{"schemaVersion":1,"builtAt":"2026-10-14T05:00:02.624Z","totalSkills":1011,"skills":[{"id":"401-403-bypass-techniques","summary":"Expert playbook for gaining access to restricted web paths by bypassing 401/403 responses through path manipulation, HTTP method tampering, header spoofing, and protocol version tricks, with a decision tree and tooling.","primaryDomain":"web-security","domainTags":["access-control","http-method-tampering","http-header-injection","path-normalization"],"capabilityTags":["access-control-bypass","path-normalization-bypass","http-method-tampering","header-injection-bypass"],"capabilityDetails":["Provides a systematic workflow for bypassing 401/403 access-denied responses using path manipulation (case, encoding, dot segments, null bytes), HTTP method overrides, URL rewrite and IP spoofing headers, and protocol downgrade tricks."],"techniqueTags":["trailing-slash-bypass","case-sensitivity-bypass","url-encoding-bypass","dot-segment-normalization","null-byte-injection","http-method-override-headers","x-original-url-header","x-forwarded-for-spoofing","http-protocol-downgrade"],"techniqueDetails":["Exploits discrepancies between proxy/WAF path normalization and backend handling, including case-insensitive filesystems, double URL decoding, path parameters, and special characters."],"tools":["byp4xx","403bypasser","dirsearch","feroxbuster","burp-intruder"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Covers a full matrix of path manipulation and HTTP verb/header bypass techniques specific to 401/403 responses, including technology-specific tricks (IIS, Tomcat, Nginx) and a decision tree; distinct from broader authentication bypass or WAF-specific bypass skills."],"familyIds":["http-request-tampering-and-bypass"]},{"id":"abusing-dpapi-for-credential-access","summary":"Operational workflow for extracting and decrypting DPAPI-protected credentials on Windows hosts, including online/offline master key decryption, browser credential extraction, and domain-wide decryption using the DPAPI backup key.","primaryDomain":"windows-security","domainTags":["dpapi","credential-access","active-directory"],"capabilityTags":["dpapi-decryption","credential-harvesting","browser-credential-extraction","domain-backup-key-exploitation"],"capabilityDetails":["Extracts and decrypts DPAPI-protected secrets on Windows hosts, including Credential Manager, browser logins/cookies, RDP/KeePass/certificate secrets, and supports domain-wide decryption via the DPAPI backup key."],"techniqueTags":["online-unprotect","offline-masterkey-decryption","pvk-backup-key","ntlm-hash-decryption","credential-blob-triage"],"techniqueDetails":["Uses CryptUnprotectData online, offline master key decryption with password/NTLM hash, and the domain DPAPI backup key (.pvk) for estate-wide decryption; includes host triage to locate credential blobs."],"tools":["SharpDPAPI","SharpChrome","Mimikatz","Impacket","DonPAPI"],"targetTypes":["windows-host","active-directory"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","post-exploitation"],"distinctiveFeatures":["Focuses solely on DPAPI credential access, distinguishing online/offline/domain-wide decryption paths, and covers both Windows-native tooling and Linux remote triage."],"familyIds":["credential-access-and-dumping"]},{"id":"abusing-shadow-credentials-for-privesc","summary":"Provides a step-by-step AD attack playbook to take over user/computer accounts by writing an attacker public key to msDS-KeyCredentialLink (Shadow Credentials), requesting a TGT with PKINIT, and recovering the target NT hash without password reset, including cleanup and RBCD chaining.","primaryDomain":"active-directory","domainTags":["active-directory","kerberos","credential-access"],"capabilityTags":["shadow-credential-abuse","key-credential-link-write","pkinit-authentication","nt-hash-recovery","account-takeover"],"capabilityDetails":["Writes attacker-controlled public keys to msDS-KeyCredentialLink for target AD accounts.","Requests TGT via PKINIT using the injected credential.","Recovers NT hash from AS-REP without password reset.","Performs cleanup of added Key Credentials.","Can chain computer account takeover into Resource-Based Constrained Delegation."],"techniqueTags":["shadow-credentials","msds-keycredentiallink-modification","pkinit","device-registration-abuse","acl-abuse"],"techniqueDetails":["Abuses GenericWrite/GenericAll/AddKeyCredentialLink ACEs to modify msDS-KeyCredentialLink.","Uses PKINIT to authenticate with a self-signed certificate and obtain TGT.","Employs T1098.005 (Account Manipulation: Device Registration)."],"tools":["pyWhisker","Whisker","Certipy","PKINITtools","NetExec","impacket-rbcd"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["exploitation","post-exploitation","validation"],"distinctiveFeatures":["Single-purpose playbook for Shadow Credentials rather than a general AD privesc skill.","Covers full chain from write-ACE confirmation to NT hash recovery and cleanup.","Includes automated one-shot via Certipy and manual PKINITtools path.","Emphasizes stealth by avoiding password resets."],"familyIds":["active-directory-acl-abuse-analysis"]},{"id":"achieving-cmmc-level-2-compliance","summary":"A practical playbook for defense contractors to achieve CMMC Level 2: determines applicability, scopes the CUI boundary, implements NIST SP 800-171 Rev 2 controls across 14 families, computes the SPRS score using DoD weighting, builds a 180-day-closable POA&M, and prepares for C3PAO assessment.","primaryDomain":"security-knowledge","domainTags":["compliance","nist-800-171","cmmc","cui","sprs","dfars","governance"],"capabilityTags":["cmmc-level-2-compliance","sprs-scoring","poam-management","ssp-authoring","c3pao-assessment-readiness"],"capabilityDetails":["Provides a workflow for achieving CMMC Level 2 certification: scoping CUI and FCI, implementing the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, computing the SPRS score with the DoD Assessment Methodology, building a compliant POA&M, and preparing for a C3PAO assessment."],"techniqueTags":["nist-sp-800-171","dod-assessment-methodology","cmmc-scoping","sprs-scoring","poam-eligibility"],"techniqueDetails":["Uses the DoD Assessment Methodology's 1/3/5-point weighting to compute SPRS scores from a baseline of 110.","Applies CMMC scoping categories (CUI assets, security protection assets, contractor risk managed assets, specialized assets, out-of-scope) to define the assessment boundary.","Leverages POA&M eligibility rules under 32 CFR Part 170, including the 80% threshold for Conditional status and 180-day closure for Final status."],"tools":["NIST SP 800-171 Rev 2","DoD NIST SP 800-171 Assessment Methodology","SPRS","eMASS","32 CFR Part 170","GRC tooling (e.g., Xacta, RegScale)"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["remediation","validation","reporting","analysis"],"distinctiveFeatures":["Focuses specifically on achieving CMMC Level 2 certification for defense contractors, including the DoD-specific SPRS scoring methodology, CMMC scoping categories, and POA&M eligibility constraints under 32 CFR Part 170.","Distinct from general compliance frameworks by providing a step-by-step readiness workflow with concrete thresholds (e.g., score ≥88 for Conditional) and C3PAO assessment preparation."],"familyIds":["compliance-governance"]},{"id":"acquiring-disk-image-with-dd-and-dcfldd","summary":"Creates forensically sound bit-for-bit disk images using dd or dcfldd on Linux, with write-blocking, hash verification (MD5/SHA), and documentation for legal or incident response use.","primaryDomain":"forensics","domainTags":["disk-imaging","evidence-acquisition","digital-forensics"],"capabilityTags":["disk-imaging","hash-verification","evidence-preservation","write-blocking"],"capabilityDetails":["Provides a step-by-step workflow for creating forensically sound bit-for-bit disk images using dd or dcfldd, including write-blocking, hash verification, and documentation for legal and incident response use."],"techniqueTags":["bit-for-bit-copy","write-blocking","split-imaging","compressed-imaging","remote-acquisition"],"techniqueDetails":["Uses dd/dcfldd with conv=noerror,sync to create exact replicas including unallocated space, and verifies integrity with SHA-256/MD5 hashes before and after acquisition."],"tools":["dd","dcfldd","sha256sum","blockdev","hdparm","smartctl","lsblk","dc3dd"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","reporting"],"distinctiveFeatures":["Specialist playbook focused specifically on creating forensically sound raw disk images with dd/dcfldd, including write-blocking and hash verification, distinct from general forensics analysis or memory acquisition."],"familyIds":["disk-forensic-acquisition"]},{"id":"active-directory-acl-abuse","summary":"Expert playbook for abusing Active Directory ACL/ACE misconfigurations, using BloodHound to identify paths and executing attacks such as GenericAll, WriteDACL, DCSync, shadow credentials, LAPS, and GPO abuse.","primaryDomain":"active-directory","domainTags":["active-directory","windows-security","acl-abuse"],"capabilityTags":["bloodhound-enumeration","acl-exploitation","dcsync","shadow-credentials","laps-access","gpo-abuse"],"capabilityDetails":["Provides a workflow for enumerating AD ACLs and exploiting misconfigured permissions such as GenericAll, WriteDACL, WriteOwner, ForceChangePassword, AddMember, and replication rights.","Includes techniques for shadow credentials, LAPS password reading, and GPO abuse."],"techniqueTags":["genericall","writedacl","writeowner","forcechangepassword","addmember","dcsync","shadow-credentials","targeted-kerberoasting","laps","gpo"],"techniqueDetails":["Details commands for each ACE type, including password resets, SPN manipulation, RBCD, and DACL modifications.","Covers DCSync execution via secretsdump and Mimikatz, shadow credential attacks with pywhisker/Whisker, LAPS retrieval, and GPO exploitation with SharpGPOAbuse/pyGPOAbuse."],"tools":["BloodHound","SharpHound","bloodhound-python","PowerView","Impacket","secretsdump","dacledit","rbcd.py","pywhisker","Whisker","Rubeus","CrackMapExec","SharpGPOAbuse","pygpoabuse","rpcclient"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","analysis","exploitation"],"distinctiveFeatures":["Focuses exclusively on ACL/ACE-based privilege escalation in Active Directory, including DCSync, shadow credentials, LAPS, and GPO abuse.","Provides a decision tree mapping BloodHound findings to specific exploitation commands."],"familyIds":["active-directory-acl-abuse-analysis"]},{"id":"active-directory-certificate-services","summary":"A comprehensive attack playbook for Active Directory Certificate Services, guiding penetration testers through ESC1-ESC13 template abuses, CA misconfigurations, NTLM relay to enrollment endpoints, and certificate-based persistence, from enumeration to domain compromise.","primaryDomain":"active-directory","domainTags":["ad-cs","certificate-services","windows-security"],"capabilityTags":["adcs-attack","certificate-template-abuse","privilege-escalation","certificate-persistence","ntlm-relay-to-enrollment"],"capabilityDetails":["Provides a comprehensive playbook for attacking Active Directory Certificate Services, covering ESC1-ESC13 template abuse, CA misconfigurations, NTLM relay to enrollment endpoints, and certificate-based persistence."],"techniqueTags":["esc1","esc2","esc3","esc4","esc6","esc7","esc8","esc9","esc10","esc11","esc13","golden-certificate","ntlm-relay"],"techniqueDetails":["Covers specific ESC conditions and exploitation steps for each variant, including SAN specification, EKU abuse, enrollment agent, template ACL modification, CA flag manipulation, NTLM relay to HTTP/RPC, weak certificate mapping, OID group links, and golden certificate forgery."],"tools":["certipy","certify","ldapsearch","ntlmrelayx","petitpotam","forgecert","certutil"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","post-exploitation"],"distinctiveFeatures":["Comprehensive single-playbook coverage of ESC1-ESC13 along with CA misconfiguration attacks, NTLM relay to enrollment endpoints, and golden certificate persistence; includes an AD CS attack decision tree for selecting the appropriate escalation path."],"familyIds":["ad-cs-abuse-and-exploitation"]},{"id":"active-directory-kerberos-attacks","summary":"Expert Kerberos attack playbook for Active Directory: AS-REP roasting, Kerberoasting, golden/silver/diamond/sapphire ticket forging, delegation abuse (unconstrained/constrained/RBCD), pass-the-ticket, and overpass-the-hash, with a decision tree and cross-links to related AD attack skills.","primaryDomain":"active-directory","domainTags":["active-directory","kerberos","windows-security"],"capabilityTags":["as-rep-roasting","kerberoasting","ticket-forging","delegation-abuse","pass-the-ticket"],"capabilityDetails":["Provides an expert playbook for attacking Kerberos in Active Directory environments.","Covers user enumeration for AS-REP roasting and SPN targeting for Kerberoasting.","Includes forging golden, silver, diamond, and sapphire tickets, as well as using them for persistence and lateral movement."],"techniqueTags":["golden-ticket","silver-ticket","diamond-ticket","sapphire-ticket","unconstrained-delegation","constrained-delegation","resource-based-constrained-delegation","overpass-the-hash"],"techniqueDetails":["AS-REP roasting: requests TGTs for users with preauthentication disabled and cracks them.","Kerberoasting: requests TGS for accounts with SPNs and cracks the service ticket hashes.","Golden ticket: forges TGT using krbtgt hash for full domain impersonation.","Silver ticket: forges TGS using service account hash for targeted service access.","Diamond ticket: modifies a legitimate TGT to evade detection.","Sapphire ticket: leverages S4U2Self to obtain a genuine PAC for forging.","Delegation attacks: exploits unconstrained, constrained, and resource-based constrained delegation to obtain service tickets.","Pass-the-ticket and overpass-the-hash: reuse or synthesize Kerberos tickets to authenticate without passwords."],"tools":["impacket","rubeus","mimikatz","powerview","hashcat","john"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","post-exploitation"],"distinctiveFeatures":["Distinguishes between golden, silver, diamond, and sapphire tickets, explaining detection-evasion trade-offs for each.","Details delegation attack chains including unconstrained, constrained, and resource-based constrained delegation, with step-by-step examples.","Includes a Kerberos attack decision tree to help select the right technique based on current access levels.","Cross-references other AD attack skills (ACL abuse, ADCS, NTLM relay, lateral movement) and a companion attack chains document."],"familyIds":["kerberos-attack-and-ticket-abuse"]},{"id":"ai-ml-security","summary":"Offensive playbook for assessing AI/ML systems: covers malicious model files (pickle RCE), Hugging Face poisoning, adversarial examples (FGSM/PGD/C&W), data poisoning, model extraction, privacy attacks, LLM data extraction, and autonomous agent security, with a decision tree for assessment scoping.","primaryDomain":"general-pentesting","domainTags":["ai-ml-security","model-security","llm-security","supply-chain-security"],"capabilityTags":["model-supply-chain-attack","adversarial-example-generation","model-poisoning","model-extraction","data-privacy-attack","llm-security-testing","agent-security-assessment"],"capabilityDetails":["Provides workflow for identifying and exploiting malicious ML model files, including pickle deserialization RCE.","Details methods for generating adversarial examples (FGSM, PGD, C&W) to test model robustness.","Covers training data poisoning, label flipping, and federated learning gradient manipulation.","Describes query-based model extraction and side-channel attacks on ML APIs.","Includes membership inference, model inversion, and gradient leakage privacy attacks.","Extends to LLM training data extraction and autonomous agent permission escalation."],"techniqueTags":["pickle-rce","trust-remote-code-abuse","dependency-confusion","fgsm","pgd","carlini-wagner","adversarial-patch","label-flipping","gradient-manipulation","query-based-extraction","side-channel-analysis","membership-inference","model-inversion","gradient-leakage","training-data-extraction","agent-prompt-injection"],"techniqueDetails":["Pickle files execute arbitrary code via __reduce__ during deserialization.","FGSM adds epsilon-signed gradient perturbation to fool classifiers.","PGD iteratively projects adversarial perturbations within an epsilon ball.","C&W optimization finds minimal perturbations for targeted misclassification.","Membership inference uses confidence scores to determine if a sample was in training data.","Model inversion optimizes inputs to recover representative training data.","Gradient leakage reconstructs training data from shared gradient updates.","Query-based extraction trains a surrogate model on API outputs."],"tools":["ART","CleverHans","Fickling","ModelScan","NB Defense","Garak","PyRIT","Rebuff"],"targetTypes":["api","web-application","cloud","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","exploitation"],"distinctiveFeatures":["Covers AI/ML-specific attack classes beyond standard web/network testing: pickle RCE, adversarial examples, model poisoning/extraction, privacy attacks, LLM and agent security.","Provides a decision tree for scoping AI/ML security assessments across supply chain, model, data, and usage layers."],"familyIds":["ai-ml-security-testing"]},{"id":"analyzing-active-directory-acl-abuse","summary":"Detect and analyze dangerous Active Directory ACL misconfigurations by querying AD with ldap3, parsing security descriptors to SDDL, and identifying non-admin principals with GenericAll, WriteDACL, WriteOwner, or GenericWrite permissions, mapping them to attack paths and remediation.","primaryDomain":"active-directory","domainTags":["active-directory","access-control","permissions-audit"],"capabilityTags":["acl-abuse-detection","sddl-parsing","dangerous-permission-analysis"],"capabilityDetails":["Provides a step-by-step workflow to identify dangerous Active Directory ACL misconfigurations (GenericAll, WriteDACL, WriteOwner, GenericWrite) by parsing nTSecurityDescriptor to SDDL and analyzing ACEs."],"techniqueTags":["ldap-enumeration","access-mask-analysis","sid-resolution"],"techniqueDetails":["Uses ldap3 to query AD objects, converts binary security descriptors to SDDL, parses DACL ACEs, resolves SIDs, and matches access masks against known dangerous permissions."],"tools":["ldap3"],"targetTypes":["active-directory"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Specialized in parsing raw nTSecurityDescriptor binary data to SDDL for ACL analysis, rather than relying on existing tools like BloodHound","Filters out expected admin trustees to focus on non-privileged principals holding dangerous permissions","Maps each dangerous ACE to concrete attack paths and remediation steps"],"familyIds":["active-directory-acl-abuse-analysis"]},{"id":"analyzing-android-malware-with-apktool","summary":"Static analysis workflow for Android APK malware using androguard, apktool, and jadx to extract manifest permissions, components, suspicious API calls, and IOCs without execution.","primaryDomain":"mobile-security","domainTags":["android-security","apk-analysis","malware-analysis"],"capabilityTags":["static-analysis","apk-triage","permission-analysis","ioc-extraction"],"capabilityDetails":["Provides a workflow for static analysis of Android APK malware using androguard, apktool, and jadx to extract manifest metadata, permissions, components, suspicious API calls, and potential IOCs without executing the sample."],"techniqueTags":["manifest-analysis","dangerous-permission-detection","obfuscation-detection","dynamic-code-loading-detection","reflection-detection"],"techniqueDetails":["Uses androguard to parse the APK manifest and enumerate requested permissions.","Flags dangerous permission combinations and suspicious API patterns.","Detects dynamic code loading and reflection-based API calls in static analysis."],"tools":["apktool","jadx","androguard"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Combines androguard for programmatic analysis with apktool/jadx for decompilation, focusing on Android-specific static malware triage and risk assessment with MITRE ATT&CK mappings."],"familyIds":["mobile-malware-analysis"]},{"id":"analyzing-api-gateway-access-logs","summary":"Structured workflow to parse API gateway access logs with pandas and detect BOLA/IDOR, rate limit bypass, credential scanning, and injection attempts for security operations.","primaryDomain":"api-security","domainTags":["bola","idor","rate-limit-bypass","credential-scanning","injection-detection","access-log-analysis"],"capabilityTags":["api-access-log-analysis","bola-detection","rate-limit-bypass-detection","credential-scanning-detection","injection-attempt-detection","anomaly-detection"],"capabilityDetails":["Provides a workflow for parsing API gateway access logs to detect BOLA/IDOR, rate limit bypass, credential scanning, and injection attempts using statistical analysis with pandas."],"techniqueTags":["access-log-parsing","statistical-analysis","pattern-detection","groupby-aggregation","status-code-analysis"],"techniqueDetails":["Uses pandas groupby to compute unique resource IDs per user/endpoint to identify sequential enumeration.","Aggregates 401 status codes by source IP to identify credential scanning."],"tools":["python","pandas"],"targetTypes":["api"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Specifically targets API gateway access logs (AWS API Gateway, Kong, Nginx) rather than general web server logs or network traffic.","Focuses on BOLA/IDOR detection from resource ID enumeration patterns in logs.","Provides a statistical approach using pandas for anomaly detection in API request patterns."],"familyIds":["api-attack-detection-and-log-analysis"]},{"id":"analyzing-apt-group-with-mitre-navigator","summary":"Practical workflow for using ATT&CK data APIs and Navigator layer JSON to map an APT group's TTPs, compare multiple groups, and visually identify detection gaps for threat-informed defense.","primaryDomain":"security-knowledge","domainTags":["mitre-attack","threat-intelligence","apt-analysis","detection-engineering","navigator"],"capabilityTags":["ttp-mapping","navigator-layer-generation","apt-group-comparison","detection-gap-analysis","threat-intel-visualization"],"capabilityDetails":["Provides a Python-based workflow to query MITRE ATT&CK data for APT groups, generate ATT&CK Navigator layer JSON files, compare technique coverage across multiple groups, and create heatmap overlays for detection-gap analysis."],"techniqueTags":["attack-data-querying","navigator-layer-creation","set-intersection-analysis","heatmap-overlay","tactic-breakdown"],"techniqueDetails":["Uses attackcti to retrieve ATT&CK group objects and associated techniques, constructs layer JSON per Navigator format, performs set operations to identify common/unique techniques, and uses color-coded gradients to distinguish detected vs. gap techniques."],"tools":["attackcti","mitreattack-python","stix2","ATT&CK Navigator"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Specializes in programmatic generation and overlay of MITRE ATT&CK Navigator layers for APT-group TTP mapping and detection-gap identification, rather than manual Navigator usage or general MITRE ATT&CK navigation."],"familyIds":["mitre-attack-ttp-analysis-structuring"]},{"id":"analyzing-azure-activity-logs-for-threats","summary":"Enables security analysts to investigate Azure activity and sign-in logs using KQL to detect privilege escalation, impossible travel, and suspicious resource modifications, with practical Python code using azure-monitor-query.","primaryDomain":"cloud-security","domainTags":["azure","azure-monitor","kql","activity-logs"],"capabilityTags":["threat-hunting","log-analysis","detection","kql-querying"],"capabilityDetails":["Provides a workflow to execute KQL queries against Azure Monitor Log Analytics workspaces for detecting suspicious administrative operations, impossible travel, privilege escalation, and resource modifications."],"techniqueTags":["kql-querying","log-correlation","impossible-travel-detection","privilege-escalation-detection"],"techniqueDetails":["Uses KQL to query and correlate Activity Logs and Sign-in Logs, identifying anomalies such as new Global Admin role assignments and sign-ins from unusual locations."],"tools":["azure-monitor-query"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Tailored specifically to Azure Activity and Sign-in Logs for threat hunting, with ready-to-use KQL detection queries for Azure-specific attack patterns.","Integrated with NIST CSF and MITRE ATT&CK mappings for cloud security monitoring."],"familyIds":["cloud-threat-detection-and-hunting"]},{"id":"analyzing-bootkit-and-rootkit-samples","summary":"Provides a specialized workflow for analyzing bootkits and rootkits that persist below the OS, covering MBR/VBR acquisition and disassembly, UEFI firmware extraction and module inspection, kernel rootkit detection via memory forensics, and boot chain integrity verification, with guidance for attributing samples to known families and remediating firmware-level infections.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","bootkit","rootkit","uefi-security","windows-security"],"capabilityTags":["mbr-analysis","uefi-firmware-analysis","rootkit-detection","kernel-memory-forensics"],"capabilityDetails":["Provides a specialized workflow for acquiring and analyzing MBR/VBR boot sectors, UEFI firmware volumes, and kernel memory artifacts to detect and attribute bootkits and rootkits.","Covers below-OS persistence mechanisms that survive OS reinstallation and evade conventional AV/EDR."],"techniqueTags":["16-bit-disassembly","uefi-volume-extraction","spi-flash-dump","ssdt-hook-detection","boot-signature-comparison","secure-boot-bypass-check"],"techniqueDetails":["Uses ndisasm/Ghidra to disassemble real-mode MBR code and identify malicious modifications.","Uses UEFITool to extract and inventory UEFI modules, comparing GUIDs and sizes against vendor baselines.","Uses Volatility 3 plugins to detect SSDT/IDT hooks, hidden processes, callbacks, and unsigned drivers.","Verifies boot chain integrity with sigcheck and Secure Boot configuration checks."],"tools":["UEFITool","chipsec","Volatility 3","Ghidra","dd","sigcheck","yara","GMER"],"targetTypes":["windows-host","binary","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation"],"distinctiveFeatures":["Focuses on below-OS persistence (MBR/VBR/UEFI) rather than general user-mode malware analysis.","Combines disk sector acquisition, firmware extraction, kernel memory forensics, and boot-chain integrity verification in one workflow.","Explicitly addresses known UEFI bootkit families (LoJax, BlackLotus, CosmicStrand, MoonBounce, ESPecter) and Secure Boot bypass techniques."],"familyIds":["firmware-bootkit-and-rootkit-analysis"]},{"id":"analyzing-browser-forensics-with-hindsight","summary":"Provides a practical workflow to parse Chromium-based browser profiles using Hindsight, extracting and correlating forensic artifacts into unified timelines for incident response and user activity reconstruction.","primaryDomain":"forensics","domainTags":["browser-forensics","chromium-forensics"],"capabilityTags":["browser-artifact-extraction","unified-timeline-generation","browser-profile-analysis"],"capabilityDetails":["Extracts and correlates browsing history, downloads, cookies, cache, autofill, saved passwords, and extensions from Chromium-based browser profiles."],"techniqueTags":["sqlite-querying","timestamp-conversion","artifact-correlation"],"techniqueDetails":["Uses Hindsight and direct SQLite queries against History, Cookies, Web Data, and Login Data databases; converts WebKit timestamps to UTC; correlates artifacts into a unified timeline."],"tools":["hindsight","sqlite3"],"targetTypes":["windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["analysis","enumeration","reporting"],"distinctiveFeatures":["Specializes exclusively in Chromium-based browser forensics with Hindsight, covering multiple browsers (Chrome, Edge, Brave, Opera, Vivaldi) and producing a unified artifact timeline in XLSX/JSON/SQLite output."],"familyIds":["browser-forensics"]},{"id":"analyzing-campaign-attribution-evidence","summary":"Provides a structured Python-based workflow for analyzing cyber-campaign evidence and assigning confidence-weighted threat actor attribution using the Diamond Model, ACH hypothesis testing, infrastructure overlap, TTP comparison, and reporting.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","campaign-analysis","attribution","diamond-model","ach"],"capabilityTags":["attribution-analysis","evidence-evaluation","confidence-scoring","hypothesis-testing"],"capabilityDetails":["Provides a systematic workflow to evaluate campaign evidence and attribute operations to threat actors with confidence levels."],"techniqueTags":["diamond-model","analysis-of-competing-hypotheses","infrastructure-overlap","ttp-similarity","confidence-scoring"],"techniqueDetails":["Uses Diamond Model dimensions to organize evidence; ACH to weigh competing hypotheses; compares infrastructure, TTPs, code, timing/language artifacts."],"tools":["attackcti","stix2","networkx","MISP","OpenCTI"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","validation","reporting"],"distinctiveFeatures":["Specializes in confidence-weighted threat actor attribution using ACH rather than generic threat intel enrichment.","Combines Diamond Model categories with quantitative scoring and Python automation.","Addresses false flags and alternative hypotheses explicitly."],"familyIds":["threat-campaign-analysis-attribution"]},{"id":"analyzing-certificate-transparency-for-phishing","summary":"Practical workflow for detecting phishing domains and lookalike certificates via Certificate Transparency logs, using crt.sh for historical querying and Certstream for real-time alerts.","primaryDomain":"reconnaissance","domainTags":["certificate-transparency","phishing-detection","threat-intelligence","domain-monitoring","ssl-tls"],"capabilityTags":["ct-log-querying","real-time-certstream-monitoring","phishing-domain-detection","subdomain-enumeration","lookalike-domain-alerting"],"capabilityDetails":["Provides a dual-mode workflow for detecting phishing domains using Certificate Transparency: historical queries via crt.sh and real-time monitoring via Certstream, including subdomain enumeration and report generation."],"techniqueTags":["crt-sh-api","certstream-websocket","levenshtein-similarity","keyword-matching","tldextract-domain-parsing"],"techniqueDetails":["Uses crt.sh JSON API for historical certificate queries and Certstream WebSocket for real-time certificate updates; flags suspicious domains via exact keyword matches, brand keywords, and Levenshtein distance-based typosquatting detection."],"tools":["crt.sh","Certstream","Python","tldextract","Levenshtein"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","detection","analysis","reporting"],"distinctiveFeatures":["Combines historical crt.sh queries with real-time Certstream streaming for continuous phishing domain monitoring, covering certificate issuance from multiple angles with automatic typo-squatting detection."],"familyIds":["certificate-transparency-monitoring"]},{"id":"analyzing-cloud-storage-access-patterns","summary":"Provides a structured procedure for detecting anomalous access to cloud object storage by analyzing audit-log data events and establishing baselines for request volume, source IPs, and API call patterns.","primaryDomain":"cloud-security","domainTags":["cloud-storage","aws-s3","gcs","azure-blob-storage","cloudtrail"],"capabilityTags":["cloud-storage-access-analysis","anomaly-detection","exfiltration-detection","audit-log-analysis"],"capabilityDetails":["Provides a structured workflow for analyzing access patterns in AWS S3, GCS, and Azure Blob Storage using audit logs.","Builds request-volume and source-IP baselines to identify anomalous behavior."],"techniqueTags":["statistical-baselining","time-series-anomaly-detection","source-ip-history","bulk-download-detection"],"techniqueDetails":["Uses hourly request volume and per-user object counts to detect after-hours bulk downloads.","Flags new source IPs absent from the prior 30-day history.","Identifies ListBucket enumeration spikes as reconnaissance indicators."],"tools":["boto3","aws-cli","requests"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Cross-cloud coverage of AWS S3, GCS, and Azure Blob Storage for storage access anomaly detection.","Combines statistical baselines with threshold-based detection rules rather than simple IP blocklists."],"familyIds":["cloud-threat-detection-and-hunting"]},{"id":"analyzing-cobalt-strike-beacon-configuration","summary":"Provides a structured workflow for extracting and analyzing Cobalt Strike beacon configurations from PE files and memory dumps, enabling identification of C2 infrastructure, malleable C2 profiles, and operator tradecraft. Includes automated parsing with dissect.cobaltstrike, manual XOR decryption, YARA rule generation, and network signature creation.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","cobalt-strike","c2-infrastructure","configuration-extraction"],"capabilityTags":["beacon-config-extraction","c2-indicator-extraction","malleable-c2-profile-analysis","yara-rule-generation"],"capabilityDetails":["Extracts Cobalt Strike beacon configuration from PE files, shellcode, and memory dumps using automated parsers and manual XOR decryption.","Identifies C2 server addresses, ports, protocols, user agents, sleep/jitter settings, and watermark identifiers.","Analyzes malleable C2 profiles to understand HTTP request/response transformations.","Generates YARA rules and network signatures for detection and threat hunting."],"techniqueTags":["xor-decryption","tlv-parsing","static-analysis","yara-scanning"],"techniqueDetails":["Uses single-byte XOR key (0x69 for v3, 0x2e for v4) to decode configuration blob.","Parses Type-Length-Value entries from the decoded config to extract fields.","Uses YARA rules to detect beacon presence in packed and unpacked samples.","Correlates extracted C2 profile with network traffic to validate indicators."],"tools":["dissect.cobaltstrike","CobaltStrikeParser","yara-python","Volatility3","Wireshark","pefile"],"targetTypes":["binary","windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focused exclusively on Cobalt Strike beacon configuration extraction and analysis, not general malware analysis.","Covers both automated parsing with dissect.cobaltstrike and manual XOR/TLV decoding for deeper understanding.","Includes generation of YARA rules and network signatures from extracted configuration."],"familyIds":["malware-c2-and-configuration-extraction"]},{"id":"analyzing-cobaltstrike-malleable-c2-profiles","summary":"Provides a structured workflow for reverse-engineering Cobalt Strike Malleable C2 profiles, extracting actionable network IOCs and generating detection rules for C2 traffic.","primaryDomain":"reverse-engineering","domainTags":["cobalt-strike","c2-analysis","malware-analysis","network-detection"],"capabilityTags":["malleable-c2-profile-parsing","c2-indicator-extraction","detection-signature-generation","beacon-config-analysis"],"capabilityDetails":["Parses Malleable C2 profiles and beacon payloads to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection settings.","Generates Suricata/Snort-compatible detection signatures from extracted network indicators."],"techniqueTags":["ast-parsing","config-extraction","network-signature-generation","threat-intelligence-comparison"],"techniqueDetails":["Uses dissect.cobaltstrike for profile and payload parsing, and pyMalleableC2 for AST-based profile manipulation.","Extracts HTTP GET/POST transforms, DNS settings, and process injection methods."],"tools":["dissect.cobaltstrike","pyMalleableC2","suricata","snort","python"],"targetTypes":["other","network"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Dual-library approach specifically for Cobalt Strike Malleable C2 profile reverse-engineering, with output tailored to network signature generation."],"familyIds":["malware-c2-and-configuration-extraction"]},{"id":"analyzing-command-and-control-communication","summary":"Provides a detailed workflow for reverse-engineering malware command-and-control communication from PCAPs, including beacon detection, protocol decoding, C2 framework identification, infrastructure mapping, and creation of Suricata/network detection signatures.","primaryDomain":"network-security","domainTags":["command-and-control","malware-analysis","network-traffic-analysis","protocol-analysis"],"capabilityTags":["c2-protocol-analysis","beacon-pattern-analysis","c2-framework-identification","c2-infrastructure-mapping","network-detection-signature-generation"],"capabilityDetails":["Provides a step-by-step workflow for reverse-engineering malware C2 communication from PCAPs, covering beacon detection, protocol decoding, framework identification, infrastructure mapping, and generation of network detection signatures."],"techniqueTags":["beacon-interval-analysis","protocol-decoding","ja3-fingerprinting","dns-tunneling-analysis","suricata-rule-writing","pcap-analysis"],"techniqueDetails":["Uses statistical analysis of TCP connection intervals to detect beaconing, decodes HTTP/DNS/custom protocols with Python libraries, matches JA3/JA3S fingerprints and URI patterns to known C2 frameworks, and builds Suricata rules for observed C2 behavior."],"tools":["wireshark","tshark","scapy","dpkt","requests","shodan","censys","virustotal","suricata","cobalt-strike-parser","rita","ghidra"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Comprehensive C2 protocol reverse-engineering workflow from PCAP to detection signatures","Includes beacon interval statistical analysis with jitter calculation","Covers multiple C2 transports: HTTP/S, DNS, custom TCP/UDP, ICMP, WebSocket, cloud services, and email","Provides framework fingerprinting for Cobalt Strike, Metasploit, Sliver, Covenant, and PoshC2, including beacon config extraction","Generates Suricata rules based on beacon patterns, JA3 hashes, DNS characteristics, and certificate subject"],"familyIds":["malware-c2-and-exfiltration-analysis"]},{"id":"analyzing-cyber-kill-chain","summary":"Enables post-incident analysts to map adversary actions to the seven Lockheed Martin Kill Chain phases, assess where defenses succeeded or failed, and generate a structured report with per-phase courses of action and prioritized control improvements.","primaryDomain":"security-knowledge","domainTags":["kill-chain","threat-intelligence","intrusion-analysis"],"capabilityTags":["kill-chain-analysis","phase-mapping","detection-gap-analysis","course-of-action-identification"],"capabilityDetails":["Provides a structured workflow for mapping observed intrusion activity to the seven Lockheed Martin Kill Chain phases.","Identifies phase completion, detection gaps, and applicable defensive courses of action to interrupt future attacks."],"techniqueTags":["phase-mapping","mitre-attack-integration","course-of-action-analysis"],"techniqueDetails":["Uses phase-specific indicators to determine which kill chain phases an adversary completed.","Maps each kill chain phase to MITRE ATT&CK tactics for technique-level granularity and detection correlation."],"tools":["MITRE ATT&CK Navigator","Elastic Security EQL","Splunk ES","MISP"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Focuses specifically on post-incident kill chain mapping and defensive gap analysis rather than offensive operations.","Provides a full courses of action taxonomy (detect, deny, disrupt, degrade, deceive, destroy) for each phase.","Explicitly distinguishes the 7-phase kill chain from MITRE ATT&CK tactics to avoid analytic confusion."],"familyIds":["threat-campaign-analysis-attribution"]},{"id":"analyzing-disk-image-with-autopsy","summary":"Provides a complete workflow for forensic analysis of disk images using Autopsy and The Sleuth Kit, covering deleted file recovery, keyword searching, metadata extraction, timeline reconstruction, and report generation for investigations.","primaryDomain":"forensics","domainTags":["disk-analysis","file-recovery","artifact-analysis","autopsy","sleuth-kit"],"capabilityTags":["disk-image-analysis","deleted-file-recovery","keyword-search","timeline-analysis","report-generation","artifact-extraction"],"capabilityDetails":["Provides a comprehensive workflow for forensic analysis of raw, E01, or AFF disk images using Autopsy and The Sleuth Kit, including deleted file recovery, metadata extraction, keyword searching, timeline construction, and visual HTML report generation."],"techniqueTags":["partition-analysis","deleted-inode-recovery","file-signature-search","hash-lookup","mactime-bodyfile","keyword-indexing"],"techniqueDetails":["Uses mmls for partition layout, fls for listing deleted files, icat for inode-based file recovery, mactime for timeline generation, srch_strings for keyword extraction, and sigfind for file signature search."],"tools":["autopsy","sleuthkit","fls","icat","mactime","mmls","sigfind","srch_strings"],"targetTypes":["windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection","validation","reporting"],"distinctiveFeatures":["Combines GUI-based Autopsy case management with a full suite of Sleuth Kit CLI commands; includes configuration of ingest modules, deleted file recovery, keyword/signature searching, timeline reconstruction, and stakeholder-ready HTML reports."],"familyIds":["disk-and-file-system-forensics"]},{"id":"analyzing-dns-logs-for-exfiltration","summary":"Detects DNS-based exfiltration, tunneling, DGA, and C2 by analyzing DNS logs with entropy, subdomain length, and query volume anomaly heuristics, providing actionable Splunk queries and an investigation workflow for SOC teams.","primaryDomain":"network-security","domainTags":["dns-security","exfiltration","threat-detection","c2-detection"],"capabilityTags":["dns-log-analysis","dns-tunneling-detection","dga-detection","anomaly-detection"],"capabilityDetails":["Provides a step-by-step workflow for analyzing DNS logs to detect data exfiltration via DNS tunneling, DGA domains, and covert C2 channels.","Includes executable Splunk queries, Python-based Shannon entropy calculation, and SIEM correlation techniques."],"techniqueTags":["entropy-analysis","subdomain-length-analysis","query-volume-anomaly","txt-record-abuse","doh-detection"],"techniqueDetails":["Uses Shannon entropy to flag high-randomness domains and subdomains.","Flags subdomains longer than 50 characters as potential tunneling.","Uses z-score to detect abnormal DNS query volume per host.","Detects excessive TXT record usage as a tunneling indicator.","Identifies DoH traffic to public resolvers over port 443."],"tools":["Splunk","Zeek","Cisco Umbrella","Infoblox","Farsight DNSDB"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Specializes specifically in DNS-based exfiltration and C2 detection, combining multiple heuristics (entropy, subdomain length, volume) with ready-to-use SIEM queries.","Provides both Splunk SPL and Python implementations for entropy analysis, enabling direct operational use."],"familyIds":["malware-c2-and-exfiltration-analysis"]},{"id":"analyzing-docker-container-forensics","summary":"Provides a structured incident response workflow for investigating compromised Docker containers, including evidence preservation, image layer analysis, host artifact examination, filesystem change detection, and vulnerability scanning.","primaryDomain":"forensics","domainTags":["container-forensics","docker","incident-response"],"capabilityTags":["docker-evidence-preservation","container-image-analysis","filesystem-change-analysis","container-config-auditing"],"capabilityDetails":["Provides a step-by-step incident response workflow for investigating compromised Docker containers, including evidence preservation, image layer analysis, host artifact examination, filesystem change detection, and vulnerability scanning."],"techniqueTags":["docker-layer-analysis","container-diffing","docker-config-inspection","vulnerability-scanning","filesystem-walk"],"techniqueDetails":["Uses dive and container-diff to inspect image layers and compare with base images.","Uses docker diff to identify added, changed, and deleted files in the container filesystem.","Parses docker inspect output to flag privileged mode, dangerous capabilities, sensitive host mounts, and exposed secrets.","Uses Trivy to scan images and filesystems for known vulnerabilities and secrets."],"tools":["docker","dive","container-diff","trivy","docker-explorer","sysdig","falco"],"targetTypes":["container","linux-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Focuses specifically on forensic investigation of Docker containers rather than general system forensics or container security hardening.","Combines live container state preservation with offline image layer and host artifact analysis.","Includes structured scenarios for web app compromise, supply chain attacks, container escapes, and cryptojacking."],"familyIds":["container-forensics"]},{"id":"analyzing-email-headers-for-phishing-investigation","summary":"Provides a step-by-step forensic workflow for analyzing email headers to trace the true origin of a phishing email, validate SPF/DKIM/DMARC authentication, and collect evidence such as lookalike domains and malicious attachments.","primaryDomain":"forensics","domainTags":["email-forensics","phishing-investigation","header-analysis"],"capabilityTags":["email-header-parsing","spf-dkim-dmarc-validation","phishing-triage","origin-tracing"],"capabilityDetails":["Provides a workflow for parsing raw email headers, tracing the Received chain, and validating SPF, DKIM, and DMARC to identify spoofed phishing emails."],"techniqueTags":["received-chain-analysis","spf-record-verification","dkim-signature-validation","dmarc-alignment-check","lookalike-domain-detection","attachment-hashing"],"techniqueDetails":["Uses the Received chain in reverse chronological order to trace the email's delivery path.","Checks SPF DNS records to verify the sending server is authorized.","Identifies DKIM signature presence and validates it.","Checks DMARC policy alignment against From domain.","Uses Levenshtein distance to detect lookalike/typosquatted domains.","Extracts and hashes email attachments to compare against threat intel."],"tools":["dig","nslookup","pyspf","dkimpy","PhishTool","VirusTotal","AbuseIPDB","whois","Python email library"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Specializes in email header forensics rather than general phishing detection","Integrates SPF/DKIM/DMARC validation with Received-chain tracing","Includes practical lookalike domain detection and attachment SHA-256 hashing"],"familyIds":["email-forensics"]},{"id":"analyzing-ethereum-smart-contract-vulnerabilities","summary":"Provides a pre-deployment auditing workflow for Ethereum smart contracts using Slither static analysis and Mythril symbolic execution to detect vulnerabilities like reentrancy and integer overflows, triage findings, and generate SWC-classified audit reports.","primaryDomain":"source-code-security","domainTags":["ethereum","solidity","smart-contract","blockchain","defi"],"capabilityTags":["smart-contract-audit","static-analysis","symbolic-execution","vulnerability-detection"],"capabilityDetails":["Provides structured procedures for running Slither and Mythril to identify and triage smart contract vulnerabilities.","Generates JSON audit reports with SWC identifiers and remediation recommendations."],"techniqueTags":["slither-analysis","mythril-analysis","reentrancy-detection","integer-overflow-detection","access-control-analysis"],"techniqueDetails":["Slither performs fast static analysis using an intermediate representation to detect over 90 vulnerability patterns.","Mythril uses symbolic execution and SMT solving to discover complex execution path vulnerabilities.","Triage combines results from both tools, deduplicates findings, and assesses severity based on exploitability and financial impact."],"tools":["slither","mythril","solc","solc-select"],"targetTypes":["source-code"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Combines two complementary analysis engines (static analysis and symbolic execution) specifically for Ethereum smart contracts.","Emphasizes pre-deployment audit with SWC-classified output, distinguishing it from general source-code scanning skills."],"familyIds":["smart-contract-security-auditing"]},{"id":"analyzing-golang-malware-with-ghidra","summary":"Provides an advanced, tool-assisted workflow for analyzing Go-compiled malware in Ghidra: recovering build metadata, deobfuscating function names from stripped binaries, and extracting dependencies and suspicious strings to accelerate malware triage.