← all publishers

henriquescastilho

@henriquescastilho source repo

Report this profile Claim this profile

• 152 skills
• 0 followers
• 3 hours ago last updated

1. ▌
   Analyzing Mft For Deleted File Recovery · henriquescastilho bundle

   Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.
   0
   installs
2. ▌
   Analyzing Ransomware Network Indicators · henriquescastilho bundle

   Identify ransomware network indicators including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange via Zeek conn.log and NetFlow analysis
   0
   installs
3. ▌
   Detecting Compromised Cloud Credentials · henriquescastilho bundle

   Detecting compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.
   0
   installs
4. ▌
   Detecting Credential Dumping Techniques · henriquescastilho bundle

   Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules
   0
   installs
5. ▌
   Implementing Ransomware Backup Strategy · henriquescastilho bundle

   Designs and implements a ransomware-resilient backup strategy following the 3-2-1-1-0 methodology (3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, 0 errors on restore verification). Configures backup schedules aligned to RPO/RTO requirements, implements backup credential isolation to prevent ransomware from compromising backup infrastructure, and establishes automated restore testing. Activates for requests involving ransomware backup planning, backup resilience, air-gapped backup design, or backup recovery point objective configuration.
   0
   installs
6. ▌
   Implementing Soar Playbook For Phishing · henriquescastilho bundle

   Automate phishing incident response using Splunk SOAR REST API to create containers, add artifacts, and trigger playbooks
   0
   installs
7. ▌
   Performing Ransomware Tabletop Exercise · henriquescastilho bundle

   Plans and facilitates tabletop exercises simulating ransomware incidents to test organizational readiness, decision-making, and communication procedures. Designs realistic scenarios based on current ransomware threat actors (LockBit, ALPHV/BlackCat, Cl0p), injects covering double extortion, backup destruction, and regulatory notification requirements. Evaluates participant responses against NIST CSF and CISA guidelines. Activates for requests involving ransomware tabletop, incident response exercise, or ransomware readiness drill.
   0
   installs
8. ▌
   Detecting Ransomware Encryption Behavior · henriquescastilho bundle

   Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral heuristics. Identifies mass file modification patterns, abnormal entropy spikes in written data, and suspicious process behavior characteristic of ransomware encryption routines. Activates for requests involving ransomware behavioral detection, entropy-based file monitoring, I/O anomaly detection, or real-time encryption activity alerting.
   0
   installs
9. ▌
   Hunting For Data Exfiltration Indicators · henriquescastilho bundle

   Hunt for data exfiltration through network traffic analysis, detecting unusual data flows, DNS tunneling, cloud storage uploads, and encrypted channel abuse.
   0
   installs
10. ▌
    Implementing Scim Provisioning With Okta · henriquescastilho bundle

    Implement automated user provisioning and deprovisioning using SCIM 2.0 protocol with Okta as the identity provider.
    0
    installs
11. ▌
    Performing Initial Access With Evilginx3 · henriquescastilho bundle

    Perform authorized initial access using EvilGinx3 adversary-in-the-middle phishing framework to capture session tokens and bypass multi-factor authentication during red team engagements.
    0
    installs
12. ▌
    Validating Backup Integrity For Recovery · henriquescastilho bundle

    Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.
    0
    installs
13. ▌
    Exploiting JWT Algorithm Confusion Attack · henriquescastilho bundle

    Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing a fixed algorithm. The tester manipulates the alg header to switch from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none to bypass signature verification, or exploits kid/jku/x5u header injection to supply attacker-controlled keys. Activates for requests involving JWT algorithm confusion, alg none attack, key confusion attack, or JWT signature bypass.
    0
    installs
14. ▌
    Exploiting Race Condition Vulnerabilities · henriquescastilho bundle

    Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate transactions, and exploit time-of-check-to-time-of-use flaws.
    0
    installs
15. ▌
    Implementing Anti Ransomware Group Policy · henriquescastilho bundle

    Configures Windows Group Policy Objects (GPO) to prevent ransomware execution and limit its spread. Implements AppLocker rules, Software Restriction Policies, Controlled Folder Access, attack surface reduction rules, and network protection settings. Activates for requests involving Windows GPO hardening against ransomware, AppLocker configuration, Controlled Folder Access setup, or endpoint protection via Group Policy.
    0
    installs
16. ▌
    Investigating Ransomware Attack Artifacts · henriquescastilho bundle

    Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.
    0
    installs
17. ▌
    Performing Credential Access With Lazagne · henriquescastilho bundle

    Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
    0
    installs
18. ▌
    Performing Red Team Phishing With Gophish · henriquescastilho bundle

    Automate GoPhish phishing simulation campaigns using the Python gophish library. Creates email templates with tracking pixels, configures SMTP sending profiles, builds target groups from CSV, launches campaigns, and analyzes results including open rates, click rates, and credential submission statistics for security awareness assessment.
    0
    installs
19. ▌
    Analyzing Ransomware Encryption Mechanisms · henriquescastilho bundle

    Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and support recovery efforts. Covers AES, RSA, ChaCha20, and hybrid encryption schemes. Activates for requests involving ransomware cryptanalysis, encryption analysis, key recovery assessment, or ransomware decryption feasibility.
    0
    installs
20. ▌
    Conducting Social Engineering Pretext Call · henriquescastilho bundle

    Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.
    0
    installs
21. ▌
    Detecting Ransomware Precursors In Network · henriquescastilho bundle

    Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involving pre-ransomware detection, network-based ransomware indicators, or early warning ransomware monitoring.
    0
    installs
22. ▌
    Detecting Spearphishing With Email Gateway · henriquescastilho bundle

    Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint,
    0
    installs
23. ▌
    Exploiting Nosql Injection Vulnerabilities · henriquescastilho bundle

    Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.
    0
    installs
24. ▌
    Implementing Delinea Secret Server For Pam · henriquescastilho bundle

    Implements Delinea Secret Server for privileged access management (PAM) including secret vault configuration, role-based access policies, automated password rotation, session recording, and integration with Active Directory and cloud platforms. Activates for requests involving PAM deployment, privileged credential vaulting, secret server administration, or password rotation automation.
    0
    installs
25. ▌
    Implementing Sigstore For Software Signing · henriquescastilho bundle

    Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic provenance for container images, binaries, and software artifacts. The practitioner configures OIDC-based identity binding, verifies signing events against the Rekor transparency log, and integrates signing workflows into CI/CD pipelines. Activates for requests involving software supply chain signing, keyless container signing, Sigstore deployment, or artifact provenance verification.
    0
    installs
26. ▌
    Performing OAUTH Scope Minimization Review · henriquescastilho bundle

    Performs OAuth 2.0 scope minimization review to identify over-permissioned third-party application integrations, excessive API scopes, unused token grants, and risky OAuth consent patterns across identity providers and SaaS platforms. Activates for requests involving OAuth scope audit, API permission review, third-party app risk assessment, or consent grant minimization.
    0
    installs
27. ▌
    Analyzing Ransomware Leak Site Intelligence · henriquescastilho bundle

    Monitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence on group tactics, and assess sector-specific ransomware risk for proactive defense.
    0
    installs
28. ▌
    Analyzing Tls Certificate Transparency Logs · henriquescastilho bundle

    Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring.
    0
    installs
29. ▌
    Building Phishing Reporting Button Workflow · henriquescastilho bundle

    Implement a phishing report button in email clients with automated triage workflow that analyzes user-reported suspicious emails and provides feedback to reporters.
    0
    installs
30. ▌
    Detecting Anomalous Authentication Patterns · henriquescastilho bundle

    Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs. Activates for requests involving authentication anomaly detection, login behavior analysis, UEBA implementation, or suspicious sign-in investigation.
    0
    installs
31. ▌
    Detecting Business Email Compromise With AI · henriquescastilho bundle

    Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.
    0
    installs
32. ▌
    Detecting Deepfake Audio In Vishing Attacks · henriquescastilho bundle

    Detects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models. Supports batch analysis of audio files, generates confidence scores, and produces forensic reports. Activates for requests involving deepfake voice detection, vishing investigation, AI-generated speech analysis, voice cloning detection, or audio authenticity verification.
    0
    installs
33. ▌
    Detecting T1003 Credential Dumping With Edr · henriquescastilho bundle

    Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.
    0
    installs
34. ▌
    Implementing Anti Phishing Training Program · henriquescastilho bundle

