF rules, and security controls by injecting duplicate parameters that are processed differently by front-end and back-end systems.
    0
    installs
52. ▌
    Performing Network Packet Capture Analysis · 26zl bundle

    Perform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic, and establish evidence of data exfiltration or command-and-control activity.
    0
    installs
53. ▌
    Performing Privilege Escalation Assessment · 26zl bundle

    Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control. The tester enumerates misconfigurations, vulnerable services, kernel exploits, SUID binaries, unquoted service paths, and credential stores to demonstrate the full impact of an initial compromise. Activates for requests involving privilege escalation testing, local exploitation, post-compromise escalation, or OS-level security assessment.
    0
    installs
54. ▌
    Performing Ssrf Vulnerability Exploitation · 26zl bundle

    Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters. Tests AWS/GCP/Azure metadata APIs (169.254.169.254), internal port scanning via HTTP, URL scheme bypass techniques, and DNS rebinding detection.
    0
    installs
55. ▌
    Performing Web Application Firewall Bypass · 26zl bundle

    Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution, and payload obfuscation to deliver SQL injection, XSS, and other attack payloads past WAF detection rules.
    0
    installs
56. ▌
    Scanning Kubernetes Manifests With Kubesec · 26zl bundle

    Perform security risk analysis on Kubernetes resource manifests using Kubesec to identify misconfigurations, privilege escalation risks, and deviations from security best practices.
    0
    installs
57. ▌
    Testing For Business Logic Vulnerabilities · 26zl bundle

    Identifying flaws in application business logic that allow price manipulation, workflow bypass, and privilege escalation beyond what technical vulnerability scanners can detect.
    0
    installs
58. ▌
    Testing For JSON Web Token Vulnerabilities · 26zl bundle

    Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.
    0
    installs
59. ▌
    Analyzing Command And Control Communication · 26zl bundle

    Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse engineering, or command-and-control infrastructure mapping.
    0
    installs
60. ▌
    Analyzing Malware Persistence With Autoruns · 26zl bundle

    Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.
    0
    installs
61. ▌
    Conducting Memory Forensics With Volatility · 26zl bundle

    Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response. Covers memory acquisition, process analysis, DLL inspection, and malware detection. Activates for requests involving memory forensics, RAM analysis, Volatility framework, memory dump investigation, volatile evidence analysis, or live memory acquisition.
    0
    installs
62. ▌
    Configuring Network Segmentation With Vlans · 26zl bundle

    Designs and implements VLAN-based network segmentation on managed switches to isolate network zones, enforce access control between segments, and reduce the attack surface by limiting lateral movement paths in enterprise network environments.
    0
    installs
63. ▌
    Configuring Suricata For Network Monitoring · 26zl bundle

    Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.
    0
    installs
64. ▌
    Configuring Zscaler Private Access For Ztna · 26zl bundle

    Configuring Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring access policies based on user identity and device posture, and integrating with IdPs.
    0
    installs
65. ▌
    Detecting AI Model Prompt Injection Attacks · 26zl bundle

    Detects prompt injection attacks targeting LLM-based applications using a multi-layered defense combining regex pattern matching for known attack signatures, heuristic scoring for structural anomalies, and transformer-based classification with DeBERTa models. The detector analyzes user inputs before they reach the LLM, flagging direct injections (system prompt overrides, role-play escapes, instruction hijacking) and indirect injections (encoded payloads, multi-language obfuscation, delimiter-based escapes). Based on the OWASP LLM Top 10 (LLM01:2025 Prompt Injection) and Simon Willison's prompt injection taxonomy. Activates for requests involving prompt injection detection, LLM input sanitization, AI security scanning, or prompt attack classification.
    0
    installs
66. ▌
    Detecting AWS Guardduty Findings Automation · 26zl bundle

    Automate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.
    0
    installs
67. ▌
    Detecting Container Escape With Falco Rules · 26zl bundle

    Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.
    0
    installs
68. ▌
    Detecting Dcsync Attack In Active Directory · 26zl bundle

    Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.
    0
    installs
69. ▌
    Detecting Insider Data Exfiltration Via Dlp · 26zl bundle

    Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data loss prevention.
    0
    installs
70. ▌
    Detecting Ntlm Relay With Event Correlation · 26zl bundle

    Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
    0
    installs
71. ▌
    Hardening Linux Endpoint With Cis Benchmark · 26zl bundle

    Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.
    0
    installs
72. ▌
    Hunting For Living Off The Cloud Techniques · 26zl bundle

    Hunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse of Azure, AWS, GCP services, and SaaS platforms.
    0
    installs
73. ▌
    Hunting For Registry Persistence Mechanisms · 26zl bundle

    Hunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking in Windows environments.
    0
    installs
74. ▌
    Implementing API Schema Validation Security · 26zl bundle

    Implement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts and prevent injection, data exposure, and mass assignment attacks.
    0
    installs
75. ▌
    Implementing Cisa Zero Trust Maturity Model · 26zl bundle

    Implement the CISA Zero Trust Maturity Model v2.0 across the five pillars of identity, devices, networks, applications, and data to achieve progressive organizational zero trust maturity.
    0
    installs
76. ▌
    Implementing Disk Encryption With Bitlocker · 26zl bundle

    Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthorized access in case of device loss or theft. Use when deploying encryption for compliance requirements, securing mobile workstations, or implementing data protection controls across the enterprise. Activates for requests involving BitLocker encryption, disk encryption, TPM configuration, or data-at-rest protection.
    0
    installs
77. ▌
    Implementing Runtime Security With Tetragon · 26zl bundle

    Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and policy enforcement.
    0
    installs
78. ▌
    Implementing Siem Correlation Rules For Apt · 26zl bundle

    Write multi-event correlation rules that detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts. Uses Splunk SPL and Sigma rule format to correlate Event IDs 4624, 4648, 4688, and Sysmon Events 1/3 within sliding time windows to surface attack sequences invisible to single-event detections.
    0
    installs
79. ▌
    Implementing Ticketing System For Incidents · 26zl bundle

    Implements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for structured incident tracking, SLA management, escalation workflows, and compliance documentation. Use when SOC teams need formalized incident lifecycle management with automated ticket creation, assignment routing, and resolution tracking.
    0
    installs
80. ▌
    Implementing Velociraptor For Ir Collection · 26zl bundle

    Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments.
    0
    installs
81. ▌
    Integrating Dast With Owasp Zap In Pipeline · 26zl bundle

    This skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic Application Security Testing in CI/CD pipelines. It addresses configuring baseline, full, and API scans against running applications, interpreting ZAP findings, tuning scan policies, and establishing DAST quality gates in GitHub Actions and GitLab CI.
    0
    installs
82. ▌
    Performing Agentless Vulnerability Scanning · 26zl bundle

    Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without installing endpoint agents.
    0
    installs
83. ▌
    Performing Authenticated Vulnerability Scan · 26zl bundle

    Authenticated (credentialed) vulnerability scanning uses valid system credentials to log into target hosts and perform deep inspection of installed software, patches, configurations, and security sett
    0
    installs
84. ▌
    Performing Dmarc Policy Enforcement Rollout · 26zl bundle

    Execute a phased DMARC rollout from p=none monitoring through p=quarantine to p=reject enforcement, ensuring all legitimate email sources are authenticated before blocking unauthorized senders.
    0
    installs
85. ▌
    Performing Docker Bench Security Assessment · 26zl bundle

    Docker Bench for Security is an open-source script that checks dozens of common best practices around deploying Docker containers in production. Based on the CIS Docker Benchmark, it audits host confi
    0
    installs
86. ▌
    Performing Endpoint Forensics Investigation · 26zl bundle

    Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Use when investigating security incidents, collecting evidence for legal proceedings, or analyzing endpoint compromise scope. Activates for requests involving endpoint forensics, memory analysis, disk forensics, or incident investigation.
    0
    installs
87. ▌
    Performing False Positive Reduction In Siem · 26zl bundle

    Perform systematic SIEM false positive reduction through rule tuning, threshold adjustment, correlation refinement, and threat intelligence enrichment to combat alert fatigue.
    0
    installs
88. ▌
    Performing Ics Asset Discovery With Claroty · 26zl bundle

    Perform comprehensive ICS/OT asset discovery using Claroty xDome platform, leveraging passive monitoring, Claroty Edge active queries, and integration ecosystem to gain full visibility into industrial control system assets including PLCs, RTUs, HMIs, and network infrastructure across Purdue Model levels.
    0
    installs
89. ▌
    Performing Network Forensics With Wireshark · 26zl bundle

    Capture and analyze network traffic using Wireshark and tshark to reconstruct network events, extract artifacts, and identify malicious communications.
    0
    installs
90. ▌
    Performing Oil Gas Cybersecurity Assessment · 26zl bundle

    This skill covers conducting cybersecurity assessments specific to oil and gas facilities including upstream (exploration/production), midstream (pipeline/transport), and downstream (refining/distribution) operations. It addresses SCADA systems controlling pipeline operations, DCS for refinery process control, safety instrumented systems for hazardous processes, remote terminal units at unmanned wellhead sites, and compliance with API 1164, TSA Pipeline Security Directives, IEC 62443, and NIST Cybersecurity Framework for critical infrastructure.
    0
    installs
91. ▌
    Performing Ot Vulnerability Scanning Safely · 26zl bundle

    Perform vulnerability scanning in OT/ICS environments safely using passive monitoring, native protocol queries, and carefully controlled active scanning with Tenable OT Security to identify vulnerabilities without disrupting industrial processes or crashing legacy controllers.
    0
    installs
92. ▌
    Performing Privileged Account Access Review · 26zl bundle

    Conduct systematic reviews of privileged accounts to validate access rights, identify excessive permissions, and enforce least privilege across PAM infrastructure.
    0
    installs
93. ▌
    Performing Ssl Tls Inspection Configuration · 26zl bundle

    Configure SSL/TLS inspection on network security devices to decrypt, inspect, and re-encrypt HTTPS traffic for threat detection while managing certificates, exemptions, and privacy compliance.
    0
    installs
94. ▌
    Performing Threat Hunting With Elastic Siem · 26zl bundle

    Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection. Use when SOC teams need to hunt for specific ATT&CK techniques, investigate anomalous behaviors, or validate detection coverage gaps using Elasticsearch and Kibana Security.
    0
    installs
95. ▌
    Performing Web Application Penetration Test · 26zl bundle

    Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses Burp Suite as the primary interception proxy alongside manual testing techniques to find flaws that automated scanners miss. Activates for requests involving web app pentest, OWASP testing, application security assessment, or web vulnerability testing.
    0
    installs
96. ▌
    Securing Historian Server In Ot Environment · 26zl bundle

    This skill covers hardening and securing process historian servers (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environments. It addresses network placement across Purdue levels, access control for historian interfaces, data replication through DMZ using data diodes or PI-to-PI connectors, SQL injection prevention in historian queries, and integrity protection of process data used for safety analysis, regulatory reporting, and process optimization.
    0
    installs
97. ▌
    Testing Android Intents For Vulnerabilities · 26zl bundle

    Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.
    0
    installs
98. ▌
    Triaging Security Incident With Ir Playbook · 26zl bundle

    Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.
    0
    installs
99. ▌
    Analyzing Cobaltstrike Malleable C2 Profiles · 26zl bundle

    Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate network detection signatures.
    0
    installs
100. ▌
     Analyzing Malware Sandbox Evasion Techniques · 26zl bundle

     Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports
     0
     installs