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","go-binary","ghidra"],"capabilityTags":["go-binary-analysis","malware-reverse-engineering","function-name-recovery","dependency-extraction"],"capabilityDetails":["Provides a workflow for reverse engineering Go-compiled malware by parsing Go buildinfo and pclntab structures, recovering function names (including stripped/obfuscated binaries via GoResolver), and extracting embedded dependencies and strings."],"techniqueTags":["pclntab-analysis","buildinfo-parsing","control-flow-graph-similarity","string-extraction"],"techniqueDetails":["Uses Go runtime structures (buildinfo, pclntab, moduledata) to recover metadata; applies control-flow graph similarity for deobfuscating stripped binaries."],"tools":["Ghidra","GoResolver","go-re.tk","Python"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["analysis"],"distinctiveFeatures":["Focuses specifically on Go binary internals (pclntab, buildinfo, moduledata) and GoResolver for function deobfuscation, rather than general malware reverse engineering."],"familyIds":["platform-specific-malware-reverse-engineering"]},{"id":"analyzing-heap-spray-exploitation","summary":"Structured Volatility3-based workflow to detect heap spray artifacts in memory dumps, including NOP sled scanning and shellcode extraction.","primaryDomain":"forensics","domainTags":["memory-forensics","malware-analysis","exploit-analysis"],"capabilityTags":["heap-spray-detection","shellcode-extraction","memory-dump-analysis","exploit-artifact-analysis"],"capabilityDetails":["Provides a workflow for detecting and analyzing heap spray attacks in memory dumps using Volatility3 plugins.","Identifies suspicious process allocations, NOP sled patterns, and shellcode landing zones."],"techniqueTags":["vad-analysis","nop-sled-scanning","memory-allocation-analysis","shellcode-pattern-analysis"],"techniqueDetails":["Uses Volatility3 windows.malfind to identify executable injected regions.","Analyzes VAD entries with windows.vadinfo to find large RWX contiguous allocations.","Scans for NOP sled signatures (0x90, 0x0c0c0c0c) using memory region dumps."],"tools":["volatility3"],"targetTypes":["windows-host","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses specifically on heap spray artifact detection in memory dumps, distinguishing it from general memory forensics.","Provides structured NOP sled scanning and shellcode extraction for exploit analysis."],"familyIds":["memory-forensics"]},{"id":"analyzing-indicators-of-compromise","summary":"Provides an operational workflow for triaging and enriching indicators of compromise (IPs, domains, file hashes, URLs) using multiple threat-intelligence sources to assign confidence scores, decide block/monitor/whitelist dispositions, and document findings for distribution.","primaryDomain":"network-security","domainTags":["threat-intelligence","incident-response","indicator-of-compromise"],"capabilityTags":["ioc-triage","ioc-enrichment","confidence-scoring","disposition-decision","campaign-attribution"],"capabilityDetails":["Provides an operational workflow for normalizing, enriching, and triaging indicators of compromise from multiple threat-intelligence sources, with tiered confidence scoring to guide block, monitor, or whitelist actions."],"techniqueTags":["multi-source-enrichment","threat-intelligence-lookup","defanging","ttl-management","stix-export"],"techniqueDetails":["Uses VirusTotal, AbuseIPDB, MalwareBazaar, MISP, and Shodan to enrich IOCs; applies a confidence threshold framework for disposition; emphasizes defanging IOCs to prevent accidental activation and assigning TTLs to indicators to avoid false positives from repurposed infrastructure."],"tools":["VirusTotal","AbuseIPDB","MalwareBazaar","MISP","Shodan","URLScan.io"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","reporting","remediation"],"distinctiveFeatures":["Distinct focus on multi-source IOC enrichment with explicit confidence scoring and disposition decisions rather than simple single-source reputation lookups.","Includes practical guidance on TTL/expiration for indicators, defanging, and avoiding false positives from shared infrastructure like CDNs."],"familyIds":["threat-intelligence-enrichment"]},{"id":"analyzing-ios-app-security-with-objection","summary":"Runtime iOS app security testing using Objection/Frida to inspect data storage, bypass SSL pinning and jailbreak detection, hook authentication methods, and search memory for sensitive data during authorized mobile penetration tests.","primaryDomain":"mobile-security","domainTags":["ios-security","mobile-security","runtime-testing"],"capabilityTags":["keychain-inspection","filesystem-analysis","ssl-pinning-bypass","jailbreak-detection-bypass","method-hooking","memory-search"],"capabilityDetails":["Perform runtime iOS app security testing using Objection and Frida to inspect keychain, filesystem, and memory for sensitive data.","Bypass client-side protections such as SSL pinning and jailbreak detection during authorized assessments.","Hook Objective-C/Swift methods to observe arguments and return values for authentication and authorization logic."],"techniqueTags":["frida-instrumentation","objection-commands","keychain-dump","ssl-pinning-disable","jailbreak-simulate","memory-scraping"],"techniqueDetails":["Uses Objection's pre-built Frida-based commands (e.g., ios keychain dump, ios sslpinning disable) to interact with the app at runtime.","Supports both jailbroken (Frida server) and non-jailbroken (patched IPA with Frida gadget) workflows.","Leverages method hooking to monitor authentication and platform interaction classes."],"tools":["objection","frida","frida-tools","ideviceinstaller","burp-suite"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","exploitation"],"distinctiveFeatures":["Dedicated to iOS runtime security testing with Objection/Frida, covering a broad range of MASVS areas (storage, network, auth, resilience, platform interaction).","Includes specific commands for keychain dump, SSL pinning bypass, jailbreak detection bypass, and memory string search.","Provides guidance for both jailbroken and non-jailbroken devices, a distinction often absent in general mobile testing guides."],"familyIds":["mobile-runtime-instrumentation"]},{"id":"analyzing-kubernetes-audit-logs","summary":"Operational playbook for parsing Kubernetes API server audit logs to detect security-relevant events such as exec-into-pod, secret access, RBAC changes, privileged pod creation, and anonymous API access, with Python examples and detection rule guidance.","primaryDomain":"cloud-security","domainTags":["kubernetes-security","container-security","audit-log-analysis"],"capabilityTags":["kubernetes-audit-log-parsing","security-event-detection","detection-rule-building"],"capabilityDetails":["Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access.","Builds threat detection rules from audit event patterns."],"techniqueTags":["json-lines-parsing","event-pattern-detection","rbac-abuse-detection","privilege-escalation-detection"],"techniqueDetails":["Uses Python to parse each audit log line and filter on verb and resource combinations.","Detects container exec via create pods/exec events, secret enumeration, clusterrolebindings creation, privileged pod creation, and unauthenticated access."],"tools":["python"],"targetTypes":["kubernetes"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Specifically targets Kubernetes API server audit log analysis rather than generic container runtime logs.","Provides a structured set of key event types to hunt for, including exec, secrets, RBAC changes, privileged pods, and anonymous access.","Includes Python code snippets for parsing JSON-lines audit logs and building detection rules."],"familyIds":["container-kubernetes-configuration-compliance-auditing"]},{"id":"analyzing-linux-audit-logs-for-intrusion","summary":"Operational playbook for using Linux auditd, ausearch, and aureport to detect, investigate, and report host-based intrusion activity, including audit rule deployment, query patterns, timeline reconstruction, and SIEM forwarding.","primaryDomain":"linux-security","domainTags":["linux-security","auditd","forensics","intrusion-detection"],"capabilityTags":["audit-log-analysis","intrusion-detection","timeline-reconstruction","audit-rule-configuration"],"capabilityDetails":["Provides a workflow for detecting intrusions and unauthorized activity on Linux hosts using the kernel-level Audit framework."],"techniqueTags":["syscall-auditing","ausearch-querying","aureport-summarization","file-watch-rules"],"techniqueDetails":["Uses audit rules with custom keys to capture syscall and file events, then queries them with ausearch and aggregates with aureport."],"tools":["auditd","ausearch","aureport","auditctl","augenrules","auditbeat"],"targetTypes":["linux-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Host-focused kernel audit capabilities rather than network traffic analysis.","Includes a ready-to-use intrusion-focused audit rule set with keys for credential access, persistence, process injection, and lateral movement.","Provides a structured attack timeline reconstruction procedure using ausearch and aureport."],"familyIds":["linux-host-compromise-detection"]},{"id":"analyzing-linux-elf-malware","summary":"Provides a comprehensive workflow for analyzing malicious Linux ELF binaries, covering static inspection, dynamic tracing, and reverse engineering to identify botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","linux-security","elf-analysis"],"capabilityTags":["elf-malware-analysis","static-analysis","dynamic-analysis","ioc-extraction","reverse-engineering"],"capabilityDetails":["Provides a step-by-step workflow for analyzing malicious Linux ELF binaries, covering static inspection, dynamic tracing, and reverse engineering.","Enables extraction of IOCs such as mining pools, C2 addresses, persistence mechanisms, and process hiding techniques."],"techniqueTags":["elf-header-analysis","string-extraction","system-call-tracing","debugger-breakpoints","decompilation","persistence-mechanism-analysis"],"techniqueDetails":["Uses readelf, pyelftools, and entropy analysis to inspect ELF headers, sections, and detect packing.","Uses strings and FLOSS to extract network indicators, shell commands, crypto mining strings, and SSH persistence.","Uses strace and ltrace to trace system calls and library calls for network, process, and file operations.","Uses GDB to set breakpoints on key functions like socket, connect, execve, and fork to observe runtime behavior.","Uses Ghidra to reverse engineer binary logic, including Mirai-like botnet capabilities and cryptominer configuration.","Checks Linux-specific persistence via LD_PRELOAD, crontab, systemd services, init scripts, SSH keys, and kernel modules."],"tools":["readelf","objdump","nm","strings","strace","ltrace","gdb","ghidra","radare2","pyelftools"],"targetTypes":["linux-host","container","cloud","binary"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Specializes solely in Linux ELF malware rather than broader malware analysis or PE binaries.","Covers architecture-specific analysis for x86_64, ARM, and MIPS, with static and dynamic workflows adapted to each.","Focuses on Linux-specific persistence and evasion mechanisms such as LD_PRELOAD, process hiding, and kernel module loading.","Provides a structured output report template for documenting analysis findings and IOCs.","Includes common scenarios (e.g., cryptominer on compromised server) with concrete analysis steps and pitfalls."],"familyIds":["platform-specific-malware-reverse-engineering"]},{"id":"analyzing-linux-kernel-rootkits","summary":"Detection and analysis workflow for Linux kernel rootkits using Volatility3 memory forensics (syscall/IDT checks, hidden modules) and live system scans with rkhunter/chkrootkit, producing evidence of hooked syscalls, hidden processes/modules, and modified binaries.","primaryDomain":"linux-security","domainTags":["kernel-rootkits","memory-forensics","malware-analysis"],"capabilityTags":["kernel-rootkit-detection","syscall-hook-detection","hidden-module-detection","cross-view-analysis","live-system-scanning"],"capabilityDetails":["Provides a structured workflow for detecting Linux kernel rootkits using memory forensics and live system scanning.","Uses Volatility3 plugins to identify hooked syscalls, hidden kernel modules, hidden processes, and modified IDT entries.","Combines memory image analysis with /proc and /sys discrepancy checks to reveal objects hidden from userspace tools.","Leverages rkhunter and chkrootkit to detect known rootkit signatures and modified system binaries."],"techniqueTags":["volatility3-linux-plugins","syscall-table-integrity","idt-integrity-checking","proc-sys-discrepancy","rkhunter","chkrootkit"],"techniqueDetails":["Uses linux.check_syscall and linux.check_idt to detect modified syscall table entries and interrupt descriptor table changes.","Compares module listings from /proc/modules, lsmod, and /sys/module to surface hidden kernel modules.","Correlates process lists from task_struct and /proc to identify hidden or spoofed processes.","Runs rkhunter and chkrootkit for known rootkit signatures and file integrity verification."],"tools":["Volatility3","rkhunter","chkrootkit","LiME","AVML"],"targetTypes":["linux-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Specializes in Linux kernel rootkit detection using Volatility3 memory forensics combined with cross-view /proc vs /sys discrepancy analysis and live rkhunter/chkrootkit scans, rather than generic malware scanning."],"familyIds":["linux-host-compromise-detection"]},{"id":"analyzing-linux-system-artifacts","summary":"Hands-on forensic workflow for analyzing Linux system artifacts to detect compromise, identify persistence mechanisms, and reconstruct attacker activity from logs, user accounts, cron/systemd, shell history, and SSH keys.","primaryDomain":"forensics","domainTags":["linux-forensics","incident-response","persistence-detection","system-artifacts"],"capabilityTags":["system-artifact-collection","authentication-log-analysis","persistence-mechanism-analysis","shell-history-analysis","rootkit-detection"],"capabilityDetails":["Provides a step-by-step workflow for collecting and analyzing Linux forensic artifacts (auth logs, user accounts, cron/systemd persistence, shell history, SSH keys, and system configuration) to identify signs of compromise, persistence, and unauthorized activity."],"techniqueTags":["forensic-artifact-collection","authentication-log-review","cron-systemd-persistence-check","ssh-key-audit","suid-binary-scan","ld-preload-check"],"techniqueDetails":["Uses read-only forensic mounts, automated parsing of /etc/passwd and /etc/shadow, review of crontab and systemd unit files, shell history flagging, and checks for modified binaries/PAM to uncover compromise."],"tools":["chkrootkit","rkhunter","AIDE","auditd","last","lastb","osquery","Velociraptor","Plaso"],"targetTypes":["linux-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses on Linux-specific forensic artifacts and persistence mechanisms (cron, systemd, SSH keys, LD_PRELOAD) rather than general incident response.","Includes scenario-based walkthroughs for SSH brute force, web server compromise, insider threat, and crypto-miner investigations.","Provides automated Python and shell scripts for parsing auth logs, user accounts, and shell history."],"familyIds":["linux-system-forensics"]},{"id":"analyzing-lnk-file-and-jump-list-artifacts","summary":"Provides a detailed forensic workflow for analyzing Windows LNK shortcut files and Jump List artifacts using LECmd, JLECmd, and manual Shell Link Binary Format parsing to reconstruct file access, program execution, and user activity, including evidence that persists after target file deletion.","primaryDomain":"forensics","domainTags":["windows-forensics","lnk-files","jump-lists"],"capabilityTags":["lnk-file-analysis","jump-list-analysis","file-access-reconstruction","program-execution-analysis"],"capabilityDetails":["Provides a workflow for analyzing Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity, even after target files are deleted."],"techniqueTags":["shell-link-binary-format","jump-list-parse","filetime-parsing","ez-tools-workflow"],"techniqueDetails":["Parses the 76-byte Shell Link header and LinkFlags, converts FILETIME timestamps, and uses LECmd/JLECmd to extract evidence from LNK files and OLE-based Jump Lists."],"tools":["LECmd","JLECmd","Timeline Explorer","Python","pylnk3","LnkParse3"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis"],"distinctiveFeatures":["Focused exclusively on LNK and Jump List artifacts rather than general Windows forensics.","Covers Windows 10 vs Windows 11 artifact generation differences.","Includes manual Shell Link Binary Format parsing in addition to EZ Tools."],"familyIds":["windows-execution-artifact-forensics"]},{"id":"analyzing-macro-malware-in-office-documents","summary":"Provides a structured workflow for static analysis of malicious Office documents, extracting and deobfuscating VBA/XLM macros to reveal download URLs, execution chains, and IOCs, while also checking for non-macro vectors such as DDE and remote template injection.","primaryDomain":"forensics","domainTags":["malware-analysis","office-document-analysis","macro-malware"],"capabilityTags":["macro-analysis","vba-deobfuscation","office-document-analysis","indicator-extraction"],"capabilityDetails":["Provides a workflow for extracting, deobfuscating, and analyzing VBA/XLM macros in Office documents to identify malicious payloads and execution chains."],"techniqueTags":["static-analysis","deobfuscation","ole-stream-analysis","xlm-macro-analysis","dde-detection","remote-template-injection-detection"],"techniqueDetails":["Uses olevba/oledump to inspect OLE streams and extract VBA source.","Applies Chr(), string concatenation, StrReverse, Replace() resolution to deobfuscate.","Checks for DDEAUTO fields and external relationships to detect non-macro attack vectors."],"tools":["olevba","oledump.py","xlmdeobfuscator","oleid","vipermonkey","yara","libreoffice"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Covers both VBA and legacy Excel 4.0 (XLM) macro analysis, including deobfuscation and detection of non-macro vectors like DDE and remote template injection.","Provides a complete static-analysis workflow from triage to IOC extraction and YARA rule generation."],"familyIds":["malicious-document-forensics"]},{"id":"analyzing-malicious-pdf-with-peepdf","summary":"Provides a structured static-analysis workflow for triaging malicious PDFs, extracting embedded JavaScript and shellcode, and producing IOCs using peepdf and Didier Stevens tools.","primaryDomain":"forensics","domainTags":["malware-analysis","pdf-analysis","static-analysis","dfir"],"capabilityTags":["pdf-static-analysis","malicious-document-triage","embedded-content-extraction","javascript-analysis","shellcode-detection","ioc-extraction"],"capabilityDetails":["Provides a workflow for static analysis of malicious PDF documents using peepdf and companion tools to extract and examine embedded JavaScript and shellcode."],"techniqueTags":["keyword-scanning","object-tree-analysis","stream-extraction","filter-decoding","javascript-deobfuscation","hash-lookup"],"techniqueDetails":["Uses pdfid to scan for suspicious PDF keywords, peepdf interactive mode to explore object structure, and pdf-parser for deep object parsing; extracts streams and decodes filters to recover plaintext JavaScript and shellcode."],"tools":["peepdf","pdfid","pdf-parser","VirusTotal","CyberChef"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Specialized in static malware analysis of PDF documents, combining peepdf, pdfid, and pdf-parser for object-level inspection, JavaScript deobfuscation, and shellcode extraction, with explicit IOC generation."],"familyIds":["malicious-document-forensics"]},{"id":"analyzing-malicious-url-with-urlscan","summary":"A structured workflow for safely analyzing suspicious URLs with URLScan.io, extracting indicators of compromise, and cross-referencing with threat intelligence to support phishing defense and incident response.","primaryDomain":"web-security","domainTags":["phishing","url-analysis","threat-intelligence"],"capabilityTags":["malicious-url-analysis","urlscan-workflow","ioc-extraction","threat-intel-cross-referencing"],"capabilityDetails":["Provides a step-by-step workflow for scanning and analyzing suspicious URLs using URLScan.io, including safe rendering, screenshot review, redirect chain analysis, DOM and network log inspection, SSL certificate verification, IOC extraction, and cross-referencing with multiple threat intelligence sources."],"techniqueTags":["safe-url-rendering","screenshot-analysis","dom-analysis","network-log-analysis","redirect-chain-analysis","certificate-analysis"],"techniqueDetails":["Uses URLScan's isolated Chromium instance to render URLs safely without exposing the analyst's system.","Reviews screenshots, DOM content, network requests, redirects, and SSL certificates to identify phishing indicators and malicious behavior."],"tools":["urlscan.io","virustotal","phishtank","google-safe-browsing","any.run","hybrid-analysis"],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focused specifically on URLScan.io as the primary analysis platform for phishing and malicious URL investigation.","Includes phishing-specific red flag guidance (e.g., newly registered domains, URL shorteners, brand impersonation) and cross-referencing with multiple threat intel services."],"familyIds":["web-attack-evidence-analysis"]},{"id":"analyzing-malware-behavior-with-cuckoo-sandbox","summary":"Provides a Cuckoo Sandbox workflow for dynamically analyzing malware behavior, including process, file, registry, network, and memory artifacts, with IOC extraction and behavioral signature generation.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","dynamic-analysis","sandboxing"],"capabilityTags":["sandbox-detonation","behavioral-analysis","ioc-extraction","signature-generation"],"capabilityDetails":["Provides a workflow for detonating malware in Cuckoo Sandbox and analyzing process, file, registry, network, and memory artifacts for behavioral classification and IOC extraction."],"techniqueTags":["api-hooking","network-simulation","memory-forensics","process-tree-analysis"],"techniqueDetails":["Leverages Cuckoo's API hooking to capture runtime calls, network simulation to emulate internet services, memory dump analysis with Volatility, and process tree analysis to map infection chains."],"tools":["Cuckoo Sandbox","InetSim","FakeNet-NG","Suricata","Volatility"],"targetTypes":["binary","windows-host","network"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Tool-specific workflow for Cuckoo Sandbox behavioral analysis","Includes memory dump analysis with Volatility and network simulation setup","Covers end-to-end infection chain mapping from process, network, file, and registry artifacts"],"familyIds":["malware-sandbox-behavioral-analysis"]},{"id":"analyzing-malware-family-relationships-with-malpedia","summary":"Enables research into malware family lineage, aliases, actor attribution, and YARA rule sourcing via Malpedia, with reusable Python workflows for mapping ecosystems and loader-payload chains.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","malware-family-analysis","malpedia","yara-rules"],"capabilityTags":["malpedia-api-querying","family-relationship-mapping","yara-rule-extraction","threat-actor-attribution"],"capabilityDetails":["Provides a workflow for querying the Malpedia API to retrieve malware family aliases, YARA rules, and actor attributions.","Maps malware family relationships including loader-payload chains and shared tooling between threat actors.","Compiles YARA rules from Malpedia for detection use."],"techniqueTags":["malpedia-api","alias-resolution","loader-payload-chain-analysis","shared-tooling-analysis","yara-rule-compilation"],"techniqueDetails":["Uses Malpedia's REST API endpoints for families, actors, and YARA rules.","Resolves vendor-specific aliases via Malpedia's platform.family_name naming convention.","Builds relationship graphs and searches for overlaps between actor tooling."],"tools":["malpedia","python","yara"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","knowledge-reference"],"distinctiveFeatures":["Exclusively uses Malpedia as the data source for malware relationship intelligence.","Provides reusable Python client for Malpedia API and actor ecosystem mapping.","Covers both YARA rule extraction and cross-actor shared tooling analysis."],"familyIds":["specialized-threat-intel-source-analysis"]},{"id":"analyzing-malware-persistence-with-autoruns","summary":"A structured workflow for enumerating and triaging Windows malware persistence using Sysinternals Autoruns, including automated suspicious-entry flagging, baseline comparison, and offline disk image analysis.","primaryDomain":"windows-security","domainTags":["persistence","malware-analysis","autoruns","windows-internals"],"capabilityTags":["persistence-enumeration","autoruns-analysis","malware-hunting"],"capabilityDetails":["Provides a workflow for using Sysinternals Autoruns to enumerate Auto-Start Extensibility Points and flag suspicious persistence artifacts using signature, metadata, path, and command-line heuristics."],"techniqueTags":["registry-run-keys","windows-service","scheduled-task","dll-search-order-hijacking","logon-scripts"],"techniqueDetails":["Covers persistence via Registry Run keys, Windows services, scheduled tasks, DLL search order hijacking, and logon scripts."],"tools":["sysinternals-autoruns","autorunsc","python3","virustotal-api"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection","validation"],"distinctiveFeatures":["Combines Sysinternals Autoruns with a Python script that automatically flags suspicious entries based on signature, path, and LOLBin heuristics","Supports offline forensic disk image analysis via the -z flag","Leverages baseline comparison to identify newly added persistence mechanisms"],"familyIds":["windows-persistence-detection-and-hunting"]},{"id":"analyzing-malware-sandbox-evasion-techniques","summary":"A specialist playbook for analyzing Cuckoo/AnyRun behavioral reports to detect sandbox and VM evasion techniques, including timing checks, VM artifact queries, user interaction fingerprints, and sleep inflation, with MITRE ATT&CK mapping and an evasion sophistication score.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","sandbox-evasion","behavioral-analysis"],"capabilityTags":["sandbox-evasion-analysis","behavioral-report-parsing","evasion-indicator-detection"],"capabilityDetails":["Provides a structured workflow for parsing Cuckoo/AnyRun behavioral report JSON files to identify sandbox and VM evasion indicators."],"techniqueTags":["timing-evasion","vm-detection","user-interaction-evasion","sleep-inflation","environment-fingerprinting"],"techniqueDetails":["Uses timing checks such as GetTickCount and QueryPerformanceCounter to detect time-based evasion.","Identifies VM/hypervisor artifact queries via registry keys, MAC address prefixes, and process names like vmtoolsd.exe.","Detects sleep inflation by comparing requested vs actual sleep durations.","Flags user interaction checks including GetCursorPos and GetAsyncKeyState patterns.","Recognizes environment fingerprinting via disk size, CPU count, and RAM."],"tools":["cuckoo","anyrun","python"],"targetTypes":["binary","windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses specifically on analyzing behavioral report exports for anti-analysis techniques rather than executing malware or performing general malware analysis.","Includes a scoring mechanism for evasion sophistication based on technique count and diversity.","Maps detected techniques to MITRE ATT&CK T1497 sub-techniques."],"familyIds":["malware-sandbox-behavioral-analysis"]},{"id":"analyzing-memory-dumps-with-volatility","summary":"Provides a comprehensive memory forensics workflow using the Volatility framework to analyze RAM dumps from compromised Windows, Linux, and macOS systems, covering process analysis, injection detection, network connections, credential extraction, YARA scanning, and report generation.","primaryDomain":"forensics","domainTags":["memory-forensics","malware-analysis","incident-response"],"capabilityTags":["memory-dump-analysis","process-injection-detection","credential-extraction","network-connection-analysis","yara-scanning"],"capabilityDetails":["Provides a structured workflow for analyzing RAM memory dumps with Volatility, including process enumeration, injection detection, network connection analysis, credential extraction, YARA malware scanning, and report generation."],"techniqueTags":["process-enumeration","vad-anomaly-analysis","pool-tag-scanning","process-hollowing-detection","timeline-analysis"],"techniqueDetails":["Uses Volatility plugins such as pslist, psscan, malfind, hollowfind, netscan, and timeliner to detect malicious activity and extract forensic artifacts."],"tools":["volatility3","volatility2","rekall","memprocfs","yara","strings","winpmem","lime"],"targetTypes":["windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","enumeration","reporting"],"distinctiveFeatures":["Covers a complete memory forensics workflow from profile identification to report generation, spanning multiple OS families and including both artifact extraction and YARA scanning."],"familyIds":["memory-forensics"]},{"id":"analyzing-memory-forensics-with-lime-and-volatility","summary":"Operational playbook for incident response on Linux hosts: acquire physical memory using the LiME kernel module and perform forensic analysis with Volatility 3 to extract running processes, bash history, network connections, loaded kernel modules, and injected code.","primaryDomain":"forensics","domainTags":["memory-forensics","linux-forensics"],"capabilityTags":["memory-acquisition","memory-image-analysis","incident-response"],"capabilityDetails":["Provides a workflow for acquiring Linux memory with the LiME kernel module and analyzing the resulting image with Volatility 3, including process listing, bash history extraction, network socket enumeration, loaded module inspection, and injected code detection."],"techniqueTags":["kernel-module-memory-acquisition","volatility3-analysis","rootkit-detection"],"techniqueDetails":["Uses LiME to capture memory in lime or raw format.","Uses Volatility 3 linux plugins such as pslist, psscan, bash, sockstat, lsmod, and malfind."],"tools":["LiME","Volatility 3"],"targetTypes":["linux-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses specifically on Linux memory forensics combining LiME acquisition with Volatility 3 analysis, covering kernel module rootkit checks and injected code detection, rather than general memory forensics or Windows memory analysis."],"familyIds":["memory-forensics"]},{"id":"analyzing-mft-for-deleted-file-recovery","summary":"Provides a comprehensive NTFS forensic workflow for recovering deleted files by analyzing the $MFT and supporting artifacts (USN Journal, $LogFile, MFT slack), correlating with Recycle Bin and Volume Shadow Copies, and detecting timestomping.","primaryDomain":"forensics","domainTags":["file-system-forensics","windows-forensics","mft-analysis","ntfs"],"capabilityTags":["deleted-file-recovery","mft-parsing","timeline-reconstruction","timestomping-detection"],"capabilityDetails":["Provides repeatable procedures to parse the NTFS $MFT, USN Journal, $LogFile, and MFT slack space for recovering deleted file metadata, reconstructing file system timelines, and detecting timestomping."],"techniqueTags":["mft-record-analysis","usn-journal-analysis","logfile-transaction-analysis","mft-slack-space-analysis","recycle-bin-correlation","volume-shadow-copy-analysis"],"techniqueDetails":["Uses MFTECmd to export MFT and USN journal data; uses LogFileParser to analyze $LogFile transactions; uses custom Python to inspect MFT slack space; correlates findings with $Recycle.Bin and Volume Shadow Copies."],"tools":["MFTECmd","analyzeMFT","X-Ways Forensics","LogFileParser","RBCmd","FTK Imager"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses specifically on MFT-centered deleted file recovery across NTFS artifacts, combining tool-based parsing (MFTECmd, LogFileParser) with custom Python slack-space analysis and anti-forensic detection, unlike general file recovery playbooks."],"familyIds":["disk-and-file-system-forensics"]},{"id":"analyzing-network-covert-channels-in-malware","summary":"Provides a Python-based workflow using statistical analysis (entropy, subdomain length, payload size) to detect DNS and ICMP covert channels in network captures, with context on HTTP steganography and protocol abuse for C2 and exfiltration.","primaryDomain":"network-security","domainTags":["network-covert-channels","dns-tunneling","icmp-exfiltration","c2-detection","data-exfiltration"],"capabilityTags":["dns-tunneling-detection","icmp-tunneling-detection","covert-channel-analysis","network-traffic-analysis","threat-hunting"],"capabilityDetails":["Provides a Python-based workflow using statistical analysis to detect DNS and ICMP covert channels in network captures.","Detects DNS tunneling via entropy, subdomain length, and query volume scoring.","Identifies ICMP tunneling through payload size anomalies and packet frequency.","Describes HTTP covert channels and protocol abuse concepts for C2 and exfiltration analysis."],"techniqueTags":["entropy-analysis","protocol-abuse","dns-tunneling","icmp-tunneling","http-steganography"],"techniqueDetails":["Uses Shannon entropy and subdomain uniqueness to score DNS tunneling risk.","Flags ICMP flows based on average payload size and packet volume.","Discusses HTTP header/cookie embedding and steganographic image exfiltration as covert channel techniques."],"tools":["scapy","wireshark","tshark","zeek","python"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Provides an executable Python analysis script rather than generic methodology, combining DNS and ICMP detection with statistical scoring.","Includes concrete scoring thresholds and indicators (subdomain entropy, uniqueness, payload size) for network forensics.","Covers both C2 communication and data exfiltration use cases across multiple protocol families."],"familyIds":["malware-c2-and-exfiltration-analysis"]},{"id":"analyzing-network-flow-data-with-netflow","summary":"Provides a structured workflow to parse NetFlow v9 and IPFIX flow records with Python and detect port scanning, data exfiltration, C2 beaconing, and volumetric anomalies using statistical baseline analysis.","primaryDomain":"network-security","domainTags":["network-security","netflow","traffic-analysis"],"capabilityTags":["network-flow-analysis","anomaly-detection","port-scan-detection","data-exfiltration-detection","c2-beacon-detection"],"capabilityDetails":["Provides a workflow to parse NetFlow v9 and IPFIX records and detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns."],"techniqueTags":["netflow-parsing","statistical-baseline-analysis","periodic-timing-analysis"],"techniqueDetails":["Uses Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and periodic timing patterns."],"tools":["netflow"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Specifically targets NetFlow v9 and IPFIX flow records rather than raw packet capture analysis.","Combines multiple detection heuristics (port scanning, data exfiltration, C2 beaconing, volumetric anomalies) in a single workflow.","Uses a lightweight Python library for flow parsing and statistical baseline analysis."],"familyIds":["network-incident-forensics-and-anomaly-detection"]},{"id":"analyzing-network-packets-with-scapy","summary":"Provides agent workflows using Scapy for reading pcap files, extracting protocol fields, computing traffic statistics, performing SYN scans, and detecting anomalies such as SYN floods, DNS tunneling, and fragmented packets.","primaryDomain":"network-security","domainTags":["packet-analysis","pcap-analysis","network-forensics","traffic-analysis"],"capabilityTags":["packet-crafting","packet-sniffing","pcap-analysis","syn-scan","anomaly-detection","dns-analysis"],"capabilityDetails":["Provides Scapy-based workflows for crafting, sending, sniffing, and dissecting TCP/UDP/ICMP/DNS packets.","Supports offline pcap/pcapng file analysis, protocol field extraction, and traffic statistics computation.","Implements SYN scan techniques and detects anomalous traffic such as SYN floods, DNS tunneling indicators, and fragment-based attacks."],"techniqueTags":["packet-crafting","protocol-dissection","traffic-statistics","tcp-flag-analysis","dns-entropy-analysis","fragmentation-detection"],"techniqueDetails":["Uses Scapy's rdpcap() for reading and parsing pcap files.","Analyzes TCP flag ratios to identify SYN flood patterns.","Detects DNS exfiltration via query length and entropy analysis.","Identifies unusual packet fragmentation or malformed headers as anomaly indicators."],"tools":["scapy"],"targetTypes":["network"],"role":"tool-guide","workflowFocus":["reconnaissance","analysis","detection"],"distinctiveFeatures":["Scapy-specific operational playbook combining offline pcap analysis with active packet crafting and custom anomaly detection heuristics, rather than generic network analysis methodology."],"familyIds":["network-packet-analysis-tooling"]},{"id":"analyzing-network-traffic-for-incidents","summary":"Provides an operational incident-response workflow for analyzing network traffic captures and flow data to identify C2 communications, lateral movement, data exfiltration, and exploitation attempts using Wireshark, Zeek, and NetFlow.","primaryDomain":"network-security","domainTags":["network-forensics","pcap-analysis","traffic-analysis","incident-response"],"capabilityTags":["c2-detection","lateral-movement-analysis","exfiltration-detection","beaconing-analysis","ioc-extraction"],"capabilityDetails":["Provides a step-by-step workflow for analyzing network traffic captures and flow data during incident response.","Includes methods for identifying command-and-control communications through beaconing analysis in Zeek logs and Wireshark filters.","Covers tracing lateral movement via protocols such as SMB, RDP, WinRM, WMI, and SSH.","Describes techniques for detecting data exfiltration using Zeek conn.log, dns.log, and Wireshark filters.","Offers guidance on extracting and correlating network-based indicators of compromise (IOCs).","Provides a structured reporting template for documenting network forensic findings with evidence references."],"techniqueTags":["beaconing-detection","dns-tunneling-detection","ja3-fingerprinting","flow-analysis","packet-filtering"],"techniqueDetails":["Uses regular time intervals and consistent packet sizes to identify C2 beaconing patterns.","Uses DNS query entropy and TXT record volume to detect DNS tunneling.","Employs JA3/JA3S hashes for TLS client/server fingerprinting.","Utilizes Zeek logs and NetFlow metadata for scalable traffic analysis.","Applies Wireshark display filters to isolate suspicious protocol and endpoint activity."],"tools":["wireshark","zeek","tcpdump","arkime","networkminer","rita"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Combines full packet capture (PCAP) analysis with Zeek metadata and NetFlow for a comprehensive network forensics workflow.","Specifically focuses on adversary activity (C2, lateral movement, exfiltration) rather than general packet troubleshooting.","Includes both raw packet-level Wireshark filters and flow-level Zeek commands for efficient triage.","Provides a complete incident reporting template with IOC extraction and evidence references.","Covers TLS-based C2 detection via JA3 fingerprinting and certificate details."],"familyIds":["network-incident-forensics-and-anomaly-detection"]},{"id":"analyzing-network-traffic-of-malware","summary":"Provides a structured workflow for analyzing network traffic of malware to identify C2 protocols, detect beaconing, extract artifacts, and generate detection signatures using Wireshark, Zeek, Suricata, and Scapy.","primaryDomain":"network-security","domainTags":["malware-analysis","pcap-analysis","c2-detection","network-traffic-analysis"],"capabilityTags":["pcap-analysis","c2-protocol-analysis","dns-analysis","beacon-detection","signature-generation","artifact-extraction"],"capabilityDetails":["Provides step-by-step procedures for analyzing PCAPs to identify C2 traffic, DNS tunneling, DGA, beaconing, and exfiltration, and for creating Suricata signatures."],"techniqueTags":["pcap-analysis","protocol-analysis","dns-tunneling-detection","beacon-detection","ja3-fingerprinting","dga-detection","suricata-rules"],"techniqueDetails":["Uses tshark, Zeek, Suricata, and Scapy to extract indicators, calculate timing jitter, fingerprint TLS, and create detection rules."],"tools":["Wireshark","tshark","Zeek","Suricata","NetworkMiner","Scapy"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation"],"distinctiveFeatures":["Specializes in malware network traffic analysis rather than general network troubleshooting; includes custom protocol reverse engineering scenario and signature generation."],"familyIds":["malware-c2-and-exfiltration-analysis"]},{"id":"analyzing-network-traffic-with-wireshark","summary":"Step-by-step guidance for using Wireshark and tshark to capture, filter, analyze, and extract evidence from network traffic for incident response and security investigations.","primaryDomain":"network-security","domainTags":["packet-analysis","traffic-analysis","pcap"],"capabilityTags":["packet-capture","traffic-analysis","artifact-extraction","malicious-traffic-detection"],"capabilityDetails":["Provides a practical workflow for capturing network packets and analyzing them to identify malicious patterns, diagnose protocol issues, and extract forensic artifacts."],"techniqueTags":["capture-filters","display-filters","protocol-dissection","tcp-stream-reassembly","statistical-analysis"],"techniqueDetails":["Uses BPF capture filters to scope live capture, Wireshark display filters for targeted post-capture analysis, and protocol dissectors for deep packet inspection."],"tools":["wireshark","tshark","tcpdump","mergecap","editcap"],"targetTypes":["network"],"role":"tool-guide","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Combines Wireshark GUI and tshark CLI-centric commands for packet capture, deep protocol analysis, artifact extraction, and evidence handling."],"familyIds":["network-packet-analysis-tooling"]},{"id":"analyzing-office365-audit-logs-for-compromise","summary":"Provides a structured workflow using Microsoft Graph API to parse Office 365 Unified Audit Logs and detect business email compromise indicators including suspicious inbox rules, email forwarding, mailbox delegation, and OAuth app grants.","primaryDomain":"cloud-security","domainTags":["office365","email-security","identity-compromise"],"capabilityTags":["audit-log-analysis","email-forwarding-detection","inbox-rule-enumeration","oauth-app-grant-detection","mailbox-delegation-detection"],"capabilityDetails":["Provides a structured workflow to parse Office 365 Unified Audit Logs via Microsoft Graph API and identify indicators of business email compromise."],"techniqueTags":["microsoft-graph-api","unified-audit-log-query","mailbox-rule-enumeration","oauth-consent-monitoring"],"techniqueDetails":["Uses MSAL client credentials flow to authenticate to Microsoft Graph, queries Unified Audit Log for suspicious operations, enumerates inbox rules and mailbox permissions, and detects suspicious OAuth app grants."],"tools":["microsoft-graph-api","msal","python"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Focused specifically on Office 365 audit log analysis for BEC indicators, covering forwarding rules, mailbox delegation, and OAuth grants rather than general log analysis."],"familyIds":["cloud-threat-detection-and-hunting"]},{"id":"analyzing-outlook-pst-for-email-forensics","summary":"A specialist playbook for Outlook PST/OST forensic analysis, using libpff/pffexport and Python pypff to extract email content, headers, attachments, and deleted items, analyze routing for phishing, and produce JSON forensic reports with exfiltration indicators.","primaryDomain":"forensics","domainTags":["email-forensics","outlook-forensics","pst-analysis"],"capabilityTags":["pst-parsing","email-forensic-export","deleted-item-recovery","attachment-extraction","email-header-extraction","forensic-report-generation"],"capabilityDetails":["Provides open-source workflows to parse Outlook PST/OST files and extract email messages, headers, attachments, calendar entries, contacts, and tasks.","Includes a Python-based analyzer class that recursively traverses folders, extracts MAPI metadata and transport headers, and exports attachments.","Supports recovery of deleted items from the Recoverable Items (deleted) folder.","Generates structured JSON forensic reports with mailbox statistics, suspicious email detection, and data exfiltration indicators."],"techniqueTags":["pffexport-cli","pypff-scripting","transport-header-parsing","recoverable-items-analysis","email-routing-reconstruction"],"techniqueDetails":["Uses pffexport to export all items, only messages, or recovered/deleted items from PST files with selective extraction modes.","Implements a Python class (PSTForensicAnalyzer) using pypff to recursively traverse folders, read message properties, and dump attachments to disk.","Performs email header analysis using parsed Received, X-Originating-IP, Message-ID, Return-Path, DKIM, SPF, DMARC, and X-Mailer headers to trace routing and identify spoofing.","Leverages Recoverable Items folder enumeration to restore deleted emails for forensic review."],"tools":["libpff","pffexport","pypff","libratom","pst-utils","MailXaminer","Forensic Email Collector","SysTools PST Forensics","Microsoft Outlook"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Specifically targets Outlook PST/OST email artifacts rather than general email-server logs or cloud mailboxes.","Combines command-line export (pffexport) with a ready-to-use Python forensic analyzer for automated evidence extraction.","Explicitly recovers deleted emails from the Recoverable Items folder and exposes MAPI metadata.","Provides an end-to-end email forensics workflow including routing analysis, phishing detection, and exfiltration indicator reporting."],"familyIds":["email-forensics"]},{"id":"analyzing-packed-malware-with-upx-unpacker","summary":"Provides a complete workflow for identifying UPX-packed malware, repairing modified UPX headers/magic bytes to enable automated unpacking, and falling back to manual debugger-based unpacking with import reconstruction for static analysis in Ghidra/IDA.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","packed-malware","pe-analysis","static-analysis"],"capabilityTags":["packer-identification","upx-unpacking","header-repair","manual-unpacking","import-reconstruction"],"capabilityDetails":["Provides a step-by-step workflow for identifying UPX-packed malware, repairing modified UPX headers/magic bytes to enable automated unpacking, and falling back to manual debugger-based unpacking with import reconstruction for static analysis in Ghidra or IDA."],"techniqueTags":["entropy-analysis","import-table-analysis","section-analysis","magic-byte-repair","pushad-popad-unpacking","hardware-breakpoint","oep-finding"],"techniqueDetails":["Uses section entropy and import counts to detect packed binaries; restores UPX magic bytes via Python script; uses x64dbg PUSHAD/POPAD hardware breakpoint technique to locate OEP; validates unpacked PE with pefile."],"tools":["UPX","Detect It Easy","x64dbg","Scylla","PE-bear","pefile"],"targetTypes":["binary","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on UPX-packed malware, including modified UPX headers and magic bytes that defeat automatic unpacking, with both automated repair and manual debugger fallback workflows."],"familyIds":["binary-protection-and-anti-analysis-bypass"]},{"id":"analyzing-pdf-malware-with-pdfid","summary":"Static-analysis playbook for malicious PDFs that uses PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, and suspicious objects, extract payloads/IOCs, and classify PDF threats (exploit vs social engineering) without opening the file.","primaryDomain":"forensics","domainTags":["malware-analysis","pdf-analysis","static-analysis","document-forensics"],"capabilityTags":["pdf-malware-triage","embedded-script-extraction","shellcode-analysis","payload-extraction","ioc-extraction"],"capabilityDetails":["Provides a step-by-step workflow for statically analyzing malicious PDFs: PDFiD risk triage, pdf-parser object inspection, JavaScript extraction/deobfuscation, shellcode emulation, embedded file/URL extraction, and report generation."],"techniqueTags":["pdfid-keyword-scanning","pdf-object-parsing","stream-decompression","javascript-deobfuscation","shellcode-emulation","yara-scanning"],"techniqueDetails":["Uses PDFiD indicators (JS, OpenAction, ObjStm) to identify malicious structures, pdf-parser to inspect object streams, and peepdf/scdbg to analyze embedded scripts and shellcode."],"tools":["PDFiD","pdf-parser","peepdf","scdbg","speakeasy","CyberChef","YARA","pdftotext","QPDF"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","reporting"],"distinctiveFeatures":["Exclusively focused on static PDF malware triage without opening the document, covering PDF-specific attack vectors like OpenAction, JavaScript, ObjStm obfuscation, and JBIG2 exploits, with integrated shellcode analysis."],"familyIds":["malicious-document-forensics"]},{"id":"analyzing-persistence-mechanisms-in-linux","summary":"Scans Linux systems for persistence mechanisms (crontab, systemd, LD_PRELOAD, shell profiles, SSH authorized_keys) and correlates findings with auditd logs to build an installation timeline for incident response or threat hunting.","primaryDomain":"linux-security","domainTags":["linux-persistence","systemd","crontab","ld-preload","auditd","incident-response","threat-hunting"],"capabilityTags":["persistence-scanning","auditd-correlation","timeline-analysis","persistence-detection"],"capabilityDetails":["Provides a structured workflow to enumerate Linux persistence mechanisms and correlate with auditd logs to build installation timelines."],"techniqueTags":["crontab-persistence","systemd-unit-persistence","ld-preload-injection","shell-profile-modification","ssh-authorized-keys-backdoor"],"techniqueDetails":["Checks crontabs, systemd units, LD_PRELOAD, shell profiles, and SSH authorized_keys; uses auditd logs for timeline."],"tools":["auditd","systemctl","crontab","python3"],"targetTypes":["linux-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Covers multiple Linux persistence vectors in one workflow and correlates with auditd logs to produce an installation timeline; distinguishes non-package-managed systemd units."],"familyIds":["linux-host-compromise-detection"]},{"id":"analyzing-powershell-empire-artifacts","summary":"Operational playbook for hunting and confirming PowerShell Empire C2 artifacts in Windows event logs, using explicit launcher, stager, module, and URL signatures, and producing structured JSON threat intelligence output.","primaryDomain":"windows-security","domainTags":["windows-event-logs","powershell","threat-hunting","c2"],"capabilityTags":["powershell-empire-detection","script-block-logging-analysis","module-logging-analysis","base64-payload-decoding","c2-artifact-hunting"],"capabilityDetails":["Provides a structured workflow for detecting PowerShell Empire post-exploitation framework artifacts in Windows PowerShell Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including default launcher strings, Base64 WebClient stagers, known module invocations, and staging URL patterns. Produces a JSON report with matched IOCs, decoded payloads, event timeline, MITRE ATT&CK mappings, and severity scores."],"techniqueTags":["event-log-analysis","signature-detection","base64-decoding","mitre-attack-mapping","stager-analysis"],"techniqueDetails":["Uses framework-specific signature strings and patterns to identify Empire activity in PowerShell logs, then decodes Base64 payloads and maps observed indicators to MITRE ATT&CK techniques."],"tools":["python","windows-event-log"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Specifically targets PowerShell Empire framework artifacts rather than generic PowerShell malware or obfuscation; combines multiple Empire-specific indicators including launcher strings, WebClient/FromBase64String stager patterns, module names, user agents, and staging URLs in one workflow."],"familyIds":["powershell-abuse-detection"]},{"id":"analyzing-powershell-script-block-logging","summary":"Provides a workflow to parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files, reconstruct multi-block scripts, and detect obfuscated, encoded, or living-off-the-land commands using python-evtx and pattern/entropy heuristics.","primaryDomain":"windows-security","domainTags":["powershell-security","script-block-logging","event-id-4104","windows-forensics","endpoint-security"],"capabilityTags":["evtx-parsing","script-block-reconstruction","obfuscation-detection","threat-detection","report-generation"],"capabilityDetails":["Parses PowerShell Operational EVTX logs to extract Event ID 4104 script blocks and reconstruct multi-part scripts","Applies detection heuristics for obfuscated commands and living-off-the-land techniques","Generates reports with risk scores and MITRE ATT&CK mappings"],"techniqueTags":["base64-encoded-command","download-cradle","amsi-bypass","entropy-analysis","string-obfuscation"],"techniqueDetails":["Uses base64 decoding and pattern matching for -EncodedCommand and FromBase64String","Detects download cradles via DownloadString, DownloadFile, Invoke-WebRequest, Net.WebClient","Identifies AMSI bypass patterns like AmsiUtils and amsiInitFailed","Applies entropy analysis and string manipulation indicators to find obfuscation"],"tools":["python-evtx","agent.py","lxml"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Specializes in Event ID 4104 script block log analysis with multi-block reconstruction using ScriptBlockId and MessageNumber","Combines log parsing with targeted obfuscation heuristics for PowerShell-specific attack techniques","Includes a ready-to-use Python agent script for automated processing"],"familyIds":["powershell-abuse-detection"]},{"id":"analyzing-prefetch-files-for-execution-history","summary":"Provides step-by-step procedures for extracting, parsing, and analyzing Windows Prefetch files to determine program execution history, identify malicious executables, and build investigation timelines.","primaryDomain":"forensics","domainTags":["windows-forensics","execution-history","timeline-analysis","windows-artifacts"],"capabilityTags":["prefetch-file-parsing","execution-history-identification","timeline-construction","malware-execution-detection"],"capabilityDetails":["Provides a full workflow to extract, hash, parse, and analyze Windows Prefetch files (versions 17, 23, 26, 30) to determine program execution history, run counts, timestamps, and referenced files, and to identify malicious or suspicious executions."],"techniqueTags":["prefetch-file-format-parsing","filename-path-hash-analysis","filetime-timestamp-conversion","artifact-correlation"],"techniqueDetails":["Uses PECmd with CSV/JSON output for automated parsing, and manual Python scripts for Linux-based parsing including MAM decompression awareness.","Relies on Prefetch filename hash (CRC32 of path) and SCCA signature for validation, and converts FILETIME timestamps to UTC.","Correlates Prefetch entries with Shimcache, Amcache, and network logs to confirm execution."],"tools":["PECmd","WinPrefetchView","python-prefetch","KAPE","Autopsy","Plaso","Velociraptor"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","reporting"],"distinctiveFeatures":["The only skill focused solely on Windows Prefetch artifact analysis for execution history—including both GUI/tool-based (PECmd, WinPrefetchView) and custom Python parsing—with built-in detection patterns for attacker tools, remote access, and exfiltration, plus timeline generation."],"familyIds":["windows-execution-artifact-forensics"]},{"id":"analyzing-ransomware-encryption-mechanisms","summary":"Provides a reverse-engineering workflow to analyze ransomware encryption algorithms, key management, and file encryption routines, assess decryption feasibility, and support recovery by identifying cryptographic weaknesses and key recovery opportunities.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","ransomware","cryptography"],"capabilityTags":["ransomware-encryption-analysis","decryption-feasibility-assessment","key-recovery","cryptographic-weakness-identification"],"capabilityDetails":["Provides a structured workflow to identify encryption algorithms used by ransomware families.","Analyzes key generation and management schemes to classify strength (strong, weak, flawed).","Guides reverse engineering of file encryption routines using decompiled code and crypto API analysis.","Includes tests for common cryptographic weaknesses such as key reuse, predictable seeds, and ECB mode.","Supports key recovery via known-plaintext attacks and memory forensics, and documents decryption feasibility."],"techniqueTags":["cryptanalysis","static-analysis","known-plaintext-attack","memory-forensics","key-management-analysis"],"techniqueDetails":["Uses Windows Crypto API imports (CryptEncrypt, BCryptEncrypt) to infer algorithm and operation mode.","Pattern-based classification of hybrid encryption schemes (AES+RSA, ChaCha20+RSA, etc.).","Examines decompiled encryption flow to understand key generation, IV handling, and file structure.","Detects key reuse by comparing IVs, brute-forces timestamp-derived keys, and identifies ECB block duplication.","Recovers XOR keys from known plaintext-ciphertext pairs and scans memory dumps for AES key schedules."],"tools":["Ghidra","IDA Pro","Python","PyCryptodome","pefile","Volatility","NoMoreRansom","CryptoTester"],"targetTypes":["binary","windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","exploitation","reporting"],"distinctiveFeatures":["Dedicated to ransomware encryption mechanism analysis and decryption feasibility assessment rather than general malware analysis.","Includes specific cryptanalytic tests and key recovery techniques tailored to ransomware weaknesses.","Provides a concrete output format for reporting encryption scheme analysis and recovery options."],"familyIds":["ransomware-encryption-analysis"]},{"id":"analyzing-ransomware-leak-site-intelligence","summary":"Safely collect and analyze ransomware leak-site victim data from public feeds to track group activity, identify emerging groups, assess sector/geography risk, and generate ransomware intelligence reports.","primaryDomain":"security-knowledge","domainTags":["ransomware","threat-intelligence","leak-site-monitoring"],"capabilityTags":["ransomware-intel-collection","victim-tracking","group-trend-analysis","sector-risk-assessment"],"capabilityDetails":["Provides a step-by-step workflow for collecting ransomware leak-site data from public feeds, analyzing group activity and trends, assessing sector/country risk, and producing actionable intelligence reports."],"techniqueTags":["osint","data-analysis","statistical-ranking","report-generation"],"techniqueDetails":["Uses Python scripts with requests and pandas to fetch and aggregate Ransomwatch data; applies frequency counting and percentile-based risk scoring; generates Markdown reports."],"tools":["python","requests","pandas","tor"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Focuses exclusively on ransomware double-extortion leak sites and uses a Python-based Ransomwatch ingest workflow","Includes sector/geography risk scoring and emerging-group tracking, not just data collection"],"familyIds":["specialized-threat-intel-source-analysis"]},{"id":"analyzing-ransomware-network-indicators","summary":"A specialist playbook for threat hunting and incident response that analyzes Zeek conn.log and NetFlow data to detect ransomware network indicators, including C2 beaconing, TOR exit node connections, data exfiltration flows, and DNS anomalies, culminating in a composite risk score with MITRE ATT&CK mapping.","primaryDomain":"network-security","domainTags":["ransomware","network-indicators","c2-beaconing","data-exfiltration","network-forensics"],"capabilityTags":["ransomware-network-indicator-analysis","beaconing-detection","exfiltration-detection","tor-connection-checking","dns-analysis","composite-risk-scoring"],"capabilityDetails":["Provides a structured workflow for detecting ransomware-related network indicators from Zeek conn.log and NetFlow data.","Includes methods for beaconing detection via interval statistics, TOR exit node cross-referencing, data exfiltration identification, DNS pattern analysis, and composite risk scoring."],"techniqueTags":["beaconing-analysis","tor-exit-node-matching","outbound-byte-ratio-analysis","dga-detection","high-entropy-dns-analysis","risk-scoring"],"techniqueDetails":["Beaconing detection uses mean, standard deviation, and coefficient of variation of connection intervals to identify periodic callbacks.","Data exfiltration detection flags connections with unusually high outbound byte ratios to external IPs.","DNS analysis detects DGA-like domain queries and high-entropy subdomains."],"tools":["zeek","netflow","python"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on ransomware network indicators rather than general network anomaly detection.","Combines multiple indicator types (beaconing, TOR, exfiltration, DNS) into a composite risk score with MITRE ATT&CK mapping.","Provides concrete procedures for analyzing Zeek conn.log and NetFlow data specifically for pre-encryption activity."],"familyIds":["malware-c2-and-exfiltration-analysis"]},{"id":"analyzing-ransomware-payment-wallets","summary":"Passively traces ransomware Bitcoin payments by querying blockchain explorers, clustering related addresses, and analyzing fund flows through mixers and exchanges to produce attribution intelligence for incident response and law enforcement.","primaryDomain":"forensics","domainTags":["blockchain","cryptocurrency","bitcoin","ransomware","threat-intelligence"],"capabilityTags":["ransomware-payment-tracing","wallet-cluster-analysis","fund-flow-tracing","attribution-reporting"],"capabilityDetails":["Provides a passive workflow for tracing ransomware cryptocurrency payments from ransom note addresses through blockchain transactions, identifying wallet clusters and fund movement through mixers/cash-out points to support attribution."],"techniqueTags":["common-input-ownership","utxo-tracing","peel-chain-detection","mixer-identification"],"techniqueDetails":["Uses common-input-ownership and change-address heuristics to cluster addresses; detects patterns such as consolidation wallets, peel chains, and mixer transactions."],"tools":["Chainalysis Reactor","WalletExplorer","OXT.me","Blockstream.info","blockchain.com API","OFAC SDN List"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Focuses specifically on passive blockchain forensics for ransomware payment wallets, using a structured workflow with public/enterprise explorers and cluster heuristics, rather than active interaction or general malware analysis."],"familyIds":["blockchain-ransomware-payment-forensics"]},{"id":"analyzing-sbom-for-supply-chain-vulnerabilities","summary":"Provides an expert workflow for analyzing SBOMs (CycloneDX/SPDX) to identify supply chain vulnerabilities via NVD CVE correlation, transitive dependency graph risk scoring, cross-validation with grype, and compliance report generation.","primaryDomain":"source-code-security","domainTags":["supply-chain-security","software-composition-analysis","dependency-management","sbom","cve-correlation"],"capabilityTags":["sbom-parsing","cve-correlation","dependency-graph-analysis","risk-scoring","compliance-reporting"],"capabilityDetails":["Parses CycloneDX and SPDX SBOM JSON formats, extracts components with PURL/CPE identifiers, queries NVD API for CVE correlation, builds dependency graphs, calculates risk scores, and generates compliance-oriented vulnerability reports."],"techniqueTags":["cyclonedx","spdx","nvd-api","cpe-correlation","purl-correlation","transitive-dependency-analysis","cvss-scoring"],"techniqueDetails":["Uses CPE and PURL identifiers to correlate components against NVD vulnerability data.","Applies network graph metrics (in-degree, shortest path, betweenness centrality) to assess transitive dependency risk.","Scores component risk based on CVSS and weights by dependency factors."],"tools":["syft","grype","nvdlib","cyclonedx-python-lib","lib4sbom","networkx","OWASP Dependency-Track","requests"],"targetTypes":["source-code","container","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting","remediation"],"distinctiveFeatures":["Focuses exclusively on SBOM file analysis rather than live system or container scanning.","Performs transitive dependency graph analysis to identify vulnerability propagation paths.","Cross-validates NVD findings with grype for broader coverage across multiple advisory databases.","Generates compliance-specific reports aligned with EO 14028 and EU CRA requirements."],"familyIds":["sca-dependency-scanning"]},{"id":"analyzing-security-logs-with-splunk","summary":"A Splunk-centric incident investigation playbook that correlates Windows, Sysmon, proxy, firewall, and DNS logs using SPL. It provides query examples for detecting brute force, pass-the-hash, lateral movement, process execution chains, C2 beaconing, DNS tunneling, and data exfiltration; reconstructs unified timelines; and creates persistent detection rules mapped to MITRE ATT&CK.","primaryDomain":"forensics","domainTags":["splunk","siem","log-analysis","security-monitoring","incident-response"],"capabilityTags":["splunk-investigation","log-correlation","timeline-reconstruction","detection-rule-creation","anomaly-detection"],"capabilityDetails":["Provides a workflow for investigating security incidents using Splunk Enterprise Security and SPL, covering log correlation, timeline reconstruction, and detection rule creation across multiple log sources."],"techniqueTags":["windows-event-log-analysis","sysmon-process-analysis","network-beacon-detection","dns-tunneling-detection","authentication-anomaly-detection","exfiltration-detection"],"techniqueDetails":["Uses SPL queries to analyze Windows Security Event Logs (4624, 4625, Logon Type 9/10), Sysmon process creation and LSASS access, proxy/firewall logs for beaconing and exfiltration, and DNS logs for tunneling."],"tools":["splunk","splunk-enterprise-security","sysmon","splunk-soar","splunk-attack-analyzer"],"targetTypes":["windows-host","network","active-directory"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Specializes in Splunk-specific investigation with ready-to-use SPL queries for Windows, Sysmon, proxy, firewall, and DNS logs; includes timeline reconstruction and creation of persistent correlation searches mapped to MITRE ATT&CK techniques."],"familyIds":["security-log-and-siem-investigation"]},{"id":"analyzing-slack-space-and-file-system-artifacts","summary":"Workflow for deep forensic analysis of NTFS images: extracts and analyzes slack space, MFT, USN Change Journal, and Alternate Data Streams to recover hidden/residual data, reconstruct deleted file metadata and file system activity, and detect anti-forensic techniques like timestomping.","primaryDomain":"forensics","domainTags":["ntfs-forensics","windows-forensics","file-system-artifacts"],"capabilityTags":["slack-space-analysis","mft-analysis","usn-journal-analysis","alternate-data-stream-analysis","deleted-file-recovery","timestomping-detection"],"capabilityDetails":["Provides a workflow for analyzing NTFS slack space, MFT entries, USN Change Journal, and Alternate Data Streams to recover hidden or residual data, reconstruct deleted file metadata, and reconstruct file system change activity."],"techniqueTags":["file-slack-carving","mft-timestamp-comparison","usn-journal-parsing","ads-extraction","timeline-reconstruction"],"techniqueDetails":["Uses blkls to extract slack space and keyword/carving searches to find hidden data.","Compares $STANDARD_INFORMATION and $FILE_NAME timestamps in MFT entries to detect timestomping.","Parses USN Change Journal records to reconstruct file creation, deletion, and rename sequences.","Uses fls and icat to enumerate and extract Alternate Data Streams, including Zone.Identifier streams."],"tools":["the-sleuth-kit","mftecmd","analyzemft","bulk_extractor","foremost"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Combines slack space, MFT, USN journal, and ADS analysis in one integrated workflow for NTFS images.","Includes custom Python scripts for MFT and USN parsing to detect timestomping and recover deleted file metadata.","Targets deep forensic analysis beyond standard file recovery, specifically hunting hidden data in ADS and slack."],"familyIds":["disk-and-file-system-forensics"]},{"id":"analyzing-supply-chain-malware-artifacts","summary":"Structured workflow and Python tooling to analyze supply chain attack artifacts by comparing trojanized binaries against legitimate versions, identifying injected code, signing anomalies, and tracing infection vectors.","primaryDomain":"reverse-engineering","domainTags":["supply-chain","malware-analysis","binary-analysis","trojanized-software"],"capabilityTags":["binary-diffing","code-signing-validation","artifact-comparison","malware-detection"],"capabilityDetails":["Provides a structured workflow and Python tooling to compare trojanized binaries against legitimate versions, detect new/modified PE sections, import changes, and code signing anomalies."],"techniqueTags":["pe-section-comparison","import-table-analysis","entropy-analysis","hash-comparison","code-signature-verification"],"techniqueDetails":["Uses PE structural comparison to identify new sections and import table changes; applies entropy to flag suspicious sections."],"tools":["pefile","ssdeep","hashlib","BinDiff","Diaphora","sigcheck","codesign"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation"],"distinctiveFeatures":["Specializes specifically in supply chain attack artifact analysis rather than generic malware analysis.","Includes a concrete Python script for automated PE binary comparison."],"familyIds":["malware-indicator-and-signature-development"]},{"id":"analyzing-threat-actor-ttps-with-mitre-attack","summary":"Systematically maps threat actor behavior to MITRE ATT&CK, generates Navigator heatmaps, identifies detection coverage gaps, and supports cross-group TTP comparison for actionable threat intelligence.