    Security awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positiv
    0
    installs
35. ▌
    Performing Firmware Extraction With Binwalk · henriquescastilho bundle

    Performs firmware image extraction and analysis using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis for detecting encrypted or compressed regions, recursive extraction of nested archives, SquashFS/CramFS/JFFS2 filesystem mounting, and string analysis for credential and configuration discovery. Activates for requests involving firmware reverse engineering, IoT device analysis, embedded system security assessment, or router/camera firmware extraction.
    0
    installs
36. ▌
    Performing Phishing Simulation With Gophish · henriquescastilho bundle

    GoPhish is an open-source phishing simulation framework used by security teams to conduct authorized phishing awareness campaigns. It provides campaign management, email template creation, landing pag
    0
    installs
37. ▌
    Conducting Spearphishing Simulation Campaign · henriquescastilho bundle

    Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craf
    0
    installs
38. ▌
    Exploiting Prototype Pollution In Javascript · henriquescastilho bundle

    Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.
    0
    installs
39. ▌
    Implementing Google Workspace Admin Security · henriquescastilho bundle

    Implements comprehensive Google Workspace security hardening including admin console configuration, phishing-resistant MFA enforcement, DLP policies, email authentication (SPF/DKIM/DMARC), OAuth app control, and external sharing restrictions. Activates for requests involving Google Workspace hardening, G Suite security configuration, or cloud office security administration.
    0
    installs
40. ▌
    Implementing Hashicorp Vault Dynamic Secrets · henriquescastilho bundle

    Implements HashiCorp Vault dynamic secrets engines for database credentials, AWS IAM keys, and PKI certificates with automatic generation, lease management, and credential rotation to eliminate static secrets in application configurations. Activates for requests involving Vault secrets engine configuration, dynamic database credentials, ephemeral cloud credentials, or automated secret rotation.
    0
    installs
41. ▌
    Analyzing Typosquatting Domains With Dnstwist · henriquescastilho bundle

    Detect typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations and identify registered lookalike domains targeting your organization.
    0
    installs
42. ▌
    Exploiting Ms17 010 Eternalblue Vulnerability · henriquescastilho bundle

    MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it
    0
    installs
43. ▌
    Implementing Browser Isolation For Zero Trust · henriquescastilho bundle

    Deploys remote browser isolation (RBI) as a core component of a Zero Trust architecture. Implements isolation policies with URL categorization and risk-based routing, content disarming and reconstruction (CDR) for file sanitization, data loss prevention controls within isolated sessions, and integration with Secure Web Gateway and ZTNA platforms. Based on Cloudflare Browser Isolation, Menlo Security, and Zscaler RBI approaches. Use when hardening web access against zero-day exploits, phishing, credential theft, and browser-based data exfiltration.
    0
    installs
44. ▌
    Implementing Ransomware Kill Switch Detection · henriquescastilho bundle

    Detects and exploits ransomware kill switch mechanisms including mutex-based execution guards, domain-based kill switches, and registry-based termination checks. Implements proactive mutex vaccination and kill switch domain monitoring to prevent ransomware from executing. Activates for requests involving ransomware kill switch analysis, mutex vaccination, WannaCry-style domain kill switches, or malware execution guard detection.
    0
    installs
45. ▌
    Performing Brand Monitoring For Impersonation · henriquescastilho bundle

    Monitor for brand impersonation attacks across domains, social media, mobile apps, and dark web channels to detect phishing campaigns, fake sites, and unauthorized brand usage targeting your organization.
    0
    installs
46. ▌
    Performing Cryptographic Audit Of Application · henriquescastilho bundle

    A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardco
    0
    installs
47. ▌
    Building Identity Governance Lifecycle Process · henriquescastilho bundle

    Builds comprehensive identity governance and lifecycle management processes including joiner-mover-leaver automation, role mining, access request workflows, periodic recertification, and orphaned account remediation using IGA platforms. Activates for requests involving identity lifecycle management, JML processes, role-based access provisioning, or identity governance program design.
    0
    installs
48. ▌
    Conducting Social Engineering Penetration Test · henriquescastilho bundle

    Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps.
    0
    installs
49. ▌
    Deploying Decoy Files For Ransomware Detection · henriquescastilho bundle

    Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses strategically placed decoy documents monitored via file integrity monitoring or OS-level watchdogs to trigger alerts when ransomware modifies or encrypts them. Activates for requests involving ransomware canary deployment, honeyfile setup, deception-based ransomware detection, or file integrity monitoring for encryption.
    0
    installs
50. ▌
    Detecting Qr Code Phishing With Email Security · henriquescastilho bundle

    Detect and prevent QR code phishing (quishing) attacks that bypass traditional email security by embedding malicious URLs in QR code images within emails.
    0
    installs
51. ▌
    Implementing Honeypot For Ransomware Detection · henriquescastilho bundle

    Deploys canary files, honeypot shares, and decoy systems to detect ransomware activity at the earliest possible stage. Configures canary tokens embedded in strategic file locations that trigger alerts when ransomware attempts encryption, uses honeypot network shares that mimic high-value targets, and deploys Thinkst Canary appliances for comprehensive deception-based detection. Activates for requests involving ransomware honeypots, canary files, deception technology for ransomware, or early ransomware alerting.
    0
    installs
52. ▌
    Implementing Proofpoint Email Security Gateway · henriquescastilho bundle

    Deploy and configure Proofpoint Email Protection as a secure email gateway to detect and block phishing, malware, BEC, and spam before messages reach user inboxes.
    0
    installs
53. ▌
    Performing Access Recertification With Saviynt · henriquescastilho bundle

    Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SOX, SOC2, and HIPAA.
    0
    installs
54. ▌
    Performing Service Account Credential Rotation · henriquescastilho bundle

    Automate credential rotation for service accounts across Active Directory, cloud platforms, and application databases to eliminate stale secrets and reduce compromise risk.
    0
    installs
55. ▌
    Building Identity Federation With Saml Azure Ad · henriquescastilho bundle

    Establish SAML 2.0 identity federation between on-premises Active Directory and Azure AD (Microsoft Entra ID) for seamless cross-domain authentication and SSO to cloud applications.
    0
    installs
56. ▌
    Implementing Google Workspace Sso Configuration · henriquescastilho bundle

    Configure SAML 2.0 single sign-on for Google Workspace with a third-party identity provider, enabling centralized authentication and enforcing organization-wide access policies.
    0
    installs
57. ▌
    Implementing Identity Governance With Sailpoint · henriquescastilho bundle

    Deploy SailPoint IdentityNow or IdentityIQ for identity governance and administration. Covers identity lifecycle management, access request workflows, certification campaigns, role mining, SOD policy
    0
    installs
58. ▌
    Implementing Zero Trust With Hashicorp Boundary · henriquescastilho bundle

    Implement HashiCorp Boundary for identity-aware zero trust infrastructure access management with dynamic credential brokering, session recording, and Vault integration.
    0
    installs
59. ▌
    Building C2 Infrastructure With Sliver Framework · henriquescastilho bundle

    Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.
    0
    installs
60. ▌
    Building Ransomware Playbook With Cisa Framework · henriquescastilho bundle

    Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Activates for requests involving ransomware response planning, CISA compliance, incident response playbook creation, or ransomware preparedness assessment.
    0
    installs
61. ▌
    Configuring Identity Aware Proxy With Google Iap · henriquescastilho bundle

    Configuring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request identity verification for Compute Engine, App Engine, Cloud Run, and GKE services using access levels, context-aware policies, and programmatic access with service accounts.
    0
    installs
62. ▌
    Exploiting Zerologon Vulnerability Cve 2020 1472 · henriquescastilho bundle

    Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account password to empty.
    0
    installs
63. ▌
    Implementing Mimecast Targeted Attack Protection · henriquescastilho bundle

    Deploy Mimecast Targeted Threat Protection including URL Protect, Attachment Protect, Impersonation Protect, and Internal Email Protect to defend against advanced phishing and spearphishing attacks.
    0
    installs
64. ▌
    Performing Entitlement Review With Sailpoint Iiq · henriquescastilho bundle

    Performs entitlement review and access certification campaigns using SailPoint IdentityIQ including manager certifications, targeted entitlement reviews, role-based access validation, SOD violation remediation, and automated revocation workflows. Activates for requests involving access reviews, entitlement certifications, SailPoint IIQ governance, or periodic user access recertification.
    0
    installs
65. ▌
    Performing Paste Site Monitoring For Credentials · henriquescastilho bundle

    Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using automated scraping and keyword matching to detect breaches early.
    0
    installs
66. ▌
    Detecting AWS Credential Exposure With Trufflehog · henriquescastilho bundle

    Detecting exposed AWS credentials in source code repositories, CI/CD pipelines, and configuration files using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.
    0
    installs
67. ▌
    Implementing Google Workspace Phishing Protection · henriquescastilho bundle

    Configure Google Workspace advanced phishing and malware protection settings including pre-delivery scanning, attachment protection, spoofing detection, and Enhanced Safe Browsing.
    0
    installs
68. ▌
    Implementing Identity Verification For Zero Trust · henriquescastilho bundle

    Implement continuous identity verification for zero trust using phishing-resistant MFA (FIDO2/WebAuthn), risk-based conditional access, and identity governance aligned with the CISA Zero Trust Maturity Model.
    0
    installs
69. ▌
    Reverse Engineering Ransomware Encryption Routine · henriquescastilho bundle

    Reverse engineer ransomware encryption routines to identify cryptographic algorithms, key generation flaws, and potential decryption opportunities using static and dynamic analysis.
    0
    installs
70. ▌
    Implementing Passwordless Auth With Microsoft Entra · henriquescastilho bundle

    Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks. Activates for requests involving passwordless deployment, FIDO2 passkey configuration, phishing-resistant MFA, or Microsoft Entra authentication method policies.
    0
    installs
71. ▌
    Implementing Azure Ad Privileged Identity Management · henriquescastilho bundle

    Configure Microsoft Entra Privileged Identity Management to enforce just-in-time role activation, approval workflows, and access reviews for Azure AD privileged roles.
    0
    installs
72. ▌
    Performing Adversary In The Middle Phishing Detection · henriquescastilho bundle

    Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.
    0
    installs
73. ▌
    Implementing Privileged Access Management With Cyberark · henriquescastilho bundle

    Deploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across enterprise infrastructure. This skill covers vault architecture, session isolation, c
    0
    installs
74. ▌
    Agirails Agent Payments · henriquescastilho

    AGIRAILS — Agent Payment Infrastructure
    0
    installs
75. ▌
    Skill Creator · henriquescastilho bundle

    Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations.
    0
    installs
76. ▌
    Monitoring Darkweb Sources · henriquescastilho bundle

    Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide early warning intelligence. Use when establishing dark web monitoring coverage, investigating specific data breach claims, or enriching incident investigations with dark web context. Activates for requests involving dark web OSINT, leak site monitoring, credential exposure, Recorded Future dark web, or Tor hidden service intelligence.
    0
    installs
77. ▌
    Analyzing Linux Elf Malware · henriquescastilho bundle

    Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.
    0
    installs
78. ▌
    Detecting OAUTH Token Theft · henriquescastilho bundle

    Detects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly detection. Covers access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates for requests involving OAuth token theft detection, token replay prevention, Azure AD conditional access token protection, or cloud identity attack investigation.
    0
    installs
79. ▌
    Securing AWS Iam Permissions · henriquescastilho bundle

    This skill guides practitioners through hardening AWS Identity and Access Management configurations to enforce least privilege access across cloud accounts. It covers IAM policy scoping, permission boundaries, Access Analyzer integration, and credential rotation strategies to reduce the blast radius of compromised identities.
    0
    installs
80. ▌
    Performing Ransomware Response · henriquescastilho bundle

    Executes a structured ransomware incident response from initial detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening. Addresses ransom negotiation considerations, backup integrity verification, and regulatory notification requirements. Activates for requests involving ransomware response, ransomware recovery, crypto-ransomware, data encryption attack, ransom payment decision, or ransomware containment.
    0
    installs
81. ▌
    Detecting Cryptomining In Cloud · henriquescastilho bundle

    This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads.
    0
    installs
82. ▌
    Implementing Saml Sso With Okta · henriquescastilho bundle

    Implement SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP). This skill covers end-to-end configuration of SAML authentication flows, attribute mapping, certificate management, a
    0
    installs
83. ▌
    Auditing Kubernetes Cluster Rbac · henriquescastilho bundle

    Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.
    0
    installs
84. ▌
    Analyzing Disk Image With Autopsy · henriquescastilho bundle

    Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.
    0
    installs
85. ▌
    Deploying Ransomware Canary Files · henriquescastilho bundle

    Deploys and monitors ransomware canary files across critical directories using Python's watchdog library for real-time filesystem event detection. Places strategically named decoy files that mimic high-value targets (financial records, credentials, database exports) in locations ransomware typically enumerates first. Monitors for any read, modify, rename, or delete operations on canary files and triggers immediate alerts via email, Slack webhook, or syslog when interaction is detected, providing early warning before full encryption begins.
    0
    installs
86. ▌
    Detecting Mobile Malware Behavior · henriquescastilho bundle

    Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.
    0
    installs
87. ▌
    Exploiting HTTP Request Smuggling · henriquescastilho bundle

    Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
    0
    installs
88. ▌
    Hunting For Cobalt Strike Beacons · henriquescastilho bundle

    Detect Cobalt Strike beacon network activity using default TLS certificate signatures (serial 8BB00EE), JA3/JA3S/JARM fingerprints, HTTP C2 profile pattern matching, beacon jitter analysis, and named pipe detection via Zeek, Suricata, and Python PCAP analysis.
    0
    installs
89. ▌
    Managing Cloud Identity With Okta · henriquescastilho bundle

    This skill covers implementing Okta as a centralized identity provider for cloud environments, configuring SSO integration with AWS, Azure, and GCP, deploying phishing- resistant MFA with Okta FastPass, managing lifecycle automation for user provisioning and deprovisioning, and enforcing adaptive access policies based on device posture and risk signals.
    0
    installs
90. ▌
    Recovering From Ransomware Attack · henriquescastilho bundle

    Executes structured recovery from a ransomware incident following NIST and CISA frameworks, including environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized system restoration from verified backups, credential reset, and validation against re-infection. Covers Active Directory recovery, database restoration, and application stack rebuild in dependency order. Activates for requests involving ransomware recovery, post-encryption restoration, or disaster recovery from ransomware.
    0
    installs
91. ▌
    Analyzing Indicators Of Compromise · henriquescastilho bundle

    Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.
    0
    installs
92. ▌
    Detecting AWS Cloudtrail Anomalies · henriquescastilho bundle

    Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
    0
    installs
93. ▌
    Analyzing Malicious PDF With Peepdf · henriquescastilho bundle

    Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.
    0
    installs
94. ▌
    Configuring Ldap Security Hardening · henriquescastilho bundle

    Harden LDAP directory services against common attacks including credential harvesting, LDAP injection, anonymous binding, and channel binding bypass. Covers LDAPS enforcement, channel binding, LDAP si
    0
    installs
95. ▌
    Detecting Business Email Compromise · henriquescastilho bundle

    Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors, or trusted partners to trick employees into transferring funds, sharing sensitive data,
    0
    installs
96. ▌
    Hunting Credential Stuffing Attacks · henriquescastilho bundle

    Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins. Uses statistical analysis on Splunk or raw log data. Use when investigating account takeover campaigns or building detection rules for auth abuse.
    0
    installs
97. ▌
    Analyzing Network Packets With Scapy · henriquescastilho bundle

    Craft, send, sniff, and dissect network packets using Scapy for protocol analysis, network reconnaissance, and traffic anomaly detection in authorized security testing
    0
    installs
98. ▌
    Analyzing Ransomware Payment Wallets · henriquescastilho bundle

    Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs. Identifies wallet clusters, tracks fund movement through mixers and exchanges, and supports law enforcement attribution. Activates for requests involving ransomware payment tracing, bitcoin wallet analysis, cryptocurrency forensics, or blockchain intelligence gathering.
    0
    installs
99. ▌
    Building Soc Playbook For Ransomware · henriquescastilho bundle

    Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.
    0
    installs
100. ▌
     Extracting Iocs From Malware Samples · henriquescastilho bundle

     Extracts indicators of compromise (IOCs) from malware samples including file hashes, network indicators (IPs, domains, URLs), host artifacts (file paths, registry keys, mutexes), and behavioral patterns for threat intelligence sharing and detection rule creation. Activates for requests involving IOC extraction, threat indicator harvesting, malware indicator collection, or building detection content from samples.
     0
     installs