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","mitre-attack","ttp-analysis"],"capabilityTags":["threat-actor-ttp-mapping","detection-gap-analysis","navigator-layer-generation","cross-group-ttp-comparison"],"capabilityDetails":["Provides a structured workflow for mapping threat actor behavior to MITRE ATT&CK techniques.","Generates ATT&CK Navigator heatmap layers to visualize technique coverage.","Identifies detection gaps by comparing actor techniques against existing detections.","Supports cross-group technique comparison to find common and unique TTPs."],"techniqueTags":["mitre-attack-mapping","navigator-heatmap-creation","detection-gap-analysis"],"techniqueDetails":["Uses ATT&CK Navigator layers to visualize and score threat actor technique coverage.","Applies STIX 2.1 Attack Pattern objects and TAXII queries for data retrieval."],"tools":["attackcti","mitreattack-python","stix2","ATT&CK Navigator"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting","knowledge-reference"],"distinctiveFeatures":["Focuses on MITRE ATT&CK framework for adversary TTP analysis rather than direct system exploitation.","Provides programmatic TAXII client workflows and ATT&CK Navigator layer generation.","Emphasizes detection gap analysis and cross-group comparison for defensive prioritization."],"familyIds":["mitre-attack-ttp-analysis-structuring"]},{"id":"analyzing-threat-actor-ttps-with-mitre-navigator","summary":"Maps APT group TTPs to MITRE ATT&CK using attackcti to query STIX data, generates Navigator layer files to visualize technique coverage and identify defense gaps.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","mitre-attack","ttp-mapping","stix-taxii","navigator"],"capabilityTags":["ttp-mapping","navigator-layer-generation","coverage-gap-analysis","attackcti-querying"],"capabilityDetails":["Provides a workflow for querying MITRE ATT&CK STIX data to map APT group TTPs and generate Navigator layer files for visualization and coverage gap assessment."],"techniqueTags":["mitre-attack-framework","stix-taxii-query","navigator-visualization","apt-profiling"],"techniqueDetails":["Uses attackcti to query ATT&CK STIX/TAXII data and extract group-technique associations."],"tools":["attackcti","stix2","MITRE ATT&CK Navigator"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","validation"],"distinctiveFeatures":["Focuses on generating ATT&CK Navigator layer files from STIX/TAXII queries rather than manual framework mapping; emphasizes coverage gap analysis against specific APT profiles."],"familyIds":["mitre-attack-ttp-analysis-structuring"]},{"id":"analyzing-threat-intelligence-feeds","summary":"Structured workflow for analyzing structured and unstructured CTI feeds, scoring feed quality, normalizing IOCs to STIX 2.1, deduplicating, enriching with commercial intelligence, and distributing indicators to SIEM/EDR systems.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","stix","taxii","indicators-of-compromise"],"capabilityTags":["threat-intelligence-analysis","ioc-normalization","feed-quality-assessment","ioc-enrichment"],"capabilityDetails":["Provides a workflow for ingesting, prioritizing, normalizing, deduplicating, enriching, and distributing CTI feeds."],"techniqueTags":["stix-2-1","taxii-2-1","ioc-deduplication","feed-scoring"],"techniqueDetails":["Uses STIX 2.1 indicators and relationships to structure IOCs.","Uses TAXII 2.1 for feed collection and distribution.","Applies weighted scoring to feed sources based on fidelity and relevance.","Enriches surviving IOCs with VirusTotal, PassiveTotal, and Shodan data."],"tools":["threatconnect","misp","opencti","recorded-future","taxii2-client","pymisp"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","detection","knowledge-reference"],"distinctiveFeatures":["Covers end-to-end CTI feed lifecycle including feed scoring, STIX normalization, TLP-aware handling, and TTL management for distribution."],"familyIds":["threat-intelligence-data-and-ioc-management"]},{"id":"analyzing-threat-landscape-with-misp","summary":"A workflow for querying MISP via PyMISP to compute event statistics, IOC type distributions, threat actor galaxy clusters, and tag trends, and generate temporal threat landscape reports.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","misp","ioc-analysis","cti","threat-landscape"],"capabilityTags":["misp-querying","ioc-type-analysis","threat-actor-tracking","temporal-trend-analysis","threat-report-generation"],"capabilityDetails":["Provides a workflow to connect to a MISP instance via PyMISP, pull events within a date range, compute statistics on threat levels and attribute types, identify top MITRE ATT&CK techniques and threat actors via galaxy clusters, and produce a landscape report with temporal trends."],"techniqueTags":["misp-api","statistical-aggregation","temporal-trend-analysis","galaxy-cluster-analysis"],"techniqueDetails":["Uses PyMISP to fetch events and attributes, then aggregates counts by type, threat level, and date; correlates galaxy clusters with threat actors and MITRE tags to identify trends."],"tools":["pymisp","misp"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","reporting"],"distinctiveFeatures":["Specialized for MISP threat landscape reporting with time-bounded event statistics and IOC type breakdowns, rather than generic threat intel aggregation."],"familyIds":["specialized-threat-intel-source-analysis"]},{"id":"analyzing-tls-certificate-transparency-logs","summary":"Practical workflow for querying Certificate Transparency logs via crt.sh and pycrtsh to proactively discover phishing domains, unauthorized certificates, and typosquatting infrastructure.","primaryDomain":"reconnaissance","domainTags":["certificate-transparency","phishing-detection","tls-monitoring","typosquatting"],"capabilityTags":["ct-log-querying","typosquatting-detection","certificate-monitoring"],"capabilityDetails":["Provides a workflow for querying crt.sh CT logs to discover phishing domains and unauthorized certificates."],"techniqueTags":["osint","levenshtein-distance","certificate-log-querying"],"techniqueDetails":["Uses Levenshtein distance to identify typosquatted domain variations."],"tools":["pycrtsh","crt.sh"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","analysis"],"distinctiveFeatures":["Combines CT log queries with fuzzy string matching for typosquatting detection","Focused on proactive monitoring rather than incident response"],"familyIds":["certificate-transparency-monitoring"]},{"id":"analyzing-typosquatting-domains-with-dnstwist","summary":"Provides an operational workflow using dnstwist to generate domain permutations, detect registered typosquatting/homograph domains, assess phishing risk via DNS and web similarity, and produce blocklists/takedown reports.","primaryDomain":"reconnaissance","domainTags":["typosquatting","domain-monitoring","dns","phishing"],"capabilityTags":["typosquatting-detection","domain-permutation-generation","dns-resolution-checking","web-similarity-scoring","risk-prioritization","continuous-monitoring"],"capabilityDetails":["Provides automated discovery and analysis of lookalike domains using dnstwist, including DNS record checks, web page similarity comparison, risk scoring, continuous monitoring, and export of blocklists and takedown reports."],"techniqueTags":["domain-permutation","dns-resolution","fuzzy-hashing","perceptual-hashing","risk-scoring","homoglyph-detection"],"techniqueDetails":["Generates domain permutations using addition, omission, transposition, homoglyph, bitsquatting, and dictionary-based techniques; checks DNS records; compares web page similarity using ssdeep and pHash; scores risk based on similarity, MX presence, registration age, and IP divergence."],"tools":["dnstwist"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["End-to-end typosquatting monitoring workflow that not only lists permutations but also assigns risk scores, tracks newly discovered domains over time, and produces ready-to-use blocklist and takedown reports."],"familyIds":["domain-impersonation-detection"]},{"id":"analyzing-uefi-bootkit-persistence","summary":"Provides a structured workflow for analyzing UEFI bootkit persistence, including SPI flash dumping, UEFI variable inspection, ESP integrity checks, Secure Boot bypass detection, and known bootkit signature scanning, using chipsec and related tools.","primaryDomain":"forensics","domainTags":["uefi","bootkit","firmware-security","secure-boot","esp"],"capabilityTags":["uefi-bootkit-analysis","firmware-integrity-verification","secure-boot-bypass-detection","boot-chain-integrity"],"capabilityDetails":["Provides a structured workflow for detecting and analyzing UEFI bootkit persistence using chipsec, UEFITool, and YARA across SPI flash, UEFI variables, and the EFI System Partition."],"techniqueTags":["spi-flash-dumping","uefi-variable-inspection","esp-file-hashing","yara-signature-scanning","secure-boot-auditing","boot-chain-integrity-check"],"techniqueDetails":["Uses chipsec commands to dump SPI flash and read UEFI variables, hashes EFI binaries on the ESP, scans firmware with UEFI-specific YARA rules, and checks Secure Boot configuration for bypass indicators."],"tools":["chipsec","UEFITool","flashrom","YARA","sigcheck","Volatility"],"targetTypes":["windows-host","binary","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting","remediation"],"distinctiveFeatures":["Specializes specifically in UEFI bootkit persistence rather than general malware analysis","Covers both SPI flash firmware implants and ESP-based boot loaders","Includes Secure Boot bypass detection and known bootkit family attribution (BlackLotus, LoJax, MoonBounce)"],"familyIds":["uefi-bootkit-forensics"]},{"id":"analyzing-usb-device-connection-history","summary":"Provides a Windows forensics workflow to reconstruct USB device connection history by correlating registry keys, SetupAPI logs, and event logs, enabling timeline creation and identification of removable media exfiltration.","primaryDomain":"forensics","domainTags":["usb-forensics","windows-registry-analysis","digital-forensics","removable-media"],"capabilityTags":["usb-history-reconstruction","removable-media-analysis","timeline-correlation","data-exfiltration-investigation"],"capabilityDetails":["Provides a workflow for correlating Windows registry keys (USBSTOR, MountedDevices, MountPoints2), SetupAPI logs, and Event Logs to reconstruct USB device connection history, including first/last connected timestamps and drive letter mappings."],"techniqueTags":["registry-artifact-analysis","setupapi-log-parsing","event-log-forensics","timeline-creation"],"techniqueDetails":["Uses registry timestamp analysis and log parsing to infer device connection events and build a chronological timeline of USB activity."],"tools":["python-registry","evtx","USBDeview","RegRipper","KAPE","Plaso","Velociraptor"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Focuses specifically on USB device connection history for forensics, combining registry, setupapi, and event log analysis into a cohesive timeline workflow.","Includes concrete Python scripts for parsing USBSTOR, MountedDevices, and MountPoints2, plus scenario-based guidance for exfiltration and insider threat investigations."],"familyIds":["windows-registry-artifact-forensics"]},{"id":"analyzing-web-server-logs-for-intrusion","summary":"Provides a structured workflow to parse Apache/Nginx access logs, detect SQL injection, LFI, XSS, scanner fingerprints, and brute-force patterns using regex signatures, GeoIP enrichment, and anomaly detection, and generate a prioritized intrusion findings report.","primaryDomain":"web-security","domainTags":["sql-injection","local-file-inclusion","directory-traversal","xss","brute-force"],"capabilityTags":["log-analysis","intrusion-detection","attack-signature-matching","geoip-enrichment","anomaly-detection"],"capabilityDetails":["Parses Apache/Nginx access logs, applies regex-based OWASP attack signatures, performs GeoIP enrichment, and uses statistical anomaly detection to identify web intrusion attempts."],"techniqueTags":["regex-pattern-matching","log-parsing","geoip-enrichment","user-agent-analysis","statistical-anomaly-detection"],"techniqueDetails":["Uses regex matching for attack patterns, parses combined log format, enriches IPs with GeoIP, analyzes user agents for scanner fingerprints, and detects outliers in request frequency and response size."],"tools":["python","geoip2","user-agents"],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Combines regex-based OWASP attack signatures with GeoIP enrichment and statistical anomaly detection specifically for Apache/Nginx access log intrusion hunting, not just general log parsing."],"familyIds":["web-attack-evidence-analysis"]},{"id":"analyzing-windows-amcache-artifacts","summary":"A specialist playbook for parsing Windows Amcache.hve using Eric Zimmerman's AmcacheParser and Timeline Explorer to extract evidence of program execution, application installation, and driver loading, including SHA-1 hash correlation with threat intel and timeline reconstruction for DFIR investigations.","primaryDomain":"forensics","domainTags":["windows-forensics","amcache","program-execution","digital-forensics"],"capabilityTags":["amcache-parsing","program-execution-evidence","hash-correlation","timeline-reconstruction","driver-loading-analysis"],"capabilityDetails":["Provides a workflow for parsing Windows Amcache.hve with AmcacheParser and Timeline Explorer to extract evidence of program execution, application installation, and driver loading, including SHA-1 hash correlation with threat intel and timeline reconstruction."],"techniqueTags":["registry-hive-parsing","sha1-threat-intel-lookup","timeline-correlation","pe-compile-timestamp-analysis","driver-signature-analysis"],"techniqueDetails":["Replays transaction logs to recover complete hive data","Correlates SHA-1 hashes against VirusTotal, CIRCL, and NSRL","Combines Amcache with Prefetch and ShimCache for execution timelines","Uses LinkDate vs file system timestamps to detect timestomping","Identifies unsigned third-party drivers as potential rootkits"],"tools":["AmcacheParser","Timeline Explorer","KAPE","Registry Explorer","vt-cli"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation"],"distinctiveFeatures":["Focuses specifically on Amcache.hve artifact analysis rather than general Windows forensics","Covers driver binary analysis for rootkit and BYOVD detection","Includes step-by-step workflow for SHA-1 hash correlation with multiple threat intel sources"],"familyIds":["windows-execution-artifact-forensics"]},{"id":"analyzing-windows-event-logs-in-splunk","summary":"Provides a structured SOC workflow to detect Windows authentication attacks, privilege escalation, persistence, and lateral movement using Splunk SPL queries on Windows Security and Sysmon event logs, including forensic timeline construction and MITRE ATT&CK mapping.","primaryDomain":"windows-security","domainTags":["windows-event-logs","splunk","sysmon","active-directory","mitre-attack"],"capabilityTags":["authentication-attack-detection","privilege-escalation-detection","persistence-detection","lateral-movement-detection","forensic-timeline-analysis","spl-query-development"],"capabilityDetails":["Provides a structured workflow for detecting Windows authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using Splunk SPL queries on Security and Sysmon event logs."],"techniqueTags":["event-id-correlation","sysmon-event-analysis","logon-type-analysis","spl-querying","mitre-attack-mapping"],"techniqueDetails":["Uses Windows Security Event IDs (e.g., 4625, 4624, 4720) and Sysmon Event IDs (e.g., 1, 10, 13) to identify malicious behavior, with Logon Type analysis for lateral movement and status code interpretation for authentication failures."],"tools":["Splunk Enterprise","Sysmon","Splunk CIM","Windows Event Forwarding"],"targetTypes":["windows-host","active-directory"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Maps each detection step to MITRE ATT&CK techniques across multiple attack phases, provides ready-to-use SPL queries for both Security and Sysmon event sources, and includes a forensic timeline builder and lookup table creation for enrichment."],"familyIds":["windows-event-log-siem-hunting"]},{"id":"analyzing-windows-lnk-files-for-artifacts","summary":"Parses Windows LNK shortcut files to extract target paths, MAC timestamps, volume serial numbers, and machine identifiers for forensic timeline reconstruction, including tracking removable media and network share access.","primaryDomain":"forensics","domainTags":["windows-security","digital-forensics","artifact-analysis"],"capabilityTags":["lnk-file-analysis","shortcut-forensics","timeline-reconstruction","evidence-collection"],"capabilityDetails":["Provides a workflow for collecting Windows LNK shortcut files from forensic images and parsing them to extract target paths, MAC timestamps, volume serial numbers, machine IDs, and MAC addresses for forensic timeline reconstruction."],"techniqueTags":["shell-link-parsing","jumplist-analysis","distributed-link-tracker-analysis","timestamp-extraction"],"techniqueDetails":["Uses LECmd, JLECmd, and LnkParse3 to parse the Shell Link binary format, including embedded target timestamps, drive volume metadata, and Distributed Link Tracker (machine ID/MAC) data."],"tools":["LECmd","JLECmd","LnkParse3"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses specifically on Windows LNK shortcut artifacts for forensic timeline reconstruction, including tracking file access from removable media and network shares, rather than general Windows memory or filesystem analysis."],"familyIds":["windows-execution-artifact-forensics"]},{"id":"analyzing-windows-prefetch-with-python","summary":"Parses Windows Prefetch files using the windowsprefetch Python library to reconstruct program execution history, run counts, accessed files, and timelines, enabling detection of renamed or masquerading binaries and suspicious execution patterns during incident response.","primaryDomain":"forensics","domainTags":["windows-forensics","digital-forensics","incident-response"],"capabilityTags":["prefetch-file-parsing","execution-history-reconstruction","renamed-binary-detection","suspicious-execution-detection"],"capabilityDetails":["Provides a workflow for parsing Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, run counts, accessed directories, and volumes, and to detect renamed or masquerading binaries and suspicious execution patterns."],"techniqueTags":["prefetch-artifact-analysis","binary-masquerading-detection","execution-timeline-analysis","dll-correlation-analysis"],"techniqueDetails":["Uses the windowsprefetch library to parse .pf files, extracts execution metadata, and correlates executable names with loaded DLLs to identify potential masquerading binaries."],"tools":["windowsprefetch"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses specifically on Windows Prefetch (.pf) artifacts and the windowsprefetch Python library","Emphasizes renamed/masquerading binary detection by correlating executable names with loaded DLLs/resources","Provides a structured incident-response workflow with execution timeline reconstruction and suspicious execution flagging"],"familyIds":["windows-execution-artifact-forensics"]},{"id":"analyzing-windows-registry-for-artifacts","summary":"Provides a structured DFIR workflow to extract Windows Registry hives from a forensic image and analyze them using RegRipper, Registry Explorer, and python-registry to uncover persistence mechanisms, user activity, installed software, and USB device history.","primaryDomain":"forensics","domainTags":["windows-registry","digital-forensics","artifact-analysis"],"capabilityTags":["registry-analysis","persistence-detection","user-activity-reconstruction","usb-device-investigation"],"capabilityDetails":["Extracts and parses Windows Registry hives to identify autorun/persistence entries, program execution history (UserAssist), recent documents, installed software, USB devices, and network configuration."],"techniqueTags":["registry-hive-extraction","autorun-key-analysis","userassist-decoding","mru-parsing","last-write-time-correlation"],"techniqueDetails":["Uses RegRipper plugins and python-registry scripts to parse specific keys; decodes ROT13 UserAssist values; correlates last write timestamps with other artifacts."],"tools":["RegRipper","Registry Explorer","python-registry","RECmd","yarp","AppCompatCacheParser","AmcacheParser","ShellBags Explorer"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection"],"distinctiveFeatures":["Specializes in registry-specific forensic artifacts (UserAssist, autorun keys, USBSTOR) rather than general Windows forensics; provides concrete command workflows for RegRipper and python-registry."],"familyIds":["windows-registry-artifact-forensics"]},{"id":"analyzing-windows-shellbag-artifacts","summary":"Provides DFIR analysts a workflow for analyzing Windows Shellbag (BagMRU) registry artifacts to reconstruct folder browsing history, including removable media and network share access, even after folders are deleted, using SBECmd and ShellBags Explorer.","primaryDomain":"forensics","domainTags":["windows-registry","shellbags","digital-forensics","dfir"],"capabilityTags":["shellbag-analysis","folder-access-reconstruction","removable-media-access-detection","network-share-access-detection"],"capabilityDetails":["Provides a workflow for parsing Windows Shellbag (BagMRU) registry artifacts to reconstruct folder browsing activity and prove user interaction with directories, including removable media and network shares, even for deleted folders."],"techniqueTags":["bagmru-key-analysis","shell-item-decoding","timeline-correlation","artifact-correlation"],"techniqueDetails":["Exploits BagMRU hierarchical key structure and parses Shell Item (SHITEMID) binary blobs; uses SBECmd for command-line batch parsing and ShellBags Explorer for interactive hierarchical exploration; correlates timestamps to reconstruct folder access timelines."],"tools":["SBECmd","ShellBags Explorer"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection","knowledge-reference"],"distinctiveFeatures":["Focuses on the specific Windows Shellbag (BagMRU) artifact rather than general registry forensics; provides concrete forensic scenarios for USB, network share, and deleted-folder access; includes both CLI and GUI tool workflows."],"familyIds":["windows-registry-artifact-forensics"]},{"id":"android-pentesting-tricks","summary":"Expert Android pentesting playbook covering SSL pinning bypass, exported component abuse, WebView exploitation, intent redirection, root detection/bypass, Play Integrity evasion, tapjacking, and backup extraction, with command examples and a decision tree.","primaryDomain":"mobile-security","domainTags":["android-security","mobile-application-security"],"capabilityTags":["ssl-pinning-bypass","exported-component-abuse","webview-exploitation","intent-redirection","root-detection-bypass","play-integrity-bypass","tapjacking-testing","backup-extraction"],"capabilityDetails":["Provides practical techniques to bypass SSL pinning using Frida, Objection, network security config, and Magisk modules.","Covers exploitation of exported activities, content providers, broadcast receivers, and services.","Includes WebView JavaScript bridge RCE, file access abuse, and deep link to WebView attack chains.","Describes intent redirection patterns to start non-exported components.","Offers root detection bypass via Frida hooks and Magisk DenyList, and Play Integrity evasion techniques.","Details tapjacking/overlay attacks and ADB backup extraction for sensitive data."],"techniqueTags":["frida-hooking","objection-sslpinning-disable","network-security-config-override","magisk-denylist","adb-intent-launch","content-provider-sql-injection","content-provider-path-traversal","broadcast-intent-injection","webview-javascript-interface-rce","file-scheme-access-abuse","intent-in-intent","frida-root-detection-hooks","play-integrity-fix","overlay-attack","adb-backup-extraction","run-as-debuggable","drozer-attack-surface"],"techniqueDetails":["Uses Frida to hook TrustManager, CertificatePinner, SSLContext, WebView SSL error callbacks, and root detection checks.","Leverages adb commands to launch exported activities and inject crafted extras into components.","Exploits WebView settings and JavaScript interfaces for code execution and data theft.","Utilizes Magisk DenyList and Play Integrity Fix modules to hide root and pass attestation.","Extracts application data from ADB backups and debuggable run-as access."],"tools":["Frida","Objection","adb","aapt","Drozer","Magisk","LSPosed","openssl"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","exploitation","post-exploitation"],"distinctiveFeatures":["Android-specific multi-layer attack playbook rather than a single technique guide.","Includes a decision tree mapping test findings to exploitation paths.","Contains comprehensive Frida hook point tables for SSL pinning and root detection.","Covers both traditional app component attacks and modern Play Integrity/tapjacking bypasses."],"familyIds":["mobile-app-penetration-testing"]},{"id":"anti-debugging-techniques","summary":"Comprehensive playbook for detecting and bypassing anti-debugging protections on Linux and Windows, covering API patches, PEB flags, timing and exception-based checks, with a decision tree and tool compatibility guidance.","primaryDomain":"reverse-engineering","domainTags":["anti-debugging","binary-protection","debugger-detection"],"capabilityTags":["anti-debug-detection","anti-debug-bypass","debugger-evasion","protection-analysis"],"capabilityDetails":["Provides a structured playbook for identifying and neutralizing anti-debugging checks in Linux and Windows binaries."],"techniqueTags":["ptrace","peb-flags","ntqueryinformationprocess","timing-attacks","exception-handling","tls-callbacks","hardware-breakpoint-detection"],"techniqueDetails":["Covers ptrace self-attach, /proc/self/status TracerPid, rdtsc timing, SIGTRAP/INT 2D exception tricks, PEB BeingDebugged/NtGlobalFlag, NtQueryInformationProcess classes, hardware breakpoint register checks, TLS callbacks, and ThreadHideFromDebugger."],"tools":["GDB","x64dbg","WinDbg","Frida","ScyllaHide","TitanHide","Qiling","LD_PRELOAD"],"targetTypes":["binary","linux-host","windows-host","ctf"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Unified Linux and Windows anti-debug playbook with decision tree and systematic bypass methodology","Includes CTF patterns and real-world protector bypass recommendations"],"familyIds":["binary-protection-and-anti-analysis-bypass"]},{"id":"api-auth-and-jwt-abuse","summary":"Playbook for testing API authentication boundaries by attacking JWT trust, mass assignment fields, header spoofing, and rate limit bypasses, with routing links to deeper JWT/OAuth/GraphQL skills.","primaryDomain":"api-security","domainTags":["authentication","jwt","api-security","authorization"],"capabilityTags":["jwt-attacks","token-manipulation","rate-limit-bypass","mass-assignment-testing","header-spoofing","auth-bypass-testing"],"capabilityDetails":["Provides a playbook for assessing API authentication boundaries, focusing on JWT trust, bearer tokens, API keys, and weak request identity signals.","Covers token triage to inspect algorithm, key ID, issuer, audience, and privilege claims.","Includes quick attack picks for common JWT implementation flaws such as alg:none, RS256 to HS256 confusion, kid lookup trust, and remote key fetch trust.","Details mass assignment field testing and header spoofing to bypass rate limits and abuse batch endpoints."],"techniqueTags":["alg-none","rs256-to-hs256","kid-injection","jku-x5u-trust","jwt-secret-cracking","header-spoofing","mass-assignment","graphql-batch-abuse","rate-limit-bypass"],"techniqueDetails":["Uses unsigned tokens or algorithm confusion to bypass JWT signature verification.","Exploits trust in attacker-controlled header fields like kid, jku, and x5u.","Abuses client-supplied IP headers (X-Forwarded-For, X-Real-IP, Forwarded) and user-agent rotation to evade rate limits.","Tests mass assignment on fields like role, isAdmin, admin, permissions, and org.","Uses batch/GraphQL arrays to make multiple authentication requests in a single call."],"tools":[],"targetTypes":["api","web-application","mobile"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","exploitation"],"distinctiveFeatures":["Combines JWT algorithm attacks with rate-limit bypass and mass assignment testing in a single API-focused playbook.","Serves as a routing hub to more specialized skills for GraphQL hidden parameters, OAuth/OIDC misconfiguration, CORS, and deeper JWT attacks.","Distinct from generic JWT references by emphasizing API authentication boundary weaknesses and batch abuse."],"familyIds":["api-authentication-and-token-security"]},{"id":"api-authorization-and-bola","summary":"Playbook for testing API authorization flaws: BOLA, BFLA, method abuse, and mass assignment via cross-account replay and hidden field payloads.","primaryDomain":"api-security","domainTags":["api-security","authorization","bola"],"capabilityTags":["bola-testing","bfla-testing","mass-assignment-testing","authorization-testing"],"capabilityDetails":["Provides a focused playbook for testing API authorization flaws including object-level (BOLA), function-level (BFLA), HTTP method abuse, and hidden writable fields."],"techniqueTags":["cross-account-replay","object-id-manipulation","http-method-abuse","mass-assignment"],"techniqueDetails":["Uses two-account replay loop to detect broken object authorization.","Explores alternate HTTP verbs and nested routes to uncover weak authorization.","Injects hidden JSON fields (role, isAdmin, verified) to test mass assignment."],"tools":[],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on API authorization boundaries and mass assignment, complementing broader IDOR and JWT-focused skills.","Emphasizes hidden writable fields and alternate HTTP verbs in addition to direct object ID replacement."],"familyIds":["api-authorization-and-data-exposure-testing"]},{"id":"api-recon-and-docs","summary":"A specialist API reconnaissance playbook that discovers endpoints, OpenAPI specs, schema details, versions, and hidden API surface area, then routes to relevant API attack skills.","primaryDomain":"api-security","domainTags":["api-reconnaissance","documentation-review","endpoint-discovery"],"capabilityTags":["api-endpoint-discovery","openapi-spec-review","api-doc-enumeration","version-drift-analysis"],"capabilityDetails":["Provides a workflow for discovering API entry points via JavaScript/client-side mining and common documentation paths.","Extracts schema details, optional fields, deprecated endpoints, and hidden parameters from OpenAPI specs and docs.","Identifies API version and product drift across v1, v2, mobile, and legacy paths.","Routes to downstream API attack skills based on findings."],"techniqueTags":["javascript-mining","common-path-probing","schema-extraction","graphql-endpoint-detection"],"techniqueDetails":["Uses grep on app.js to extract API paths.","Probes common documentation and schema locations.","Checks versioned endpoint and mobile/legacy paths.","Looks for schema hints and parameter names in API docs."],"tools":["curl"],"targetTypes":["api","web-application","mobile"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","analysis"],"distinctiveFeatures":["Focuses on API documentation, schema, and version surface discovery before exploitation.","Includes a routing table to downstream API authorization, auth, GraphQL, and business logic skills."],"familyIds":["api-asset-discovery-and-reconnaissance"]},{"id":"api-sec","summary":"Entry P1 router for API security testing; triages to API recon/docs, authorization/BOLA, JWT/auth abuse, and GraphQL/hidden-parameter playbooks.","primaryDomain":"api-security","domainTags":["api-security","web-api","rest-api"],"capabilityTags":["api-security-router","skill-routing","api-testing-triage"],"capabilityDetails":["Provides an entry P1 router for API security testing, selecting between API recon/docs, authorization/BOLA, JWT/auth abuse, and GraphQL/hidden-parameter tracks."],"techniqueTags":["api-testing-methodology","decision-tree","skill-selection"],"techniqueDetails":["Uses a quick-triage table mapping API observations (Swagger, IDs in URLs, JWT, GraphQL) to dedicated sub-skill tracks."],"tools":[],"targetTypes":["api","web-application","mobile"],"role":"router","workflowFocus":["navigation","analysis"],"distinctiveFeatures":["Pure routing skill with an observation-to-track triage table; does not contain deep API testing procedures, but maps to four specialized API security playbooks."],"familyIds":["api-security-routing-and-triage"]},{"id":"api-security-testing","summary":"Workflow for security-testing REST, GraphQL, and gRPC APIs with Strix autonomous agents; enumerates endpoints from schemas or crawling, exploits OWASP API Security Top 10 vulnerability classes, and provides verified PoC requests for reporting.","primaryDomain":"api-security","domainTags":["authorization","injection","ssrf","graphql"],"capabilityTags":["api-penetration-testing","endpoint-enumeration","owasp-api-top-10-coverage","proof-of-concept-generation"],"capabilityDetails":["Provides an autonomous-agent workflow to enumerate API endpoints from OpenAPI/GraphQL schemas or crawling, and exploit API-specific vulnerability classes from the OWASP API Security Top 10 (2023), including BOLA/IDOR, broken property-level authorization (mass assignment and excessive data exposure), broken function-level authorization, SSRF, injection, and resource consumption."],"techniqueTags":["bola","idor","mass-assignment","excessive-data-exposure","broken-function-level-authorization","ssrf","injection","unrestricted-resource-consumption"],"techniqueDetails":["Uses tenant-scoped token pairs to prove BOLA and IDOR; compares low-privilege vs admin tokens to prove broken function-level authorization; tests mass assignment and field exposure via object property-level authorization; scans for SSRF and injection via schema-derived requests; checks for resource exhaustion."],"tools":["strix","curl"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses on API-specific OWASP API Security Top 10 classes rather than web UI security; requires multiple tenant/low-privilege credentials to prove authorization flaws; parses OpenAPI/GraphQL/Postman/gRPC definitions for endpoint discovery; delivers working PoC requests for each finding."],"familyIds":["general-api-security-assessment"]},{"id":"application-security-testing","summary":"Entry-point skill that selects and sequences the appropriate security test for each application asset (source, web app, API, CI) and consolidates findings into a single remediation plan ranked by proven exploitability.","primaryDomain":"general-pentesting","domainTags":["application-security","security-assessment","orchestration"],"capabilityTags":["test-selection","result-consolidation","coverage-analysis"],"capabilityDetails":["Maps application assets (source, web app, API, CI) to the appropriate specialized security test and consolidates findings into a ranked remediation plan by proven impact."],"techniqueTags":["asset-mapping","risk-ranking"],"techniqueDetails":["Selects the right security test skill based on asset type and stage; ranks merged findings by validated exploitability rather than static severity."],"tools":["strix"],"targetTypes":["web-application","api","source-code"],"role":"router","workflowFocus":["navigation","reconnaissance","analysis","reporting"],"distinctiveFeatures":["Entry-point orchestration skill that routes to leaf testing skills and produces a single consolidated, exploitability-ranked plan; explicitly handles coverage limitations and deduplicates cross-asset findings."],"familyIds":["security-test-routing-and-orchestration"]},{"id":"arbitrary-write-to-rce","summary":"Expert playbook for converting an arbitrary write primitive into code execution, with glibc-version-aware overwrite targets from GOT and hooks to _IO_FILE, __exit_funcs, TLS_dtor_list, modprobe_path, and setcontext pivots.","primaryDomain":"binary-exploitation","domainTags":["arbitrary-write","code-execution","glibc-internals"],"capabilityTags":["arbitrary-write-to-rce","overwrite-target-selection","glibc-version-aware-exploitation","pointer-mangling-bypass"],"capabilityDetails":["Provides an expert playbook for converting an arbitrary write primitive into code execution by selecting and exploiting the appropriate overwrite target based on glibc version, RELRO, and pointer mangling constraints."],"techniqueTags":["got-overwrite","malloc-free-hook-overwrite","io-file-vtable","exit-funcs","tls-dtor-list","setcontext-gadget","modprobe-path-overwrite","fini-array-overwrite","cpp-vtable-overwrite"],"techniqueDetails":["Covers GOT overwrite, malloc/free hooks, _IO_FILE vtable (FSOP), __exit_funcs, TLS_dtor_list, _dl_fini, modprobe_path, .fini_array, C++ vtable, and setcontext pivot gadgets."],"tools":["pwntools"],"targetTypes":["binary","linux-host"],"role":"specialist-playbook","workflowFocus":["exploitation"],"distinctiveFeatures":["Provides a glibc-version-aware decision tree mapping every major overwrite target from GOT and hooks to post-2.34 alternatives like TLS_dtor_list, including pointer mangling requirements and setcontext pivot usage."],"familyIds":["arbitrary-write-to-rce"]},{"id":"assessing-vector-and-embedding-weaknesses","summary":"A specialized playbook for assessing security weaknesses in RAG vector stores and embedding endpoints, providing operational procedures for embedding inversion, membership inference, multi-tenant leakage, knowledge-base poisoning, and indirect prompt injection, with Python examples and remediation guidance.","primaryDomain":"general-pentesting","domainTags":["ai-security","rag-security","vector-database","owasp-llm08","multi-tenant-isolation"],"capabilityTags":["vector-store-security-assessment","embedding-inversion-testing","membership-inference-testing","multi-tenant-isolation-testing","knowledge-base-poisoning-testing","indirect-prompt-injection-detection"],"capabilityDetails":["Provides a structured workflow for assessing security weaknesses in RAG vector stores, covering five vulnerability classes from OWASP LLM08:2025.","Includes Python-based procedures for testing embedding inversion, membership inference, cross-tenant leakage, and knowledge-base poisoning.","Guides testers through inventorying the RAG pipeline, executing tests, and reporting remediation steps."],"techniqueTags":["embedding-inversion","membership-inference","cross-tenant-data-leakage","knowledge-base-poisoning","indirect-prompt-injection","retrieval-manipulation"],"techniqueDetails":["Embedding inversion: reconstructs source text from embeddings using hill-climbing candidates and cosine similarity.","Membership inference: measures retrieval similarity deltas to determine if a document is in the corpus.","Cross-tenant leakage: validates that server-side filters enforce tenant isolation and client-side filters are not relied upon.","Knowledge-base poisoning: inserts benign canary chunks into a test collection to measure retrieval dominance.","Indirect prompt injection: scans retrieved chunks for injection markers using regex patterns."],"tools":["sentence-transformers","qdrant-client","vec2text","chromadb","weaviate-client","pinecone-client","scikit-learn"],"targetTypes":["database","api"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","exploitation","remediation","reporting"],"distinctiveFeatures":["Focused exclusively on RAG vector-store weaknesses per OWASP LLM08, not general web/API vulnerabilities.","Includes concrete, copy-paste Python test snippets for embedding inversion, membership inference, multi-tenant isolation, and poisoning in vector databases.","Stresses testing server-side isolation enforcement rather than trusting client-supplied filters.","Covers both data confidentiality (inversion, membership, leakage) and data integrity (poisoning, indirect injection) in the retrieval layer."],"familyIds":["ai-ml-security-testing"]},{"id":"attacking-entra-id-with-roadtools","summary":"Operational ROADtools playbook for enumerating Microsoft Entra ID tenants, acquiring and exchanging tokens across resources, and abusing primary refresh tokens during authorized red-team engagements.","primaryDomain":"cloud-security","domainTags":["entra-id","azure-ad","token-manipulation","cloud-enumeration"],"capabilityTags":["tenant-enumeration","token-acquisition","token-exchange","prt-abuse"],"capabilityDetails":["Provides workflow to enumerate Entra ID directory objects using ROADrecon and acquire/exchange tokens via roadtx, including primary refresh token operations."],"techniqueTags":["device-code-flow","ropc","refresh-token-exchange","primary-refresh-token","foci-pivot"],"techniqueDetails":["Uses OAuth device flow, ROPC, refresh token redemption, and PRT-based SSO to obtain and pivot access across resources."],"tools":["roadrecon","roadtx","bloodhound"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","exploitation","post-exploitation"],"distinctiveFeatures":["Focuses specifically on the ROADtools toolkit for Entra ID attacks, including PRT operations and FOCI-aware cross-client token exchange rather than generic cloud reconnaissance."],"familyIds":["cloud-offensive-security-and-emulation"]},{"id":"attacking-oauth-with-device-code-phishing","summary":"Provides an offensive workflow for authorized red teams to perform OAuth device-code phishing and illicit consent grant attacks against Microsoft Entra ID, capturing access and refresh tokens, bypassing MFA via the legitimate device-login page, pivoting across Microsoft 365 services, and enumerating impact with ROADtools.","primaryDomain":"authentication","domainTags":["oauth","identity-access-management","microsoft-entra-id","device-code-phishing","token-theft"],"capabilityTags":["device-code-phishing","illicit-consent-grant","mfa-bypass","token-refresh","token-replay"],"capabilityDetails":["Provides a step-by-step attack workflow for OAuth device-code phishing against Microsoft Entra ID, including initiating device code requests, phishing users to authenticate on the legitimate Microsoft device-login page, and polling for tokens.","Covers the illicit consent grant variant, registering a malicious multi-tenant app and phishing consent to obtain durable delegated Graph permissions.","Demonstrates how to use captured refresh tokens to pivot across Microsoft 365 services (Outlook, Teams, Graph, Azure Resource Manager) and enumerate access with ROADtools."],"techniqueTags":["device-code-flow-abuse","consent-grant-attack","refresh-token-replay","phishing","token-theft"],"techniqueDetails":["Abuses the OAuth 2.0 Device Authorization Grant (RFC 8628) by initiating a flow on an attacker-controlled device and tricking a victim into completing authentication, resulting in attacker-controlled tokens.","Uses the legitimate Microsoft device-login page to bypass user suspicion and satisfy MFA on the victim's side.","Exchanges refresh tokens (with offline_access) for new tokens scoped to different first-party resources, preserving access across services.","Registers a multi-tenant app and phishes user consent for delegated Graph permissions, creating persistent service-principal grants."],"tools":["TokenTactics","ROADtools","AADInternals"],"targetTypes":["cloud","api"],"role":"specialist-playbook","workflowFocus":["exploitation","post-exploitation","enumeration"],"distinctiveFeatures":["Focuses specifically on OAuth device-code and consent-grant phishing against Microsoft Entra ID rather than general web or credential phishing.","Exploits the legitimate OAuth device authorization grant (RFC 8628) to bypass MFA without intercepting credentials or cookies.","Includes both device-code flow and illicit consent grant variants, with long-lived refresh token reuse across Microsoft 365 services.","Provides detailed TokenTactics and ROADtools commands for token capture, refresh, and impact enumeration."],"familyIds":["oauth-idp-attacks"]},{"id":"audit-skills","summary":"当用户要求审计 Java、.NET 或 PHP 源码/部署产物/反编译产物/安全发现，并需要默认脚本输出目录、报告输出目录、Java/.NET 反编译与反混淆参考、Java 组件 YAML 正则匹配扫描、确认漏洞判定标准、安全 Payload 和 BurpSuite 原始 HTTP 请求包证据时使用。仅用于授权代码审计和防御性安全验证。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"auditing-aws-s3-bucket-permissions","summary":"Systematic audit workflow for AWS S3 bucket permissions, covering public access detection, policy/ACL analysis, encryption and versioning checks, with automated tooling and remediation commands.","primaryDomain":"cloud-security","domainTags":["cloud-security","aws","s3","bucket-permissions","data-protection","access-control"],"capabilityTags":["s3-permission-auditing","public-access-detection","bucket-policy-review","encryption-status-check","least-privilege-assessment"],"capabilityDetails":["Provides a step-by-step workflow for auditing S3 bucket permissions across an AWS account.","Identifies publicly accessible buckets, overly permissive ACLs, wildcard principals in policies, and missing encryption/versioning.","Includes automated checks using Prowler and IAM Access Analyzer.","Offers remediation commands to enforce least-privilege data access."],"techniqueTags":["bucket-policy-analysis","acl-review","public-access-block-check","encryption-audit","versioning-check"],"techniqueDetails":["Uses AWS CLI commands to enumerate buckets and retrieve configuration settings.","Analyzes bucket policies for wildcard principals and missing conditions.","Reviews ACLs for public grants to AllUsers or AuthenticatedUsers.","Uses Prowler for CIS AWS Foundations Benchmark checks.","Uses IAM Access Analyzer to identify cross-account and public sharing."],"tools":["AWS CLI","Prowler","IAM Access Analyzer","S3audit","ScoutSuite"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection","validation","reporting","remediation"],"distinctiveFeatures":["Combines manual AWS CLI enumeration with Prowler and IAM Access Analyzer for a comprehensive S3 security audit.","Covers both detection and remediation of public access, encryption, versioning, and logging issues.","Provides a structured report format and common scenario walkthrough."],"familyIds":["cloud-security-posture-assessment"]},{"id":"auditing-azure-active-directory-configuration","summary":"A specialist playbook for auditing Microsoft Entra ID configuration: enumerates security defaults, privileged role assignments, conditional access coverage, stale/guest accounts, and sign-in risks using Graph PowerShell, Azure CLI, and ScoutSuite.","primaryDomain":"cloud-security","domainTags":["azure","entra-id","active-directory","identity-and-access-management","conditional-access"],"capabilityTags":["azure-ad-audit","identity-configuration-review","conditional-access-audit","privileged-role-audit","guest-user-risk-assessment"],"capabilityDetails":["Provides a workflow for auditing Microsoft Entra ID (Azure AD) configuration, including authentication policies, privileged role assignments, conditional access coverage, stale accounts, guest user risks, and sign-in logs."],"techniqueTags":["microsoft-graph-api-queries","powershell-auditing-scripts","azure-cli-queries","security-defaults-review","sign-in-log-analysis"],"techniqueDetails":["Uses Get-Mg* cmdlets and az rest Graph API calls to enumerate tenant policies, role assignments, conditional access policies, and audit logs.","Uses ScoutSuite for automated Azure tenant configuration assessment."],"tools":["Microsoft Graph PowerShell SDK","Azure CLI","Microsoft Graph API","ScoutSuite"],"targetTypes":["active-directory","cloud"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection","reporting"],"distinctiveFeatures":["Focuses exclusively on Microsoft Entra ID (Azure AD) configuration auditing rather than on-prem AD; covers conditional access gaps, guest user risks, and sign-in risk in addition to role assignments.","Combines Graph API/PowerShell manual checks with ScoutSuite automated assessment in one workflow."],"familyIds":["cloud-security-posture-assessment"]},{"id":"auditing-cloud-with-cis-benchmarks","summary":"Audits cloud environments (AWS, Azure, GCP) against CIS Foundations Benchmarks using Prowler/ScoutSuite, interprets failed controls, prioritizes remediation, and sets up continuous compliance monitoring.","primaryDomain":"cloud-security","domainTags":["cis-benchmarks","cloud-compliance","multi-cloud","security-audit"],"capabilityTags":["automated-compliance-scanning","control-interpretation","remediation-prioritization","continuous-compliance-monitoring"],"capabilityDetails":["Provides a workflow for auditing AWS, Azure, and GCP environments against CIS Foundations Benchmarks using automated scanners like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation."],"techniqueTags":["benchmark-based-audit","cis-profile-levels","compliance-score-tracking","remediation-runbook"],"techniqueDetails":["Uses CIS benchmark profiles (Level 1 and Level 2) to assess security posture and prioritize remediation, with examples for parsing results and generating compliance scores."],"tools":["Prowler","ScoutSuite","AWS Security Hub","Azure Policy","GCP Security Command Center"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Multi-cloud (AWS, Azure, GCP) CIS Foundations Benchmark auditing with Prowler and ScoutSuite, including remediation steps and continuous compliance monitoring setup."],"familyIds":["cloud-security-posture-assessment"]},{"id":"auditing-entra-id-with-aadinternals","summary":"Provides an AADInternals-driven workflow for auditing Microsoft Entra ID tenant exposure, acquiring Microsoft API access tokens, and testing Golden SAML/federation backdoors during authorized red-team or defensive validation engagements.","primaryDomain":"authentication","domainTags":["entra-id","azure-ad","federation","adfs","saml-token-forgery"],"capabilityTags":["tenant-reconnaissance","token-acquisition","saml-token-forgery","federation-backdoor-testing","directory-enumeration"],"capabilityDetails":["Provides a workflow using AADInternals to audit Microsoft Entra ID tenant configuration, acquire access tokens, and test federation backdoors for defensive validation."],"techniqueTags":["saml-token-forgery","golden-saml","federation-backdoor","oauth-token-acquisition","user-enumeration"],"techniqueDetails":["Uses public endpoints to enumerate tenant identity and federation information without credentials.","Forges SAML tokens using a controlled federation IssuerUri to impersonate arbitrary users.","Acquires and caches OAuth access tokens for Microsoft first-party APIs."],"tools":["AADInternals","PowerShell","AADOutsider-py"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","exploitation","validation","reporting"],"distinctiveFeatures":["Specifically focuses on Microsoft Entra ID/Azure AD identity attacks using AADInternals, including unauthenticated recon, token acquisition, and Golden SAML federation backdoors.","Distinguished from generic cloud security skills by its targeted coverage of AD FS federation configuration and SAML token forgery for defensive validation."],"familyIds":["oauth-idp-attacks"]},{"id":"auditing-foundry-smart-contract-security","summary":"Pre-deployment security audit for Foundry-based Solidity projects, combining static analysis, symbolic execution, fuzz/invariant testing, and key hygiene to catch critical vulnerabilities before EVM deployment.","primaryDomain":"source-code-security","domainTags":["smart-contract-security","solidity-security","evm-security"],"capabilityTags":["smart-contract-audit","static-analysis","symbolic-execution","invariant-testing","fuzz-testing"],"capabilityDetails":["Provides a defense-in-depth pre-deployment audit for Solidity smart contracts in a Foundry project.","Combines Slither, Aderyn static analysis with Mythril symbolic execution to catch known anti-patterns and deep bugs.","Uses Forge fuzz and invariant tests with handler contracts to prove protocol-level properties across random sequences.","Enforces key hygiene and secure deployment workflow with encrypted cast keystore."],"techniqueTags":["static-analysis","symbolic-execution","fuzz-testing","invariant-testing","handler-based-testing","key-hygiene"],"techniqueDetails":["Static analysis via Slither and Aderyn scans the AST/IR in seconds for known anti-patterns.","Symbolic execution via Mythril explores execution paths and SMT-solves for deep arithmetic/reentrancy bugs.","Fuzz and invariant testing via Forge prove properties hold across millions of random sequences.","Manual review uses a structured vulnerability checklist covering reentrancy, access control, oracle manipulation, and more.","Key hygiene ensures no plaintext private keys and uses encrypted cast keystore for deployment."],"tools":["slither","aderyn","mythril","forge","cast","gitleaks"],"targetTypes":["source-code"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting","remediation"],"distinctiveFeatures":["Combines Slither, Aderyn, Mythril, and Forge property-based testing into a single defense-in-depth audit.","Includes mandatory key hygiene and encrypted keystore workflow to prevent private key leaks.","Gates deployment with a PASS/FAIL based on static findings, test results, and coverage."],"familyIds":["smart-contract-security-auditing"]},{"id":"auditing-gcp-iam-permissions","summary":"Audits GCP IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.","primaryDomain":"cloud-security","domainTags":["iam","gcp","service-accounts","permissions-audit"],"capabilityTags":["iam-permissions-audit","service-account-audit","excess-permission-detection","role-hygiene-assessment"],"capabilityDetails":["Provides a workflow for auditing GCP IAM permissions, including service account keys, primitive roles, and effective access via policy analysis."],"techniqueTags":["gcloud-cli","policy-analyzer","iam-recommender","cloud-asset-search"],"techniqueDetails":["Uses gcloud asset search-all-iam-policies for inventory, Policy Analyzer for effective permissions, and IAM Recommender for suggested least-privilege roles."],"tools":["gcloud","IAM Recommender","Policy Analyzer","Cloud Asset Inventory","ScoutSuite"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on GCP IAM permission auditing with Policy Analyzer and IAM Recommender, including service account key hygiene and impersonation risks, rather than general cloud security posture."],"familyIds":["cloud-security-posture-assessment"]},{"id":"auditing-kubernetes-cluster-rbac","summary":"Provides a step-by-step Kubernetes RBAC audit workflow to discover overly permissive roles and bindings, risky service accounts, privilege escalation paths, and unsafe pod security contexts using kubectl, rbac-tool, KubiScan, and Kubeaudit.","primaryDomain":"cloud-security","domainTags":["kubernetes","rbac","access-control","service-account"],"capabilityTags":["rbac-auditing","least-privilege-validation","privilege-escalation-detection","service-account-token-audit","workload-security-policy-review"],"capabilityDetails":["Provides a step-by-step workflow for auditing Kubernetes RBAC configurations, including enumeration of ClusterRoles, ClusterRoleBindings, RoleBindings, and service account permissions.","Detects overly permissive roles, wildcard permissions, bindings granted to all authenticated/unauthenticated users, and RBAC verbs that enable privilege escalation (bind, escalate, impersonate).","Includes checks for service account token auto-mounting, privileged containers, and running as root, correlating workload security contexts with RBAC exposure."],"techniqueTags":["wildcard-permission-detection","clusterrole-binding-analysis","who-can-query","automount-service-account-token-review","security-context-scanning"],"techniqueDetails":["Uses raw kubectl JSON queries to identify ClusterRoles with wildcard verbs/resources, secret access, and pods/exec permissions.","Leverages rbac-tool who-can queries to map subjects to sensitive permissions such as get secrets, create pods, create pods/exec, and bind/escalate clusterroles.","Uses KubiScan to detect risky roles, role bindings, service accounts, and privilege escalation paths.","Checks pods for auto-mounted service account tokens and privileged/root security contexts.","Runs Kubeaudit to validate workload security policies against RBAC-related anti-patterns."],"tools":["kubectl","rbac-tool","KubiScan","Kubeaudit","rakkess"],"targetTypes":["kubernetes","cloud","container"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection","validation","remediation"],"distinctiveFeatures":["Combines declarative kubectl enumeration with specialized RBAC security tooling (rbac-tool, KubiScan, Kubeaudit) to assess Kubernetes RBAC least-privilege and service account exposure, including privilege escalation verbs.","Focuses entirely on Kubernetes RBAC and workload permission hygiene rather than general Kubernetes security, network policy, or container image scanning."],"familyIds":["container-kubernetes-configuration-compliance-auditing"]},{"id":"auditing-kubernetes-rbac-privilege-escalation","summary":"Audits Kubernetes RBAC for over-permissive roles and service-account token abuse, enumerating effective permissions with kubectl auth can-i, running rbac-police escalation-path analysis, and demonstrating cluster-admin-equivalent primitives in a lab with remediation guidance.","primaryDomain":"cloud-security","domainTags":["kubernetes-security","rbac","privilege-escalation","container-security"],"capabilityTags":["rbac-audit","service-account-token-analysis","escalation-path-discovery","least-privilege-assessment"],"capabilityDetails":["Provides a systematic workflow to inventory Kubernetes RBAC objects, enumerate effective permissions per subject, identify cluster-admin-equivalent escalation primitives, trace token-mounting pods, and produce remediation evidence."],"techniqueTags":["kubectl-auth-can-i","impersonation-check","rego-policy-analysis","reverse-lookup","access-matrix"],"techniqueDetails":["Uses kubectl auth can-i --as to evaluate live authorizer permissions, kubectl-who-can and rakkess for reverse lookups and access matrices, and rbac-police for Rego-based escalation path analysis."],"tools":["kubectl","rbac-police","kubectl-who-can","rakkess","rbac-lookup"],"targetTypes":["kubernetes"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","exploitation","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on Kubernetes RBAC privilege escalation primitives and service-account token abuse, combining live impersonation checks with automated Rego path analysis and a lab demonstration workflow."],"familyIds":["container-kubernetes-configuration-compliance-auditing"]},{"id":"auditing-mcp-servers-for-tool-poisoning","summary":"Operational playbook to audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure before adding them to an AI agent stack.","primaryDomain":"injection","domainTags":["ai-security","mcp-security","tool-poisoning","prompt-injection","ssrf","supply-chain-security"],"capabilityTags":["mcp-server-auditing","tool-poisoning-detection","ssrf-testing","authentication-validation","rug-pull-detection"],"capabilityDetails":["Provides an end-to-end workflow for auditing MCP servers before integrating them into AI agent stacks.","Detects hidden instructions in tool descriptions (tool poisoning), tool shadowing, and toxic tool combinations.","Includes manual checks for SSRF and unauthenticated exposure in MCP endpoints."],"techniqueTags":["static-scanning","runtime-analysis","tool-description-inspection","hash-pinning","manual-probing","proxy-guardrails"],"techniqueDetails":["Uses mcp-scan for static scanning of MCP configs and runtime proxy guardrails.","Inspects raw tool/prompt/resource descriptions for hidden or obfuscated instructions.","Pins tool description hashes to detect post-approval changes (rug pulls).","Performs manual SSRF probing of URL-fetching tools against internal/cloud metadata targets.","Verifies authentication and network exposure of remote MCP servers."],"tools":["mcp-scan","uvx","mcp-python-sdk","curl"],"targetTypes":["api","network","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","reporting"],"distinctiveFeatures":["Targets the MCP server attack surface for AI agents, combining automated scanning with manual SSRF/auth checks.","Focuses specifically on tool poisoning and rug pulls via tool description inspection and hashing.","Includes runtime proxy enforcement for continuous protection of agent tool calls."],"familyIds":["llm-prompt-injection-red-teaming"]},{"id":"auditing-terraform-infrastructure-for-security","summary":"A specialist playbook for auditing Terraform infrastructure-as-code using Checkov, tfsec, Terrascan, and OPA/Rego to detect cloud misconfigurations before deployment, with CI/CD integration and state file auditing.","primaryDomain":"cloud-security","domainTags":["infrastructure-as-code","terraform","policy-as-code","cloud-misconfiguration"],"capabilityTags":["iac-security-scanning","policy-as-code","compliance-validation","ci-cd-security-gate"],"capabilityDetails":["Provides a multi-tool workflow to audit Terraform infrastructure-as-code for cloud misconfigurations before deployment, including custom OPA/Rego policy evaluation and CI/CD integration."],"techniqueTags":["static-analysis","rego-policy-writing","plan-file-analysis","state-file-auditing"],"techniqueDetails":["Uses Checkov, tfsec, and Terrascan static scans of Terraform files and plan JSON; evaluates custom Rego policies via OPA/Conftest; audits deployed state files for misconfigurations."],"tools":["checkov","tfsec","terrascan","opa","conftest","terraform"],"targetTypes":["cloud","source-code"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting","remediation"],"distinctiveFeatures":["Comprehensive Terraform-specific IaC audit playbook combining multiple open-source scanners, custom Rego policy development, CI/CD gate integration, and both plan and state scanning."],"familyIds":["cloud-security-posture-assessment"]},{"id":"auditing-tls-certificate-transparency-logs","summary":"Workflow for monitoring Certificate Transparency logs via crt.sh and RFC 6962 APIs to detect unauthorized certificate issuance, discover subdomains, identify typosquatting, and produce compliance reports.","primaryDomain":"reconnaissance","domainTags":["certificate-transparency","subdomain-discovery","tls-monitoring","threat-intelligence"],"capabilityTags":["ct-log-monitoring","subdomain-enumeration","certificate-issuance-alerting","typosquat-detection","ca-compliance-auditing"],"capabilityDetails":["Provides a workflow for continuous monitoring of Certificate Transparency logs to detect unauthorized or unexpected certificate issuance for owned domains.","Enables subdomain discovery and attack surface mapping by mining certificate data from crt.sh and direct CT log queries.","Configures alerting for new certificates, unauthorized CAs, wildcard certificates, and typosquatting, with integration to email, Slack, or SIEM."],"techniqueTags":["crt-sh-api-querying","rfc6962-log-querying","dns-validation","merkle-tree-verification","typosquat-permutation"],"techniqueDetails":["Uses crt.sh JSON API with wildcard queries to retrieve historical and current certificate data.","Directly queries CT log servers using RFC 6962 endpoints, including get-sth and consistency proof verification for log integrity.","Employs DNS resolution and permutation generation to validate discovered subdomains and detect phishing infrastructure."],"tools":["crt.sh","ct-woodpecker","certspotter","OpenSSL","cryptography","pyOpenSSL","requests"],"targetTypes":["network","web-application","other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","reporting"],"distinctiveFeatures":["Dual-purpose: defensive monitoring for unauthorized certificate issuance and offensive subdomain discovery via CT logs.","Covers both crt.sh aggregation API and direct RFC 6962 CT log queries, including Signed Tree Head consistency verification.","Includes typosquat detection, CAA policy violation auditing, and compliance reporting, distinguishing it from basic subdomain enumeration tools."],"familyIds":["certificate-transparency-monitoring"]},{"id":"auditing-uefi-firmware-with-chipsec","summary":"Provides an operational playbook for auditing UEFI firmware security with CHIPSEC: verifying BIOS write protection, SPI flash locking, SMM/SMRR, and Secure Boot variable protections, plus dumping and decoding SPI flash for forensic comparison.","primaryDomain":"general-pentesting","domainTags":["firmware-security","uefi","chipsec","spi-flash","bios-write-protection","secure-boot"],"capabilityTags":["firmware-security-assessment","spi-flash-forensics","uefi-variable-triage","secure-boot-validation","platform-lock-verification"],"capabilityDetails":["Provides a workflow for auditing UEFI firmware security configuration using Intel CHIPSEC, including verifying BIOS write protection, SPI flash descriptor locks, SMM/SMRR protections, Secure Boot variable state, and dumping/decoding SPI flash for forensic analysis."],"techniqueTags":["chipsec-module-testing","spi-flash-dump","uefi-variable-enumeration","firmware-image-decoding","platform-hardening-validation"],"techniqueDetails":["Uses CHIPSEC's automated test modules to check platform security controls, uses chipsec_util to dump SPI flash and enumerate UEFI variables, and uses the decode utility for offline firmware analysis."],"tools":["chipsec_main","chipsec_util","UEFITool","Binarly fwhunt"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","reporting"],"distinctiveFeatures":["Focuses specifically on pre-OS firmware security validation using Intel CHIPSEC, not general endpoint or web pentesting; includes both automated test suite execution and manual SPI flash forensics/UEFI variable triage."],"familyIds":["specialized-platform-security-assessment"]},{"id":"auth-sec","summary":"Routing entry point that triages authentication and authorization testing topics to specialized playbooks for bypass, IDOR, JWT/OAuth, CSRF, CORS, and SAML.","primaryDomain":"authentication","domainTags":["authentication","authorization","identity-protocols"],"capabilityTags":["authentication-testing-triage","authorization-testing-routing"],"capabilityDetails":["Routes users to specialized playbooks for authentication bypass, IDOR/BOLA, JWT/OAuth attacks, CSRF, CORS, and SAML issues."],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":["web-application","api"],"role":"router","workflowFocus":["navigation"],"distinctiveFeatures":["Pure router/triage skill; does not contain executable attack steps, but maps to seven specialist auth/authorization playbooks.","Covers both authentication and authorization boundaries, including token and SSO protocol flows."],"familyIds":["web-authentication-bypass-testing"]},{"id":"authbypass-authentication-flaws","summary":"Expert authentication bypass playbook for login flows, password reset, account enumeration, brute-force bypass, MFA bypass, session flaws, token prediction, and captcha bypass, with practical attack patterns and tool references.","primaryDomain":"authentication","domainTags":["web-security","session-management","identity-management"],"capabilityTags":["authentication-bypass-testing","password-reset-testing","mfa-bypass-testing","account-enumeration","brute-force-testing","token-prediction","captcha-bypass","session-management-testing"],"capabilityDetails":["Comprehensive authentication bypass testing workflow covering login flaws, password reset vulnerabilities, account enumeration, brute-force evasion, MFA bypass, session management issues, token prediction, and captcha/verification bypass."],"techniqueTags":["sql-injection-login-bypass","host-header-injection","predictable-token","lockout-bypass","header-spoofing","session-fixation","bcrypt-truncation","unicode-normalization"],"techniqueDetails":["Uses SQL injection payloads in login fields, host header injection to poison reset links, timing and error-based account enumeration, lockout reset cycling, X-Forwarded-For/IP rotation, 2FA code brute force and reuse, session invalidation checks, bcrypt 72-byte truncation, unicode normalization attacks, and token prediction via UUID v1/MongoDB ObjectId/mt_rand."],"tools":["hydra","Burp Intruder","guidtool","reset-tolkien","php_mt_seed","sandwich","tesseract"],"targetTypes":["web-application","api","database","network"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","enumeration"],"distinctiveFeatures":["Focuses specifically on login and authentication mechanism bypass rather than token format attacks like JWT/OAuth; includes an extensive 22-pattern password reset attack matrix and a 20-method captcha/verification bypass catalog."],"familyIds":["web-authentication-bypass-testing"]},{"id":"automating-ioc-enrichment","summary":"Automates IOC enrichment with multi-source threat intelligence using Python and SOAR, with composite scoring and rate limiting to streamline analyst triage.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","ioc-enrichment","soar","automation"],"capabilityTags":["ioc-enrichment","soar-playbook-automation","python-pipeline","threat-intel-aggregation","composite-scoring"],"capabilityDetails":["Provides a workflow to automatically enrich raw IOCs with multi-source threat intelligence via SOAR playbooks and Python pipelines, including composite confidence scoring."],"techniqueTags":["multi-source-enrichment","parallel-fan-out","rate-limiting","retry-logic","confidence-scoring"],"techniqueDetails":["Uses parallel API calls to VirusTotal, AbuseIPDB, Shodan, MISP etc., weighted scoring, and rate limit handling."],"tools":["cortex-xsoar","splunk-soar","tines","python","virustotal","abuseipdb","shodan","misp","thehive"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis"],"distinctiveFeatures":["Specializes in automating IOC enrichment with multi-source threat intelligence and includes ready-to-use Python functions and SOAR integration patterns."],"familyIds":["threat-intelligence-data-and-ioc-management"]},{"id":"benchmarking-kubernetes-with-kube-bench","summary":"Run kube-bench to assess a Kubernetes cluster against the CIS Kubernetes Benchmark, covering control-plane, node, etcd, and policy targets, with distribution-specific benchmarks, CI-friendly output, and a remediation/re-validation workflow.","primaryDomain":"cloud-security","domainTags":["kubernetes","container-security","cis-benchmark","compliance","hardening"],"capabilityTags":["kubernetes-benchmarking","cis-compliance-scanning","cluster-hardening-audit","compliance-evidence-generation"],"capabilityDetails":["Provides a workflow for running kube-bench to audit Kubernetes control-plane, kubelet, node, etcd, and policy configurations against the CIS Kubernetes Benchmark, and to remediate and re-validate findings."],"techniqueTags":["configuration-based-benchmarking","static-configuration-review","benchmark-driven-compliance-check"],"techniqueDetails":["Uses CIS Kubernetes Benchmark checks to statically inspect component configuration files and flags, and to identify insecure settings."],"tools":["kube-bench","kubectl","docker"],"targetTypes":["kubernetes","cloud"],"role":"specialist-playbook","workflowFocus":["validation","analysis","remediation","reporting"],"distinctiveFeatures":["Explicit coverage of managed Kubernetes distributions (EKS, GKE, AKS, ACK, OpenShift, RKE, k3s) with distribution-specific benchmarks.","Produces machine-readable output (JSON, JUnit, ASFF) and optional PostgreSQL persistence for compliance tracking.","Includes concrete remediation examples and a re-validation loop to confirm PASS after fixes."],"familyIds":["container-kubernetes-configuration-compliance-auditing"]},{"id":"binary-protection-bypass","summary":"Expert reference and decision workflow for identifying ELF binary protections (ASLR, PIE, NX, RELRO, canary, FORTIFY, CET, MTE) and mapping them to bypass techniques and required primitives.","primaryDomain":"binary-exploitation","domainTags":["binary-protection","elf","exploitation-mitigations"],"capabilityTags":["protection-identification","aslr-bypass","pie-bypass","nx-bypass","relro-bypass","canary-bypass","fortify-bypass","cet-bypass","mte-bypass"],"capabilityDetails":["Provides a decision-tree driven workflow to identify ELF binary mitigations from checksec/readelf output and select appropriate bypass techniques based on available primitives."],"techniqueTags":["rop","ret2libc","ret2dlresolve","srop","partial-overwrite","format-string-leak","got-overwrite","data-only-attack","jop","brute-force"],"techniqueDetails":["Details information leak primitives, partial overwrites, ROP/ret2libc/ret2dlresolve/SROP chains, GOT overwrite and post-RELRO hook/vtable targets, and brute-force/probabilistic approaches for canary, ASLR, CET and MTE."],"tools":["checksec","readelf"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["detection","analysis","exploitation"],"distinctiveFeatures":["Covers modern mitigations beyond common guides (CET shadow stack/IBT, ARM MTE) and provides a combined decision tree linking mitigation combinations to bypass primitives."],"familyIds":["binary-protection-identification-and-bypass"]},{"id":"browser-exploitation-v8","summary":"Expert playbook for exploiting V8 JavaScript engine vulnerabilities in Chrome/Chromium, covering JIT type confusion, bounds check elimination, addrof/fakeobj primitives, arbitrary read/write, WASM/JIT code execution, V8 sandbox bypass, and renderer-to-browser sandbox escape.","primaryDomain":"binary-exploitation","domainTags":["browser-security","v8-engine","jit-exploitation","sandbox-escape"],"capabilityTags":["v8-exploitation","jit-type-confusion","addrof-fakeobj-primitives","arbitrary-memory-read-write","sandbox-escape-techniques"],"capabilityDetails":["Expert playbook for exploiting V8 JavaScript engine vulnerabilities in Chrome/Chromium, including JIT type confusion, incorrect bounds elimination, and V8 sandbox bypass.","Provides step-by-step methodology for building addrof/fakeobj primitives, achieving arbitrary read/write, and leveraging WASM RWX pages or corrupting ArrayBuffer backing stores for code execution.","Covers modern V8 sandbox constraints (pointer compression, external pointer table) and outlines the renderer-to-browser sandbox escape chain via Mojo IPC."],"techniqueTags":["turbo-fan-jit-analysis","bounds-check-elimination","type-confusion","arraybuffer-backing-store-corruption","wasm-code-execution","pointer-compression-bypass","external-pointer-table-corruption"],"techniqueDetails":["Detailed explanations of V8 compilation pipeline (Ignition, Sparkplug, Maglev, TurboFan) and object representation with pointer compression.","Specific bug classes: JIT type confusion, incorrect bounds elimination, prototype chain confusion, Turbofan reduction bugs, race conditions, off-by-one builtins, and typer bugs.","Primitive construction: addrof (leak object address via object/float array confusion) and fakeobj (forge object reference from raw address).","Arbitrary R/W via fake Float64Array with corrupted backing_store pointer or OOB read/write to corrupt adjacent object metadata.","WASM RWX page exploitation and modern W^X workaround through write windows or JIT spray.","V8 sandbox escape vectors: external pointer table corruption, WASM code pointer overwrite, JIT code corruption, Mojo IPC, and backing store seal bypass."],"tools":["d8","Turbolizer","Chrome DevTools","ninja","gn"],"targetTypes":["binary","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","exploitation","post-exploitation"],"distinctiveFeatures":["Focused exclusively on V8/Chrome JavaScript engine exploitation with modern V8 sandbox (pointer compression, external pointer table) rather than generic binary exploitation.","Includes a decision tree that maps vulnerability classes to exploitation primitives and sandbox escape paths, distinguishing d8/CTF vs modern Chrome sandbox scenarios.","Provides concrete JavaScript code templates for addrof/fakeobj primitives and arbitrary R/W, plus commands for V8 debugging and TurboFan tracing."],"familyIds":["browser-engine-exploitation"]},{"id":"browser-skill","summary":"Automate the user's logged-in Chromium browser: read pages, fill forms, scrape data, operate tabs, test a UI, or debug a website. Requires the bsk CLI and browser extension.","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"building-adversary-infrastructure-tracking-system","summary":"Automated Python system to map and track threat-actor C2 infrastructure by pivoting through passive DNS, WHOIS, reverse IP, and certificate transparency data, then using graph analysis to identify clusters and monitor for newly registered domains.","primaryDomain":"reconnaissance","domainTags":["threat-intelligence","passive-dns","c2-infrastructure","whois","infrastructure-tracking"],"capabilityTags":["infrastructure-pivoting","c2-mapping","passive-dns-analysis","whois-analysis","graph-clustering","new-domain-monitoring"],"capabilityDetails":["Provides an automated Python workflow for discovering, mapping, and monitoring threat actor C2 infrastructure through passive DNS, WHOIS, reverse IP, and graph analysis."],"techniqueTags":["passive-dns-pivoting","reverse-ip-lookup","whois-pivoting","certificate-transparency","graph-clustering","pattern-monitoring"],"techniqueDetails":["Pivots from seed domains/IPs across passive DNS history, reverse IP lookups, WHOIS registration data, and certificate transparency to uncover related infrastructure.","Uses networkx graph analysis to identify clusters and hub nodes indicating shared infrastructure.","Monitors for newly registered domains matching adversary naming/registration patterns."],"tools":["securitytrails","networkx","shodan","virustotal","dnspython","python-whois"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis","detection","reporting"],"distinctiveFeatures":["Specialized in building an automated adversary infrastructure tracking system for C2 networks, combining passive DNS, WHOIS pivoting, IP enrichment, and graph-based cluster analysis—not a general vulnerability discovery skill."],"familyIds":["infrastructure-threat-intelligence"]},{"id":"building-attack-pattern-library-from-cti-reports","summary":"Provides an automated pipeline to parse CTI reports, extract adversary behaviors, map them to MITRE ATT&CK techniques, and generate STIX 2.1 attack-pattern libraries with detection rule templates for threat-informed detection engineering.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","mitre-attack","stix","cti-reports","detection-engineering"],"capabilityTags":["cti-report-parsing","attack-pattern-extraction","mitre-attack-mapping","stix-2-1-library-building","detection-template-generation"],"capabilityDetails":["Parses CTI reports to extract adversary behaviors based on action verbs and tool mentions.","Maps extracted behaviors to MITRE ATT&CK technique IDs using a keyword dictionary.","Creates STIX 2.1 Attack Pattern objects with external references and kill chain phases.","Generates Sigma rule templates and detection metadata from mapped behaviors."],"techniqueTags":["behavioral-indicator-extraction","technique-keyword-matching","kill-chain-phase-mapping","stix-attack-pattern-creation","sigma-rule-generation"],"techniqueDetails":["Uses behavior indicator keywords (e.g., 'used', 'executed') to identify suspicious sentences.","Matches technique-specific keywords (e.g., 'lsass' -> T1003.001) to infer ATT&CK techniques.","Builds STIX Attack Patterns via the stix2 library, including external references to MITRE ATT&CK.","Produces detection rule skeletons with data sources, observed tools, and source context."],"tools":["stix2","attackcti","python"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","detection","knowledge-reference"],"distinctiveFeatures":["Focuses on converting unstructured CTI narrative into structured ATT&CK-aligned STIX objects, rather than executing offensive test cases.","Includes concrete Python code for parsing, mapping, STIX bundle creation, and detection template generation.","Distinct from generic ATT&CK navigation skills by producing machine-readable attack pattern libraries and detection rules."],"familyIds":["mitre-attack-ttp-analysis-structuring"]},{"id":"building-automated-malware-submission-pipeline","summary":"Builds an automated pipeline that collects suspicious files from EDR and email gateways, pre-screens them via VirusTotal/MalwareBazaar, submits unknowns to sandboxes, generates verdicts with IOCs, and pushes results to SIEM and blocklists for SOC triage.","primaryDomain":"forensics","domainTags":["malware-analysis","sandbox","automation","ioc-extraction","soc-operations"],"capabilityTags":["malware-collection","hash-lookup","sandbox-submission","verdict-generation","siem-integration","automated-triage"],"capabilityDetails":["Provides a workflow for collecting suspicious files from EDR quarantine and email gateways.","Implements pre-screening using VirusTotal and MalwareBazaar hash lookups.","Automates submission to sandboxes (Cuckoo, Joe Sandbox) and retrieves analysis reports.","Generates combined verdicts with confidence scores and extracts IOCs.","Pushes results to SIEM and firewall blocklists."],"techniqueTags":["dynamic-analysis","static-analysis","hash-lookup","behavioral-analysis","verdict-scoring","ioc-extraction"],"techniqueDetails":["Uses sandbox dynamic analysis to observe runtime behavior such as process creation, network activity, and registry changes.","Uses hash-based pre-screening to identify known malware via VirusTotal and MalwareBazaar.","Combines VirusTotal detection counts, sandbox scores, and signature counts into a weighted verdict.","Extracts indicators of compromise from sandbox reports for blocking and enrichment."],"tools":["cuckoo-sandbox","joe-sandbox","any-run","virustotal","malwarebazaar","splunk"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","reporting","remediation"],"distinctiveFeatures":["End-to-end automated malware submission pipeline, not limited to a single sandbox tool.","Includes pre-screening to avoid unnecessary sandbox submissions by leveraging VirusTotal and MalwareBazaar.","Combines multiple data sources into a weighted verdict score with confidence levels.","Automates IOC extraction and pushes results to SIEM and blocklisting infrastructure."],"familyIds":["malware-incident-response-and-eradication"]},{"id":"building-c2-infrastructure-with-sliver-framework","summary":"Detailed playbook for deploying Sliver C2 infrastructure with hardened team server, multiple listener protocols, redirectors, domain fronting, and implant generation for red-team operations.","primaryDomain":"post-exploitation","domainTags":["c2-framework","command-and-control","red-teaming","infrastructure","adversary-simulation"],"capabilityTags":["c2-infrastructure-deployment","sliver-framework","listener-configuration","redirector-setup","implant-generation","multi-operator-management"],"capabilityDetails":["Provides a detailed workflow for deploying and hardening a Sliver C2 team server, configuring mTLS/HTTPS/DNS/WireGuard listeners, setting up NGINX redirectors and Cloudflare-based domain fronting, and generating beacon/session implants."],"techniqueTags":["domain-fronting","dns-c2","mtls","wireguard-tunneling","beacon-jitter","redirector-proxy"],"techniqueDetails":["Uses multiple C2 protocols and redirectors to evade detection.","Configures beacon jitter to blend with normal traffic.","Implements domain fronting via Cloudflare CDN."],"tools":["sliver","nginx","certbot","cloudflare","armory"],"targetTypes":["network","windows-host","linux-host","cloud"],"role":"specialist-playbook","workflowFocus":["exploitation","post-exploitation"],"distinctiveFeatures":["Tool-specific deployment for Sliver C2, including operational security hardening and multi-protocol listeners, distinct from general C2 methodology."],"familyIds":["c2-framework-deployment-and-operations"]},{"id":"building-c2-redirector-infrastructure","summary":"Provides step-by-step guidance for deploying C2 redirector infrastructure (dumb-pipe and filtering nginx/Apache reverse proxies) with Malleable C2 profile-derived filter rules, Let's Encrypt TLS, and OPSEC controls to protect a hidden team server during authorized red-team engagements.","primaryDomain":"network-security","domainTags":["c2-infrastructure","red-teaming","traffic-filtering","reverse-proxy","opsec"],"capabilityTags":["redirector-deployment","malleable-c2-profile-filtering","tls-termination","opsec-hardening"],"capabilityDetails":["Provides a workflow for deploying both dumb-pipe and filtering C2 redirectors using nginx and Apache.","Automates filter rule generation from Malleable C2 profiles via cs2modrewrite.","Covers TLS termination with Let's Encrypt and OPSEC controls like domain fronting and UA/geo filtering."],"techniqueTags":["dumb-pipe-forwarding","filtering-reverse-proxy","malleable-c2-profile","domain-fronting","ua-filtering","geo-filtering","tls-termination"],"techniqueDetails":["Uses socat or iptables DNAT for simple port forwarding without filtering.","Uses nginx proxy_pass or Apache mod_rewrite [P] to proxy only requests matching the C2 profile.","Derives URI and User-Agent filter rules from a Malleable C2 profile to match implant traffic.","Adds Let's Encrypt TLS and applies UA/Geo filtering and domain fronting for OPSEC."],"tools":["nginx","apache","mod_rewrite","socat","iptables","cs2modrewrite","certbot"],"targetTypes":["network","linux-host","cloud"],"role":"specialist-playbook","workflowFocus":["post-exploitation","validation"],"distinctiveFeatures":["Focuses on C2 redirector infrastructure rather than vulnerability discovery or exploitation.","Covers both dumb-pipe and filtering redirectors with detailed nginx and Apache configurations.","Derives filter rules directly from Malleable C2 profiles to match implant traffic precisely.","Includes OPSEC controls such as domain fronting, UA/geo filtering, TLS termination, and infrastructure rotation."],"familyIds":["network-adversary-simulation"]},{"id":"building-cloud-siem-with-sentinel","summary":"Provides a step-by-step workflow for deploying Microsoft Sentinel as a multi-cloud SIEM/SOAR, including configuring AWS/Azure/GCP data connectors, writing KQL detection and hunting queries, and building Logic Apps automated response playbooks.","primaryDomain":"cloud-security","domainTags":["siem","multi-cloud","microsoft-sentinel","kql","soar"],"capabilityTags":["sentinel-workspace-provisioning","data-connector-configuration","kql-rule-authoring","soar-playbook-development","threat-hunting","threat-intelligence-integration"],"capabilityDetails":["Provides a structured workflow for deploying Microsoft Sentinel as a cloud SIEM, configuring multi-cloud data connectors, authoring KQL detection and hunting queries, and building Logic Apps SOAR playbooks."],"techniqueTags":["kql-querying","cloudtrail-analysis","azure-ad-log-analysis","impossible-travel-detection","logic-apps-automation","threat-intelligence-matching","data-lake-hunting"],"techniqueDetails":["Uses KQL to detect cloud-specific threats such as impossible travel, AWS IAM credential abuse, and mass S3 deletions; applies Logic Apps for automated incident response; correlates Azure AD and AWS CloudTrail for cross-cloud attack chains."],"tools":["microsoft-sentinel","azure-logic-apps","kql","azure-cli","azure-data-explorer","microsoft-threat-intelligence"],"targetTypes":["cloud","active-directory","network"],"role":"workflow","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["End-to-end blueprint for operationalizing Microsoft Sentinel as a multi-cloud SIEM with automated SOAR response, including workspace provisioning, KQL analytics rules, and Logic Apps playbooks.","Covers both detection and hunting across AWS, Azure, and GCP, with threat intelligence integration and cross-cloud correlation."],"familyIds":["cloud-incident-response-and-forensics"]},{"id":"building-detection-rule-with-splunk-spl","summary":"A practical guide for building Splunk SPL detection rules, with ready-to-use patterns for brute force, lateral movement, exfiltration, PowerShell abuse, and anomaly detection, plus correlation search configuration and validation techniques.","primaryDomain":"security-knowledge","domainTags":["splunk","spl","detection-engineering","siem","soc","threat-detection"],"capabilityTags":["detection-rule-development","correlation-search-authoring","spl-query-writing","security-content-engineering"],"capabilityDetails":["Provides a complete workflow for building Splunk SPL detection rules, including threshold, sequence, baseline anomaly, lateral movement, exfiltration, and PowerShell detection patterns, with guidance on enrichment, performance optimization, and validation."],"techniqueTags":["threshold-detection","sequence-detection","anomaly-detection","tstats","lookup-enrichment"],"techniqueDetails":["Uses Splunk SPL commands such as stats, tstats, eval, where, lookup, and collect to aggregate events, apply thresholds, enrich context, and generate baseline comparisons."],"tools":["splunk"],"targetTypes":["windows-host","network","active-directory"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Provides runnable SPL code for six specific MITRE ATT&CK techniques, unlike generic detection methodology guides","Includes performance optimization via tstats, summary indexing, and indexed field usage","Covers end-to-end detection rule lifecycle from use case definition to testing metrics with precision and false positive rate"],"familyIds":["detection-rule-engineering"]},{"id":"building-detection-rules-with-sigma","summary":"A practical guide for SOC engineers to build portable Sigma detection rules, convert them into Splunk, Elastic, or Sentinel queries using pySigma, and operationalize them through testing and CI/CD pipelines.","primaryDomain":"security-knowledge","domainTags":["sigma","detection-rules","siem","mitre-attack"],"capabilityTags":["sigma-rule-authoring","rule-validation","siem-query-conversion","detection-as-code"],"capabilityDetails":["Provides a step-by-step workflow to author, validate, convert, and deploy Sigma detection rules across SIEM platforms."],"techniqueTags":["sigma-syntax","logsource-mapping","mitre-attack-tagging","pipeline-processing"],"techniqueDetails":["Uses Sigma's YAML rule format with logsource/detection sections, applies pySigma pipelines for field mapping, and tags rules with ATT&CK technique IDs."],"tools":["pysigma","sigma-cli","uncoder.io","attack-navigator"],"targetTypes":["windows-host"],"role":"workflow","workflowFocus":["detection","validation"],"distinctiveFeatures":["Vendor-agnostic Sigma rule format with conversion to multiple SIEM query languages","Covers complete rule lifecycle from threat intelligence to CI/CD deployment"],"familyIds":["detection-rule-engineering"]},{"id":"building-devsecops-pipeline-with-gitlab-ci","summary":"Enables teams to quickly assemble a GitLab CI/CD pipeline with integrated SAST, DAST, container, dependency, and secret scanning using managed templates, plus security dashboards and approval policies.","primaryDomain":"source-code-security","domainTags":["devsecops","sast","dast","container-scanning","dependency-scanning","secret-detection"],"capabilityTags":["pipeline-configuration","security-scanning-integration","vulnerability-management","shift-left-security"],"capabilityDetails":["Provides a complete GitLab CI/CD pipeline template with SAST, DAST, container scanning, dependency scanning, secret detection, and license compliance stages."],"techniqueTags":["static-application-security-testing","dynamic-application-security-testing","known-vulnerability-scanning","secret-pattern-matching"],"techniqueDetails":["Uses GitLab managed security analyzers to overlay scanning stages onto the CI/CD pipeline."],"tools":["gitlab","semgrep","spotbugs","gosec","bandit","nodejsscan","trivy"],"targetTypes":["source-code","container","web-application","api"],"role":"workflow","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Covers the full stack of GitLab security scanners in a single include-based pipeline","Leverages GitLab managed templates rather than building scanners from scratch","Includes security approval policies and GitLab Duo AI triage for vulnerabilities"],"familyIds":["ci-cd-security-scanning-integration"]},{"id":"building-identity-federation-with-saml-azure-ad","summary":"Operational guide for implementing SAML 2.0 identity federation with Azure AD/Entra ID, covering AD FS and third-party IdP configurations, claims transformation, SaaS application SSO, and certificate lifecycle management.","primaryDomain":"authentication","domainTags":["saml","identity-federation","azure-ad","entra-id","adfs","single-sign-on"],"capabilityTags":["saml-federation-configuration","identity-provider-setup","claims-rule-configuration","certificate-lifecycle-management","hybrid-identity-architecture"],"capabilityDetails":["Provides step-by-step workflow for configuring SAML 2.0 federation between on-premises Active Directory (AD FS or third-party IdP) and Microsoft Entra ID, including federation models, claims rules, SaaS app SSO, and certificate rotation."],"techniqueTags":["saml-2-0","adfs-federation","password-hash-sync","pass-through-authentication","third-party-idp","claims-transformation"],"techniqueDetails":["Uses SAML 2.0 protocol with AD FS as identity provider, claims rules to map AD attributes to SAML assertions, federation metadata exchange, and token-signing certificate management."],"tools":["powershell","adfs","microsoft-graph","entra-id","azure-ad-connect"],"targetTypes":["active-directory","cloud","web-application"],"role":"workflow","workflowFocus":["analysis","validation","knowledge-reference"],"distinctiveFeatures":["Covers both AD FS and third-party IdP federation models","Includes concrete PowerShell for AD FS farm setup, Azure AD domain federation, claims rules, and token-signing certificate rotation","Provides validation checklist with security controls (MFA, smart lockout, extranet lockout, monitoring)"],"familyIds":["identity-federation-sso-security"]},{"id":"building-identity-governance-lifecycle-process","summary":"Provides a structured workflow for designing and automating identity governance and lifecycle processes, including JML transitions, HR feed integration, birthright role mining, risk-based access approvals, and orphaned account remediation, for compliance with SOX, HIPAA, and GDPR.","primaryDomain":"security-knowledge","domainTags":["identity-governance","lifecycle-management","access-provisioning"],"capabilityTags":["jml-automation","role-mining","access-request-workflow","orphaned-account-detection"],"capabilityDetails":["Provides a workflow for automating joiner-mover-leaver identity lifecycle, role mining, access approvals, and orphaned account remediation based on HR feed integration."],"techniqueTags":["lifecycle-state-machine","hr-feed-correlation","birthright-role-mining","risk-based-approvals","account-correlation"],"techniqueDetails":["Models identity phases with automated actions and valid transitions.","Uses HR system as authoritative source and polls for worker lifecycle events.","Mines access patterns to define birthright roles and detect role explosion.","Classifies access requests by risk and builds multi-level approval chains.","Detects orphaned accounts by correlating application accounts with active HR identities."],"tools":["sailpoint","saviynt","entra-id","workday","active-directory"],"targetTypes":["active-directory","cloud","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","remediation"],"distinctiveFeatures":["Covers the full IGA lifecycle process from HR feed to recertification, with executable Python code for connectors and algorithms, rather than focusing on a single identity attack or vulnerability."],"familyIds":["compliance-governance"]},{"id":"building-incident-response-dashboard","summary":"Provides step-by-step guidance for building incident response dashboards in Splunk, Elastic, Grafana, and Sentinel, including affected systems tracking, IOC spread, timeline, SOC metrics, and executive briefings.","primaryDomain":"reporting","domainTags":["soc-operations","incident-response","visualization"],"capabilityTags":["dashboard-creation","incident-tracking","soc-metrics"],"capabilityDetails":["Provides workflows to build real-time incident response dashboards for situational awareness, tracking affected systems, containment status, IOC spread, response timeline, SOC operational metrics, and executive summaries."],"techniqueTags":["splunk-search","visualization-layout","metrics-calculation"],"techniqueDetails":["Uses Splunk Search Processing Language queries and dashboard panels to compute metrics such as MTTD, MTTR, containment progress, and IOC hits."],"tools":["Splunk","Elastic Kibana","Grafana","Microsoft Sentinel","TheHive"],"targetTypes":["other"],"role":"workflow","workflowFocus":["reporting","analysis"],"distinctiveFeatures":["Focuses specifically on building incident response dashboards rather than executing IR processes."],"familyIds":["soc-incident-response-dashboarding"]},{"id":"building-incident-response-playbook","summary":"Provides a structured methodology for designing and documenting incident response playbooks, including templates, RACI matrices, decision trees, escalation criteria, and SOAR automation guidance, aligned with NIST 800-61r3 and SANS PICERL.","primaryDomain":"security-knowledge","domainTags":["incident-response","playbook-development","soar-integration","ir-documentation"],"capabilityTags":["incident-response-playbook-design","raci-matrix-authoring","decision-tree-creation","soar-playbook-automation"],"capabilityDetails":["Provides a structured methodology to design, document, and mature incident response playbooks.","Includes templates for RACI matrices, decision trees, escalation criteria, and step-by-step procedures.","Guides integration with SOAR platforms to automate response workflows.","Supports alignment with NIST SP 800-61r3 and SANS PICERL frameworks."],"techniqueTags":["nist-sp-800-61r3","sans-picerl","tabletop-exercise","live-fire-exercise","decision-trees"],"techniqueDetails":["Uses NIST SP 800-61r3 and SANS PICERL as governing frameworks for playbook structure.","Employs decision trees to define response paths based on binary conditions.","Recommends tabletop and live-fire exercises to validate and maintain playbooks."],"tools":["cortex-xsoar","splunk-soar","thehive","confluence","gitlab-wiki","tines"],"targetTypes":["other"],"role":"workflow","workflowFocus":["knowledge-reference","analysis","reporting"],"distinctiveFeatures":["Focuses on authoring and maturing incident response playbooks rather than performing incident response actions.","Includes detailed templates for RACI matrices, decision trees, and escalation matrices.","Provides specific SOAR platform integration guidance (Cortex XSOAR, Splunk SOAR, Tines) not found in generic IR methodology skills."],"familyIds":["security-playbook-process-development"]},{"id":"building-incident-timeline-with-timesketch","summary":"Provides a comprehensive workflow for building collaborative forensic incident timelines with Timesketch, covering deployment, multi-source ingestion via Plaso/CSV/JSONL, built-in analyzers, search, and story-based reporting for attack chain reconstruction.","primaryDomain":"forensics","domainTags":["incident-response","digital-forensics","timeline-analysis","dfir"],"capabilityTags":["timeline-construction","multi-source-log-ingestion","collaborative-investigation","analyzer-automation","story-building"],"capabilityDetails":["Provides a workflow to ingest, normalize, and analyze multi-source event data into a collaborative forensic timeline using Timesketch."],"techniqueTags":["artifact-parsing","timeline-normalization","event-correlation","query-language-searching","sigma-rule-matching"],"techniqueDetails":["Uses Plaso to parse artifacts and normalize events; applies built-in analyzers and search queries to correlate events for attack chain reconstruction."],"tools":["timesketch","plaso","opensearch","elasticsearch","dissect"],"targetTypes":["windows-host","linux-host","network","cloud","other"],"role":"tool-guide","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Focuses specifically on Timesketch for collaborative forensic timeline construction rather than general DFIR methodology.","Covers full pipeline from evidence ingestion (Plaso/CSV/JSONL) through analyzers, search, and story-based reporting."],"familyIds":["log-analysis-and-timeline-reconstruction"]},{"id":"building-ioc-defanging-and-sharing-pipeline","summary":"A workflow for building an automated IOC defanging and sharing pipeline, covering extraction, normalization, STIX 2.1 conversion, and distribution to MISP/TAXII for safe threat intel sharing.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","ioc-management","defanging","stix","misp","taxii"],"capabilityTags":["ioc-extraction","ioc-normalization","ioc-defanging","stix-conversion","ioc-distribution","pipeline-automation"],"capabilityDetails":["Provides a step-by-step workflow to build an automated pipeline that ingests raw IOCs, normalizes and deduplicates them, defangs them for safe human reading, converts to STIX 2.1 bundles, and distributes via MISP/TAXII/email."],"techniqueTags":["regex-extraction","refanging","stix-indicator-patterns","taxii-2-1-api","misp-rest-api"],"techniqueDetails":["Uses regex patterns to extract IOCs from text, refangs defanged indicators before processing, normalizes via lowercasing and URL-decoding, defangs using replacements like hxxp:// and [.], generates STIX 2.1 Indicator patterns, and publishes via TAXII 2.1 Collection API and MISP REST API."],"tools":["python","defang","ioc-fanger","stix2","requests","validators","misp","taxii"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","reporting"],"distinctiveFeatures":["Focuses specifically on the operational pipeline for IOC defanging and automated threat intel sharing, rather than detection or analysis of individual threats.","Includes end-to-end implementation code for STIX 2.1 and TAXII/MISP integration."],"familyIds":["threat-intelligence-data-and-ioc-management"]},{"id":"building-ioc-enrichment-pipeline-with-opencti","summary":"Provides a step-by-step workflow for deploying OpenCTI and building an automated IOC enrichment pipeline with internal connectors and custom Python connectors that add context from VirusTotal, Shodan, AbuseIPDB, GreyNoise, and SecurityTrails, and score indicators for analyst prioritization.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","ioc-enrichment","opencti","stix","mitre-attack"],"capabilityTags":["ioc-enrichment","automated-pipeline","connector-development","confidence-scoring"],"capabilityDetails":["Provides a workflow to deploy OpenCTI and configure enrichment connectors to automatically enrich new IOCs with external threat context, correlate with threat actors/campaigns, and score for prioritization."],"techniqueTags":["stix-2-modeling","external-api-enrichment","message-queue-connectors","confidence-scoring"],"techniqueDetails":["Uses OpenCTI internal enrichment connectors triggered by new observables, querying external APIs and returning STIX 2.1 bundles with notes and labels."],"tools":["opencti","pycti","docker","virustotal","shodan","abuseipdb","greynoise","securitytrails","elasticsearch","rabbitmq"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses on operationalizing OpenCTI as an automated IOC enrichment hub with multiple external intelligence sources, including custom Python connector development."],"familyIds":["threat-intelligence-data-and-ioc-management"]},{"id":"building-malware-incident-communication-template","summary":"Provides structured communication templates and escalation procedures for malware incidents, covering internal, executive, technical, regulatory, and customer notifications.","primaryDomain":"reporting","domainTags":["incident-communication","malware-response","stakeholder-notification","regulatory-disclosure"],"capabilityTags":["communication-template-drafting","severity-classification","escalation-workflow","notification-messaging"],"capabilityDetails":["Provides a framework for creating structured communication templates during malware incidents, including audience-specific notifications and severity-based escalation timelines."],"techniqueTags":["template-design","severity-based-escalation","audience-mapping"],"techniqueDetails":["Defines a severity classification matrix with notification timelines and audiences, and provides five distinct notification templates adapted to internal teams, executives, IT staff, regulators, and customers."],"tools":[],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["reporting"],"distinctiveFeatures":["Focuses exclusively on communication templates for malware incidents, not on technical detection or response. Includes separate templates for executive, IT team, regulatory, and customer audiences. Provides severity-based escalation timelines and contact channels."],"familyIds":["incident-communication-and-post-incident-review"]},{"id":"building-patch-tuesday-response-process","summary":"Provides an operational playbook for building a Microsoft Patch Tuesday response process, including advisory triage, risk-based prioritization, ring-based deployment, and post-patch validation.","primaryDomain":"security-knowledge","domainTags":["patch-management","vulnerability-remediation","microsoft-patch-tuesday","risk-based-remediation"],"capabilityTags":["patch-triage","patch-deployment","deployment-ring-management","compliance-reporting"],"capabilityDetails":["Provides a structured workflow for triaging Microsoft Patch Tuesday updates from advisory review through ring-based deployment and validation."],"techniqueTags":["ring-based-deployment","cve-prioritization","pre-post-scan-validation","emergency-patching"],"techniqueDetails":["Uses risk-based categorization and deployment rings to prioritize and stage patches."],"tools":["wsus","sccm","intune","qualys-vmdr","rapid7","tenable"],"targetTypes":["windows-host"],"role":"workflow","workflowFocus":["detection","validation","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on a repeatable Patch Tuesday response timeline with risk-based ring deployment for Microsoft products.","Includes pre/post-scan validation and compliance reporting."],"familyIds":["security-playbook-process-development"]},{"id":"building-phishing-reporting-button-workflow","summary":"Deploys a user-facing phishing report button in email clients and automates SOAR triage of reported emails, including IOC extraction, classification, remediation actions, and reporter feedback.","primaryDomain":"cloud-security","domainTags":["phishing-defense","email-security","incident-response","security-awareness","soar"],"capabilityTags":["phishing-reporting","automated-triage","ioc-extraction","email-classification","automated-remediation","feedback-loop"],"capabilityDetails":["Provides a workflow for deploying a user-facing phishing report button and automating triage of reported emails with SOAR platforms, including IOC extraction, classification, and remediation actions."],"techniqueTags":["user-reported-phishing","soar-playbook","sandbox-analysis","threat-intelligence-lookup","email-retraction"],"techniqueDetails":["Uses built-in Microsoft 365 Report button or third-party add-ins (KnowBe4, Cofense) to collect reports, then SOAR automation performs IOC extraction, reputation checks, sandboxing, and automated classification/response."],"tools":["Microsoft 365","Microsoft Sentinel","Splunk SOAR","Cortex XSOAR","KnowBe4 Phish Alert Button","Cofense Reporter","VirusTotal","URLScan.io","Proofpoint CLEAR"],"targetTypes":["cloud"],"role":"workflow","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Covers both Microsoft 365 native report button and third-party options, explicitly focusing on the end-user reporting-to-remediation loop with SOAR automation and reporter feedback rather than gateway detection or phishing simulation."],"familyIds":["cloud-incident-response-and-forensics"]},{"id":"building-ransomware-playbook-with-cisa-framework","summary":"Guides creation of a CISA-aligned ransomware incident response playbook, providing phase-based checklists, detection indicators, containment steps, recovery priorities, and post-incident reporting templates.","primaryDomain":"security-knowledge","domainTags":["ransomware","incident-response","cisa","nist-csf"],"capabilityTags":["playbook-creation","readiness-assessment","tabletop-exercise","incident-response-planning"],"capabilityDetails":["Provides a structured workflow for creating or updating a ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST CSF, including actionable checklists for each response phase."],"techniqueTags":["shadow-copy-deletion-detection","endpoint-isolation","offline-backup-restoration","ad-credential-reset"],"techniqueDetails":["Employs CISA's phased response model with checklists, including isolation of affected systems, restoration from offline backups, and Active Directory krbtgt reset."],"tools":["CISA StopRansomware Guide","NIST CSF","ID Ransomware","MITRE ATT&CK","Velociraptor"],"targetTypes":["active-directory","windows-host","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation","reporting","validation"],"distinctiveFeatures":["Focuses on building a structured ransomware playbook rather than performing hands-on incident response","Provides CISA-aligned checklists and recovery priority matrix","Covers the full incident lifecycle from preparation to post-incident lessons learned"],"familyIds":["security-playbook-process-development"]},{"id":"building-red-team-c2-infrastructure-with-havoc","summary":"Delivers a complete operational playbook for deploying and hardening Havoc C2 infrastructure, including teamserver setup, HTTPS/SMB listeners, Nginx redirectors, Demon payload generation, and post-exploitation command execution for authorized red team engagements.","primaryDomain":"post-exploitation","domainTags":["command-and-control","red-team-infrastructure","c2-framework","adversary-emulation"],"capabilityTags":["c2-deployment","listener-configuration","redirector-setup","payload-generation","post-exploitation-operations"],"capabilityDetails":["Provides step-by-step instructions for deploying Havoc teamserver, configuring HTTPS/HTTP/SMB listeners, setting up Nginx redirectors, generating Demon payloads, and executing common post-exploitation commands."],"techniqueTags":["https-redirector","malleable-c2-profile","sleep-jitter","process-injection","in-memory-execution","token-manipulation","socks-pivoting"],"techniqueDetails":["Configures HTTP/HTTPS listeners with custom URIs, headers, and response spoofing to blend in with legitimate traffic.","Uses Nginx reverse proxy as a redirector to forward only C2 URIs and redirect all other traffic to a legitimate site.","Sets Demon agent sleep and jitter to avoid detection.","Leverages process injection and in-memory .NET execution for evasion.","Uses token manipulation and SOCKS pivoting for post-exploitation."],"tools":["havoc","nginx","demon-agent"],"targetTypes":["windows-host","network"],"role":"specialist-playbook","workflowFocus":["post-exploitation"],"distinctiveFeatures":["Dedicated to Havoc C2 framework specifically, not general C2 or other frameworks like Cobalt Strike.","Provides complete production-hardening steps including separate redirector, domain categorization, and SSL certificate requirements.","Includes detailed Demon agent post-exploitation commands and MITRE ATT&CK mapping."],"familyIds":["c2-framework-deployment-and-operations"]},{"id":"building-role-mining-for-rbac-optimization","summary":"Provides a practical workflow for mining and consolidating RBAC roles from existing user-permission data using clustering, formal concept analysis, and matrix decomposition, enabling organizations to reduce role explosion and enforce least privilege.","primaryDomain":"security-knowledge","domainTags":["rbac","access-control","identity-governance","least-privilege","role-mining"],"capabilityTags":["rbac-optimization","role-mining","permission-analysis","role-consolidation","least-privilege-enforcement"],"capabilityDetails":["Provides a data-driven workflow to discover and consolidate RBAC roles from existing user-permission assignments, reducing role explosion and enforcing least privilege."],"techniqueTags":["clustering","formal-concept-analysis","boolean-matrix-decomposition","silhouette-analysis","jaccard-distance"],"techniqueDetails":["Uses hierarchical clustering with Jaccard distance to group users into candidate roles.","Applies formal concept analysis to mine closed permission sets shared by user groups.","Demonstrates boolean matrix decomposition for role-permission mapping.","Uses silhouette analysis to select optimal number of roles."],"tools":["python","pandas","scikit-learn","numpy"],"targetTypes":["database","active-directory","other"],"role":"specialist-playbook","workflowFocus":["analysis","validation","remediation"],"distinctiveFeatures":["Focuses specifically on RBAC role mining and consolidation rather than vulnerability discovery or exploitation.","Combines multiple data-mining techniques for role engineering, including clustering and formal concept analysis, with a business validation workflow."],"familyIds":["rbac-role-mining-and-access-governance"]},{"id":"building-soc-escalation-matrix","summary":"Provides a complete SOC escalation matrix blueprint including tier definitions, severity-based SLAs, decision matrices, automatic and time-based triggers, communication templates, and SOAR integration examples.","primaryDomain":"security-knowledge","domainTags":["soc-operations","incident-management","escalation","triage"],"capabilityTags":["escalation-matrix-design","severity-tier-definition","response-sla-configuration","tiered-escalation-path"],"capabilityDetails":["Provides a structured framework for defining SOC severity tiers, response SLAs, tiered escalation paths, and notification procedures."],"techniqueTags":["context-driven-escalation","time-based-escalation","severity-classification","asset-criticality-analysis"],"techniqueDetails":["Combines incident severity, asset criticality, and business risk to determine escalation priority and response timelines."],"tools":["xsoar"],"targetTypes":["other"],"role":"mixed","workflowFocus":["analysis","reporting","remediation"],"distinctiveFeatures":["Focuses on SOC operational process design rather than technical offensive or defensive security testing.","Provides reusable templates and decision matrices for multi-tier incident response.","Integrates context-driven escalation triggers combining severity, asset criticality, and data sensitivity.","Includes time-based escalation rules and SOAR automation examples."],"familyIds":["soc-operations-playbook-design"]},{"id":"building-soc-metrics-and-kpi-tracking","summary":"Builds SOC performance metrics and KPI tracking dashboards, using Splunk SPL to measure MTTD/MTTR, alert quality, analyst productivity, and ATT&CK detection coverage, with executive reporting and continuous improvement workflows.","primaryDomain":"reporting","domainTags":["soc-operations","metrics","kpi","detection-coverage"],"capabilityTags":["soc-metrics-framework","mttd-mttr-calculation","alert-quality-analysis","detection-coverage-tracking","executive-dashboarding"],"capabilityDetails":["Provides a structured workflow for defining and measuring SOC performance metrics, including MTTD, MTTR, alert quality, analyst productivity, and detection coverage.","Includes practical Splunk SPL queries to compute these metrics from SIEM data and generate executive dashboards."],"techniqueTags":["splunk-spl","att-ck-mapping","trend-analysis","percentile-statistics"],"techniqueDetails":["Uses Splunk SPL for calculating averages, medians, and percentiles of detection and response times.","Leverages ATT&CK Navigator and lookup tables to score detection coverage across tactics and data sources.","Applies trend analysis and month-over-month comparisons for continuous improvement tracking."],"tools":["splunk","grafana","power-bi","attack-navigator","servicenow"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","reporting"],"distinctiveFeatures":["Focuses exclusively on SOC operational performance metrics rather than threat detection or incident response execution.","Provides concrete, copy-pasteable Splunk queries for MTTD/MTTR, alert disposition, and ATT&CK coverage scoring.","Includes NIST CSF mapping and executive reporting output templates, making it directly actionable for SOC leadership."],"familyIds":["soc-incident-response-dashboarding"]},{"id":"building-soc-playbook-for-ransomware","summary":"Provides a step-by-step guide for building a SOC ransomware response playbook, including detection queries, triage decision tree, EDR/firewall containment commands, evidence collection, recovery steps, and post-incident template aligned to NIST/MITRE.","primaryDomain":"security-knowledge","domainTags":["soc-operations","incident-response","ransomware"],"capabilityTags":["soc-playbook-development","ransomware-detection","incident-containment","evidence-collection","recovery-planning"],"capabilityDetails":["Builds a structured SOC incident response playbook for ransomware, including SIEM detection rules, triage decision tree, EDR/firewall containment actions, forensic evidence collection, eradication/recovery steps, and post-incident documentation."],"techniqueTags":["mitre-attack-mapping","data-encrypted-for-impact","inhibit-system-recovery","phishing","powershell"],"techniqueDetails":["Maps ransomware response activities to MITRE ATT&CK techniques such as T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery), T1566 (Phishing), and T1059.001 (PowerShell), with matching SIEM detection logic."],"tools":["CrowdStrike Falcon","SentinelOne","Splunk ES","Elastic Security","Microsoft Defender for Endpoint","ID Ransomware","No More Ransom","Veeam"],"targetTypes":["windows-host","network","active-directory"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Delivers a pre-written, ready-to-adapt SOC playbook template rather than generic IR methodology, with literal SIEM queries and EDR/firewall commands.","Explicitly tied to NIST SP 800-61 phases and MITRE ATT&CK techniques, including ransomware-specific scenarios (LockBit, BlackCat, Conti) and an output report template."],"familyIds":["soc-operations-playbook-design"]},{"id":"building-super-timelines-with-plaso","summary":"Builds comprehensive forensic super timelines using Plaso's CLI tools and triages them in Timesketch, including detection of timestomping and log-clearing artifacts.","primaryDomain":"forensics","domainTags":["digital-forensics","timeline-analysis","incident-response"],"capabilityTags":["forensic-timelining","artifact-extraction","timeline-triage","anti-forensics-detection"],"capabilityDetails":["Provides a step-by-step workflow for creating forensic super timelines using Plaso's log2timeline, pinfo, psort, and psteal, importing them into Timesketch, and triaging the results."],"techniqueTags":["plaso-toolsuite","log2timeline","psort-filtering","timesketch-import"],"techniqueDetails":["Uses Plaso parsers to extract MACB timestamps, registry, EVTX, browser history, prefetch, LNK, USN journal, and syslog events; uses psort filters to scope date ranges; identifies timestomping via timestamp inconsistencies."],"tools":["plaso","log2timeline","pinfo","psort","psteal","timesketch"],"targetTypes":["windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation"],"distinctiveFeatures":["Focuses specifically on building comprehensive super timelines with Plaso and importing them into Timesketch for collaborative triage, including detection of timestomping and log-clearing artifacts."],"familyIds":["log-analysis-and-timeline-reconstruction"]},{"id":"building-threat-actor-profile-from-osint","summary":"Provides a structured workflow for collecting OSINT from diverse public sources, correlating indicators, mapping TTPs to MITRE ATT&CK, and generating STIX 2.1 threat actor dossiers for attribution and defense.","primaryDomain":"reconnaissance","domainTags":["osint","threat-intelligence","attribution"],"capabilityTags":["osint-collection","threat-actor-profiling","indicator-correlation","ttp-mapping","dossier-generation"],"capabilityDetails":["Collects OSINT from vendor reports, paste sites, dark web forums, social media, code repos, and certificate transparency logs.","Correlates indicators across sources and maps adversary infrastructure using link analysis tools.","Maps TTPs to MITRE ATT&CK and produces structured STIX 2.1 threat actor dossiers with attribution assessments."],"techniqueTags":["osint","diamond-model","ach","stix-2-1","mitre-attack"],"techniqueDetails":["Uses the Diamond Model to structure analysis of adversary, infrastructure, capability, and victim.","Applies Analysis of Competing Hypotheses (ACH) for attribution confidence.","Leverages STIX 2.1 Threat Actor, Intrusion Set, and Identity objects for standardized profile representation.","Maps tactics and techniques to MITRE ATT&CK using attackcti."],"tools":["Maltego","SpiderFoot","Shodan","VirusTotal","AlienVault OTX","PassiveTotal","attackcti","stix2"],"targetTypes":["other"],"role":"workflow","workflowFocus":["reconnaissance","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on adversary attribution and structured threat actor dossier generation rather than general OSINT collection.","Integrates STIX 2.1 object modeling and MITRE ATT&CK mapping as core parts of the profiling workflow.","Provides executable Python examples for each step, from OSINT collection to final dossier generation."],"familyIds":["osint-threat-actor-profiling"]},{"id":"building-threat-feed-aggregation-with-misp","summary":"Provides a practical workflow to deploy MISP via Docker, ingest threat feeds from OSINT and custom sources, correlate indicators, and export IOCs to SIEMs or blocklists for detection and enrichment.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","misp","ioc-management","security-operations"],"capabilityTags":["misp-deployment","threat-feed-configuration","ioc-correlation","siem-export"],"capabilityDetails":["Deploy MISP via Docker Compose, enable and add OSINT/custom threat feeds, search and correlate indicators, and export IOCs to Splunk or flat blocklists."],"techniqueTags":["docker-compose","pymisp-api","feed-fetching","splunk-hec"],"techniqueDetails":["Uses Docker for MISP stack, PyMISP for feed management and search, and Splunk HTTP Event Collector for SIEM export."],"tools":["misp","docker","docker-compose","pymisp","splunk"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Centered on building a centralized threat intelligence hub with MISP, covering deployment, feed ingestion, and SIEM export rather than a single investigative technique."],"familyIds":["threat-intelligence-operations-and-analysis"]},{"id":"building-threat-hunt-hypothesis-framework","summary":"A structured workflow for planning and executing proactive threat hunts, from hypothesis formulation based on intelligence and gap analysis to EDR/SIEM query execution, validation, and standardized reporting.","primaryDomain":"security-knowledge","domainTags":["threat-hunting","hypothesis-framework","edr","siem","threat-intelligence"],"capabilityTags":["threat-hunt-workflow","hypothesis-formulation","query-execution","finding-validation","hunt-reporting"],"capabilityDetails":["Provides a step-by-step methodology for turning threat intelligence and ATT&CK coverage gaps into testable hunting hypotheses, executing EDR/SIEM queries to collect evidence, validating findings to separate true positives from false positives, and documenting results in a structured hunt report."],"techniqueTags":["command-and-control","powershell-execution","process-injection","persistence"],"techniqueDetails":["Hunts for these ATT&CK techniques using endpoint and SIEM telemetry, but the skill focuses on the hypothesis-driven workflow rather than deep technical analysis of each technique."],"tools":["crowdstrike-falcon","microsoft-defender-for-endpoint","splunk","elastic-security","sysmon","velociraptor","sigma"],"targetTypes":["windows-host","network"],"role":"workflow","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Provides an end-to-end hunting framework instead of a prebuilt query pack","Formalizes hypothesis generation from threat intelligence and ATT&CK gap analysis","Includes a standardized hunt report template for consistent documentation"],"familyIds":["threat-hunting"]},{"id":"building-threat-intelligence-enrichment-in-splunk","summary":"A specialized guide to building automated threat intelligence enrichment in Splunk ES, covering feed ingestion, KV Store lookups, correlation searches, and dashboards for IOC matching.","primaryDomain":"network-security","domainTags":["threat-intelligence","ioc-enrichment","siem","soc-operations"],"capabilityTags":["threat-intelligence-enrichment","ioc-correlation","splunk-configuration","detection-engineering"],"capabilityDetails":["Provides an end-to-end workflow for building automated IOC enrichment pipelines in Splunk ES, ingesting threat feeds into KV Store collections and correlating them against security events via lookup tables and the Threat Intelligence Framework."],"techniqueTags":["kv-store-lookup","modular-input","stix-taxii","correlation-search","tstats"],"techniqueDetails":["Uses KV Store collections as normalized IOC storage with lookup-based enrichment.","Leverages modular inputs for pulling STIX/TAXII, CSV, and API-based threat feeds.","Applies correlation searches with tstats and lookup commands to enrich and flag events."],"tools":["splunk","splunk-enterprise-security"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses specifically on Splunk ES Threat Intelligence Framework rather than generic IOC handling.","Provides complete pipeline from feed ingestion, KV Store configuration, to correlation searches and dashboards.","Includes a Python modular input example for custom OTX threat feed API."],"familyIds":["threat-intelligence-enrichment"]},{"id":"building-threat-intelligence-feed-integration","summary":"Builds automated pipelines to ingest threat intelligence feeds from STIX/TAXII and open-source sources, normalize and deduplicate indicators, and push them to SIEM and security tools for real-time IOC matching and alerting.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","soc-operations","siem-integration","stix-taxii","ioc-management"],"capabilityTags":["threat-intelligence-feed-integration","ioc-normalization","ioc-deduplication","siem-distribution","feed-health-monitoring"],"capabilityDetails":["Provides an automated pipeline to ingest threat intelligence feeds from STIX/TAXII and open-source sources, normalize indicators to STIX 2.1, deduplicate, and distribute to SIEM platforms for real-time IOC matching and alerting."],"techniqueTags":["stix-2-1","taxii-2-1","ioc-scoring","python-automation","misp-integration"],"techniqueDetails":["Uses STIX/TAXII client libraries for feed retrieval, Python scripts for normalization and deduplication, and APIs to push indicators into Splunk ES and MISP."],"tools":["MISP","AlienVault OTX","Abuse.ch","OpenCTI","Splunk ES","taxii2-client","stix2","pymisp"],"targetTypes":["network","other"],"role":"workflow","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Focuses on defensive SOC operations rather than offensive security, providing a complete feed integration workflow with concrete Python code for TAXII, OTX, Abuse.ch, Splunk, and MISP.","Includes feed health monitoring and match-rate analytics to assess intelligence source quality."],"familyIds":["threat-intelligence-operations-and-analysis"]},{"id":"building-threat-intelligence-platform","summary":"Provides a complete, operational procedure to architect and deploy an integrated open-source Threat Intelligence Platform (TIP) with MISP, OpenCTI, TheHive, and Cortex, including feed ingestion, automated enrichment, metrics dashboards, and intelligence sharing.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","cti","platform-building","ioc-management","stix-taxii"],"capabilityTags":["platform-architecture","feed-ingestion","enrichment-workflow","stix-taxii-interop","analytics-dashboard"],"capabilityDetails":["Provides a step-by-step procedure for designing and deploying an integrated Threat Intelligence Platform from open-source components, including feed ingestion, enrichment, and sharing workflows."],"techniqueTags":["misp-opencti-sync","cortex-analyzer-integration","osint-feed-management","docker-compose-deployment","stix-2-1-data-model"],"techniqueDetails":["Uses Docker Compose to deploy MISP, OpenCTI, TheHive, and Cortex; Python libraries to manage feeds and enrichment; and STIX/TAXII standards for interoperability."],"tools":["MISP","OpenCTI","TheHive","Cortex","Docker","Elasticsearch","Redis","RabbitMQ","MinIO","pymisp","pycti"],"targetTypes":["container","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["End-to-end TIP deployment and integration across multiple CTI tools rather than a single tool","Includes data pipelines and dashboards, not just threat intel lookup"],"familyIds":["threat-intelligence-operations-and-analysis"]},{"id":"building-vulnerability-aging-and-sla-tracking","summary":"Provides a comprehensive framework and Python implementation for building a vulnerability aging and SLA tracking system, including severity-based deadlines, adaptive modifiers, KPI calculation, dashboards, and automated escalation workflows, enabling organizations to measure time-to-remediation and demonstrate compliance.","primaryDomain":"reporting","domainTags":["vulnerability-management","sla-tracking","remediation-metrics","compliance"],"capabilityTags":["vulnerability-aging","sla-enforcement","escalation-workflow","compliance-reporting"],"capabilityDetails":["Provides a workflow and Python implementation for computing vulnerability age, comparing against severity-based SLA deadlines, generating KPIs, and producing escalation lists and compliance metrics."],"techniqueTags":["aging-calculation","adaptive-sla-modifiers","escalation-thresholds","dashboard-querying"],"techniqueDetails":["Uses Python/pandas to calculate aging and SLA compliance, applies adaptive modifiers based on asset criticality and threat context, and uses percentage-based escalation levels."],"tools":["python","pandas","elasticsearch","grafana"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","reporting","remediation"],"distinctiveFeatures":["Focuses specifically on time-to-remediation metrics and SLA enforcement rather than vulnerability discovery or technical exploitation.","Provides a concrete Python implementation for aging calculation and escalation list generation, along with dashboard query examples."],"familyIds":["vulnerability-management-dashboarding-and-sla-tracking"]},{"id":"building-vulnerability-dashboard-with-defectdojo","summary":"Provides deployment and configuration guidance for DefectDojo as a centralized vulnerability management platform, including scanner result ingestion, CI/CD integration, Jira ticketing, and metrics tracking via REST API.","primaryDomain":"reporting","domainTags":["vulnerability-management","defectdojo","devsecops","scanner-integration"],"capabilityTags":["vulnerability-dashboarding","scanner-result-ingestion","deduplication","remediation-tracking","jira-integration"],"capabilityDetails":["Provides a workflow for deploying DefectDojo as a centralized vulnerability management platform, ingesting findings from multiple scanners, deduplicating results, and tracking remediation metrics via REST API."],"techniqueTags":["docker-compose-deployment","rest-api-automation","ci-cd-pipeline-integration","jira-ticket-mapping"],"techniqueDetails":["Uses Docker Compose to deploy DefectDojo and REST API calls for creating products, engagements, reimporting scan results, and querying metrics."],"tools":["defectdojo","docker-compose","jira","slack","nesuss","openvas","qualys","zap","burp-suite","trivy","semgrep","snyk","sonarqube","checkov"],"targetTypes":["web-application","api","network","container","source-code","cloud"],"role":"tool-guide","workflowFocus":["analysis","reporting","remediation"],"distinctiveFeatures":["Focuses on centralizing and managing vulnerability findings from multiple scanners into a single dashboard rather than performing security assessments or scans."],"familyIds":["vulnerability-management-dashboarding-and-sla-tracking"]},{"id":"building-vulnerability-exception-tracking-system","summary":"Provides a blueprint for a vulnerability exception tracking system with approval workflows, compensating control documentation, and automatic expiration, supporting compliance frameworks like PCI DSS, SOC 2, and NIST CSF.","primaryDomain":"security-knowledge","domainTags":["vulnerability-management","risk-acceptance","exception-tracking","compliance"],"capabilityTags":["exception-request-workflow","approval-tracking","compensating-controls-documentation","expiration-management"],"capabilityDetails":["Provides a process and implementation blueprint for tracking vulnerability exceptions, including request categorization, approval workflows, compensating control documentation, and automatic expiration."],"techniqueTags":["flask-api","database-schema-design","sla-expiration-checking","audit-logging"],"techniqueDetails":["Uses a Flask REST API with database tables for exceptions and audit logs, and a cron job to expire exceptions past their validity period."],"tools":["python","flask","sqlalchemy","postgresql"],"targetTypes":["other"],"role":"workflow","workflowFocus":["remediation","reporting"],"distinctiveFeatures":["Unlike vulnerability discovery or exploitation skills, this covers the governance process for accepted risks, including exception categorization, multi-level approval, compensating controls documentation, and automated expiration to enforce SLAs."],"familyIds":["risk-assessment-and-exception-management"]},{"id":"building-vulnerability-scanning-workflow","summary":"Builds a recurring vulnerability scanning workflow for SOC teams, covering scoping, risk-based prioritization with CVSS and CISA KEV, SIEM integration for exploitation detection, SLA-based remediation tracking, and automated ticket creation.","primaryDomain":"network-security","domainTags":["vulnerability-scanning","vulnerability-management","soc-operations","risk-prioritization"],"capabilityTags":["vulnerability-scanning","risk-prioritization","siem-integration","remediation-tracking"],"capabilityDetails":["Provides a complete workflow to establish recurring vulnerability scans, prioritize findings using CVSS and CISA KEV, integrate with SIEM for exploitation detection, and track remediation SLAs."],"techniqueTags":["cvss-scoring","cisa-kev-correlation","asset-criticality-scoring","splunk-correlation"],"techniqueDetails":["Uses CVSS base scores boosted by CISA KEV status and asset criticality to compute risk scores","Correlates vulnerability scan data with IDS/IPS alerts in Splunk to detect active exploitation","Automates scan creation and result retrieval via Nessus and Qualys APIs"],"tools":["nessus","qualys","openvas","cisa-kev","splunk","servicenow"],"targetTypes":["network","windows-host","linux-host"],"role":"workflow","workflowFocus":["detection","analysis","reporting","remediation"],"distinctiveFeatures":["Focuses on building a complete vulnerability management workflow, not just running scans","Emphasizes risk-based prioritization beyond CVSS using CISA KEV and asset criticality","Integrates vulnerability scans with SIEM for exploitation detection and automated ticketing","Provides concrete API examples for Nessus, Qualys, and Splunk for SOC operations"],"familyIds":["vulnerability-scanning-management"]},{"id":"business-logic-vuln","summary":"Routing skill for business logic and state-machine vulnerability testing, directing users to specialized playbooks for workflow abuse, race conditions, pricing flaws, and multi-step state attacks.","primaryDomain":"web-security","domainTags":["business-logic","state-machine","logic-flaws"],"capabilityTags":["business-logic-testing","workflow-analysis","state-machine-analysis"],"capabilityDetails":["Provides routing and triage for business logic vulnerability testing, directing users to specialized playbooks and advising when to use them."],"techniqueTags":["race-condition-testing","workflow-bypass","price-tampering","multi-step-state"],"techniqueDetails":["Mentions check-then-act windows, sequence dependencies, and missing cross-step authorization as key test areas."],"tools":[],"targetTypes":["web-application","api"],"role":"router","workflowFocus":["navigation","analysis"],"distinctiveFeatures":["Entry-point router specifically for business logic and state-machine flaws, distinguishing them from parser-level injection issues."],"familyIds":["business-logic-vulnerabilities"]},{"id":"business-logic-vulnerabilities","summary":"Comprehensive business logic vulnerability playbook for web applications and APIs, covering price manipulation, race conditions, workflow bypasses, coupon abuse, account logic flaws, subscription/VIP bypass, and API state attacks, with practical reproduction steps and prioritized checklists.","primaryDomain":"web-security","domainTags":["business-logic","api-security","e-commerce-security","authentication"],"capabilityTags":["business-logic-testing","price-manipulation-testing","race-condition-testing","workflow-bypass-testing","coupon-abuse-testing","authorization-bypass-testing","state-machine-attacks"],"capabilityDetails":["Provides a human-reasoning workflow for discovering and exploiting scanner-invisible business logic flaws.","Covers price/value manipulation, race conditions, workflow step skipping, coupon/referral abuse, account and privilege logic flaws, API state manipulation, subscription/VIP bypass, and business-logic file upload issues.","Includes consolidated 30-minute and 2-hour attack checklists across login, registration, payment, authentication, subscription, and resources surfaces."],"techniqueTags":["parameter-tampering","negative-value-injection","integer-overflow","race-condition","step-skip","state-parameter-manipulation","token-reuse","weak-random-token","filter-bypass","idor"],"techniqueDetails":["Uses negative or fractional quantity values to manipulate price calculations.","Uses parallel requests to exploit non-atomic check-update operations in race conditions.","Skips required steps in multi-step workflows by directly invoking final endpoints or manipulating client-trusted status fields.","Exploits token reuse, weak random token generation, and email change flows to bypass authentication and password reset logic.","Uses path-traversal truncation and semicolon path-parameter tricks to bypass Java Filter authentication checks.","Tests direct resource access and IDOR for premium content and media URLs."],"tools":["burp-suite","turbo-intruder","curl","tesseract","vlc"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on scanner-invisible business logic vulnerabilities rather than generic web vulnerabilities.","Includes consolidated 30-minute and 2-hour checklists prioritized by impact.","Covers Java-specific anti-patterns such as getRequestURI() filter bypasses and Spring Security antMatchers coverage gaps.","Provides companion methodology, checklist, and scenario files for further depth."],"familyIds":["business-logic-vulnerabilities"]},{"id":"bypassing-authentication-with-forced-browsing","summary":"A hands-on playbook for discovering unlinked URLs, admin panels, and exposed files via forced browsing, then testing and bypassing authentication enforcement on web and API endpoints.","primaryDomain":"web-security","domainTags":["authentication","web-application-security","access-control"],"capabilityTags":["forced-browsing","directory-enumeration","authentication-bypass-testing","access-control-validation"],"capabilityDetails":["Provides a workflow for discovering unprotected pages, APIs, and admin interfaces via forced browsing and testing authentication enforcement."],"techniqueTags":["directory-bruteforcing","http-method-fuzzing","path-normalization-bypass","url-encoding-bypass","sensitive-file-discovery"],"techniqueDetails":["Uses wordlist-based brute-forcing to find hidden URLs; tests alternative HTTP methods and method override headers; exploits URL parsing differences (case, encoding, traversal) to bypass path-based auth; searches for backup/config files."],"tools":["ffuf","gobuster","feroxbuster","dirbuster","burp-suite","seclists"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","exploitation"],"distinctiveFeatures":["Combines forced browsing discovery with multiple authentication bypass techniques (method override, path normalization, URL encoding) in one workflow","Includes concrete ffuf, gobuster, and curl command examples for each step","Covers both API and web application endpoints, including Spring Boot Actuator exposure and backup file discovery"],"familyIds":["http-request-tampering-and-bypass"]},{"id":"ci-security-scanning-with-strix","summary":"Step-by-step guide to integrating Strix AI security scanning into CI/CD pipelines, covering both self-hosted CLI and managed platform, with diff-scoped PR scanning, build failure on validated findings, SARIF upload, and operational guidance to prevent fail-open scans.","primaryDomain":"source-code-security","domainTags":["ci-security","sast","vulnerability-scanning"],"capabilityTags":["ci-security-scanning","diff-scope-scanning","pr-gating","sarif-upload","managed-platform-integration"],"capabilityDetails":["Provides complete setup guidance for incorporating Strix AI security scanning into CI/CD pipelines.","Covers both self-hosted OSS CLI integration (GitHub Actions, GitLab CI, or generic pipelines) and managed app.strix.ai platform via PR-review app or API.","Includes diff-scoped scanning on pull requests, build failure on validated vulnerabilities, SARIF 2.1.0 export, and PR comment delivery."],"techniqueTags":["exit-code-gating","run-status-validation","budget-sizing","diff-base-resolution","scan-mode-configuration"],"techniqueDetails":["Uses Strix exit code 2 to fail CI jobs when validated vulnerabilities are found.","Validates patch completion by inspecting run.json status, avoiding fail-open behavior when the scan budget is exhausted before full diff coverage.","Leverages diff-scope resolution and --diff-base to ensure only changed files are scanned.","Recommends scan-mode tuning (quick, standard, deep) and budget sizing appropriate to diff size."],"tools":["strix","git","jq","curl"],"targetTypes":["source-code"],"role":"tool-guide","workflowFocus":["detection","validation","reporting"],"distinctiveFeatures":["Dedicated operational guide to Strix CI/CD integration, covering both self-hosted OSS CLI and managed platform options.","Emphasizes robust fail-open prevention through run.json status checks and explicit diff-base resolution.","Differentiates from general SAST methodology by providing turnkey YAML workflows, exit-code policies, and SARIF upload steps specific to Strix."],"familyIds":["ci-cd-security-scanning-integration"]},{"id":"classical-cipher-analysis","summary":"Expert CTF playbook for identifying and breaking classical ciphers (substitution, Vigenere, affine, Hill, transposition, XOR) using frequency analysis, Kasiski examination, known-plaintext attacks, and automated tools.","primaryDomain":"ctf","domainTags":["classical-ciphers","cryptanalysis"],"capabilityTags":["cipher-identification","frequency-analysis","vigenere-cracking","xor-analysis","substitution-solving"],"capabilityDetails":["Provides a complete workflow to identify unknown ciphertext (encoding vs classical cipher) and apply appropriate breaking techniques.","Includes Python implementations for frequency analysis, Kasiski examination, IC-based key length detection, and known-plaintext attacks."],"techniqueTags":["frequency-analysis","kasiski-examination","index-of-coincidence","known-plaintext-attack","chi-squared-scoring","xor-key-recovery"],"techniqueDetails":["Uses chi-squared scoring against English letter frequencies to rank candidate plaintexts.","Uses Kasiski examination and index of coincidence to determine Vigenere key length.","Uses known plaintext/crib dragging to recover keys for substitution, affine, Hill, and XOR ciphers."],"tools":["CyberChef","dcode.fr","quipqiup","xortool","Ciphey","Python"],"targetTypes":["ctf"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Starts with encoding detection (base64/hex/binary/Morse) before cipher analysis, preventing misidentification.","Provides an expert decision tree that routes to cipher-specific attacks.","Covers both classical ciphers (substitution, Vigenere, affine, Hill, transposition) and XOR ciphers in one CTF-focused playbook.","Includes Python implementations for frequency analysis, IC, Kasiski, and known-plaintext attacks."],"familyIds":["ctf-cryptanalysis"]},{"id":"clickjacking","summary":"Step-by-step playbook to detect and exploit clickjacking vulnerabilities, including header/CSP analysis, transparent iframe PoCs, frame-busting bypasses, and high-impact target prioritization.","primaryDomain":"web-security","domainTags":["clickjacking","ui-redress","x-frame-options","csp-frame-ancestors"],"capabilityTags":["clickjacking-testing","frameability-assessment","poc-development","frame-busting-bypass"],"capabilityDetails":["Provides a workflow to test whether pages can be framed, analyze X-Frame-Options and CSP frame-ancestors, and build proof-of-concept exploits."],"techniqueTags":["transparent-iframe","x-frame-options-analysis","csp-frame-ancestors-analysis","frame-busting-bypass","multi-step-clickjacking","drag-and-drop-clickjacking","double-framing"],"techniqueDetails":["Uses transparent iframes with low opacity to overlay decoy UI over a target page; evaluates header-based and CSP-based framing protections; bypasses frame-busting scripts using sandbox attributes."],"tools":["browser"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Expert playbook specifically for clickjacking/UI redress attacks, covering XFO/CSP frame-ancestors, frame-busting bypasses, multi-step and drag-and-drop attacks, and chaining with sensitive actions."],"familyIds":["cross-origin-attacks"]},{"id":"cmdi-command-injection","summary":"Expert OS command injection playbook that teaches how to identify, validate, and exploit command injection across web apps and infrastructure, including blind timing/OOB detection, payload libraries, WAF bypass, PHP disable_functions workarounds, Windows cmd/PowerShell differences, and container/K8s execution contexts.","primaryDomain":"injection","domainTags":["command-injection","os-command-injection"],"capabilityTags":["command-injection-testing","blind-injection-validation","out-of-band-exploitation","filter-bypass","reverse-shell-development"],"capabilityDetails":["Provides a comprehensive workflow for detecting, validating, and exploiting OS command injection across web applications and supporting infrastructure.","Covers blind command injection using time-based delays and out-of-band DNS/HTTP exfiltration.","Includes advanced filter and WAF bypass techniques, PHP disable_functions bypass paths, and environment-variable-based execution attacks."],"techniqueTags":["shell-metacharacter-injection","time-based-detection","out-of-band-exfiltration","waf-bypass","environment-variable-abuse","container-exec-injection"],"techniqueDetails":["Uses shell metacharacters such as ;, |, &, $(), and backticks to break out of command context.","Blind detection via sleep/timeout payloads and DNS/HTTP callbacks to Burp Collaborator.","Bypasses filters using $IFS, brace expansion, globbing, hex encoding, variable assembly, and PHP-specific obfuscation.","Includes Windows cmd.exe vs PowerShell injection behavior and cross-platform polyglot payloads."],"tools":["burp-collaborator","netcat","phuip-fpizdam"],"targetTypes":["web-application","linux-host","windows-host","container","kubernetes"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Comprehensive single-playbook coverage of OS command injection from shell metacharacter basics through advanced WAF bypass, PHP disable_functions bypass, environment-variable implicit execution, and container/K8s exec injection, with a Windows cmd.exe vs PowerShell injection matrix."],"familyIds":["command-injection"]},{"id":"code-audit","summary":"Professional code security audit skill covering 55+ vulnerability types. Enhanced with WooYun 88,636 real-world vulnerability cases (2010-2016). This skill should be used when performing security audits, vulnerability scanning, penetration testing preparation, or code review for security issues. Supports 9 languages: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust. Includes 143 mandatory detection items across all languages with language-specific checklists. Covers SQL injection, XSS, RCE, deserialization, SSRF, JNDI injection, JDBC protocol injection, authentication bypass, business logic flaws, race conditions, and modern security domains (LLM, Serverless, Android). WooYun integration adds: statistical-driven parameter priority, bypass techniques library, logic vuln","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"code-obfuscation-deobfuscation","summary":"Analyst playbook for identifying and defeating code obfuscation in native binaries, covering junk code, opaque predicates, self-modifying code, control-flow flattening, movfuscator, VM protectors, string encryption, import hiding, and anti-disassembly.","primaryDomain":"reverse-engineering","domainTags":["code-obfuscation","deobfuscation","binary-analysis"],"capabilityTags":["obfuscation-detection","deobfuscation-strategy","control-flow-recovery","vm-deobfuscation","string-decryption"],"capabilityDetails":["Provides a structured playbook to identify and defeat code obfuscation techniques in native binaries."],"techniqueTags":["junk-code","opaque-predicates","self-modifying-code","control-flow-flattening","movfuscator","vm-protection","import-hiding","anti-disassembly"],"techniqueDetails":["Covers junk code removal via dead code analysis and opaque predicate solving using abstract interpretation or Z3.","Describes self-modifying code analysis through breakpoint placement and memory dumping after decryption loops.","Explains control flow flattening recovery via symbolic execution, trace-based reconstruction, and D-810.","Includes movfuscator identification and demovfuscation using static analysis or trace-based approaches.","Covers VM protection analysis from VM entry identification to handler table extraction and devirtualization.","Addresses string encryption recovery patterns including XOR loops, stack strings, RC4, and AES.","Details import hiding detection and API hash resolution for common hash algorithms.","Lists anti-disassembly tricks and manual IDA/Ghidra fix techniques."],"tools":["IDA Pro","Ghidra","D-810","angr","Z3","Unicorn Engine","Triton","miasm","REVEN","demovfuscator","x64dbg","Capstone","Binary Ninja"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Combines static and dynamic techniques across a broad spectrum of obfuscation types including junk code, opaque predicates, SMC, CFF, movfuscator, VM protectors, string encryption, import hiding, and anti-disassembly, with a decision tree and tool selection guide."],"familyIds":["binary-protection-and-anti-analysis-bypass"]},{"id":"coercing-authentication-with-coercer-petitpotam","summary":"Actionable playbook for coercing Windows machine authentication via Coercer/PetitPotam and relaying to AD CS or LDAP to achieve domain compromise through ESC8 or RBCD.","primaryDomain":"active-directory","domainTags":["authentication","rpc","ntlm-relay","ad-cs"],"capabilityTags":["authentication-coercion","ntlm-relay","certificate-abuse","rbcd"],"capabilityDetails":["Provides an operational workflow to coerce Windows machine accounts to authenticate to an attacker-controlled host using Coercer or PetitPotam, then relay the captured NTLM authentication to AD CS (ESC8) or LDAP (RBCD) for domain compromise."],"techniqueTags":["rpc-coercion","ms-efsr","ms-rprn","ms-dfsnm","ms-fsrvp","esc8","rbcd","dcsync"],"techniqueDetails":["Uses MS-EFSR (PetitPotam) and multiple other RPC protocols via Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) to force authentication.","Relays coerced NTLM authentication to AD CS Web Enrollment for ESC8 certificate theft or to LDAP for Resource-Based Constrained Delegation."],"tools":["coercer","petitpotam","certipy","impacket"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["reconnaissance","exploitation","validation"],"distinctiveFeatures":["Combines multiple RPC coercion methods (MS-EFSR, MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) in a single tool (Coercer) with scan, coerce, and fuzz modes.","Directly integrates coerced authentication with NTLM relay to AD CS (ESC8) or LDAP (RBCD), including DCSync after certificate acquisition."],"familyIds":["authentication-coercion-and-ntlm-relay"]},{"id":"collecting-indicators-of-compromise","summary":"A specialist incident-response playbook that systematically collects, enriches, scores, and distributes indicators of compromise across network, host, and email sources, packaging them in STIX/TAXII formats for detection and threat intelligence sharing.","primaryDomain":"security-knowledge","domainTags":["incident-response","threat-intelligence","ioc-collection","stix-taxii"],"capabilityTags":["ioc-collection","ioc-enrichment","confidence-scoring","threat-intelligence-sharing","detection-rule-creation"],"capabilityDetails":["Provides a systematic workflow to identify, extract, enrich, score, distribute, and share indicators of compromise from network, host, and email evidence sources."],"techniqueTags":["stix","taxii","tlp-classification","defanging","memory-forensics","log-analysis"],"techniqueDetails":["Uses STIX 2.1 for structured IOC representation, TAXII for transport, TLP for sharing restrictions, and confidence scoring to prioritize indicators."],"tools":["MISP","VirusTotal","AlienVault OTX","Shodan","DomainTools","OpenCTI","Yeti","CyberChef","Volatility"],"targetTypes":["network","windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting","remediation"],"distinctiveFeatures":["Covers the full IOC lifecycle from collection to partner sharing, with explicit STIX/TAXII integration and confidence scoring, unlike general indicator-checking skills."],"familyIds":["threat-intelligence-operations-and-analysis"]},{"id":"collecting-open-source-intelligence","summary":"Provides a passive OSINT collection workflow for investigating threat actor infrastructure using passive DNS, WHOIS, certificate transparency, Shodan, Maltego, and dark web sources.","primaryDomain":"reconnaissance","domainTags":["osint","threat-intelligence","passive-recon","infrastructure-mapping"],"capabilityTags":["osint-collection","passive-data-gathering","threat-actor-profiling","infrastructure-enrichment"],"capabilityDetails":["Collects and synthesizes open-source intelligence about threat actors, malicious infrastructure, and attack campaigns from public sources without sending packets to targets."],"techniqueTags":["passive-dns","whois-history-analysis","certificate-transparency","shodan-search","maltego-pivoting","dark-web-monitoring"],"techniqueDetails":["Uses passive DNS and WHOIS history to map infrastructure; certificate transparency to discover subdomains; Shodan for device/service fingerprinting; pivoting via registrant email and shared hosting; dark web monitoring for leaked data."],"tools":["Maltego","Shodan","SpiderFoot","Recon-ng","crt.sh","OSINT Framework","SecurityTrails"],"targetTypes":["network","other"],"role":"general-playbook","workflowFocus":["reconnaissance","enumeration","analysis"],"distinctiveFeatures":["Emphasizes passive OSINT collection only (no active scanning), with a multi-tool workflow including dark web monitoring and careful attribution; distinguishes itself from active scanning or single-tool reconnaissance skills."],"familyIds":["attack-surface-discovery"]},{"id":"collecting-threat-intelligence-with-misp","summary":"Deploys MISP threat intelligence platform, configures community and custom threat feeds, and uses PyMISP to automate IOC collection, search, and export to STIX, Suricata, and CSV.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","ioc-management","misp","cti"],"capabilityTags":["misp-deployment","threat-feed-configuration","pymisp-automation","ioc-collection","ioc-export"],"capabilityDetails":["Provides a workflow for deploying MISP, configuring built-in and custom threat feeds, and using PyMISP to programmatically fetch and search events and IOCs.","Covers exporting IOCs to STIX 2.1, Suricata rules, and CSV for downstream integration."],"techniqueTags":["misp-native-feeds","freetext-feeds","taxii-feeds","csv-feeds","stix-export","rest-api"],"techniqueDetails":["Uses MISP native JSON/CSV feeds, freetext parsing, TAXII 2.1, and CSV feed import with configurable column mapping.","Uses PyMISP REST API for event search, feed management, and multi-format export."],"tools":["MISP","PyMISP","Docker"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis"],"distinctiveFeatures":["Specific to MISP platform, combining Docker deployment, PyMISP scripting, and threat feed management.","Covers end-to-end collection pipeline from feed configuration to IOC export, rather than only consuming pre-built intel.","Includes multiple feed types (MISP native, freetext, TAXII, CSV) with concrete code examples."],"familyIds":["threat-intelligence-operations-and-analysis"]},{"id":"collecting-volatile-evidence-from-compromised-host","summary":"A live forensics playbook for collecting volatile evidence from compromised Windows and Linux hosts, covering memory, network state, processes, user sessions, and system configuration while maintaining evidence integrity and chain of custody.","primaryDomain":"forensics","domainTags":["incident-response","dfir","forensics","volatile-evidence","memory-forensics","chain-of-custody"],"capabilityTags":["volatile-evidence-collection","memory-acquisition","network-state-capture","process-capture","chain-of-custody"],"capabilityDetails":["Provides a step-by-step live forensic workflow to collect volatile evidence from compromised Windows and Linux hosts, including memory, network state, processes, logged-in users, and system configuration, with hashing and chain of custody documentation."],"techniqueTags":["order-of-volatility","memory-imaging","live-response","evidence-hashing","trusted-tools"],"techniqueDetails":["Follows RFC 3227 order of volatility from memory to disk","Uses trusted external tools to avoid altering evidence","Immediately hashes all collected evidence with SHA256"],"tools":["WinPmem","LiME","Sysinternals Suite","Velociraptor","KAPE","CyLR","GRR"],"targetTypes":["windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["analysis","reporting"],"distinctiveFeatures":["Focuses specifically on live volatile evidence collection from compromised hosts before isolation or shutdown","Covers both Windows and Linux with comparable command sets","Emphasizes order of volatility and chain of custody documentation alongside technical collection commands"],"familyIds":["memory-forensics"]},{"id":"conducting-api-security-testing","summary":"Provides an OWASP API Top 10-driven workflow for security testing REST, GraphQL, and gRPC APIs, covering discovery, authentication/authorization bypasses (BOLA/BFLA, JWT, OAuth), injection flaws, and data exposure, with tooling guidance (Burp, Postman, Nuclei) and a reporting format.","primaryDomain":"api-security","domainTags":["api-security","owasp-api-top10","graphql","rest-api"],"capabilityTags":["api-security-testing","authorization-testing","authentication-testing","input-validation-testing","data-exposure-testing","business-logic-testing"],"capabilityDetails":["Provides a comprehensive workflow for security testing REST, GraphQL, and gRPC APIs against the OWASP API Security Top 10.","Covers discovery, authentication and authorization testing, input validation, data exposure analysis, and reporting.","Includes automated authorization testing with Burp Autorize and GraphQL-specific attack techniques."],"techniqueTags":["bola-testing","bfla-testing","mass-assignment-testing","jwt-attacks","oauth2-testing","graphql-attacks","sql-injection-testing","ssrf-testing","rate-limit-testing"],"techniqueDetails":["BOLA/IDOR testing by swapping object identifiers across user accounts.","BFLA testing by accessing admin endpoints with low-privilege tokens.","Mass assignment by injecting extra JSON properties.","JWT attacks including algorithm confusion, weak secret brute force, and claim tampering.","GraphQL introspection, query depth attacks, alias-based batching, and field suggestion enumeration.","SQL/NoSQL injection, SSRF, XXE, and rate limit bypass attempts."],"tools":["Burp Suite Professional","Postman","GraphQL Voyager","jwt.io / jwt_tool","Nuclei","Burp Autorize","hashcat"],"targetTypes":["api"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","detection","validation","exploitation","reporting"],"distinctiveFeatures":["Structured around OWASP API Security Top 10 rather than general web pentesting.","Dedicated GraphQL security testing covering introspection and query complexity attacks.","Emphasizes API-specific vulnerabilities like BOLA, BFLA, mass assignment, and excessive data exposure.","Includes a realistic fintech scenario and detailed finding output format."],"familyIds":["general-api-security-assessment"]},{"id":"conducting-cloud-incident-response","summary":"A practical multi-cloud incident response playbook for AWS, Azure, and GCP that detects compromised credentials through cloud-native audit logs, contains them via identity-based actions, preserves evidence from ephemeral resources, investigates cloud-specific attack paths, and guides post-incident hardening.","primaryDomain":"cloud-security","domainTags":["incident-response","cloud-forensics","identity-containment","aws","azure","gcp"],"capabilityTags":["cloud-incident-detection","identity-based-containment","forensic-evidence-collection","cloud-log-analysis","post-incident-hardening"],"capabilityDetails":["Provides a complete multi-cloud incident response workflow covering detection, containment, evidence preservation, investigation, eradication, and hardening for AWS, Azure, and GCP."],"techniqueTags":["cloudtrail-analysis","azure-activity-log-analysis","gcp-audit-log-analysis","iam-credential-disabling","session-revocation","deny-all-policy","snapshot-forensics","nsg-isolation","imds-token-theft-investigation"],"techniqueDetails":["Uses provider-native audit logs to identify suspicious IAM and resource activity; contains compromised identities by disabling access keys, revoking sessions, and attaching deny-all policies; collects evidence via log exports, snapshots, and flow logs; investigates cloud-specific attack patterns such as IMDS token theft and cross-account role abuse."],"tools":["AWS CloudTrail","Azure Activity Logs","GCP Audit Logs","AWS CLI","Azure PowerShell","Amazon GuardDuty","Azure Defender for Cloud","GCP Security Command Center","Cado Response","Prowler","ScoutSuite","Steampipe","Cartography"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Multi-cloud IR playbook with provider-specific commands for AWS, Azure, and GCP","Identity-based containment approach (deactivating keys, revoking sessions, deny-all policies) rather than network-only containment","Includes forensic evidence collection adapted for ephemeral cloud infrastructure","Covers cloud-native attack patterns like IMDS token theft and cross-account role abuse","Provides a structured incident report output template"],"familyIds":["cloud-incident-response-and-forensics"]},{"id":"conducting-cloud-penetration-testing","summary":"Operational playbook for authorized cloud penetration testing of AWS, Azure, and GCP, covering scope definition, IAM privilege escalation, SSRF/IMDS exploitation, lateral movement, persistence validation, and MITRE ATT&CK-aligned reporting.","primaryDomain":"cloud-security","domainTags":["iam","cloud-metadata","ssrf","multi-cloud","shared-responsibility-model"],"capabilityTags":["cloud-penetration-testing-methodology","iam-privilege-escalation-testing","ssrf-imds-exploitation","cloud-persistence-testing","mitre-attack-cloud-reporting"],"capabilityDetails":["Provides a step-by-step workflow for authorized penetration testing of AWS, Azure, and GCP cloud environments.","Covers testing for IAM misconfigurations and privilege escalation paths using Pacu and manual techniques.","Includes methodology for exploiting SSRF to reach cloud metadata services (IMDS) and steal IAM credentials.","Tests lateral movement via cross-account role assumptions and persistence/detection evasion scenarios.","Maps findings to MITRE ATT&CK Cloud matrix with severity and remediation guidance."],"techniqueTags":["imds-v1-exploitation","imds-v2-testing","iam-privilege-escalation-paths","cross-account-role-assumption","cloudtrail-disabling","lambda-backdoor-creation","s3-bucket-enumeration"],"techniqueDetails":["Uses curl to access IMDS endpoints on AWS, Azure, and GCP metadata services.","Exploits common IAM privilege escalation vectors such as iam:CreatePolicyVersion, iam:AttachUserPolicy, and iam:PassRole.","Assumes cross-account roles using AWS STS to test lateral movement.","Disables CloudTrail and creates IAM backdoor users to verify detection and cleanup procedures."],"tools":["Pacu","ScoutSuite","CloudFox","Prowler","Cartography","AWS CLI","curl"],"targetTypes":["cloud","web-application","api","container","kubernetes","database"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","exploitation","post-exploitation","reporting","validation"],"distinctiveFeatures":["Multi-cloud (AWS, Azure, GCP) penetration testing methodology with shared responsibility model scoping.","Integrates specialized cloud attack tools like Pacu, ScoutSuite, CloudFox, and Prowler.","Explicitly covers SSRF-to-IMDS credential theft across all three major cloud providers.","Includes persistence and detection evasion testing with cleanup verification, plus MITRE ATT&CK Cloud reporting."],"familyIds":["cloud-offensive-security-and-emulation"]},{"id":"conducting-cyber-risk-assessment-with-nist-800-30","summary":"Conduct a defensible NIST SP 800-30 risk assessment: define scope and risk model, identify threat sources/events and vulnerabilities, score likelihood and impact, and produce a prioritized risk register with treatment recommendations.","primaryDomain":"security-knowledge","domainTags":["risk-assessment","nist-800-30","risk-management","threat-modeling","risk-register"],"capabilityTags":["risk-assessment-execution","threat-source-identification","threat-event-identification","vulnerability-identification","likelihood-impact-scoring","risk-register-creation"],"capabilityDetails":["Provides a workflow for conducting qualitative cyber risk assessments per NIST SP 800-30 Rev 1, from preparation through risk scoring and reporting."],"techniqueTags":["qualitative-risk-scales","likelihood-impact-matrix","mitre-attack-mapping","inherent-residual-risk"],"techniqueDetails":["Uses qualitative (Very Low-Very High) scales and a likelihood x impact matrix to determine risk levels.","Maps adversarial threat events to MITRE ATT&CK techniques for traceability."],"tools":["nist-sp-800-30","nist-sp-800-39","mitre-attack","process.py"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","reporting","remediation"],"distinctiveFeatures":["Rooted specifically in NIST SP 800-30 Rev 1 rather than a generic risk framework","Covers the complete lifecycle: prepare, assess, communicate, maintain, plus treatment decisions","Provides a configurable scoring script (process.py) for reproducible risk register generation","Integrates MITRE ATT&CK mapping and NIST SP 800-39 tier context","Designed to satisfy compliance requirements (CSF, ISO 27001, RMF, SOC 2, PCI) for documented risk analysis"],"familyIds":["risk-assessment-and-exception-management"]},{"id":"conducting-domain-persistence-with-dcsync","summary":"Provides an advanced Active Directory post-exploitation workflow for abusing MS-DRSR replication rights (DCSync) to extract KRBTGT and domain credential hashes, forge Golden Tickets, and establish persistent domain access via DCSync rights escalation, with detection guidance and validation criteria.","primaryDomain":"active-directory","domainTags":["active-directory","windows-security","credential-dumping","domain-persistence"],"capabilityTags":["dcsync","golden-ticket-forging","credential-extraction","replication-rights-abuse","domain-persistence"],"capabilityDetails":["Provides an end-to-end workflow for abusing MS-DRSR replication rights to impersonate a Domain Controller and extract account hashes.","Details Golden Ticket creation from the KRBTGT hash to maintain indefinite domain access.","Describes how to enumerate and grant DCSync ACL rights for persistence using PowerView and ntlmrelayx."],"techniqueTags":["ms-drsr","dcsync","golden-ticket","extended-rights-abuse","kerberos-forgery"],"techniqueDetails":["Abuses DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights to request password data from a Domain Controller via MS-DRSR.","Uses extracted KRBTGT NTLM hash to forge Kerberos Golden Tickets for persistent privileged access.","Demonstrates ACL enumeration and modification for DCSync rights persistence."],"tools":["Mimikatz","secretsdump.py","ticketer.py","PowerView","Rubeus","ntlmrelayx.py"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","post-exploitation"],"distinctiveFeatures":["Focuses specifically on DCSync as a persistence mechanism rather than general credential dumping.","Covers the entire chain from ACL enumeration to Golden Ticket forging and DCSync rights grant persistence.","Provides detection signatures for replication abuse to support dual-use in red teaming and detection validation."],"familyIds":["dcsync-domain-persistence"]},{"id":"conducting-external-reconnaissance-with-osint","summary":"A comprehensive passive external reconnaissance playbook that maps an organization's attack surface via DNS enumeration, certificate transparency, Shodan/Censys, email harvesting, credential leak searches, and technology fingerprinting, including a structured report format.","primaryDomain":"reconnaissance","domainTags":["osint","attack-surface","footprinting","passive-recon"],"capabilityTags":["subdomain-enumeration","dns-enumeration","email-harvesting","cloud-asset-discovery","credential-leak-search","technology-profiling"],"capabilityDetails":["Provides a step-by-step passive external reconnaissance workflow that gathers DNS records, subdomains, cloud assets, employee emails, leaked credentials, and technology stack information without directly touching target systems."],"techniqueTags":["certificate-transparency-log-querying","reverse-whois-lookup","shodan-search","google-dorking","social-media-analysis","code-repository-secret-scanning","dns-record-analysis"],"techniqueDetails":["Uses certificate transparency logs (crt.sh) to enumerate subdomains.","Leverages Shodan/Censys to find internet-facing services and TLS certificates.","Applies Google dorking to locate exposed files and admin panels.","Scans public GitHub repositories for leaked credentials using trufflehog/gitleaks."],"tools":["amass","subfinder","dig","crt.sh","theHarvester","shodan","censys","trufflehog","gitleaks","whatweb","spiderfoot","recon-ng"],"targetTypes":["network","cloud","web-application","source-code","mobile"],"role":"general-playbook","workflowFocus":["reconnaissance","enumeration","detection","analysis"],"distinctiveFeatures":["Passive-only external recon that avoids direct interaction with target systems","Combines DNS, certificate transparency, cloud storage, email/personnel, credential leaks, and technology profiling into one attack-surface report","Includes concrete command examples and a structured reconnaissance report template"],"familyIds":["attack-surface-discovery"]},{"id":"conducting-full-scope-red-team-engagement","summary":"Delivers a complete red team engagement playbook — from planning and OSINT to post-exploitation and reporting — with MITRE ATT&CK alignment, concrete TTP examples, and purple team metrics.","primaryDomain":"general-pentesting","domainTags":["red-teaming","adversary-emulation","mitre-attack","purple-team","ttp-mapping"],"capabilityTags":["red-team-engagement-planning","threat-modeling","osint-reconnaissance","initial-access","post-exploitation","lateral-movement","reporting"],"capabilityDetails":["Provides a comprehensive red team engagement playbook spanning threat modeling, reconnaissance, initial access, post-exploitation, lateral movement, objective achievement, and reporting, aligned with MITRE ATT&CK tactics and techniques."],"techniqueTags":["spearphishing","valid-accounts","kerberoasting","dcsync","pass-the-hash","wmi-execution","exfiltration-over-dns"],"techniqueDetails":["Uses real-world adversary TTPs for initial access (spearphishing, valid accounts), credential access (LSASS dump, Kerberoasting), lateral movement (WMI, PsExec, pass-the-hash), and exfiltration (DNS), with concrete command examples."],"tools":["amass","theHarvester","whatweb","h8mail","msfvenom","gophish","nmap","havoc","cobalt strike","metasploit","impacket","crackmapexec","rubeus","mimikatz","secretsdump","dnscat2"],"targetTypes":["network","active-directory","windows-host","web-application"],"role":"specialist-playbook","workflowFocus":["reconnaissance","exploitation","post-exploitation","reporting"],"distinctiveFeatures":["Full-scope engagement methodology covering all attack chain phases from planning to reporting","Emphasizes stealth, persistence, and objective-based scenarios rather than vulnerability discovery","MITRE ATT&CK technique mapping across the entire operation","Includes metrics such as MTTD/MTTR and detection gap analysis for purple team recommendations","Provides concrete tool usage examples for OSINT, initial access, lateral movement, and exfiltration"],"familyIds":["red-team-adversary-simulation"]},{"id":"conducting-internal-network-penetration-test","summary":"Executes an assumed-breach internal network penetration test from discovery to domain compromise, including credential capture, lateral movement, privilege escalation, and impact demonstration with reporting.","primaryDomain":"network-security","domainTags":["active-directory","windows-security","post-exploitation","credential-access","lateral-movement"],"capabilityTags":["internal-pentest","assumed-breach-testing","lateral-movement-testing","privilege-escalation-testing","credential-harvesting","domain-escalation"],"capabilityDetails":["Provides an end-to-end internal penetration testing workflow from an assumed-breach position, covering network discovery, credential attacks, lateral movement, privilege escalation, domain escalation, data access, and reporting."],"techniqueTags":["llmnr-poisoning","ntlmv2-capture","pass-the-hash","kerberoasting","dcsync","golden-ticket","adcs-exploitation","password-spraying"],"techniqueDetails":["Uses Responder for LLMNR/NBT-NS/mDNS poisoning to capture NTLMv2 hashes.","Employs Impacket tools for pass-the-hash, Kerberoasting, DCSync, and remote execution.","Includes ADCS exploitation with Certipy for certificate-based domain escalation."],"tools":["Responder","Impacket","BloodHound","NetExec (CrackMapExec)","Evil-WinRM","Certipy","Mimikatz","Hashcat","Nmap","LinPEAS/WinPEAS"],"targetTypes":["network","active-directory","windows-host","linux-host","database"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","exploitation","post-exploitation","reporting"],"distinctiveFeatures":["Covers the complete internal pentest lifecycle from an assumed-breach network position through full domain compromise, combining network scanning, credential harvesting (Responder, Kerberoasting), lateral movement (PsExec/WMI/WinRM), and domain escalation (DCSync, ADCS) with reporting templates."],"familyIds":["network-adversary-simulation"]},{"id":"conducting-internal-reconnaissance-with-bloodhound-ce","summary":"Operational playbook for deploying BloodHound CE, collecting Active Directory data, and using graph queries to identify and prioritize attack paths from low-privileged accounts to Domain Admin.","primaryDomain":"active-directory","domainTags":["active-directory-reconnaissance","graph-analysis","attack-path-mapping"],"capabilityTags":["ad-data-collection","graph-querying","attack-path-enumeration","bloodhound-deployment","acl-abuse-detection"],"capabilityDetails":["Provides end-to-end workflow for deploying BloodHound CE, collecting AD data via SharpHound and BloodHound.py, importing into graph analysis, and running built-in and custom Cypher queries to enumerate attack paths."],"techniqueTags":["acl-abuse","kerberoasting","as-rep-roasting","delegation-abuse","gpo-abuse","session-hijacking","dcsync"],"techniqueDetails":["Identifies ACL-based attack paths such as GenericAll, WriteDACL, GenericWrite, and ForceChangePassword.","Detects Kerberoastable accounts and AS-REP roastable accounts with paths to Domain Admin.","Maps delegation abuse, GPO abuse, and DA session hijacking opportunities from collected graph data."],"tools":["BloodHound CE","SharpHound v2","BloodHound.py","AzureHound","PlumHound","BloodHound Query Library"],"targetTypes":["active-directory"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","analysis"],"distinctiveFeatures":["Centered on BloodHound CE rather than generic AD enumeration, including deployment and graph database analysis.","Includes custom Cypher queries for pathfinding and ACL abuse, and prioritization criteria by stealth and tool availability.","Covers both SharpHound v2 for on-prem Active Directory and AzureHound for Entra ID collection."],"familyIds":["active-directory-reconnaissance-and-path-mapping"]},{"id":"conducting-malware-incident-response","summary":"Structured workflow for responding to malware incidents on endpoints, covering alert triage, scoping, containment, malware analysis, eradication, and recovery, with MITRE ATT&CK mapping and practical examples for Qakbot and Emotet.","primaryDomain":"forensics","domainTags":["malware-incident-response","endpoint-security","mitre-attack"],"capabilityTags":["malware-triage","scope-infection","containment","eradication","recovery"],"capabilityDetails":["Workflow for validating malware alerts and scoping infection spread.","Procedures to contain compromised endpoints and block C2 infrastructure.","Eradication steps to remove malware artifacts and persistence mechanisms.","Recovery and validation process including reimaging and monitoring."],"techniqueTags":["process-hollowing","scheduled-task-persistence","powershell-downloader","c2-beaconing","credential-harvesting","data-exfiltration"],"techniqueDetails":["Describes how malware uses process hollowing to evade detection.","Explains how scheduled tasks maintain persistence across reboots.","Covers use of PowerShell for encoded malware downloads.","Details beaconing communication patterns used for command and control."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","ANY.RUN","Joe Sandbox","VirusTotal","MalwareBazaar","KAPE","YARA"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","remediation","reporting"],"distinctiveFeatures":["Covers full incident response lifecycle from detection through recovery, not just malware analysis.","Includes specific guidance for common families (Qakbot, Emotet, Cobalt Strike) with MITRE ATT&CK mappings.","Provides actionable containment and eradication procedures alongside forensic analysis."],"familyIds":["malware-incident-response-and-eradication"]},{"id":"conducting-man-in-the-middle-attack-simulation","summary":"Provides an advanced MITM attack simulation playbook using Bettercap, Ettercap, and mitmproxy to intercept, analyze, and modify network traffic, with a focus on validating encryption enforcement, certificate validation, and detection capabilities in authorized assessments.","primaryDomain":"network-security","domainTags":["network-security","mitm","traffic-interception"],"capabilityTags":["mitm-simulation","traffic-interception","ssl-stripping","arp-spoofing","dns-spoofing","certificate-validation-testing"],"capabilityDetails":["Provides a step-by-step workflow to simulate man-in-the-middle attacks using Bettercap, Ettercap, and mitmproxy, including ARP/DNS/DHCP spoofing, SSL stripping, and credential interception. Focuses on testing encryption enforcement, certificate validation, and detection capabilities in authorized environments."],"techniqueTags":["arp-cache-poisoning","dns-spoofing","dhcp-spoofing","ssl-stripping","transparent-proxy","certificate-interception"],"techniqueDetails":["Uses ARP cache poisoning to redirect traffic through the attacker machine.","Employs DNS spoofing to redirect domains to attacker-controlled hosts.","Leverages SSL stripping to downgrade HTTPS to HTTP.","Uses transparent proxy mode with iptables REDIRECT for traffic interception.","Tests certificate validation by presenting a custom CA certificate to targets."],"tools":["bettercap","mitmproxy","ettercap","wireshark","tshark"],"targetTypes":["network","web-application"],"role":"specialist-playbook","workflowFocus":["exploitation","validation","detection"],"distinctiveFeatures":["End-to-end MITM simulation playbook combining multiple tools and attack techniques, with explicit validation of anti-MITM controls like HSTS and certificate pinning, plus verification of detection capabilities via IDS/network monitoring."],"familyIds":["network-adversary-simulation"]},{"id":"conducting-memory-forensics-with-volatility","summary":"Practical guide for conducting memory forensics on RAM dumps with Volatility 3, covering acquisition, process and network analysis, malware/injection detection, credential extraction, and structured reporting.","primaryDomain":"forensics","domainTags":["memory-forensics","volatility","dfir","incident-response"],"capabilityTags":["memory-acquisition","process-analysis","process-injection-detection","network-connection-analysis","credential-recovery","malware-detection"],"capabilityDetails":["Provides an end-to-end workflow for acquiring and analyzing RAM dumps, including process enumeration, injection detection, network connection correlation, and credential extraction using Volatility 3."],"techniqueTags":["volatility-plugins","process-hierarchy-analysis","vad-injection-detection","network-scan","yara-scanning","registry-hive-analysis"],"techniqueDetails":["Uses psscan to detect processes hidden from the active list by rootkits.","Uses malfind to identify executable non-file-backed memory regions indicating injected code.","Correlates netscan output with process ownership to spot C2 connections.","Employs YARA rules against memory dumps to match malware signatures."],"tools":["volatility3","winpmem","dumpit","magnet-ram-capture","avml","yara","memprocfs","cobaltstrikeparser"],"targetTypes":["windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Specializes in volatile memory analysis rather than disk forensics, capturing evidence that exists only in RAM.","Provides a complete incident-response workflow from memory acquisition to forensic report generation using Volatility 3.","Emphasizes detection of fileless malware and process injection through VAD analysis and hidden-process scanning."],"familyIds":["memory-forensics"]},{"id":"conducting-mobile-app-penetration-test","summary":"Conducts comprehensive penetration testing of iOS and Android mobile applications following OWASP MASTG, covering static analysis, network communication, data storage, authentication, and runtime manipulation with tools like Frida, Objection, and Burp Suite.","primaryDomain":"mobile-security","domainTags":["mobile-pentest","owasp-mastg","android-security","ios-security","mobile-application-security"],"capabilityTags":["mobile-app-penetration-testing","static-analysis","dynamic-analysis","runtime-manipulation","api-security-testing"],"capabilityDetails":["Provides a comprehensive workflow for conducting mobile app penetration tests following OWASP MASTG, covering static application analysis, network traffic interception, insecure data storage checks, authentication/session testing, and runtime manipulation."],"techniqueTags":["frida-hooking","certificate-pinning-bypass","biometric-authentication-bypass","root-jailbreak-detection-bypass","deep-link-testing"],"techniqueDetails":["Uses Frida and Objection for runtime instrumentation to bypass certificate pinning, root/jailbreak detection, and biometric authentication.","Employs jadx and Ghidra for static decompilation and binary analysis, and Burp Suite for intercepting and analyzing mobile API traffic."],"tools":["frida","objection","mobsf","jadx","ghidra","burp-suite"],"targetTypes":["mobile","api"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","exploitation"],"distinctiveFeatures":["Covers the complete OWASP MASTG methodology for both iOS and Android, including static analysis, network interception, data storage testing, authentication bypass, and runtime manipulation in a single playbook.","Provides concrete Frida/Objection command examples for SSL pinning bypass and biometric authentication bypass, with scenario-based guidance for mobile banking applications."],"familyIds":["mobile-app-penetration-testing"]},{"id":"conducting-network-penetration-test","summary":"A comprehensive network penetration testing playbook covering the full engagement lifecycle from scoping and host discovery to exploitation, post-exploitation, cleanup, and reporting, with concrete command examples, tool usage, and a realistic scenario.","primaryDomain":"network-security","domainTags":["network-penetration-testing","infrastructure-security","vulnerability-assessment"],"capabilityTags":["network-pentest-execution","host-discovery","service-enumeration","vulnerability-identification","controlled-exploitation","post-exploitation"],"capabilityDetails":["Provides an end-to-end workflow for conducting authorized network penetration tests, from pre-engagement scoping and host discovery through exploitation, post-exploitation, cleanup, and reporting, with specific command examples and scenario illustration."],"techniqueTags":["nmap-scanning","nse-vulnerability-scanning","metasploit-exploitation","credential-spraying","pass-the-hash","pivoting","privilege-escalation"],"techniqueDetails":["Uses Nmap for ICMP/ARP/TCP/UDP host discovery, full TCP and top UDP port scans, service version detection, OS fingerprinting, and NSE vulnerability scripts.","Employs Metasploit modules for controlled exploitation and post-exploitation, plus manual proof-of-concept exploits.","Applies credential attacks including password spraying with Hydra/CrackMapExec and pass-the-hash/relay with Impacket.","Demonstrates pivoting and lateral movement to assess network segmentation, and privilege escalation with LinPEAS/WinPEAS and Mimikatz."],"tools":["Nmap","Metasploit","CrackMapExec","Impacket","Burp Suite","enum4linux","snmpwalk","Hydra","linpeas","winPEAS","Mimikatz"],"targetTypes":["network","windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","validation","exploitation","post-exploitation","reporting"],"distinctiveFeatures":["End-to-end network penetration testing workflow aligned with PTES methodology","Includes pre-engagement scoping and cleanup/reporting phases often omitted in tool-specific guides","Provides concrete Nmap, Metasploit, and Impacket command examples for each phase","Includes a realistic internal network pentest scenario with attack path narrative"],"familyIds":["network-adversary-simulation"]},{"id":"conducting-pass-the-ticket-attack","summary":"Operational playbook for performing Pass-the-Ticket attacks by extracting Kerberos tickets from LSASS memory and injecting them into another session to move laterally in Active Directory environments.","primaryDomain":"active-directory","domainTags":["kerberos","lateral-movement","active-directory"],"capabilityTags":["pass-the-ticket-execution","kerberos-ticket-extraction","ticket-injection","lateral-movement"],"capabilityDetails":["Provides a step-by-step workflow to extract Kerberos TGT/TGS tickets from LSASS memory and inject them into an attacker session to impersonate the ticket owner without knowing the password."],"techniqueTags":["pass-the-ticket","kerberos-ticket-theft","lsass-memory-dump"],"techniqueDetails":["Uses Mimikatz or Rubeus to dump tickets from LSASS and inject them into the current session to impersonate the ticket owner."],"tools":["mimikatz","rubeus","impacket"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["exploitation","post-exploitation"],"distinctiveFeatures":["Focuses specifically on Kerberos Pass-the-Ticket rather than general credential dumping or other Kerberos attacks.","Covers both ticket extraction and injection phases with concrete tool commands."],"familyIds":["kerberos-attack-and-ticket-abuse"]},{"id":"conducting-phishing-incident-response","summary":"End-to-end playbook for responding to phishing incidents: triage reported emails using header analysis and sandboxing, scope impact, contain by purging emails and remediating compromised accounts (password reset, session revocation, inbox rule review), and produce a structured report with IOCs and recommendations.","primaryDomain":"forensics","domainTags":["phishing-response","email-security","credential-compromise","email-header-analysis","mailbox-remediation","incident-response"],"capabilityTags":["email-triage","header-analysis","url-sandboxing","attachment-sandboxing","scope-impact","mailbox-purge","account-remediation"],"capabilityDetails":["Provides a step-by-step workflow for responding to reported phishing emails, from triage through containment and post-incident actions.","Includes procedures for email header analysis (SPF/DKIM/DMARC), URL and attachment sandboxing, recipient impact assessment, and mailbox quarantine."],"techniqueTags":["spf-dkim-dmarc-analysis","sender-spoofing-detection","credential-phishing","adversary-in-the-middle","oauth-app-review","inbox-rule-review","session-revocation"],"techniqueDetails":["Uses header authentication results (SPF/DKIM/DMARC) and relay path analysis to identify spoofed senders.","Addresses credential-phishing scenarios including AiTM attacks that bypass MFA through session token theft.","Recommends checking mailbox forwarding rules and OAuth grants as part of account containment."],"tools":["Microsoft Defender for Office 365","Proofpoint TAP","URLscan.io","ANY.RUN","Joe Sandbox","PhishTool","GoPhish","Azure AD PowerShell"],"targetTypes":["cloud","active-directory","web-application"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Covers the full incident response lifecycle specifically for phishing, including mailbox-wide purge and account remediation, not just detection.","Explicitly addresses AiTM phishing and QR code phishing, with pitfalls like not revoking active sessions or missing forwarding rules.","Includes concrete PowerShell commands for session revocation and inbox rule inspection in Microsoft 365.","Provides a structured output report template for incident documentation."],"familyIds":["phishing-incident-response"]},{"id":"conducting-post-incident-lessons-learned","summary":"Provides a structured, blameless post-incident review process to identify root causes, calculate response metrics, and produce actionable improvements and detection updates.","primaryDomain":"reporting","domainTags":["incident-response","post-incident-review","root-cause-analysis","process-improvement"],"capabilityTags":["blameless-post-mortem","root-cause-analysis","incident-metrics","action-item-tracking","playbook-update"],"capabilityDetails":["Provides a structured workflow for conducting post-incident lessons-learned sessions, including data gathering, blameless post-mortem facilitation, root cause analysis, incident metrics calculation, and creation of action items and detection rule updates."],"techniqueTags":["five-whys","blameless-postmortem","incident-metrics","sigma-rule-creation"],"techniqueDetails":["Uses structured questioning (5 Whys) to trace root causes, and computes MTTD, MTTC, and MTTR from event timestamps."],"tools":["thehive","servicenow","jira","azure-devops","confluence","sharepoint","splunk","elastic","sigma"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","reporting","remediation"],"distinctiveFeatures":["Focuses specifically on organizational learning and process improvement after incidents, with a structured blameless post-mortem agenda, response metric calculations, and actionable playbook/detection updates, rather than technical containment or forensic investigation."],"familyIds":["incident-communication-and-post-incident-review"]},{"id":"conducting-social-engineering-penetration-test","summary":"Operational playbook for designing and executing authorized social engineering penetration tests, including OSINT target profiling, phishing/vishing campaigns, physical pretexting, MFA bypass, metrics-driven risk scoring, and remediation guidance.","primaryDomain":"general-pentesting","domainTags":["social-engineering","phishing","vishing","pretexting","security-awareness","red-team"],"capabilityTags":["social-engineering-pentest","phishing-campaign-management","vishing-simulation","physical-pretexting","osint-profiling","mfa-bypass-testing"],"capabilityDetails":["Provides an end-to-end methodology for scoping and executing social engineering penetration tests against an organization's human attack surface.","Includes campaign setup for phishing using GoPhish, including credential harvesting landing pages and lookalike domains.","Covers vishing call scripts and metrics for evaluating phone-based social engineering.","Describes physical pretexting scenarios such as tailgating, USB drops, and impersonation.","Provides metrics calculation and risk scoring to prioritize security awareness remediation."],"techniqueTags":["phishing","spear-phishing","vishing","smishing","physical-pretexting","credential-harvesting","mfa-bypass","osint"],"techniqueDetails":["Phishing: uses email templates and credential harvesting landing pages to simulate password reset and invoice pretexts.","Vishing: provides call scripts to gather credentials and direct targets to phishing links.","Smishing: mentions SMS phishing as an attack vector.","Physical pretexting: covers tailgating, fake vendors, and USB drops to assess physical access controls.","Credential harvesting: uses cloned login pages to capture passwords and redirect victims.","MFA bypass: leverages Evilginx reverse proxy to intercept session tokens.","OSINT: uses theHarvester and manual social media reconnaissance for target profiling."],"tools":["gophish","evilginx","social-engineer-toolkit","maltego","theharvester","king-phisher","modlishka"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","exploitation","reporting","remediation"],"distinctiveFeatures":["Covers end-to-end social engineering assessment combining OSINT profiling, phishing, vishing, and physical pretexting with quantitative metrics.","Includes explicit MFA bypass testing via Evilginx as part of phishing campaigns.","Provides remediation priorities and risk scoring tailored to human-centered controls."],"familyIds":["social-engineering-testing"]},{"id":"conducting-social-engineering-pretext-call","summary":"A structured playbook for executing authorized social engineering pretext calls (vishing), covering OSINT research, pretext scenario design, call execution with objection handling, and reporting of employee security awareness metrics.","primaryDomain":"general-pentesting","domainTags":["social-engineering","vishing","pretexting","human-factor"],"capabilityTags":["pretext-development","call-execution","objection-handling","metrics-collection"],"capabilityDetails":["Provides a structured methodology for planning and executing authorized vishing (voice phishing) pretext calls, including OSINT research, pretext scenario development, call execution with objection handling, data collection, and reporting of human security awareness metrics."],"techniqueTags":["impersonation","authority-exploitation","urgency-creation","rapport-building","caller-id-spoofing"],"techniqueDetails":["Uses impersonation of trusted roles (IT helpdesk, vendor, executive assistant, facilities) to elicit sensitive information or credentials.","Employs urgency and authority to reduce resistance and increase compliance.","Provides scripted responses for handling target objections during calls."],"tools":["theHarvester"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","exploitation","reporting"],"distinctiveFeatures":["Specializes in voice-based social engineering (vishing) with concrete phases for OSINT, pretext development, call execution, objection handling, and metrics, distinguishing it from generic phishing or awareness training skills."],"familyIds":["social-engineering-testing"]},{"id":"conducting-spearphishing-simulation-campaign","summary":"Executes authorized spearphishing simulations for initial access by developing OSINT-derived pretexts, building diverse payloads, setting up look-alike domain infrastructure with GoPhish, and tracking results.","primaryDomain":"general-pentesting","domainTags":["red-teaming","social-engineering","phishing","initial-access"],"capabilityTags":["phishing-campaign-management","payload-development","email-infrastructure-setup","osint-pretexting","credential-harvesting"],"capabilityDetails":["Provides a comprehensive workflow for conducting targeted spearphishing simulations against specific individuals, covering pretext development, payload creation, email infrastructure setup, campaign execution, and tracking."],"techniqueTags":["html-smuggling","macro-document","iso-lnk","onenote-payload","qr-code-phishing","look-alike-domain","spf-dkim-dmarc"],"techniqueDetails":["Employs a variety of payload delivery techniques to bypass email security controls, including HTML smuggling, macro-enabled documents, ISO/LNK files, OneNote embedded scripts, and QR codes linking to credential harvesting pages."],"tools":["GoPhish","Evilginx2","King Phisher","SET","Modlishka","CredSniper","Fierce Phish"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","exploitation","reporting"],"distinctiveFeatures":["Focuses on targeted spearphishing with OSINT-derived personalization rather than broad phishing campaigns","Covers full campaign lifecycle from pretext development to post-campaign metrics and reporting","Includes multiple payload techniques (HTML smuggling, macros, ISO/LNK, OneNote, QR codes) and look-alike domain infrastructure with proper email authentication"],"familyIds":["social-engineering-testing"]},{"id":"conducting-wireless-network-penetration-test","summary":"Conducts authorized wireless network penetration tests, including WPA2/WPA3 handshake capture and cracking, evil twin and rogue AP attacks, enterprise EAP credential capture, and post-compromise validation of network segmentation.","primaryDomain":"network-security","domainTags":["wireless-pentest","wifi-security","wpa2","wpa3","evil-twin"],"capabilityTags":["wireless-security-assessment","wpa2-psk-cracking","wpa2-enterprise-attack","evil-twin-deployment","rogue-ap-detection","network-segmentation-testing","captive-portal-testing"],"capabilityDetails":["Provides a structured workflow for authorized wireless penetration tests: wireless reconnaissance, WPA2/WPA3 handshake capture and cracking, enterprise EAP credential attacks, evil twin deployment, rogue AP detection, and post-compromise network segmentation validation."],"techniqueTags":["wpa2-handshake-capture","pmkid-capture","deauthentication","dictionary-attack","evil-twin","rogue-radius","mschapv2-cracking","wpa3-transition-downgrade","captive-portal-bypass"],"techniqueDetails":["Uses deauthentication to force WPA2 handshake capture; cracks PSK with aircrack-ng or hashcat; captures PMKID clientlessly with hcxdumptool; uses hostapd-mana rogue RADIUS to capture enterprise credentials; tests WPA3 transition mode downgrade; validates VLAN segmentation with nmap scans."],"tools":["aircrack-ng","airodump-ng","aireplay-ng","hashcat","hcxdumptool","hostapd-mana","dnsmasq","bettercap","kismet","nmap"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","exploitation","post-exploitation","reporting"],"distinctiveFeatures":["Covers both WPA2-Personal cracking and WPA2-Enterprise rogue RADIUS attacks, including WPA3 transition mode downgrade and post-compromise VLAN segmentation testing in a single workflow.","Provides concrete commands for each phase and a detailed corporate scenario illustrating common pitfalls and findings."],"familyIds":["network-adversary-simulation"]},{"id":"configuring-active-directory-tiered-model","summary":"High-level implementation guide for Microsoft's ESAE tiered AD model, providing architectural guidance for Tier 0/1/2 separation, privileged access workstations, admin forest design, and authentication policy silos to harden Active Directory against credential theft and lateral movement.","primaryDomain":"active-directory","domainTags":["identity-access-management","privileged-access-management","active-directory-security"],"capabilityTags":["tiered-administration","privileged-access-workstation","administrative-forest-design","authentication-policy-silos","credential-theft-mitigation"],"capabilityDetails":["Provides high-level implementation guidance for Microsoft's ESAE tiered administration model, including Tier 0/1/2 separation, PAWs, administrative forest design, and authentication policy silos."],"techniqueTags":["tier-0-1-2-separation","paw-deployment","auth-policy-silos","admin-forest","least-privilege"],"techniqueDetails":["Describes separating AD accounts into tiers and using privileged access workstations to isolate privileged tasks.","Mentions administrative forest design and authentication policy silos as protective architecture."],"tools":[],"targetTypes":["active-directory","windows-host"],"role":"workflow","workflowFocus":["remediation","knowledge-reference"],"distinctiveFeatures":["Focuses specifically on Microsoft's ESAE tiered administration model for Active Directory, rather than general AD hardening or attack simulation.","Provides an architectural/implementation-oriented view with NIST and MITRE mappings."],"familyIds":["active-directory-hardening-and-architecture"]},{"id":"configuring-aws-verified-access-for-ztna","summary":"A practical configuration guide for implementing AWS Verified Access as a ZTNA solution, covering trust provider integration, Cedar policy authoring, Terraform deployment, multi-account sharing, and monitoring/logging best practices.","primaryDomain":"cloud-security","domainTags":["zero-trust","aws","identity-management","device-posture"],"capabilityTags":["aws-verified-access-configuration","cedar-policy-authoring","identity-provider-integration","device-trust-validation","terraform-deployment","multi-account-resource-sharing"],"capabilityDetails":["Provides a comprehensive workflow for configuring AWS Verified Access to replace VPN-based access with Zero Trust Network Access (ZTNA).","Covers creation and attachment of identity trust providers (IAM Identity Center, Okta/OIDC) and device trust providers (CrowdStrike, Jamf).","Includes Cedar policy authoring for conditional access decisions based on identity and device posture.","Demonstrates deployment via AWS CLI and Terraform, including multi-account sharing through AWS RAM."],"techniqueTags":["conditional-access-policy","oidc-trust-provider","device-posture-assessment","vpn-replacement"],"techniqueDetails":["Uses Cedar policy language to define permit/forbid rules based on context attributes like group membership and device assessment scores.","Integrates with OIDC and device trust providers to collect signals for real-time access evaluation.","Applies group-level and endpoint-level policies to layer access controls."],"tools":["aws-cli","terraform","cedar","cloudwatch"],"targetTypes":["cloud","web-application"],"role":"specialist-playbook","workflowFocus":["knowledge-reference"],"distinctiveFeatures":["Focuses specifically on AWS Verified Access implementation rather than general ZTNA concepts.","Provides both CLI and Terraform paths for deploying Verified Access instances, trust providers, groups, and endpoints.","Includes multi-account deployment via AWS RAM, which is uncommon in generic ZTNA guides.","Offers detailed Cedar policy examples for time-based, group-based, and device-posture-based access control."],"familyIds":["zero-trust-implementation"]},{"id":"configuring-certificate-authority-with-openssl","summary":"Provides a step-by-step approach to stand up a two-tier PKI with offline Root CA and issuing Intermediate CA using OpenSSL and Python cryptography, including CRLs, OCSP responders, and certificate policy management.","primaryDomain":"security-knowledge","domainTags":["pki","certificate-authority","cryptography","x509"],"capabilityTags":["pki-hierarchy-setup","certificate-signing","crl-generation","ocsp-configuration"],"capabilityDetails":["Provides a workflow for building a two-tier CA hierarchy (Root CA and Intermediate CA) using OpenSSL and the Python cryptography library."],"techniqueTags":["openssl","x509","crl","ocsp"],"techniqueDetails":["Uses OpenSSL and the Python cryptography library to generate CA certificates and configure extensions, revocation lists, and OCSP responders."],"tools":["openssl","python-cryptography"],"targetTypes":["other"],"role":"workflow","workflowFocus":["knowledge-reference","analysis"],"distinctiveFeatures":["Focuses specifically on building a trusted CA hierarchy for certificate issuance rather than testing or exploiting certificates.","Covers both Root and Intermediate CA roles, certificate extensions, CRL, and OCSP in a single workflow."],"familyIds":["cryptographic-infrastructure-configuration"]},{"id":"configuring-host-based-intrusion-detection","summary":"Provides actionable configuration guidance for deploying Wazuh/OSSEC HIDS agents, enabling file integrity monitoring, rootkit detection, custom alerting, active response, and SIEM integration across Windows and Linux endpoints.","primaryDomain":"network-security","domainTags":["endpoint-security","intrusion-detection","windows-security","linux-security"],"capabilityTags":["host-based-intrusion-detection-configuration","file-integrity-monitoring","rootkit-detection","active-response-configuration","siem-alert-integration"],"capabilityDetails":["Provides step-by-step guidance for deploying and configuring Wazuh/OSSEC HIDS agents, including FIM policies, rootkit detection, custom alert rules, active response, and SIEM integration."],"techniqueTags":["syscheck-configuration","rootcheck-configuration","custom-rule-creation","registry-monitoring","automated-threat-response"],"techniqueDetails":["Uses syscheck for file integrity and registry monitoring, rootcheck for rootkit detection, custom local rules for alerting, and active response for automated mitigation."],"tools":["Wazuh","OSSEC","AIDE","Tripwire","Samhain","Filebeat"],"targetTypes":["windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","remediation"],"distinctiveFeatures":["Focuses specifically on configuring HIDS agents (Wazuh/OSSEC) for endpoint monitoring, covering FIM, rootkit detection, and active response, with cross-platform Windows/Linux support and SIEM integration."],"familyIds":["host-intrusion-detection-configuration"]},{"id":"configuring-hsm-for-key-storage","summary":"Provides guidance for configuring Hardware Security Modules for cryptographic key storage using PKCS#11, including key generation, signing, encryption, and key management, with support for SoftHSM2 development and cloud HSM integration.","primaryDomain":"security-knowledge","domainTags":["cryptography","key-management","hardware-security","hsm","pkcs11"],"capabilityTags":["hsm-configuration","key-generation","cryptographic-operations","key-management","pkcs11-integration"],"capabilityDetails":["Provides a workflow for configuring HSMs via PKCS#11, covering key generation, signing, encryption, and key management on physical HSMs and SoftHSM2."],"techniqueTags":["pkcs11","softhsm2","fips-140-2","cloud-hsm"],"techniqueDetails":["Uses PKCS#11 standard interface to interact with HSMs, SoftHSM2 for development, and AWS/Azure cloud HSM services."],"tools":["softhsm2","python"],"targetTypes":["other","cloud"],"role":"specialist-playbook","workflowFocus":["knowledge-reference","validation"],"distinctiveFeatures":["Focuses specifically on HSM-based cryptographic key storage via PKCS#11 interface rather than generic key management, including FIPS compliance levels and developer setup with SoftHSM2."],"familyIds":["cryptographic-infrastructure-configuration"]},{"id":"configuring-identity-aware-proxy-with-google-iap","summary":"Provides a gcloud-based workflow for configuring Google Cloud IAP to enforce identity-aware access on GCP web services and TCP tunnels, covering IAM bindings with conditions, Access Context Manager levels, session reauthentication, service account programmatic access, and audit log monitoring.","primaryDomain":"cloud-security","domainTags":["zero-trust-architecture","identity-and-access-management","gcp-security","access-context-manager"],"capabilityTags":["identity-aware-proxy-configuration","iam-binding-management","context-aware-access-policy","session-reauthentication","service-account-authentication"],"capabilityDetails":["Provides a gcloud-based workflow for enabling and configuring Google Cloud Identity-Aware Proxy on GCP backend services, including IAM bindings with conditions, Access Context Manager access levels, session reauthentication settings, programmatic service account access, and audit logging."],"techniqueTags":["gcloud-cli","access-context-manager","cel-expressions","iap-tcp-tunneling","oauth-client-setup"],"techniqueDetails":["Uses gcloud CLI commands to configure IAP and IAM bindings; uses Access Context Manager levels and CEL expressions for context-aware access decisions; uses IAP TCP tunneling for SSH/RDP access without VPN or public IPs."],"tools":["gcloud","google-iap","access-context-manager","cloud-audit-logs","google-auth"],"targetTypes":["cloud","web-application","api"],"role":"specialist-playbook","workflowFocus":["remediation","knowledge-reference"],"distinctiveFeatures":["Focuses specifically on Google Cloud IAP implementation across multiple GCP compute platforms, combining IAM conditional bindings, Access Context Manager levels, reauthentication policies, service account programmatic access, and audit log monitoring in a single operational workflow."],"familyIds":["zero-trust-implementation"]},{"id":"configuring-ldap-security-hardening","summary":"Provides a defensive hardening playbook for LDAP and Active Directory environments, enforcing LDAPS, channel binding, and LDAP signing to mitigate credential harvesting, LDAP injection, anonymous binding, and channel-binding bypass, with NIST 800-53 mapping and verification checklists.","primaryDomain":"active-directory","domainTags":["ldap-security","directory-services","identity-access-management","authentication"],"capabilityTags":["ldap-hardening","ldaps-enforcement","channel-binding-configuration","ldap-signing-configuration","access-control-enforcement","audit-logging"],"capabilityDetails":["Provides a hardening workflow for LDAP/Active Directory that enforces LDAPS, channel binding, LDAP signing, and access control lists, along with monitoring and compliance-ready documentation."],"techniqueTags":["ldap-injection-mitigation","anonymous-binding-prevention","channel-binding-bypass-mitigation","credential-harvesting-protection","man-in-the-middle-prevention"],"techniqueDetails":["Uses cryptographic protections (LDAPS, channel binding, signing) and policy controls to block anonymous binds, prevent LDAP injection, and deter credential harvesting and relay attacks."],"tools":[],"targetTypes":["active-directory"],"role":"specialist-playbook","workflowFocus":["remediation","analysis"],"distinctiveFeatures":["Unlike attack-oriented LDAP skills, this is a defensive hardening playbook that maps LDAP security controls to NIST 800-53 and includes a compliance verification checklist for production deployment."],"familyIds":["active-directory-hardening-and-architecture"]},{"id":"configuring-microsegmentation-for-zero-trust","summary":"A specialist playbook for implementing microsegmentation in zero-trust architectures, guiding users from application dependency discovery and label-based policy design to test-mode modeling, incremental enforcement, and lateral-movement validation using tools like VMware NSX, Illumio, and Calico.","primaryDomain":"network-security","domainTags":["zero-trust","microsegmentation","lateral-movement"],"capabilityTags":["microsegmentation-policy-design","policy-enforcement","lateral-movement-prevention"],"capabilityDetails":["Provides a phased workflow for designing and implementing microsegmentation policies, from application dependency discovery and policy modeling to incremental enforcement and validation.","Covers both network-based and host-based enforcement mechanisms, including container-based options for Kubernetes."],"techniqueTags":["label-based-policy","allow-list-policy","application-dependency-mapping","ring-fencing"],"techniqueDetails":["Uses workload attributes (labels) instead of IP addresses for portable and scalable policy rules.","Employs monitor/test mode before enforcement to avoid breakage and refine allow-list rules.","Maps actual workload communication flows with traffic telemetry before creating segmentation policies.","Applies strict default-deny policies around critical applications to prevent lateral movement."],"tools":["VMware NSX","Illumio","Guardicore","Cisco ACI","Calico","Cilium","Zscaler Workload Segmentation","AppDynamics"],"targetTypes":["network","cloud","container"],"role":"specialist-playbook","workflowFocus":["analysis","validation"],"distinctiveFeatures":["Focuses specifically on microsegmentation as a zero-trust control, distinguishing between network-based, host-based, container-based, and application-based enforcement models.","Provides a complete operational lifecycle including discovery, dependency mapping, labeling, test-mode policy modeling, incremental enforcement, and ongoing maintenance."],"familyIds":["network-segmentation-and-hardening"]},{"id":"configuring-multi-factor-authentication-with-duo","summary":"Deploy and harden Cisco Duo MFA across VPN, RDP, SSH, and web apps, with adaptive policies, device trust, and phishing-resistant WebAuthn, aligned to NIST AAL2/AAL3.","primaryDomain":"authentication","domainTags":["mfa","duo","identity-access-management","device-trust"],"capabilityTags":["mfa-deployment","adaptive-authentication-policy","device-health-policy","phishing-resistant-mfa"],"capabilityDetails":["Provides step-by-step deployment of Duo MFA for VPN, RDP, SSH, and web applications, including adaptive access policies, device trust assessment, and WebAuthn/FIDO2 enrollment."],"techniqueTags":["authentication-proxy-integration","radius-mfa","webautn-fido2","risk-based-factor-selection"],"techniqueDetails":["Uses Duo Authentication Proxy for RADIUS/LDAP integration, WebAuthn security keys, and risk-based factor selection to reduce MFA fatigue."],"tools":["duo-authentication-proxy","duo-admin-panel","duo-mobile"],"targetTypes":["network","windows-host","linux-host","web-application"],"role":"specialist-playbook","workflowFocus":["remediation","detection"],"distinctiveFeatures":["Focuses entirely on Cisco Duo-specific MFA deployment, including on-prem Authentication Proxy, adaptive/device-trust policies, and WebAuthn for phishing resistance, with NIST 800-63B AAL2/AAL3 alignment."],"familyIds":["multi-factor-and-passwordless-authentication-implementation"]},{"id":"configuring-network-segmentation-with-vlans","summary":"Provides a step-by-step workflow to design and implement VLAN-based network segmentation on managed switches, including switch hardening against VLAN hopping, inter-VLAN ACLs, and verification, to reduce lateral movement and meet compliance requirements.","primaryDomain":"network-security","domainTags":["network-segmentation","vlan","switch-security","802-1q"],"capabilityTags":["vlan-segmentation-design","switch-hardening","inter-vlan-routing","segmentation-verification","access-control-list-configuration"],"capabilityDetails":["Designs and implements VLAN-based network segmentation on managed switches, including VLAN architecture planning, 802.1Q trunking, switch hardening against Layer 2 attacks, inter-VLAN ACLs, and verification of traffic isolation."],"techniqueTags":["802-1q-trunking","vlan-hopping-prevention","dhcp-snooping","dynamic-arp-inspection","port-security","inter-vlan-acls"],"techniqueDetails":["Uses 802.1Q trunking with explicit allowed VLAN lists, sets native VLAN to an unused VLAN, disables DTP, enables DHCP snooping and Dynamic ARP Inspection, and applies ACLs on VLAN interfaces to enforce inter-VLAN traffic policy."],"tools":["cisco-catalyst","cisco-nexus","hp-aruba-cx","pfsense","opnsense","netbox","nmap"],"targetTypes":["network"],"role":"workflow","workflowFocus":["validation","remediation"],"distinctiveFeatures":["Focuses on defensive network segmentation using VLANs, including switch hardening against Layer 2 attacks and compliance-driven isolation, distinct from offensive network mapping skills.","Covers the full lifecycle from VLAN design to verification, with concrete Cisco IOS configuration commands."],"familyIds":["network-segmentation-and-hardening"]},{"id":"configuring-oauth2-authorization-flow","summary":"Provides a step-by-step workflow to configure secure OAuth 2.0 authorization flows (Authorization Code + PKCE, Client Credentials, Device Authorization Grant), including scope design, token lifecycle, and OAuth 2.1 hardening controls.","primaryDomain":"authentication","domainTags":["oauth2","identity-access-management","access-control"],"capabilityTags":["oauth2-flow-configuration","pkce-implementation","token-lifecycle-management","scope-design"],"capabilityDetails":["Provides a workflow for configuring secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, with token lifecycle management and scope design."],"techniqueTags":["authorization-code-pkce","client-credentials","device-authorization-grant","refresh-token-rotation","dpop"],"techniqueDetails":["Uses PKCE to prevent authorization code interception, state parameter for CSRF protection, refresh token rotation, and DPoP for sender-constrained tokens."],"tools":["python"],"targetTypes":["web-application","api","mobile"],"role":"specialist-playbook","workflowFocus":["remediation","validation","knowledge-reference"],"distinctiveFeatures":["Focuses on secure OAuth 2.0/2.1 configuration and hardening rather than attacking OAuth, with mandatory PKCE for all client types, coverage of Device Authorization Grant, and DPoP."],"familyIds":["identity-federation-sso-security"]},{"id":"configuring-pfsense-firewall-rules","summary":"Provides a complete, step-by-step configuration workflow for pfSense firewalls, including VLAN segmentation, firewall rules, NAT port forwarding, VPN tunnels, traffic shaping, logging, and backup/testing procedures.","primaryDomain":"network-security","domainTags":["pfsense","firewall","network-segmentation","vpn"],"capabilityTags":["firewall-rule-configuration","nat-configuration","vlan-segmentation","vpn-setup","traffic-shaping"],"capabilityDetails":["Provides a step-by-step workflow to configure pfSense interfaces, VLANs, DHCP/DNS, firewall rules, NAT, logging, and backups for network segmentation."],"techniqueTags":["stateful-firewall","port-forwarding","site-to-site-vpn","remote-access-vpn","qos-traffic-shaping"],"techniqueDetails":["Uses pfSense WebConfigurator navigation to define zones, rules, and NAT policies.","Applies aliases for reusable IP/port groups and rule ordering principles."],"tools":["pfSense","pfBlockerNG","OpenVPN","IPsec","Snort","Suricata","Netgate AutoConfigBackup"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["remediation"],"distinctiveFeatures":["Product-specific to pfSense with explicit WebConfigurator navigation paths and configuration examples.","Covers full lifecycle including VLAN setup, NAT, VPN, traffic shaping, logging, testing, and backup.","Includes a real-world segmentation scenario (medical practice HIPAA) with pitfalls."],"familyIds":["network-segmentation-and-hardening"]},{"id":"configuring-snort-ids-for-intrusion-detection","summary":"Deploy and maintain Snort 3 network IDS at network boundaries, including source installation, DAQ and Lua configuration, community/custom ruleset management, custom rule writing for threats like reverse shells, SMB lateral movement, and DNS tunneling, plus alert output to SIEM and false-positive suppression.","primaryDomain":"network-security","domainTags":["network-security","intrusion-detection","snort","ids"],"capabilityTags":["ids-deployment","custom-rule-authoring","ruleset-management","false-positive-tuning"],"capabilityDetails":["Provides end-to-end workflow for installing Snort 3 from source and configuring network interfaces for passive capture.","Explains Lua-based Snort 3 configuration including DAQ, stream, protocol inspectors, and alert outputs.","Covers automated ruleset management with PulledPork 3 and writing custom Snort rules.","Includes alert monitoring, suppression/threshold tuning, and SIEM integration via JSON/syslog/unified2 outputs."],"techniqueTags":["signature-based-detection","protocol-inspection","stream-reassembly","false-positive-suppression"],"techniqueDetails":["Uses Snort signature rules to match known attack patterns in network traffic.","Leverages preprocessors to normalize and reassemble streams before inspection.","Applies thresholds and suppression rules to reduce alert noise.","Employs DAQ for packet capture integration."],"tools":["Snort 3","PulledPork 3","Barnyard2","tcpreplay"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Covers the full Snort 3 IDS lifecycle from source installation and Lua configuration to custom rule writing, ruleset management, and production service deployment.","Provides concrete custom detection rules for reverse shells, SMB lateral movement, DNS tunneling, FTP cleartext, and port scans.","Emphasizes operational tuning and SIEM integration rather than just basic Snort setup."],"familyIds":["signature-based-network-ids-ips-deployment"]},{"id":"configuring-suricata-for-network-monitoring","summary":"Deploys and tunes Suricata IDS/IPS with EVE JSON logging, Emerging Threats rulesets, and custom detection rules for malware C2, protocol anomalies, and data exfiltration, plus Elastic SIEM integration.","primaryDomain":"network-security","domainTags":["intrusion-detection","intrusion-prevention","network-traffic-analysis","signature-based-detection"],"capabilityTags":["suricata-deployment","suricata-configuration","rule-management","eve-json-logging","siem-integration","custom-rule-development"],"capabilityDetails":["Provides a step-by-step workflow for installing Suricata, configuring high-performance packet capture via AF_PACKET, managing Emerging Threats rulesets, writing custom detection rules, and integrating EVE JSON logs with Elastic SIEM."],"techniqueTags":["signature-based-detection","protocol-anomaly-detection","ja3-fingerprinting","hassh-fingerprinting","file-extraction","network-packet-capture"],"techniqueDetails":["Uses AF_PACKET with multi-threaded cluster_flow for high-throughput packet capture; applies JA3/HASSH fingerprinting to identify malware C2; writes custom Suricata rules for specific threats; parses EVE JSON with jq for analysis."],"tools":["suricata","suricata-update","filebeat","elastic-stack","jq","ethtool","scirius","evebox"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Focuses exclusively on Suricata IDS/IPS configuration, including inline IPS mode, EVE JSON logging, custom rule writing for C2 detection, and performance tuning for 10+ Gbps networks; differs from general network monitoring skills by providing tool-specific configuration details and operational scenarios."],"familyIds":["signature-based-network-ids-ips-deployment"]},{"id":"configuring-tls-1-3-for-secure-communications","summary":"Guides deployment and hardening of TLS 1.3, including cipher suite and key exchange configuration, legacy protocol disablement, and validation with openssl and testssl.sh.","primaryDomain":"network-security","domainTags":["tls","cryptography","transport-security"],"capabilityTags":["tls-configuration","tls-validation","cipher-suite-selection","secure-communication-hardening"],"capabilityDetails":["Provides a workflow to configure TLS 1.3 on nginx, Apache, and Python, including cipher suite and key exchange selection, disable legacy protocols, and validate the result using openssl s_client and testssl.sh."],"techniqueTags":["cipher-suite-selection","key-exchange-group-selection","0-rtt-early-data","ocsp-stapling","hsts-configuration"],"techniqueDetails":["Uses openssl s_client to test TLS versions and cipher suites, and testssl.sh to identify misconfigurations."],"tools":["openssl","testssl.sh"],"targetTypes":["network","web-application"],"role":"specialist-playbook","workflowFocus":["validation","remediation"],"distinctiveFeatures":["Covers TLS 1.3-specific configuration (RFC 8446) for nginx, Apache, and Python, with attention to 0-RTT replay protections and key exchange group selection, and validates using openssl s_client and testssl.sh."],"familyIds":["secure-communication-protocol-hardening"]},{"id":"configuring-windows-defender-advanced-settings","summary":"Provides a step-by-step workflow for configuring Microsoft Defender for Endpoint advanced protection, including ASR rules, controlled folder access, network protection, exploit protection, cloud protection, and enterprise deployment via Intune.","primaryDomain":"windows-security","domainTags":["windows-security","endpoint-security","microsoft-defender"],"capabilityTags":["windows-endpoint-hardening","asr-rule-configuration","controlled-folder-access-configuration","network-protection-configuration","exploit-protection-configuration"],"capabilityDetails":["Provides a workflow for configuring Microsoft Defender for Endpoint advanced protection settings, including attack surface reduction rules, controlled folder access, network protection, exploit protection, cloud-delivered protection, and scan/update settings."],"techniqueTags":["attack-surface-reduction","controlled-folder-access","network-protection","exploit-protection","tamper-protection","cloud-delivered-protection"],"techniqueDetails":["Uses ASR rules to block common attack techniques, controlled folder access for ransomware protection, network protection against malicious domains, and exploit protection to apply memory mitigations like DEP and CFG."],"tools":["powershell","microsoft-intune","microsoft-365-defender","microsoft-defender-for-endpoint"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["remediation"],"distinctiveFeatures":["Focuses exclusively on Microsoft Defender for Endpoint advanced configuration, including specific ASR rule GUIDs and PowerShell cmdlets, with enterprise-scale deployment via Intune and monitoring via MDE portal, distinguishing it from generic Windows hardening or third-party EDR guides."],"familyIds":["endpoint-security-configuration"]},{"id":"configuring-windows-event-logging-for-detection","summary":"Configures Windows Advanced Audit Policy, process creation command-line logging, event log sizes, and Windows Event Forwarding to produce high-fidelity Windows security events for SIEM detection and forensic investigation.","primaryDomain":"windows-security","domainTags":["windows-security","endpoint-security","event-logging","audit-policy"],"capabilityTags":["audit-policy-configuration","event-log-configuration","event-forwarding","detection-engineering"],"capabilityDetails":["Provides a step-by-step workflow to configure Windows Advanced Audit Policy, enable process creation command-line logging, size event logs, and set up Windows Event Forwarding for centralized security monitoring."],"techniqueTags":["advanced-audit-policy","command-line-logging","wef-subscriptions","event-log-sizing"],"techniqueDetails":["Uses Advanced Audit Policy subcategories instead of basic audit categories to avoid conflicts.","Enables ProcessCreationIncludeCmdLine_Enabled for Event 4688 command-line capture.","Configures Event Log sizes via wevtutil to prevent log overflow.","Sets up WEF collector and subscriptions for forwarding high-value events."],"tools":["wevtutil","wecutil","PowerShell","Group Policy","Windows Event Forwarding","NXLog","Winlogbeat","Palantir WEF"],"targetTypes":["windows-host","active-directory"],"role":"specialist-playbook","workflowFocus":["detection"],"distinctiveFeatures":["Focuses specifically on built-in Windows event logging configuration (not Sysmon) with Advanced Audit Policy, command-line logging in Event 4688, log sizing, and WEF, plus a curated reference of high-value Event IDs for detection."],"familyIds":["endpoint-security-configuration"]},{"id":"configuring-zscaler-private-access-for-ztna","summary":"A vendor-specific configuration playbook for deploying Zscaler Private Access (ZPA) to replace VPN with zero trust network access, covering App Connector deployment, application segmentation, identity- and device-posture-based access policies, clientless Browser Access, and SIEM log streaming, with practical migration scenarios and output reporting.","primaryDomain":"network-security","domainTags":["zero-trust","vpn-replacement","network-access-control","sase","cloud-security"],"capabilityTags":["ztna-configuration","app-connector-deployment","access-policy-management","device-posture-integration","log-streaming-integration"],"capabilityDetails":["Provides step-by-step workflow for deploying Zscaler Private Access (ZPA) to replace VPN with zero trust network access.","Covers App Connector installation, application segmentation, identity- and device-posture-based access policies, clientless Browser Access, and log streaming to SIEM."],"techniqueTags":["app-segmentation","identity-based-policies","device-posture-checks","saml-integration","outbound-only-tunnel"],"techniqueDetails":["App Connectors establish outbound-only tunnels to the ZPA cloud, eliminating inbound ports.","Application segments map internal FQDNs/IPs to server groups and access policies based on user groups and device posture signals.","Browser Access provides clientless ZTNA via SAML authentication and custom domains."],"tools":["Zscaler Private Access","Zscaler Client Connector","ZPA App Connector","ZPA Admin Portal","ZPA Log Streaming Service","CrowdStrike ZTA","Splunk"],"targetTypes":["network","cloud","web-application"],"role":"workflow","workflowFocus":["remediation","knowledge-reference","validation"],"distinctiveFeatures":["Vendor-specific configuration for Zscaler ZPA, including exact App Connector install commands and Admin Portal navigation.","Covers both standard and clientless (Browser Access) ZTNA deployment, with device posture integration and a migration scenario from Cisco AnyConnect.","Includes a concrete deployment report template and common pitfalls such as DNS requirements and Wildcard segment caveats."],"familyIds":["zero-trust-network-access-deployment"]},{"id":"container-escape-techniques","summary":"Expert playbook for escaping Docker/LXC/Kubernetes containers to the host via privileged mode, capability abuse, Docker socket, cgroup/namespace tricks, and runtime CVEs; includes container detection, a decision tree, and tool guidance.","primaryDomain":"cloud-security","domainTags":["container-security","kubernetes-security","docker-security","linux-security"],"capabilityTags":["container-escape","privileged-container-escape","docker-socket-exploitation","cgroup-exploitation","namespace-escape","kubernetes-pod-escape"],"capabilityDetails":["Provides a comprehensive container escape playbook covering Docker, LXC, and Kubernetes pods, with step-by-step techniques for breaking out to the host and a decision tree for selecting the right path."],"techniqueTags":["privileged-mode-exploitation","capability-abuse","cgroup-release-agent","nsenter","docker-socket-abuse","ebpf-escape","runtime-cve-exploitation","namespace-escape"],"techniqueDetails":["Uses host filesystem mounting and nsenter to escape privileged containers.","Abuses Linux capabilities such as CAP_SYS_ADMIN, CAP_SYS_PTRACE, and CAP_DAC_READ_SEARCH.","Exploits cgroup v1 release_agent and cgroup v2/eBPF paths.","Interacts with the Docker socket to create privileged containers.","Leverages runtime vulnerabilities like runc CVE-2019-5736 and containerd CVE-2020-15257."],"tools":["deepce","CDK","amicontained","PEIRATES","BOtB","shocker"],"targetTypes":["container","kubernetes","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","enumeration","exploitation"],"distinctiveFeatures":["Focuses specifically on container escaping rather than general host privilege escalation, covering both Docker and Kubernetes scenarios with a decision tree.","Includes multiple escape vectors: privileged mode, capability abuse, Docker socket, cgroup release_agent, namespace tricks, and runtime CVEs."],"familyIds":["cloud-offensive-security-and-emulation"]},{"id":"containing-active-breach","summary":"Execution-oriented incident response playbook for containing active adversaries during a confirmed breach, combining EDR isolation, network segmentation, credential revocation, C2 blocking, and validation while preserving forensic evidence.","primaryDomain":"network-security","domainTags":["incident-response","breach-containment","network-security","active-directory"],"capabilityTags":["breach-containment","lateral-movement-prevention","network-isolation","credential-revocation","endpoint-isolation","incident-response"],"capabilityDetails":["Provides an operational workflow for containing active adversary operations during a confirmed breach, including scope assessment, network and endpoint isolation, credential revocation, long-term containment measures, effectiveness validation, and evidence preservation."],"techniqueTags":["edr-network-containment","microsegmentation","c2-sinkholing","krbtgt-double-reset","session-token-revocation","evidence-preservation"],"techniqueDetails":["Uses EDR network containment to isolate compromised endpoints while maintaining the management channel.","Creates network ACLs and microsegmentation rules to restrict lateral movement between hosts and VLANs.","Sinkholes C2 domains to internal servers to block adversary communication and detect additional compromised hosts.","Performs double KRBTGT password reset to invalidate existing Kerberos tickets when Domain Admin is compromised.","Revokes active user sessions and tokens (e.g., Revoke-AzureADUserAllRefreshToken) and disables compromised accounts.","Preserves forensic evidence by capturing memory dumps, volatile data, event logs, and network traffic before remediation."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Palo Alto Networks NGFW","Velociraptor","BloodHound"],"targetTypes":["network","active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Focuses on active breach containment as a defensive incident response playbook, not penetration testing or eradication.","Distinguishes short-term vs long-term containment and includes AD-specific measures like KRBTGT double reset and C2 sinkholing.","Emphasizes evidence preservation during containment to avoid destroying forensic artifacts."],"familyIds":["active-breach-containment"]},{"id":"continuous-llm-red-teaming-with-promptfoo","summary":"CI/CD-integrated LLM red teaming that uses Promptfoo and DeepTeam to run OWASP/MITRE-aligned adversarial tests and fail builds on jailbreak or prompt-injection regressions.","primaryDomain":"injection","domainTags":["llm-security","ai-security","prompt-injection","llm-jailbreak"],"capabilityTags":["continuous-red-teaming","regression-testing","ci-cd-integration","vulnerability-gating"],"capabilityDetails":["Wires Promptfoo and DeepTeam into CI/CD to run automated adversarial LLM tests on every commit and block merges on new jailbreak or injection vulnerabilities.","Generates per-plugin pass/fail reports aligned to OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS risk taxonomies."],"techniqueTags":["prompt-injection","jailbreak","composite-jailbreak","crescendo-attack"],"techniqueDetails":["Uses Promptfoo strategies like jailbreak, composite jailbreak, and crescendo to wrap attack payloads.","Maps plugins to OWASP LLM Top 10 categories such as prompt extraction, PII disclosure, and harmful content."],"tools":["promptfoo","deepteam"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation"],"distinctiveFeatures":["Focuses on continuous regression testing in CI/CD rather than one-off manual LLM security assessment.","Combines Promptfoo and DeepTeam to provide both preset OWASP-aligned plugins and programmatic Python-based attack suites.","Provides a merge-blocking security gate with persistent JSON results for trend tracking across releases."],"familyIds":["llm-prompt-injection-red-teaming"]},{"id":"correlating-security-events-in-qradar","summary":"Operational playbook for SOC analysts and detection engineers using IBM QRadar to investigate offenses, build correlation rules with AQL and building blocks, tune false positives, and enrich detection with reference sets.","primaryDomain":"security-knowledge","domainTags":["siem","qradar","soc-operations","security-correlation"],"capabilityTags":["security-event-correlation","offense-investigation","correlation-rule-development","false-positive-tuning","aql-querying"],"capabilityDetails":["Provides a workflow for investigating QRadar offenses and building custom correlation rules using AQL."],"techniqueTags":["aql-querying","building-block-rules","reference-set-configuration","offense-coalescing","cross-source-correlation"],"techniqueDetails":["Uses AQL joins to correlate events and flows across log sources; creates multi-condition rules with building blocks."],"tools":["IBM QRadar SIEM","QRadar API","QRadar Pulse","QRadar Use Case Manager","QRadar Assistant"],"targetTypes":["network","windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting","remediation"],"distinctiveFeatures":["QRadar-specific AQL and building block workflow","Includes offense triage and false positive tuning","Covers both event and flow correlation"],"familyIds":["siem-correlation-and-investigation"]},{"id":"correlating-threat-campaigns","summary":"Provides a structured methodology for security analysts to correlate disparate incidents into unified threat campaigns using pivot analysis, weighted confidence scoring, and STIX-based graph building for actionable intelligence reporting.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","campaign-analysis","incident-correlation","cti","att-ck"],"capabilityTags":["threat-campaign-correlation","indicator-pivoting","campaign-graph-building","intelligence-report-generation","incident-clustering"],"capabilityDetails":["Provides a workflow for correlating multiple security incidents into unified threat campaigns using weighted confidence scoring and STIX-based campaign graph construction."],"techniqueTags":["infrastructure-pivot","capability-pivot","temporal-pivot","victimology-pivot","weighted-confidence-scoring","stix-normalization"],"techniqueDetails":["Uses four-dimensional pivot analysis (infrastructure, capability, temporal, victimology) and weighted scoring to link incidents into campaigns."],"tools":["MISP","OpenCTI","Maltego","Neo4j"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Focuses on unifying multiple incidents into campaign-level intelligence using weighted scoring and STIX graph modeling, rather than single incident triage or general threat hunting."],"familyIds":["threat-intelligence-operations-and-analysis"]},{"id":"cors-cross-origin-misconfiguration","summary":"Practical CORS misconfiguration playbook that detects reflected origins, wildcard-with-credentials flaws, allowlist regex bypasses, null-origin acceptance, and missing Vary cache poisoning, then demonstrates exploitation via credentialed fetches, subdomain XSS chains, and browser-based internal API access.","primaryDomain":"web-security","domainTags":["api-security","authentication","web-security"],"capabilityTags":["cors-testing","origin-reflection-analysis","credentialed-cors-exploitation","allowlist-bypass-testing","cache-poisoning-testing"],"capabilityDetails":["Provides a testing playbook for CORS misconfigurations including reflected origins, wildcard credentials, allowlist bypasses, null origin, preflight trust, cache poisoning, and internal API exposure."],"techniqueTags":["reflected-origin-testing","wildcard-credential-testing","origin-allowlist-bypass","null-origin-exploitation","vary-origin-cache-poisoning","subdomain-xss-cors-chain"],"techniqueDetails":["Crafts customized Origin headers to detect reflection and credentialed access.","Uses sandboxed iframes and data/file URLs to trigger Origin: null.","Exploits regex flaws and parser edge cases in origin allowlists.","Detects missing Vary: Origin header that enables CORS cache poisoning.","Chains subdomain XSS with CORS allowlists to bypass SameSite cookie protections."],"tools":["curl","amass","subfinder","crt.sh"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Covers advanced CORS exploitation chains — null-origin via sandbox/iframe, missing Vary cache poisoning, subdomain XSS to CORS read, internal network CORS abuse, and DNS rebinding — rather than only checking for reflected/wildcard headers."],"familyIds":["cross-origin-attacks"]},{"id":"crlf-injection","summary":"Expert playbook for detecting and exploiting CRLF injection in HTTP responses, covering header injection, body injection, log injection, filter bypasses, and chains to XSS, session fixation, and cache poisoning.","primaryDomain":"injection","domainTags":["http-response-splitting","header-injection"],"capabilityTags":["crlf-detection","crlf-exploitation","filter-bypass","xss-escalation"],"capabilityDetails":["Provides a workflow for detecting CRLF injection in HTTP response headers, redirects, Set-Cookie values, and log files.","Covers exploitation techniques including header injection, response body injection via double CRLF, session fixation, cache poisoning, and log injection.","Includes encoding and filter bypass strategies such as double URL encoding, Unicode encoding, and LF-only injection."],"techniqueTags":["header-injection","response-body-injection","cache-poisoning","log-injection","encoding-bypass"],"techniqueDetails":["Uses CRLF characters to split HTTP responses and inject arbitrary headers or body content.","Demonstrates double CRLF to terminate headers and inject HTML/script in the response body.","Exploits injected Set-Cookie headers for session fixation and injected Location headers for redirect hijacking.","Abuses log-visible fields like User-Agent or Referer to forge log entries.","Presents filter bypass techniques including Unicode encoding (%E5%98%8A%E5%98%8D) and double URL encoding (%250D%250A)."],"tools":[],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["detection","exploitation"],"distinctiveFeatures":["Dedicated expert playbook focused specifically on CRLF injection as a vulnerability class, rather than general injection testing.","Comprehensively covers multiple injection surfaces (headers, body, logs) and exploitation chains to XSS, session fixation, and cache poisoning.","Includes detailed filter bypass techniques and links to a related Java-specific bypass skill."],"familyIds":["header-injection"]},{"id":"csp-bypass-advanced","summary":"Advanced CSP bypass techniques including per-directive weaknesses, nonce leakage, trusted CDN abuse, strict-dynamic bypasses, and data exfiltration channels. Provides a decision tree and directive reference to identify and exploit policy misconfigurations.","primaryDomain":"web-security","domainTags":["content-security-policy","xss","client-side-security"],"capabilityTags":["csp-bypass","policy-misconfiguration-testing","data-exfiltration"],"capabilityDetails":["Provides advanced techniques to identify CSP weaknesses and bypass script-src, nonce, and trusted CDN policies, plus exfiltration channels."],"techniqueTags":["nonce-leakage","trusted-cdn-abuse","strict-dynamic-bypass","base-uri-hijack","dangling-markup","jsonp-abuse","template-injection","dns-exfiltration"],"techniqueDetails":["Covers per-directive bypass vectors including JSONP endpoints, uploaded JS, DOM XSS, Angular/Vue template injection, nonce theft via CRLF/dangling markup, strict-dynamic trust propagation abuse, base-uri injection, and exfiltration via DNS prefetch, WebRTC, CSS, and form action."],"tools":[],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on CSP bypass with a per-directive matrix, a decision tree, and data exfiltration channels that CSP cannot block; distinguishes from general XSS skills by addressing policy misconfigurations and nonce/CDN abuse."],"familyIds":["client-side-injection-and-policy-bypass"]},{"id":"csrf-cross-site-request-forgery","summary":"Deep CSRF attack playbook for testing and bypassing anti-CSRF defenses, SameSite protections, JSON and multipart CSRF, OAuth state handling, token fixation, and chaining with XSS/CORS/clickjacking.","primaryDomain":"web-security","domainTags":["csrf","same-site-attacks","web-session-security"],"capabilityTags":["csrf-vulnerability-testing","csrf-bypass-development","proof-of-concept-creation","oauth-state-testing","clickjacking-testing"],"capabilityDetails":["Expert workflow for discovering and validating CSRF flaws in state-changing endpoints: token removal/alteration, cross-user token reuse, SameSite and cookie behavior, JSON/multipart CSRF, OAuth state, and clickjacking-assisted bypass. Includes PoC templates and advanced chain examples."],"techniqueTags":["anti-csrf-token-bypass","samesite-lax-bypass","json-csrf","multipart-csrf","oauth-csrf","csrf-token-fixation","csrf-with-xss","cors-csrf-chaining"],"techniqueDetails":["Token bypasses cover absence, non-validation, session-not-user binding, cookie-only, static/predictable, and double-submit cookie patterns. SameSite bypasses cover GET top-level navigation, 302 redirect chains, _method override, and Chrome's 2-minute Lax+POST window. JSON CSRF covers text/plain disguise, XHR/fetch with credentials, no-cors limitations, and content-type downgrade. Also covers multipart/upload CSRF, CSPT-to-CSRF, token fixation, clickjacking as CSRF bypass, and CORS misconfiguration chains."],"tools":[],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Specialized solely in CSRF with detailed modern bypass coverage (SameSite edge cases, method override, JSON/multipart variants, token fixation, clickjacking and CORS chains), rather than generic web vulnerability scanning or a broad OWASP playbook. Explicitly contrasts traditional CSRF with CSPT2CSRF and includes OAuth state CSRF."],"familyIds":["cross-origin-attacks"]},{"id":"csv-formula-injection","summary":"Focused playbook for detecting and validating CSV/spreadsheet formula injection, including DDE command execution, obfuscation bypasses, and Google Sheets-based exfiltration, with a safe testing methodology and defensive mitigations.","primaryDomain":"injection","domainTags":["csv-injection","spreadsheet-injection","formula-injection"],"capabilityTags":["formula-injection-testing","dde-injection-testing","spreadsheet-export-analysis"],"capabilityDetails":["Provides a workflow for detecting formula injection in CSV exports and spreadsheet imports, including DDE and Google Sheets IMPORT* primitives."],"techniqueTags":["formula-prefix-injection","dde-abuse","obfuscation","outbound-request"],"techniqueDetails":["Uses prefix characters (=, +, -, @) to trigger formula evaluation and DDE/IMPORT functions for code execution or data exfiltration."],"tools":["excel","libreoffice","google-sheets"],"targetTypes":["web-application","api","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Targets CSV/spreadsheet formula injection specifically, covering DDE, obfuscation, and Google Sheets IMPORT* exfiltration, distinct from generic injection testing."],"familyIds":["csv-formula-injection"]},{"id":"ctf-ai-ml","summary":"A CTF-focused quick reference for AI/ML attacks, providing one-liner techniques and Python/curl commands for model weight analysis, adversarial example generation, model extraction/inversion, and LLM prompt injection/jailbreaking, with pointers to detailed supporting files and pivoting to other CTF domains when appropriate.","primaryDomain":"ctf","domainTags":["machine-learning","ai-security","llm-security","adversarial-ml"],"capabilityTags":["adversarial-example-generation","model-extraction","model-inversion","prompt-injection","jailbreaking","membership-inference","data-poisoning","lora-adapter-analysis"],"capabilityDetails":["Provides a quick-reference for attacking ML models in CTF challenges, covering weight perturbation negation, model inversion via gradient descent, encoder collision, LoRA adapter merging, model extraction via query API, membership inference, and gradient-based input recovery.","Covers adversarial example generation (FGSM, PGD, C&W), adversarial patches, evasion attacks, data poisoning, and backdoor detection.","Includes LLM-specific attacks: direct/indirect prompt injection, jailbreaking, token smuggling, context window manipulation, and tool use exploitation."],"techniqueTags":["fgsm","pgd","cw-attack","gradient-descent","lora-merge","token-smuggling","activation-maximization","query-api"],"techniqueDetails":["FGSM computes x_adv = x + eps * sign(grad_x(loss)) for a single-step adversarial perturbation.","PGD is an iterative version of FGSM with projection back to an epsilon-ball after each step.","C&W is an optimization-based attack minimizing perturbation norm while achieving misclassification.","LoRA adapter merging computes W_base + alpha * (B @ A) to combine base weights with adapter weights.","Model inversion via gradient descent optimizes a random input to minimize distance between model output and a known target.","Token smuggling exploits tokenizer splits to bypass filters by using subword tokens."],"tools":["torch","transformers","safetensors","numpy","scipy","Pillow","scikit-learn","curl"],"targetTypes":["ctf"],"role":"reference","workflowFocus":["analysis","detection","exploitation"],"distinctiveFeatures":["Combines classical ML attack techniques (adversarial examples, model extraction, inversion) with LLM-specific attacks (prompt injection, jailbreaking, token smuggling) in a single CTF-oriented quick reference.","Provides concrete Python/curl one-liners for direct inspection and attack execution on model files and remote LLM endpoints.","Includes pivoting guidance to other CTF domains (crypto, reverse engineering, misc) when the challenge is not purely AI/ML."],"familyIds":["ctf-ai-ml-security"]},{"id":"ctf-crypto","summary":"Comprehensive quick-reference knowledge base for attacking cryptographic primitives in CTF challenges, covering classical ciphers, modern block/stream ciphers, RSA, ECC, lattices, PRNGs, and ZKPs, with attack one-liners, tooling, and pointers to detailed technique files.","primaryDomain":"ctf","domainTags":["cryptography","encryption","hashing","signatures","key-recovery"],"capabilityTags":["crypto-attack-playbook","cipher-identification","plaintext-recovery","signature-forgery","prng-recovery","oracle-attacks","lattice-attacks"],"capabilityDetails":["Provides a rapid-reference knowledge base for CTF cryptography challenges, with one-line attack summaries and pointers to detailed code files.","Covers classic ciphers, modern block/stream ciphers, RSA, ECC, lattices, PRNGs, ZKPs, and exotic algebraic cryptosystems.","Includes quick-start commands for cipher identification and factorization, plus pivot guidance to other CTF skill areas."],"techniqueTags":["classical-cipher-cryptanalysis","aes-ecb-attacks","aes-cbc-attacks","padding-oracle-attack","rsa-small-exponent","rsa-coppersmith","rsa-wiener-attack","ecc-invalid-curve","lattice-lwe","prng-state-recovery","zkp-forgery","nonce-reuse"],"techniqueDetails":["Includes frequency analysis and Kasiski examination for classical ciphers, byte-at-a-time ECB and CBC bit-flipping, padding oracle decryption, RSA small-e/common-modulus/Wiener/Hastad/Coppersmith, ECC small-subgroup and invalid-curve, lattice CVP/LWE, PRNG state recovery for MT19937/LCG, and more."],"tools":["python3","pycryptodome","z3-solver","sympy","gmpy2","hashpumpy","fpylll","py_ecc","hashcat","sagemath","RsaCtfTool","FeatherDuster","nonce-disrespect","fastcol","hashid","openssl","pwntools"],"targetTypes":["ctf"],"role":"reference","workflowFocus":["knowledge-reference","analysis","exploitation"],"distinctiveFeatures":["Indexed quick-reference for CTF crypto attacks with one-liners per technique and linked deep-dive files, rather than a single automated exploitation workflow.","Includes routing/pivot guidance to sibling CTF skills for reverse engineering, forensics, pwn, web, AI/ML, and misc challenges."],"familyIds":["ctf-cryptanalysis"]},{"id":"ctf-forensics","summary":"A comprehensive quick-reference and routing skill for CTF digital forensics, covering disk/memory analysis, network packet and log analysis, steganography, hardware signal decoding, and credential recovery, with pointers to specialized sub-skills.","primaryDomain":"ctf","domainTags":["digital-forensics","steganography","memory-forensics","disk-forensics","network-forensics"],"capabilityTags":["disk-image-analysis","memory-dump-analysis","network-pcap-analysis","steganography-decoding","event-log-analysis","file-carving","credential-recovery","signal-analysis"],"capabilityDetails":["Provides a broad reference of digital forensics techniques applicable to CTF challenges, including disk, memory, network, steganography, and hardware signal analysis.","Includes quick-start commands and pointers to specialized sub-skills for deep-dive workflows."],"techniqueTags":["volatility-memory-analysis","binwalk-file-carving","exif-metadata-extraction","pcap-analysis","lsb-steganography","jpeg-dct-analysis","usb-hid-decoding","side-channel-power-analysis","ntfs-alternate-data-streams","bitcoin-transaction-tracing"],"techniqueDetails":["Uses Volatility 3 plugins for process listing, file scanning, and memory artifact extraction.","Employs binwalk, foremost, and photorec for embedded file carving and deleted file recovery.","Leverages exiftool and strings for metadata and hidden data discovery.","Analyzes PCAPs for TLS decryption, protocol steganography, and credential extraction.","Covers LSB, FFT, DTMF, and multi-layer steganography decoding.","Examines JPEG DCT coefficients for F5 stego detection.","Decodes USB HID keyboard, mouse, and LED exfiltration signals.","Applies differential power analysis for side-channel key recovery.","Detects hidden data in NTFS alternate data streams using Sleuth Kit.","Traces Bitcoin peel chains via mempool.space API."],"tools":["volatility3","binwalk","foremost","exiftool","tshark","sleuthkit","steghide","zsteg","impacket","hashcat","aircrack-ng","sox","gdb","testdisk","pcapfix"],"targetTypes":["ctf","network","windows-host","linux-host","database","container","other"],"role":"mixed","workflowFocus":["analysis","detection","knowledge-reference","navigation"],"distinctiveFeatures":["Serves as a comprehensive hub for CTF forensics, covering disk, memory, network, stego, hardware signals, and peripheral captures.","Routes to specialized sub-skills (windows, network, stego, disk, signals, etc.) while providing quick-reference commands inline.","Includes pivot guidance to other CTF domains (crypto, malware, web, misc, OSINT, reverse) based on evidence type."],"familyIds":["ctf-forensics-analysis"]},{"id":"ctf-malware","summary":"Quick-reference router for CTF malware challenges, covering obfuscated scripts, C2 network protocols, PE/.NET analysis, YARA, shellcode, and memory forensics, with links to deeper playbooks.","primaryDomain":"ctf","domainTags":["malware-analysis","network-traffic-analysis","reverse-engineering"],"capabilityTags":["malware-analysis","obfuscated-script-analysis","c2-protocol-analysis","memory-forensics","pe-analysis","yara-scanning","shellcode-analysis"],"capabilityDetails":["Provides a quick-reference workflow for analyzing malware in CTF challenges, covering static and dynamic analysis, network protocol reverse engineering, memory forensics, and anti-analysis technique identification."],"techniqueTags":["eval-deobfuscation","base64-decoding","tshark-pcap-analysis","rc4-decryption","aes-decryption","yara-rules","unicorn-emulation","volatility-malfind","pefile-analysis","dnspy-decompilation","pyinstaller-unpacking","api-hashing","vm-detection","process-injection-detection"],"techniqueDetails":["Uses string extraction, YARA scanning, and custom crypto identification to uncover C2 indicators and malware behavior."],"tools":["tshark","yara","volatility3","peframe","dnSpy","unicorn","capstone","strace","ltrace","pefile"],"targetTypes":["ctf","binary","network"],"role":"router","workflowFocus":["analysis","detection","knowledge-reference"],"distinctiveFeatures":["Combines malware binary analysis with network traffic and memory forensics in a CTF context","Acts as a router to specialized playbooks for scripts/obfuscation, C2/protocols, and PE/.NET malware","Includes CTF-specific pivoting guidance to reverse-engineering, forensics, and OSINT skills"],"familyIds":["ctf-malware-analysis"]},{"id":"ctf-misc","summary":"Fallback CTF skill providing quick-reference techniques for miscellaneous challenges: encoding/unicode decoding, Python/Bash jail escapes, Z3 constraint solving, RF/SDR analysis, DNS tricks, game exploitation, Linux privilege escalation, and CTFd API automation.","primaryDomain":"ctf","domainTags":["ctf-miscellaneous","encoding","sandbox-escape","game-hacking","privilege-escalation","dns","sdr"],"capabilityTags":["encoding-decoding","sandbox-escape","constraint-solving","signal-analysis","dns-exploitation","game-manipulation","ctf-platform-integration","privilege-escalation"],"capabilityDetails":["Fallback reference skill for miscellaneous CTF challenges, providing quick-reference techniques for encoding/unicode puzzles, Python/Bash jails, Z3 constraint solving, RF/SDR analysis, DNS exploitation, game/VMs, Linux privilege escalation, and CTFd API navigation."],"techniqueTags":["unicode-steganography","python-jail-escape","bash-jail-escape","z3-sat-solving","dns-rebinding","suid-exploitation","ctfd-api","length-extension-attack","usb-pcap-analysis"],"techniqueDetails":["Includes methods for character encoding identification and decoding, hidden data extraction from Unicode variation selectors/tags, sandbox escapes via Python/Bash internals, solving logical constraints with Z3, exploiting DNS edge cases, reconstructing USB mouse input from PCAPs, abusing SUID/docker/PostgreSQL for privesc, and automating CTFd platform interactions through its API."],"tools":["pwntools","z3","zbarimg","sox","qsstv","hlextend","7z","binwalk","flask-unsign","docker"],"targetTypes":["ctf","linux-host","network","database","container","other"],"role":"reference","workflowFocus":["knowledge-reference","analysis","exploitation","enumeration"],"distinctiveFeatures":["Serves as the fallback/reference skill for CTF challenges that do not cleanly fit web, pwn, reverse, forensics, crypto, or OSINT; spans a broad miscellany of edge-case techniques, provides quick one-liners and pointers to detailed subfiles, and includes cross-cutting content like Linux privesc and CTFd API automation."],"familyIds":["ctf-miscellaneous-techniques"]},{"id":"ctf-osint","summary":"A concise OSINT quick-reference for CTF challenges, covering social media investigation, geolocation, DNS recon, image analysis, and data identification via one-liners and service lookups.","primaryDomain":"ctf","domainTags":["osint","public-source-intelligence","geolocation","social-media","dns-reconnaissance"],"capabilityTags":["information-gathering","username-enumeration","reverse-image-search","google-dorking","metadata-extraction","hash-identification"],"capabilityDetails":["Provides a practical quick-reference of open source intelligence techniques for CTF challenges, including social media investigation, geolocation from images, DNS recon, web archive lookup, and identification of hashes/coordinates."],"techniqueTags":["google-dorking","reverse-image-search","exif-metadata","dns-zone-transfer","wayback-machine","username-lookup","tor-relay-lookup","plus-code-geolocation","unicode-steganography"],"techniqueDetails":["Uses one-liner commands and service lookups to gather clues and encode/flag data from public sources.","Covers geolocation via railroad signs, Street View matching, and Plus Codes.","Covers social media techniques such as Snowflake timestamps and homoglyph steganography.","Includes DNS TXT/zone transfer enumeration and Shodan SSH fingerprint lookups."],"tools":["dig","whois","exiftool","curl","shodan","nmap","identify","python"],"targetTypes":["ctf","other"],"role":"reference","workflowFocus":["reconnaissance","enumeration","analysis"],"distinctiveFeatures":["Tailored specifically for OSINT challenges in CTFs, with CTF-specific pivots to forensics/web/malware skills and unique CTF techniques like Unicode homoglyph steganography, MGRS/Plus code decoding, and fake service banner detection."],"familyIds":["ctf-osint"]},{"id":"ctf-pwn","summary":"Quick reference and knowledge base for CTF binary exploitation (pwn), covering stack overflows, format strings, ROP, heap attacks, kernel exploits, sandbox escapes, and cross-skill routing.","primaryDomain":"binary-exploitation","domainTags":["ctf","exploit-development","memory-corruption"],"capabilityTags":["binary-exploitation","memory-corruption","code-execution","exploit-development"],"capabilityDetails":["Provides a comprehensive quick reference and knowledge base for CTF binary exploitation (pwn), covering stack overflows, format strings, ROP chains, heap exploitation, kernel attacks, sandbox escapes, and more, with links to detailed per-topic playbooks and cross-routing to other CTF skill domains."],"techniqueTags":["buffer-overflow","format-string","rop","ret2libc","heap-exploitation","kernel-exploitation","seccomp-bypass","sandbox-escape","shellcode","uaf"],"techniqueDetails":["Covers stack buffer overflows, format string exploitation, ROP chain construction (including ret2libc, ret2csu, SROP), heap exploitation (tcache, FSOP, unsafe unlink), Linux kernel exploitation, seccomp bypass, sandbox escapes, and various memory corruption techniques across architectures and operating systems."],"tools":["pwntools","ropper","ROPgadget","gdb","checksec","one_gadget","seccomp-tools","pwndbg","libc-database"],"targetTypes":["binary","ctf","linux-host"],"role":"knowledge-base","workflowFocus":["exploitation","analysis","knowledge-reference","navigation"],"distinctiveFeatures":["Comprehensive CTF pwn knowledge base with pointers to specialized technique files for stack, heap, kernel, sandbox escape, and architecture-specific exploits; includes protection decision trees and routing to related CTF skill domains (reverse, misc, web, crypto)."],"familyIds":["ctf-pwn-knowledge-base"]},{"id":"ctf-reverse","summary":"A comprehensive CTF reverse-engineering skill that provides a practical workflow for analyzing compiled, obfuscated, packed, or virtualized targets using static/dynamic analysis, symbolic execution, emulation, anti-analysis bypass, and cross-platform techniques, with clear pivots to other CTF domains.","primaryDomain":"reverse-engineering","domainTags":["ctf-challenges","binary-reversing","anti-analysis"],"capabilityTags":["static-analysis","dynamic-analysis","symbolic-execution","emulation","anti-debug-bypass","deobfuscation"],"capabilityDetails":["Provides a structured CTF reverse-engineering workflow covering initial triage, quick dynamic tracing, symbolic execution, emulation, anti-analysis bypass, memory dumping, and validation across many binary formats and architectures."],"techniqueTags":["strings-extraction","system-call-tracing","frida-hooking","symbolic-execution","qiling-emulation","gdb-debugging","xor-decryption","anti-debug-identification"],"techniqueDetails":["Starts with strings extraction, ltrace/strace, Frida hooking, and angr symbolic execution for quick wins.","Includes deep-dive techniques for anti-debug bypass, custom VM analysis, runtime patching, side-channel oracle attacks, and language-specific reversing."],"tools":["strings","rabin2","ltrace","strace","frida","angr","qiling","gdb","radare2","ghidra","ida","uncompyle6","pycdc","apktool","upx","z3"],"targetTypes":["binary","mobile","ctf"],"role":"mixed","workflowFocus":["analysis","knowledge-reference"],"distinctiveFeatures":["Broad CTF-focused RE playbook that combines quick-win dynamic tracing, symbolic execution, emulation, and anti-analysis patterns, while also routing to sibling CTF skills for exploitation, forensics, web, crypto, malware, and misc challenges."],"familyIds":["ctf-reverse-engineering"]},{"id":"ctf-web","summary":"Routing and execution guide for web-heavy CTF challenges; classifies bug families, provides quick-start recon and exploitation commands, and routes to specialized technique files across SQLi, XSS, SSRF, SSTI, XXE, JWT, auth bypass, file upload, request smuggling, and prototype pollution.","primaryDomain":"web-security","domainTags":["web-exploitation","ctf"],"capabilityTags":["web-exploitation-routing","ctf-workflow","vulnerability-classification","quick-recon"],"capabilityDetails":["Provides a routing layer for CTF web challenges, including first-pass reconnaissance workflow, quick start commands for common vulnerability checks, and pointers to specialized technique files."],"techniqueTags":["sql-injection","xss","ssti","ssrf","xxe","jwt","auth-bypass","file-upload","request-smuggling","prototype-pollution"],"techniqueDetails":["References sub-skills covering detailed exploitation techniques: SQL injection filters and bypasses, XSS and CSP bypass, template injection, SSRF via various protocols, XXE exfiltration, JWT manipulation, auth bypasses, file upload to RCE, request smuggling, and prototype pollution."],"tools":["sqlmap","ffuf","flask-unsign","hashcat","jq","curl","ysoserial"],"targetTypes":["web-application","api","database"],"role":"router","workflowFocus":["navigation","reconnaissance","detection","exploitation"],"distinctiveFeatures":["Router skill that pivots across CTF domains (web, pwn, crypto, forensics, OSINT) and directs users to specialized sub-skill files.","Contains a Fast Pattern Map for classifying bug families to choose the right technique guide.","Includes Common Chain Shapes for typical multi-step CTF exploit paths."],"familyIds":["ctf-web-routing-and-exploitation"]},{"id":"ctf-writeup","summary":"Generates a standardized, concise CTF writeup for competition handoff and organizer review, using a submission template that emphasizes one complete solving script and final flag.","primaryDomain":"ctf","domainTags":["ctf","documentation","reporting"],"capabilityTags":["writeup-generation","solution-documentation","flag-reporting"],"capabilityDetails":["Generates a concise structured writeup for a solved CTF challenge, including metadata, solution steps, and flag."],"techniqueTags":["template-based-writing","step-by-step-solution","code-block-integration"],"techniqueDetails":["Uses a submission template with sections for summary, solution steps, and final flag; emphasizes one complete solving script."],"tools":[],"targetTypes":["ctf"],"role":"reporting","workflowFocus":["reporting"],"distinctiveFeatures":["Specifically produces submission-style CTF writeups rather than performing exploitation or enumeration.","Prioritizes a single complete solving script and concise steps for fast organizer review."],"familyIds":["ctf-writeup-generation"]},{"id":"dangling-markup-injection","summary":"A specialist playbook for exploiting HTML injection via dangling markup to exfiltrate page content when JavaScript execution is blocked by CSP or sanitizers, covering multiple exfiltration vectors, browser-specific constraints, and advanced combinations.","primaryDomain":"web-security","domainTags":["html-injection","csp-bypass","data-exfiltration"],"capabilityTags":["dangling-markup-injection","exfiltration-without-javascript","html-tag-consumption"],"capabilityDetails":["Provides a playbook for exploiting HTML injection when JavaScript execution is blocked by CSP, sanitizers, or WAF.","Covers injecting unclosed HTML tags to capture subsequent page content such as CSRF tokens, session data, and form values.","Includes multiple exfiltration vectors and CSP-aware selection logic."],"techniqueTags":["unclosed-tag-exfiltration","attribute-quote-consumption","form-action-hijack","base-tag-hijack","meta-refresh-redirect"],"techniqueDetails":["Core technique uses unclosed tags like <img src= to consume page content until the next matching quote, sending it to an attacker-controlled URL.","Alternative vectors include form action hijack, base tag hijack, meta refresh, link stylesheet, video/audio poster, and table background.","Discusses selective quote type choice, textarea consumption, comment/style dangling, and window.name via iframe.","Includes browser-specific mitigations, particularly Chrome's restrictions on <img src> with certain characters."],"tools":[],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["detection","analysis","exploitation"],"distinctiveFeatures":["Dedicated to exploiting HTML injection when XSS is blocked by CSP or sanitizers, using dangling markup for data exfiltration without JavaScript.","Provides a decision tree for selecting exfiltration vectors based on CSP directives and browser-specific behavior.","Details Chrome-specific mitigations and workarounds, and includes combination attacks with CSRF, cache poisoning, open redirect, and clickjacking."],"familyIds":["client-side-injection-and-policy-bypass"]},{"id":"defending-llms-with-guardrails","summary":"Provides a deployment playbook for adding runtime guardrails to LLM applications using Llama Guard 3, NeMo Guardrails, and LLM Guard to block prompt injection, jailbreaks, toxic content, and sensitive data leakage, including validation against known-bad payloads.","primaryDomain":"injection","domainTags":["ai-security","llm-security","prompt-injection","runtime-defense"],"capabilityTags":["guardrail-deployment","prompt-classification","output-scanner-pipeline","dialogue-rail-authoring","guardrail-validation"],"capabilityDetails":["Deploys Llama Guard 3 as a semantic safety classifier for prompts and responses.","Configures LLM Guard input and output scanner pipelines for filtering and redaction.","Authors NeMo Guardrails config.yml and Colang dialogue flows for input/output/jailbreak rails.","Validates guardrail stack against labeled known-bad payloads to compute block rate and false-positive rate."],"techniqueTags":["content-safety-classification","scanner-pipeline","dialogue-rails","jailbreak-detection","prompt-injection-detection"],"techniqueDetails":["Uses Llama Guard 3 with MLCommons hazard taxonomy (S1-S14) to classify safety of prompts and responses.","Uses LLM Guard input/output scanners with thresholds, redaction, and risk scores.","Uses NeMo Guardrails self-check input/output flows and custom Colang flows for topical boundaries.","Combines semantic classification and deterministic scanning for defense-in-depth against prompt injection and jailbreaks."],"tools":["llama-guard","nemo-guardrails","llm-guard","transformers","huggingface-hub"],"targetTypes":["api","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Covers three complementary open-source guardrail systems (Llama Guard, NeMo, LLM Guard) rather than a single tool or methodology.","Provides both semantic classification and deterministic scanning approaches to LLM runtime defense.","Includes a validation workflow to measure block rate and false-positive rate against a known-bad payload corpus."],"familyIds":["llm-guardrails"]},{"id":"defi-attack-patterns","summary":"Expert-level playbook for analyzing and exploiting DeFi attack patterns, including flash loans, oracle manipulation, MEV strategies, precision loss, governance exploits, bridge vulnerabilities, and token standard edge cases. Includes attack flows, real-world exploit references, and a decision tree to guide security assessment of decentralized finance protocols.","primaryDomain":"source-code-security","domainTags":["defi","smart-contract-security","blockchain-security","decentralized-finance"],"capabilityTags":["defi-attack-pattern-analysis","flash-loan-exploitation","oracle-manipulation-testing","mev-strategy-analysis","governance-attack-assessment","bridge-vulnerability-assessment","token-standard-edge-case-analysis"],"capabilityDetails":["Provides a structured playbook for identifying and exploiting a wide range of DeFi vulnerabilities including flash loan attacks, oracle manipulation, MEV extraction, precision loss, governance exploits, bridge vulnerabilities, and token standard edge cases.","Offers a decision tree to map protocol characteristics to likely attack vectors and relevant defensive measures."],"techniqueTags":["flash-loan","price-oracle-manipulation","twap-manipulation","sandwich-attack","jit-liquidity","liquidation-mev","rounding-attack","first-depositor-attack","governance-flash-borrow","timelock-bypass","bridge-signature-bypass","erc777-reentrancy","fee-on-transfer-token","rebasing-token"],"techniqueDetails":["Flash loan attacks: uncollateralized borrowing within a single transaction to amplify capital for manipulating prices or governance.","Price oracle manipulation: exploiting spot price oracles by single-block swaps; TWAP resistance and Chainlink staleness considerations.","MEV strategies: sandwich attacks, JIT liquidity provision, and liquidation extraction from pending transactions.","Precision loss attacks: integer truncation in share calculations, first depositor vault inflation, and dust accumulation.","Governance attacks: flash borrowing governance tokens, timelock bypasses, and quorum manipulation.","Bridge vulnerabilities: signature verification bypass, message replay, fake deposits, and validator compromise.","Token standard edge cases: ERC-777 reentrancy hooks, fee-on-transfer accounting bugs, approval front-running, and rebasing token mismatches."],"tools":[],"targetTypes":["source-code","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","exploitation","knowledge-reference"],"distinctiveFeatures":["Focused specifically on DeFi protocol attack patterns rather than generic smart contract vulnerabilities, separating it from general Solidity security playbooks.","Integrates a decision tree that guides the analyst from protocol features to the most relevant attack class.","Covers both offensive exploitation techniques and defensive countermeasures for each vulnerability category.","Unique inclusion of MEV extraction strategies (sandwich, JIT, liquidation) as a first-class attack pattern."],"familyIds":["smart-contract-security-auditing"]},{"id":"deobfuscating-javascript-malware","summary":"Provides a complete workflow for safely deobfuscating malicious JavaScript in phishing pages, web skimmers, and droppers, including script extraction, obfuscation identification, anti-debugging removal, decoding of string layers, and sandboxed eval chain resolution to reveal payloads and IOCs.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","javascript-obfuscation","web-malware","script-analysis"],"capabilityTags":["javascript-deobfuscation","malware-analysis","string-decoding","eval-chain-resolution","anti-analysis-neutralization"],"capabilityDetails":["Provides a step-by-step workflow for safely deobfuscating malicious JavaScript by extracting scripts, identifying obfuscation techniques, neutralizing anti-analysis traps, decoding string layers, and resolving eval chains in a sandboxed environment.","Includes automated Python and Node.js scripts for common decoding tasks and sandboxed execution to reveal the underlying malware logic and extract IOCs."],"techniqueTags":["string-encoding","eval-chain","control-flow-obfuscation","anti-debugging","string-array-rotation"],"techniqueDetails":["Covers decoding of hex, Unicode, base64, and charCodeAt/fromCharCode string obfuscation.","Intercepts eval, document.write, setTimeout, and Function constructor calls using a Node.js VM sandbox to safely unwrap nested encoding layers.","Identifies switch-case dispatchers, opaque predicates, dead code insertion, and variable name mangling to simplify control flow.","Neutralizes debugger traps, DevTools detection, and timing checks before analysis.","Explains string array rotation and how to resolve array-based string lookups."],"tools":["Node.js","Python","Chrome DevTools","CyberChef","de4js","JSDetox"],"targetTypes":["web-application","source-code"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","reporting"],"distinctiveFeatures":["Focuses specifically on deobfuscating malicious JavaScript (not general minified code) with dedicated workflows for phishing pages, Magecart skimmers, and dropper scripts.","Emphasizes safe sandboxed execution using Node.js VM to intercept eval/document.write calls, alongside automated decoding of common encoding schemes.","Provides a structured output report format for documenting obfuscation techniques, deobfuscated functionality, and extracted IOCs."],"familyIds":["script-malware-deobfuscation"]},{"id":"deobfuscating-powershell-obfuscated-malware","summary":"Provides a systematic workflow to deobfuscate multi-layer PowerShell malware through regex-based layer identification, AST analysis, dynamic IEX replacement, and IOC extraction tooling.","primaryDomain":"reverse-engineering","domainTags":["powershell","malware-analysis","obfuscation"],"capabilityTags":["malware-deobfuscation","obfuscation-analysis","payload-recovery","ioc-extraction"],"capabilityDetails":["Systematically identifies and classifies common PowerShell obfuscation techniques using regex-based analysis.","Automates deobfuscation through tick-mark removal, string concatenation resolution, Base64 decoding, and iterative IEX replacement.","Extracts indicators of compromise from deobfuscated scripts, including URLs, IPs, file paths, registry keys, and suspicious commands."],"techniqueTags":["ast-analysis","dynamic-execution-tracing","iex-replacement","regex-pattern-matching","base64-decoding"],"techniqueDetails":["Uses PowerShell AST parsing to expose underlying script structure and resolve expression nodes.","Dynamically traces execution by replacing Invoke-Expression with Write-Output to safely reveal payloads.","Applies iterative regex-based transformations to remove obfuscation layers such as tick marks and string concatenation."],"tools":["PSDecode","PowerDecode","PowerPeeler","CyberChef","PowerShell","Python"],"targetTypes":["windows-host","source-code"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Specializes specifically in PowerShell obfuscation techniques (tick marks, string concatenation, Base64, IEX) rather than generic malware analysis.","Provides executable Python scripts for automated layer identification and deobfuscation, making it hands-on and reproducible.","Includes safe IEX replacement methodology that iteratively unwraps payloads without executing malicious code."],"familyIds":["script-malware-deobfuscation"]},{"id":"dependency-confusion","summary":"Practical playbook for detecting and proving dependency confusion across multiple package ecosystems, including registry recon, version collision analysis, non-destructive callback PoCs, and defensive controls.","primaryDomain":"source-code-security","domainTags":["supply-chain","package-manager-security"],"capabilityTags":["dependency-confusion-testing","package-manifest-review","registry-collision-detection","callback-poc-validation"],"capabilityDetails":["Provides a workflow for identifying package names that may collide between private and public registries, assessing version resolution risk, and proving execution with lifecycle callback PoCs."],"techniqueTags":["dependency-confusion","version-confusion","lifecycle-script-execution","public-registry-squatting"],"techniqueDetails":["Exploits package manager resolution where private and public indexes are merged, so a higher semver published on a public registry is selected and lifecycle scripts execute malicious code."],"tools":["confused","DepFuzzer"],"targetTypes":["source-code","container","cloud"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","exploitation","remediation"],"distinctiveFeatures":["Covers multi-ecosystem dependency confusion including npm scopes, pip extra-index-url, Maven repo order, and Docker image typosquatting, with non-destructive callback PoCs and a registry-resolution decision tree."],"familyIds":["package-registry-supply-chain-risk-screening"]},{"id":"deploying-active-directory-honeytokens","summary":"Deploys decoy Active Directory accounts, SPNs, GPOs, and BloodHound paths to detect Kerberoasting, credential theft, and adversary reconnaissance, with SIEM alerting on interaction.","primaryDomain":"active-directory","domainTags":["active-directory","deception","honeytokens","detection"],"capabilityTags":["honeytoken-deployment","kerberoasting-detection","decoy-gpo","bloodhound-deception","siem-detection-rules"],"capabilityDetails":["Provides a workflow to deploy fake privileged AD accounts, fake SPNs, decoy GPOs with cpassword traps, and deceptive BloodHound paths; then monitor Windows event logs and SIEM for interactions."],"techniqueTags":["honey-admin-account","fake-spn","cpassword-trap","deceptive-acl-path","event-id-monitoring"],"techniqueDetails":["Creates decoy AD objects and monitors security event IDs (4769, 4625, 4662, 5136) to detect credential theft and reconnaissance."],"tools":["PowerShell","ActiveDirectory-Module","Group Policy Management Console","BloodHound","Splunk","Microsoft Sentinel","Sigma"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","validation"],"distinctiveFeatures":["Dedicated to AD deception-based defense using honeytokens for high-fidelity detection, with specific implementations for Kerberoasting, GPP cpassword, and BloodHound path deception; includes SIEM rule generation."],"familyIds":["active-directory-deception-and-honeytokens"]},{"id":"deploying-cloud-deception-with-decoy-resources","summary":"Deploys permission-less decoy cloud resources (canary keys, honey buckets, decoy secrets) across AWS, Azure, and GCP and wires native audit-log alerting to detect attacker touch with high fidelity.","primaryDomain":"cloud-security","domainTags":["deception-technology","honeypots","honeytokens","canary-tokens"],"capabilityTags":["cloud-deception-deployment","decoy-resource-creation","detection-wiring","high-fidelity-alerting","credential-theft-detection"],"capabilityDetails":["Provides end-to-end workflow for planting decoy users, credentials, storage buckets, and secrets across AWS, Azure, and GCP, and wiring cloud-native audit logs to SOC alerts."],"techniqueTags":["permission-less-principals","canary-access-keys","honey-storage-buckets","decoy-secrets","honeytoken-watchlists","cloud-audit-log-alerting"],"techniqueDetails":["Uses deny-all policies and no-role-binding principals so any use is malicious.","Leverages services like EventBridge and Sentinel HoneyTokens to create high-fidelity alerts."],"tools":["aws-cli","gcloud","cloudtrail","eventbridge","microsoft-sentinel","cloud-monitoring","canarytokens","process.py"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","validation"],"distinctiveFeatures":["Multi-cloud (AWS/Azure/GCP) native deception using permission-less decoy resources","High-fidelity detection with near-zero false positives via native audit-log wiring","Includes validation and maintenance procedures to ensure decoys are functional"],"familyIds":["cloud-deception-and-canary-deployment"]},{"id":"deploying-cloudflare-access-for-zero-trust","summary":"A detailed operational playbook for deploying Cloudflare Access and Cloudflare Tunnel as a zero trust VPN replacement, covering tunnel setup, identity-aware policies, device posture checks, WARP enrollment, and audit logging.","primaryDomain":"cloud-security","domainTags":["zero-trust","cloudflare","identity-aware-proxy","secure-access-service-edge"],"capabilityTags":["zero-trust-deployment","cloudflare-access-configuration","cloudflare-tunnel-management","warp-client-enrollment","device-posture-policy","identity-provider-integration"],"capabilityDetails":["Provides a step-by-step workflow to deploy Cloudflare Access and Cloudflare Tunnel for zero trust access to self-hosted applications, including identity provider integration, access policies, device posture checks, WARP client enrollment, and audit logging."],"techniqueTags":["cloudflare-tunnel","access-policy","device-posture","identity-provider-federation","split-tunnel-configuration","logpush"],"techniqueDetails":["Uses cloudflared tunnel to expose internal services without inbound ports, configures Cloudflare Access policies with identity and device posture conditions, enrolls devices with WARP client, and streams audit logs via Logpush."],"tools":["cloudflared","Cloudflare Access","Cloudflare WARP","Cloudflare Gateway","Cloudflare Logpush","Cloudflare API"],"targetTypes":["cloud","network","web-application"],"role":"specialist-playbook","workflowFocus":["remediation","validation","knowledge-reference"],"distinctiveFeatures":["Focuses specifically on Cloudflare One implementation, combining Cloudflare Tunnel, Access policies, and WARP device enrollment to replace VPN, rather than generic ZTNA architecture guidance."],"familyIds":["zero-trust-implementation"]},{"id":"deploying-decoy-files-for-ransomware-detection","summary":"A specialist playbook for deploying decoy canary files across endpoints and file shares to detect ransomware encryption activity in real time, with filesystem monitoring and automated alerting.","primaryDomain":"network-security","domainTags":["ransomware-defense","deception","file-integrity-monitoring","canary-files"],"capabilityTags":["canary-file-deployment","honeytoken-setup","file-integrity-monitoring","filesystem-watchdog-deployment","alert-response-configuration"],"capabilityDetails":["Provides a workflow for deploying canary files as tripwires to detect ransomware encryption activity.","Monitors file system events using watchdog/inotify and triggers alerts on modification, deletion, or rename.","Includes automated response actions such as process kill and network isolation."],"techniqueTags":["canary-files","honeytokens","file-integrity-monitoring","filesystem-event-monitoring","alphabetical-naming-strategy","tripwire-detection"],"techniqueDetails":["Uses strategically placed decoy files with names that sort first/last alphabetically to catch ransomware enumeration patterns.","Monitors filesystem events (modify, delete, rename) using inotify/ReadDirectoryChangesW via watchdog.","Validates detection coverage by simulating ransomware encryption and rename events.","Defines an alert response matrix mapping events to severity and automated responses."],"tools":["watchdog","python-docx","canarytokens","ossec","wazuh","elastic-endpoint","sysmon"],"targetTypes":["windows-host","linux-host","network","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Provides a complete deception-based ransomware detection playbook, not just a FIM configuration guide.","Covers both Windows and Linux using cross-platform filesystem monitoring (watchdog).","Includes specific canary naming and placement strategies to catch ransomware directory enumeration."],"familyIds":["deception-based-threat-detection"]},{"id":"deploying-edr-agent-with-crowdstrike","summary":"Provides a step-by-step operational guide for deploying CrowdStrike Falcon EDR sensors across Windows, Linux, and macOS endpoints, configuring prevention and response policies, integrating with SIEM, and validating deployment with test detections.","primaryDomain":"windows-security","domainTags":["endpoint-security","edr","windows-security","linux-security","macos-security"],"capabilityTags":["edr-deployment","sensor-installation","policy-configuration","siem-integration","deployment-validation"],"capabilityDetails":["Provides a step-by-step workflow for deploying CrowdStrike Falcon sensors to Windows, Linux, and macOS endpoints using enterprise tools like SCCM, Intune, GPO, and MDM.","Covers configuration of prevention policies, response policies, and automated response for malware and ransomware detection.","Details integration with SIEM platforms (Splunk, Elastic, Sentinel) using Falcon Event Streams API.","Includes validation procedures for sensor connectivity and detection via test detection sample."],"techniqueTags":["silent-installation","group-policy-deployment","sccm-deployment","intune-deployment","macos-mdm","sensor-health-check"],"techniqueDetails":["Uses Windows installer command-line flags for silent installation with CID.","Uses SCCM application packaging for centralized Windows deployment.","Uses Intune Win32 app deployment for cloud-managed Windows endpoints.","Uses GPO startup script to deploy sensor if not present.","Uses MDM profile to pre-approve system extensions on macOS.","Verifies sensor status and cloud connectivity via falconctl and Falcon console."],"tools":["CrowdStrike Falcon Console","Falcon Sensor","falconctl","SCCM","Microsoft Intune","Group Policy","PSFalcon","Splunk"],"targetTypes":["windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Product-specific deployment and configuration for CrowdStrike Falcon rather than generic EDR onboarding.","Includes cross-platform silent install commands, enterprise distribution methods (SCCM, Intune, GPO, MDM), SIEM connector setup, and a test detection step to confirm the sensor works."],"familyIds":["endpoint-security-configuration"]},{"id":"deploying-honeytokens-and-canarytokens","summary":"Practical playbook for deploying Thinkst Canarytokens (self-hosted or public) to create decoy files, credentials, DNS names, and cloud keys that trigger high-fidelity alerts when touched, enabling early intrusion and data-theft detection in low-telemetry areas.","primaryDomain":"network-security","domainTags":["deception-technology","intrusion-detection","threat-detection"],"capabilityTags":["honeytoken-deployment","canarytoken-generation","decoy-credential-planting","alerting","detection-validation"],"capabilityDetails":["Provides a full operational workflow for deploying Thinkst Canarytokens, from self-hosting the switchboard to generating and planting a range of token types (HTTP, DNS, AWS keys, documents, Slack, kubeconfig) and validating end-to-end alert delivery."],"techniqueTags":["decoy-file","decoy-user-credential","honeytoken","dns-canary","web-bug"],"techniqueDetails":["Deploys decoy artifacts with no legitimate use so any interaction becomes a high-fidelity alert.","Covers both decoy user credentials and decoy files, aligned with MITRE D3FEND D3-DF and D3-DUC."],"tools":["canarytokens","canarytokens-docker"],"targetTypes":["network","cloud","active-directory","windows-host","linux-host","kubernetes"],"role":"specialist-playbook","workflowFocus":["detection","validation"],"distinctiveFeatures":["Focuses on proactive deception-based intrusion detection using Thinkst Canarytokens, covering self-hosting, multiple token types, and AD honey accounts, unlike reactive vulnerability or exploit-focused skills."],"familyIds":["deception-based-threat-detection"]},{"id":"deploying-osquery-for-endpoint-monitoring","summary":"Practical deployment and configuration guide for osquery, enabling SQL-based endpoint monitoring across Windows, Linux, and macOS for threat hunting and compliance.","primaryDomain":"network-security","domainTags":["endpoint-monitoring","osquery","threat-hunting","fleet-management"],"capabilityTags":["osquery-deployment","endpoint-visibility","sql-querying","threat-detection"],"capabilityDetails":["Provides a complete workflow to deploy osquery, configure scheduled queries, integrate with FleetDM, and use SQL queries to inspect endpoint state for monitoring and threat hunting."],"techniqueTags":["sql-querying","scheduled-queries","differential-result-logging","fleet-enrollment"],"techniqueDetails":["Uses osquery's SQL interface to query system tables in real time, scheduling periodic queries and using differential results to reduce data volume."],"tools":["osquery","fleetdm","kolide"],"targetTypes":["windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses specifically on osquery as an open-source SQL-based endpoint visibility tool, including deployment, schedule configuration, and threat hunting queries, rather than proprietary EDR products."],"familyIds":["endpoint-visibility-and-monitoring"]},{"id":"deploying-palo-alto-prisma-access-zero-trust","summary":"Provides a step-by-step operational playbook for deploying Palo Alto Prisma Access as an enterprise SASE/ZTNA solution, covering ZTNA Connector deployment, GlobalProtect rollout, HIP device posture enforcement, security policy configuration, and monitoring via Strata Cloud Manager.","primaryDomain":"network-security","domainTags":["zero-trust","sase","ztna","network-security"],"capabilityTags":["zero-trust-access-deployment","sase-configuration","ztna-connector-deployment","globalprotect-agent-deployment","device-posture-enforcement"],"capabilityDetails":["Provides a workflow for deploying Palo Alto Prisma Access as an enterprise SASE/ZTNA solution, including ZTNA Connectors, GlobalProtect agents, HIP posture checks, and security policies."],"techniqueTags":["prisma-access-configuration","ztna-connector-setup","hip-posture-check","globalprotect-rollout","security-policy-configuration"],"techniqueDetails":["Uses ZTNA Connectors to establish IPSec tunnels from internal networks to Prisma Access for private application access.","Configures HIP objects and profiles to enforce device posture before granting access."],"tools":["prisma-access","strata-cloud-manager","globalprotect","ztna-connector","cortex-data-lake","wildfire","aws-cloudformation"],"targetTypes":["network","cloud","other"],"role":"specialist-playbook","workflowFocus":["remediation","validation","analysis"],"distinctiveFeatures":["Product-specific deployment playbook for Palo Alto Prisma Access, not generic ZTNA methodology.","Detailed configuration of ZTNA Connectors, GlobalProtect, HIP posture checks, and Strata Cloud Manager policies.","Includes an enterprise migration scenario with specific metrics and common pitfalls."],"familyIds":["zero-trust-network-access-deployment"]},{"id":"deploying-ransomware-canary-files","summary":"Deploys and monitors ransomware canary decoy files using Python watchdog, alerting via email/Slack/syslog on any file access, modification, rename, or deletion, enabling early detection of ransomware on file servers, NAS, or endpoints.","primaryDomain":"general-pentesting","domainTags":["ransomware-defense","deception","file-monitoring","endpoint-security"],"capabilityTags":["canary-file-deployment","filesystem-event-monitoring","ransomware-early-warning","alert-chaining"],"capabilityDetails":["Provides a workflow to plant decoy files that mimic high-value targets and monitor them for any access, modification, rename, or deletion, triggering alerts through email, Slack, or syslog."],"techniqueTags":["watchdog-filesystem-monitoring","canary-token-detection","sha256-integrity-check","multi-channel-alerting"],"techniqueDetails":["Uses Python's watchdog library to watch filesystem events; checks integrity via SHA-256 hashes; sends alerts via SMTP, Slack webhook, and syslog."],"tools":["watchdog","smtplib","requests","hashlib","psutil"],"targetTypes":["windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["detection","validation"],"distinctiveFeatures":["Specifically designed for ransomware early-warning via decoy files, leveraging OS-native filesystem events and multi-channel alerting, distinct from generic antivirus/EDR or full FIM solutions."],"familyIds":["ransomware-canary-deployment"]},{"id":"deploying-software-defined-perimeter","summary":"Provides an advanced deployment playbook for Software-Defined Perimeter per CSA v2.0, covering SDP Controller/Gateway/Client configuration, SPA, mTLS, and validation such as port scanning to confirm invisibility.","primaryDomain":"network-security","domainTags":["zero-trust","software-defined-perimeter","network-access","ztna"],"capabilityTags":["sdp-deployment","single-packet-authorization-configuration","mutual-tls-configuration","zero-trust-network-access"],"capabilityDetails":["Provides a step-by-step workflow for deploying a Software-Defined Perimeter (SDP) per CSA v2.0, including setting up the Controller, Gateway, and Initiating Hosts, and configuring SPA, mTLS, and access policies."],"techniqueTags":["single-packet-authorization","mutual-tls","default-drop-firewall","dynamic-provisioning"],"techniqueDetails":["Uses cryptographically signed single packets to authorize connections, making services invisible to scanners.","Employs bidirectional X.509 certificate authentication between client and gateway.","Enforces default-deny firewall rules on gateways.","Provisions sessions on-demand based on policy, without persistent tunnels."],"tools":["fwknop"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["validation","remediation"],"distinctiveFeatures":["Focuses on the defensive deployment of zero trust network architecture using SDP/SPA, including operational security validation of the SDP itself.","Distinct from offensive network security skills by covering architecture, configuration, and compliance validation rather than penetration testing."],"familyIds":["zero-trust-network-access-deployment"]},{"id":"deploying-tailscale-for-zero-trust-vpn","summary":"Deploys Tailscale or self-hosted Headscale as a WireGuard-based zero trust mesh VPN, configuring identity-aware ACLs, exit nodes, subnet routers, MagicDNS, Tailscale SSH, and hardening controls.","primaryDomain":"network-security","domainTags":["zero-trust","mesh-vpn","vpn-security"],"capabilityTags":["vpn-deployment","zero-trust-network-access","acl-policy-management","identity-aware-access","wireguard-mesh","network-hardening"],"capabilityDetails":["Provides a complete deployment workflow for zero trust mesh VPN using Tailscale or self-hosted Headscale.","Covers identity-aware access control lists, subnet routers, exit nodes, MagicDNS, Tailscale SSH, and network hardening features."],"techniqueTags":["wireguard-tunnel","identity-based-authentication","access-control-lists","subnet-routing","exit-node","magicdns","tailscale-ssh","network-lock"],"techniqueDetails":["Uses WireGuard peer-to-peer encrypted tunnels authenticated via identity providers.","Enforces granular access policies via declarative ACL JSON and device authorization rules."],"tools":["tailscale","headscale","wireguard"],"targetTypes":["network","cloud","linux-host","windows-host","container","kubernetes"],"role":"specialist-playbook","workflowFocus":["remediation","knowledge-reference"],"distinctiveFeatures":["Covers both managed Tailscale and self-hosted Headscale control server.","Includes identity-aware ACL, Tailscale SSH, subnet router/exit node configuration, and Tailnet Lock hardening."],"familyIds":["zero-trust-network-access-deployment"]},{"id":"deserialization-insecure","summary":"Expert attack playbook for detecting and exploiting insecure deserialization across Java, PHP, Python, Ruby, .NET, and Node.js, covering traffic fingerprinting, safe confirmation probes, gadget chain selection (ysoserial/PHPGGC/ysoserial.net), and targeted exploits such as Shiro, WebLogic, phpMyAdmin, and ViewState.","primaryDomain":"injection","domainTags":["insecure-deserialization","rce","serialization","object-injection"],"capabilityTags":["deserialization-exploitation","gadget-chain-selection","payload-generation","traffic-fingerprinting","multi-language-deserialization"],"capabilityDetails":["Provides expert workflow for detecting and exploiting insecure deserialization across Java, PHP, Python, Ruby, .NET, and Node.js.","Covers traffic fingerprinting of serialized object formats, safe confirmation probes, gadget chain selection, and RCE payload generation.","Includes product-specific attack flows such as Apache Shiro rememberMe, WebLogic T3/XMLDecoder, phpMyAdmin configuration injection, and ASP.NET ViewState forgery."],"techniqueTags":["java-serialization","php-unserialize","python-pickle","phar-deserialization","ruby-marshal","yaml-deserialization","dotnet-binaryformatter","node-serialize-iife"],"techniqueDetails":["Uses serialized object magic bytes (e.g., AC ED, rO0AB, O:NUMBER:, pickle protocol headers, AAEAAD) to identify deserialization formats.","Leverages gadget chains (CommonsCollections, Laravel/Symfony, TypeConfuseDelegate) appropriate to target libraries and frameworks.","Employs URLDNS and DNSLog callbacks for safe confirmation before attempting RCE.","Exploits language-specific mechanisms: Java readObject, PHP magic methods and phar://, Python __reduce__, Ruby Marshal/YAML.load, .NET BinaryFormatter/JSON.NET $type, and Node.js node-serialize IIFE."],"tools":["ysoserial","PHPGGC","ysoserial.net","Blacklist3r","elttam/ruby-deserialization"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Comprehensive multi-language deserialization coverage in a single playbook, from traffic fingerprinting through RCE.","Emphasizes the difference between finding a deserialization sink and obtaining a usable gadget chain.","Includes safe confirmation techniques (URLDNS, DNSLog) before escalating to full exploitation.","Provides product-specific attack flows for Shiro, WebLogic, phpMyAdmin, and ASP.NET ViewState."],"familyIds":["insecure-deserialization"]},{"id":"designing-adversary-engagement-with-mitre-engage","summary":"Provides a strategy-and-operations workflow for planning, running, and measuring adversary deception engagements using MITRE Engage, including mapping attacker ATT&CK techniques to deception Activities, defining measurable goals/objectives, and producing an operation plan with gating criteria and after-action analysis.","primaryDomain":"security-knowledge","domainTags":["adversary-engagement","deception","mitre-engage","denial-and-deception"],"capabilityTags":["adversary-engagement-planning","deception-strategy","goal-objective-definition","activity-selection","operation-planning","measurement-and-after-action"],"capabilityDetails":["Provides a strategy and operations layer for planning, running, and measuring adversary deception engagements.","Defines Engagement Goals (Expose, Affect, Elicit) and requires falsifiable, time-bound Operational Objectives.","Selects and sequences deception Activities based on an adversary's ATT&CK techniques and the weaknesses they expose.","Includes gating criteria, rules of engagement, and after-action analysis to keep operations controlled and measurable."],"techniqueTags":["mitre-engage-matrix","attack-to-activity-mapping","engagement-goals","operational-objectives","gating-criteria","after-action-analysis"],"techniqueDetails":["Uses the MITRE Engage Matrix hierarchy of Goals, Approaches, and Activities to structure engagement design.","Maps attacker ATT&CK techniques to the Engage Activity that exposes the weakness created by that technique.","Employs measurable Operational Objectives and gating criteria to constrain blast radius and evaluate success."],"tools":["MITRE Engage Matrix","MITRE ATT&CK Navigator","MITRE D3FEND","OpenCanary","T-Pot","Cowrie","Canarytokens","Thinkst Canary","SIEM/SOAR","MISP","OpenCTI","scripts/process.py"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Sits above tactical honeypot/honeytoken deployment skills by providing the coordinating strategy and measurement layer.","Directly ties adversary ATT&CK techniques to specific MITRE Engage Activities for principled deception selection.","Requires falsifiable operational objectives and after-action scoring, making engagement outcomes measurable rather than ad hoc."],"familyIds":["adversary-engagement-design"]},{"id":"detecting-ai-model-prompt-injection-attacks","summary":"Provides a multi-layered Python-based detector for LLM prompt injection attacks, combining regex signatures, heuristic anomaly scoring, and a DeBERTa transformer classifier for real-time input validation and retrospective audit of LLM interaction logs.","primaryDomain":"injection","domainTags":["llm-security","ai-security","prompt-injection"],"capabilityTags":["prompt-injection-detection","multi-layer-classification","input-validation","log-auditing"],"capabilityDetails":["Provides a three-layer detection pipeline for LLM prompt injection: regex signature matching, heuristic anomaly scoring, and DeBERTa transformer classification.","Supports real-time input filtering for chatbots/agents/RAG pipelines and retrospective batch scanning of historical prompts."],"techniqueTags":["regex-signature-matching","heuristic-scoring","transformer-classification","multi-layer-fusion"],"techniqueDetails":["Uses 25+ regex patterns to match known attack patterns such as system prompt overrides and delimiter escapes.","Computes a 0.0-1.0 anomaly score based on structural features like instruction density, special character ratio, language mixing, and token sequences.","Runs a DeBERTa-v3 prompt injection classifier with a default confidence threshold of 0.85.","Combines regex, heuristic, and classifier outputs with configurable weights (0.3, 0.2, 0.5)."],"tools":["agent.py","huggingface-transformers","protectai/deberta-v3-base-prompt-injection-v2"],"targetTypes":["api","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Dedicated to LLM prompt injection detection using a three-layer ensemble (regex + heuristics + transformer), distinguishing it from generic injection skills.","Explicitly addresses both direct and indirect prompt injection per OWASP LLM Top 10 LLM01:2025 and includes batch log auditing with JSON output."],"familyIds":["llm-prompt-injection-detection"]},{"id":"detecting-anomalies-in-industrial-control-systems","summary":"Operational playbook for continuous OT/ICS security monitoring. Builds baselines of deterministic SCADA traffic and uses machine learning (Isolation Forest) plus statistical tests to detect new communication pairs, polling interval changes, and unauthorized function codes, with integration guidance for Nozomi Guardian and Dragos Platform.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","scada","anomaly-detection"],"capabilityTags":["ot-anomaly-detection","baseline-modeling","protocol-deviation-detection","rogue-device-detection"],"capabilityDetails":["Deploys multi-dimensional baseline modeling of OT network traffic to detect anomalies.","Flags deviations in polling timing, topology, and function codes for industrial protocols."],"techniqueTags":["isolation-forest","z-score-analysis","function-code-allowlist","topology-baselining"],"techniqueDetails":["Uses Isolation Forest and z-score thresholding on deterministic SCADA traffic patterns.","Enforces per-pair function code allowlists to detect unauthorized Modbus/DNP3 operations."],"tools":["scikit-learn","zeek","nozomi-guardian","dragos-platform"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Specializes in OT/ICS deterministic communication baselines rather than general IT anomaly detection.","Provides executable Python code to build baselines and detect anomalies.","Covers OT-specific protocols (Modbus, DNP3) with function-code allowlist enforcement."],"familyIds":["ot-ics-attack-detection-and-monitoring"]},{"id":"detecting-anomalous-authentication-patterns","summary":"A comprehensive authentication anomaly detection playbook that leverages statistical baselines, machine learning (Isolation Forest), and SIEM rules to identify impossible travel, brute force, password spraying, credential stuffing, and compromised account behaviors from Azure AD, Okta, and Windows AD authentication logs.","primaryDomain":"authentication","domainTags":["identity-management","ueba","behavioral-analytics"],"capabilityTags":["authentication-anomaly-detection","impossible-travel-detection","brute-force-detection","password-spray-detection","behavioral-baselining"],"capabilityDetails":["Provides a workflow for detecting anomalous authentication events using statistical baselines, machine learning, and SIEM rules, including impossible travel, brute force, password spraying, credential stuffing, and compromised account behaviors."],"techniqueTags":["statistical-baselining","machine-learning","isolation-forest","haversine-distance","sliding-window-analysis","z-score-analysis"],"techniqueDetails":["Uses haversine distance and speed thresholds to flag impossible travel; detects brute force and password spraying via sliding-window failure analysis; builds user behavioral baselines and uses Isolation Forest for multivariate anomaly detection."],"tools":["python","pandas","scipy","scikit-learn","geoip2","splunk","maxmind-geolite2"],"targetTypes":["active-directory","cloud","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Combines multiple detection methods (statistical, ML, SIEM) for authentication anomalies across Azure AD, Okta, and Windows AD logs."],"familyIds":["authentication-threat-detection-and-user-behavior-analytics"]},{"id":"detecting-api-enumeration-attacks","summary":"Provides SIEM detection rules (Splunk, Elastic, Python script) to identify API enumeration attacks including BOLA/IDOR via sequential ID iteration, UUID harvesting, parameter tampering, and mixed authorization response patterns.","primaryDomain":"api-security","domainTags":["bola","idor","access-control","authorization"],"capabilityTags":["siem-detection-rule-development","api-enumeration-detection","bola-detection","idor-detection"],"capabilityDetails":["Provides workflows and ready-to-use detection content for identifying API enumeration attacks such as BOLA/IDOR using SIEM platforms."],"techniqueTags":["sequential-id-enumeration","uuid-enumeration","parameter-tampering","authorization-failure-patterns"],"techniqueDetails":["Detects rapid sequential or harvested identifier access, parameter tampering, and mixed 200/401/403 response patterns from API gateway logs."],"tools":["splunk","elastic-siem","python"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses entirely on detecting API enumeration/BOLA using SIEM content and log analysis rather than active exploitation, and includes native detection content for Splunk, Elastic SIEM, and a custom Python analyzer."],"familyIds":["api-authorization-and-data-exposure-testing"]},{"id":"detecting-arp-poisoning-in-network-traffic","summary":"A specialist playbook for detecting ARP poisoning/ARP spoofing attacks on a local network using ARPWatch, Dynamic ARP Inspection, Wireshark filters, and a custom Python monitoring script, with coverage of attack indicators and preventive measures.","primaryDomain":"network-security","domainTags":["arp-poisoning","arp-spoofing","man-in-the-middle","layer-2-security"],"capabilityTags":["arp-poisoning-detection","dynamic-arp-inspection","packet-capture-analysis","custom-monitoring-script"],"capabilityDetails":["Provides a multi-layered workflow for detecting ARP poisoning using ARPWatch, Dynamic ARP Inspection (DAI), Wireshark analysis, and a custom Python monitoring script."],"techniqueTags":["gratuitous-arp-monitoring","mac-flip-flop-detection","arp-cache-monitoring","dhcp-snooping"],"techniqueDetails":["Monitors for gratuitous ARP flooding, IP-to-MAC mapping changes, duplicate IP claims, and high ARP packet rates."],"tools":["arpwatch","wireshark","tcpdump","scapy","python"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Combines host-based monitoring (ARPWatch, custom Python) with infrastructure-based controls (DAI on switches) and packet analysis (Wireshark) into a cohesive detection playbook."],"familyIds":["network-traffic-analysis-and-detection"]},{"id":"detecting-attacks-on-historian-servers","summary":"A specialist playbook for detecting attacks on OT historian servers, providing a Python detector that flags unauthorized client connections, data replay/flatline patterns, and lateral movement indicators as historians bridge IT and OT networks.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","historian-security","it-ot-pivot"],"capabilityTags":["historian-attack-detection","unauthorized-connection-detection","data-integrity-validation","lateral-movement-detection"],"capabilityDetails":["Provides a Python detector for monitoring OT historian servers (OSIsoft PI, Ignition, etc.) for unauthorized connections, data manipulation, and lateral movement indicators."],"techniqueTags":["baseline-comparison","api-monitoring","flatline-detection","data-gap-detection","authentication-anomaly-detection"],"techniqueDetails":["Uses baseline authorized clients to flag unauthorized connections.","Checks historian APIs for active connections and recorded data.","Detects flatline data patterns and missing data as integrity issues.","Identifies outbound connections to PLC subnets, unauthorized processes, and anomalous logons as lateral movement indicators."],"tools":["python","requests"],"targetTypes":["database","network","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Focuses specifically on OT historian servers as IT/OT pivot points, combining API-based connection checks, data integrity validation, and lateral movement indicators in one detector."],"familyIds":["ot-ics-attack-detection-and-monitoring"]},{"id":"detecting-attacks-on-scada-systems","summary":"Operational playbook for detecting cyber attacks on SCADA/ICS systems, including establishing industrial protocol baselines, deploying OT-specific Suricata rules, monitoring process historian data for physical anomalies, and recognizing known ICS malware indicators.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","scada-security","industrial-control"],"capabilityTags":["scada-attack-detection","ot-protocol-anomaly-detection","ics-malware-detection","process-anomaly-detection","baseline-establishment"],"capabilityDetails":["Provides a workflow for establishing deterministic baselines of SCADA communication patterns (Modbus, DNP3, EtherNet/IP, S7comm) using passive traffic analysis.","Delivers OT-specific Suricata detection rules for unauthorized Modbus writes, S7comm CPU STOP/program download, DNP3 cold restart/firmware transfer, and network anomalies.","Implements process data anomaly detection to identify physical process manipulation and Stuxnet-style sensor spoofing using historian data.","Includes specific detection guidance for known ICS malware families (TRITON, Industroyer/CrashOverride, PIPEDREAM/INCONTROLLER)."],"techniqueTags":["modbus-anomaly-detection","s7comm-detection","dnp3-detection","process-data-monitoring","statistical-anomaly-detection","intrusion-detection-rules"],"techniqueDetails":["Uses baseline comparison to flag unauthorized function codes, register ranges, and polling interval deviations in industrial protocols.","Detects physical process anomalies through out-of-range values, rate-of-change violations, flatline sensor readings, and z-score statistical outliers.","Applies threshold-based detection for rapid sequences of control commands characteristic of malware such as Industroyer.","Leverages OT-specific indicators of compromise for known ICS-targeting malware, including network patterns and host artifacts."],"tools":["suricata","scapy","python","dragos-platform","nozomi-guardian","claroty-xdome"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Exclusively focused on OT/ICS/SCADA attack detection rather than general IT network intrusion detection.","Integrates network traffic baselining, protocol-specific detection rules, process data anomaly detection, and known ICS malware IOCs into a single operational workflow.","Provides ready-to-use Python scripts for baseline construction and process data anomaly monitoring, along with Suricata signatures tailored to industrial protocols."],"familyIds":["ot-ics-attack-detection-and-monitoring"]},{"id":"detecting-aws-cloudtrail-anomalies","summary":"Provides a structured procedure for detecting AWS CloudTrail anomalies by querying CloudTrail logs with boto3, building statistical baselines of normal API activity, and flagging unusual patterns indicative of credential compromise, privilege escalation, or unauthorized access.","primaryDomain":"cloud-security","domainTags":["aws","cloudtrail","anomaly-detection","threat-detection"],"capabilityTags":["anomaly-detection","threat-hunting","baseline-analysis"],"capabilityDetails":["Provides a structured procedure for querying CloudTrail logs and building statistical baselines to detect unusual API call patterns."],"techniqueTags":["statistical-baselining","behavioral-analysis","lookup-events"],"techniqueDetails":["Uses boto3 lookup_events to retrieve CloudTrail events.","Aggregates events by user, source IP, event source, and event name to establish baseline patterns.","Flags anomalies such as new event sources, first-time API calls, geographic IP changes, high error rates, and sensitive API usage."],"tools":["boto3","aws-cloudtrail"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on detecting anomalies in AWS CloudTrail logs using statistical baselines, distinguishing it from generic cloud security or broad log analysis skills."],"familyIds":["aws-threat-detection-and-response"]},{"id":"detecting-aws-credential-exposure-with-trufflehog","summary":"A specialist playbook for detecting exposed AWS credentials in source code, git history, and CI/CD pipelines using TruffleHog, validating their active status, remediating exposure, and preventing future leaks.","primaryDomain":"cloud-security","domainTags":["aws","credential-exposure","secrets-detection","devsecops"],"capabilityTags":["secrets-scanning","credential-validation","incident-response","ci-cd-integration"],"capabilityDetails":["Provides a workflow for scanning git repositories, CI/CD pipelines, and filesystems for exposed AWS credentials using TruffleHog, validating active status, and guiding incident response and remediation."],"techniqueTags":["git-history-scanning","verified-secret-detection","credential-pattern-matching","aws-api-verification"],"techniqueDetails":["Uses TruffleHog's verified-secret detection to confirm active AWS keys via API calls, and git-secrets pre-commit hooks to prevent future exposures."],"tools":["trufflehog","git-secrets","bfg-repo-cleaner","aws-cli"],"targetTypes":["source-code","cloud","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on AWS credential exposure in source code and git history, combining TruffleHog scanning with verified active-key detection, rotation workflows, and CI/CD prevention."],"familyIds":["aws-identity-and-credential-risk-assessment"]},{"id":"detecting-aws-guardduty-findings-automation","summary":"Builds automated AWS GuardDuty finding response pipelines using EventBridge and Lambda to quarantine compromised EC2 instances, deactivate IAM credentials, and notify via SNS, with Terraform deployment options.","primaryDomain":"cloud-security","domainTags":["aws","guardduty","cloud-security","incident-response"],"capabilityTags":["automated-remediation","ec2-quarantine","iam-credential-quarantine","eventbridge-lambda-pipeline"],"capabilityDetails":["Provides Lambda functions for automated EC2 instance quarantine and IAM credential deactivation in response to GuardDuty findings."],"techniqueTags":["eventbridge-rule-filtering","lambda-triggered-response","terraform-deployment","multi-account-guardduty"],"techniqueDetails":["Uses EventBridge rules to filter GuardDuty findings by severity and triggers Lambda functions for automated response; supports Terraform deployment."],"tools":["aws-cli","boto3","terraform"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","remediation"],"distinctiveFeatures":["Differs from generic GuardDuty detection guides by providing ready-to-deploy Lambda functions for EC2 isolation and IAM key deactivation, with EventBridge filtering and Terraform infrastructure-as-code."],"familyIds":["aws-threat-detection-and-response"]},{"id":"detecting-aws-iam-privilege-escalation","summary":"Provides a step-by-step workflow using boto3 and Cloudsplaining to detect AWS IAM privilege escalation paths by analyzing policies for dangerous permission combinations, wildcard resources, and least-privilege violations, outputting a prioritized JSON report.","primaryDomain":"cloud-security","domainTags":["aws","iam","privilege-escalation","policy-analysis","least-privilege"],"capabilityTags":["iam-privilege-escalation-detection","policy-permission-analysis","least-privilege-audit"],"capabilityDetails":["Detects overly permissive IAM policies and dangerous permission combinations using boto3 and Cloudsplaining-style analysis."],"techniqueTags":["permission-combination-analysis","wildcard-resource-detection","principal-policy-mapping"],"techniqueDetails":["Checks for dangerous combinations like iam:PassRole with lambda:CreateFunction, iam:CreatePolicyVersion, sts:AssumeRole.","Flags policies with Resource '*' and dangerous actions.","Maps principals to escalation paths and scores severity."],"tools":["boto3","cloudsplaining"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Specifically targets AWS IAM privilege escalation paths through policy analysis rather than general cloud security auditing.","Provides a structured severity scoring and reporting workflow for IAM findings."],"familyIds":["aws-identity-and-credential-risk-assessment"]},{"id":"detecting-azure-lateral-movement","summary":"Provides a structured KQL and Sentinel playbook for detecting Azure AD/Entra ID lateral movement via Graph API audit logs, sign-in anomalies, and OAuth/service principal abuse, with automated response and MITRE ATT&CK mapping.","primaryDomain":"cloud-security","domainTags":["azure","entra-id","cloud-security","threat-hunting","identity-security"],"capabilityTags":["lateral-movement-detection","threat-hunting","kql-hunting","log-correlation","detection-rule-building"],"capabilityDetails":["Provides a KQL and Microsoft Graph API based workflow for detecting Azure AD/Entra ID lateral movement, including log ingestion configuration, detection query building, event correlation, and automated response."],"techniqueTags":["oauth-consent-grant-abuse","service-principal-abuse","token-theft","cross-tenant-pivoting","mailbox-delegation-abuse","conditional-access-bypass"],"techniqueDetails":["Covers application impersonation, service principal credential additions, OAuth consent grants to unknown apps, token replay from different IP/user-agent combinations, mailbox delegation changes, and conditional access policy bypasses."],"tools":["microsoft-graph-api","azure-sentinel","kusto-query-language","logic-apps"],"targetTypes":["cloud","active-directory"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on Azure AD/Entra ID lateral movement detection rather than generic cloud security","Combines Graph API audit log analysis with Sentinel KQL hunting and automated playbook response"],"familyIds":["azure-identity-and-entra-threat-detection"]},{"id":"detecting-azure-service-principal-abuse","summary":"Detection and investigation playbook for Azure service principal abuse in Entra ID, providing Sentinel/KQL and Splunk/SPL queries for added credentials, privileged role assignments, admin consent bypass, service principal enumeration, and OAuth permissions escalation, along with Microsoft Graph PowerShell steps for validation and incident investigation.","primaryDomain":"cloud-security","domainTags":["azure","entra-id","service-principal","identity-abuse"],"capabilityTags":["detection-query-writing","threat-hunting","incident-investigation","privilege-escalation-detection"],"capabilityDetails":["Provides KQL and Splunk detection queries for Azure service principal abuse patterns and PowerShell-based investigation procedures for validation."],"techniqueTags":["kql","splunk-spl","microsoft-graph-powershell","audit-log-analysis"],"techniqueDetails":["Uses Azure AD Audit Logs, Sign-in Logs, and Microsoft Graph Activity Logs via Sentinel/KQL and Splunk/SPL, followed by Microsoft Graph PowerShell for step-by-step investigation and validation."],"tools":["microsoft-sentinel","splunk","microsoft-graph-powershell"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focused exclusively on Azure service principal abuse in Microsoft Entra ID with concrete, copy-paste-ready KQL and Splunk queries for five abuse patterns, plus PowerShell validation steps.","Distinct from general cloud security or identity monitoring skills by targeting service principal credential additions, role assignments, admin consent bypass, enumeration, and OAuth permission escalation specifically."],"familyIds":["azure-identity-and-entra-threat-detection"]},{"id":"detecting-azure-storage-account-misconfigurations","summary":"Audits Azure Blob and ADLS storage accounts for public access, weak SAS tokens, missing encryption, disabled HTTPS, and outdated TLS, generating a risk-scored report with remediation guidance.","primaryDomain":"cloud-security","domainTags":["azure","storage-accounts","cloud-misconfiguration","data-exposure"],"capabilityTags":["azure-storage-audit","public-access-detection","sas-token-risk-assessment","encryption-audit","tls-version-check"],"capabilityDetails":["Provides a workflow using the azure-mgmt-storage Python SDK to enumerate Azure storage accounts, inspect public blob access, HTTPS-only setting, minimum TLS version, encryption at rest, network rules, and SAS token risks, then generate a risk-scored report."],"techniqueTags":["cloud-configuration-audit","sdk-based-enumeration","risk-scoring"],"techniqueDetails":["Uses StorageManagementClient to programmatically inspect storage account properties and container access levels; applies severity ratings based on CIS Azure Benchmark guidance."],"tools":["azure-mgmt-storage","azure-identity","python"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on Azure Storage account misconfigurations across blob and ADLS, covering public access, SAS tokens, encryption, HTTPS, TLS, and network rules; produces a risk-scored report using azure-mgmt-storage SDK."],"familyIds":["azure-storage-security-audit"]},{"id":"detecting-beaconing-patterns-with-zeek","summary":"Detects C2 beaconing by statistically analyzing Zeek conn.log connection intervals using ZAT to compute inter-arrival time jitter and flag low-variability periodic traffic.","primaryDomain":"network-security","domainTags":["network-security","c2-beaconing","threat-hunting","zeek"],"capabilityTags":["c2-beaconing-detection","conn-log-analysis","periodicity-analysis","statistical-analysis"],"capabilityDetails":["Provides a workflow to detect command-and-control beaconing by analyzing inter-arrival times in Zeek conn.log."],"techniqueTags":["interarrival-time-analysis","coefficient-of-variation","jitter-analysis","zat-dataframe-analysis"],"techniqueDetails":["Computes standard deviation and coefficient of variation for connection intervals to identify periodic, low-jitter traffic."],"tools":["zeek","zat","python"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Employs statistical timing analysis (low coefficient of variation) on Zeek conn.log rather than signature or IOC matching for C2 detection."],"familyIds":["network-traffic-analysis-and-detection"]},{"id":"detecting-bluetooth-low-energy-attacks","summary":"Provides an advanced, hands-on workflow for authorized BLE security assessments, covering device discovery, GATT service enumeration, passive packet capture with Ubertooth/nRF sniffers, legacy pairing encryption cracking via crackle, replay attack validation, and MITM detection, with concrete commands and analysis guidance.","primaryDomain":"network-security","domainTags":["bluetooth-low-energy","wireless-security","iot-security","protocol-analysis"],"capabilityTags":["ble-discovery","gatt-enumeration","packet-capture","encryption-cracking","replay-testing"],"capabilityDetails":["Provides workflows for scanning BLE devices, enumerating GATT services and characteristics, capturing and analyzing BLE traffic, cracking legacy pairing encryption, testing replay vulnerabilities, and detecting MITM attacks."],"techniqueTags":["passive-sniffing","active-scanning","gatt-analysis","pairing-cracking","replay-detection","mitm-detection"],"techniqueDetails":["Uses Ubertooth and nRF dongles for passive packet capture, bleak for active GATT enumeration and write operations, crackle for LTK recovery from legacy pairing exchanges, and Wireshark/tshark filters for protocol-level analysis."],"tools":["Ubertooth One","nRF Sniffer","bleak","crackle","Wireshark","tshark","GATTacker","BTLEjuice"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","exploitation"],"distinctiveFeatures":["Specializes in BLE attack detection and validation with hardware sniffers and GATT-level testing, including replay attack practical validation and legacy pairing encryption cracking, distinguishing it from generic wireless security or Bluetooth scanning skills."],"familyIds":["wireless-network-security-assessment"]},{"id":"detecting-broken-object-property-level-authorization","summary":"Structured methodology and Python scanner for detecting and validating Broken Object Property Level Authorization (BOPLA) in APIs, covering excessive data exposure, mass assignment, and GraphQL property exposure.","primaryDomain":"api-security","domainTags":["api-security","bopla","mass-assignment","excessive-data-exposure"],"capabilityTags":["bopla-detection","mass-assignment-testing","excessive-data-exposure-testing","graphql-introspection-testing"],"capabilityDetails":["Provides automated and manual workflows for detecting BOPLA vulnerabilities, including excessive data exposure and mass assignment."],"techniqueTags":["property-field-comparison","mass-assignment-injection","sensitive-property-pattern-matching","graphql-introspection"],"techniqueDetails":["Uses expected field sets to identify unexpected properties, injects known dangerous fields to test mass assignment, classifies property sensitivity based on naming patterns, and performs GraphQL introspection to discover exposed schema."],"tools":["python","requests","burp-suite","postman"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on OWASP API3:2023 BOPLA combining excessive data exposure and mass assignment","Provides a Python scanner with sensitivity classification and mass assignment payload injection","Includes GraphQL introspection testing for schema exposure"],"familyIds":["api-authorization-and-data-exposure-testing"]},{"id":"detecting-business-email-compromise","summary":"A defensive playbook for detecting Business Email Compromise (BEC) fraud—where attackers impersonate executives or vendors without malicious links—using email gateway rules, behavioral analytics, and financial process controls.","primaryDomain":"security-knowledge","domainTags":["phishing","email-security","social-engineering","fraud"],"capabilityTags":["bec-detection","email-spoofing-detection","behavioral-analytics","financial-controls"],"capabilityDetails":["Provides a structured detection playbook for Business Email Compromise (BEC) using email gateway rules, behavioral analytics, and financial process controls."],"techniqueTags":["display-name-spoofing","reply-to-mismatch","email-forwarding-rule-monitoring","impossible-travel-detection"],"techniqueDetails":["Detects VIP display name spoofing from external domains, flags reply-to domain mismatches, and monitors for email forwarding rule changes to identify compromised accounts."],"tools":["Microsoft Defender for O365 Anti-BEC","Proofpoint Email Fraud Defense","Abnormal Security"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Focused solely on BEC fraud that avoids malicious links/attachments, combining email gateway rules, behavioral analytics, and financial dual-authorization controls rather than generic phishing detection."],"familyIds":["business-email-compromise-detection"]},{"id":"detecting-business-email-compromise-with-ai","summary":"Provides a step-by-step workflow for deploying AI/NLP-powered email security platforms to detect business email compromise through behavioral baselining, writing style analysis, and detection policy configuration.","primaryDomain":"security-knowledge","domainTags":["email-security","phishing-defense","business-email-compromise"],"capabilityTags":["ai-powered-detection","nlp-analysis","behavioral-baselining","impersonation-detection"],"capabilityDetails":["Provides a workflow for deploying AI and NLP-based detection systems to identify BEC attacks through writing style and behavioral anomaly analysis."],"techniqueTags":["writing-style-analysis","behavioral-profiling","transformer-models","anomaly-detection"],"techniqueDetails":["Uses transformer-based NLP models to analyze email content and behavioral baselines to detect deviations indicating impersonation."],"tools":["abnormal-security","microsoft-defender-for-o365","tessian","ironscales","darktrace"],"targetTypes":["cloud","api"],"role":"workflow","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Focuses specifically on AI/ML-based detection of social-engineering BEC attacks without malicious payloads, rather than link/attachment analysis."],"familyIds":["business-email-compromise-detection"]},{"id":"detecting-cloud-threats-with-guardduty","summary":"Deploys and operationalizes Amazon GuardDuty for AWS threat detection: enables organization-wide protection plans, aggregates findings across accounts, interprets severity and finding types, automates EC2 and credential containment with EventBridge and Lambda, and investigates attack sequence findings.","primaryDomain":"cloud-security","domainTags":["amazon-guardduty","threat-detection","aws-security","runtime-monitoring","cloud-soc"],"capabilityTags":["guardduty-enablement","multi-account-aggregation","finding-severity-analysis","eventbridge-automation","lambda-remediation","attack-sequence-investigation","security-hub-integration"],"capabilityDetails":["Provides an end-to-end workflow to enable Amazon GuardDuty organization-wide, activate S3, EKS, EC2 runtime, Lambda, and malware protection plans, aggregate findings across accounts, interpret finding types and severities, and automate incident response with EventBridge and Lambda."],"techniqueTags":["aws-cli-configuration","cloudtrail-analysis","vpc-flow-log-analysis","dns-log-analysis","eventbridge-patterns","lambda-auto-remediation","finding-prioritization","attack-chain-correlation"],"techniqueDetails":["Uses GuardDuty's data sources including CloudTrail, VPC Flow Logs, DNS logs, and runtime telemetry to detect threats; applies severity-based triage and automated containment for compromised EC2 instances and IAM credentials."],"tools":["Amazon GuardDuty","AWS CLI","Amazon EventBridge","AWS Lambda","AWS Security Hub","Amazon Security Lake","Amazon Detective"],"targetTypes":["cloud","container","kubernetes"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on the full Amazon GuardDuty lifecycle: from enabling organization-wide protection plans and multi-account aggregation to interpreting critical attack sequence findings and building automated response via EventBridge and Lambda."],"familyIds":["aws-threat-detection-and-response"]},{"id":"detecting-command-and-control-over-dns","summary":"Provides a multi-method workflow for detecting C2 traffic tunneled over DNS, using Shannon entropy analysis of subdomains, ML-based DGA classification, TXT record payload analysis, and tool signatures for Iodine/dnscat2/dns2tcp/Cobalt Strike DNS beacons.","primaryDomain":"network-security","domainTags":["dns","command-and-control","dns-tunneling","dga","network-forensics"],"capabilityTags":["dns-tunneling-detection","dga-classification","dns-beacon-detection","txt-payload-analysis","entropy-analysis"],"capabilityDetails":["Provides a workflow for detecting C2 tunneling over DNS using Shannon entropy analysis of query subdomains, ML-based DGA classification, TXT record payload inspection, and Zeek/Suricata signature matching."],"techniqueTags":["shannon-entropy-analysis","ml-dga-classification","passive-dns-correlation","zeek-suricata-signatures","base64-payload-detection"],"techniqueDetails":["Uses entropy and subdomain length thresholds to flag suspicious DNS queries; trains RandomForest/GradientBoosting classifiers on character-level domain features; inspects TXT records for base64-encoded executables and PowerShell stagers; correlates with passive DNS and known tool patterns."],"tools":["zeek","suricata","tshark","python","scikit-learn","splunk","elastic","microsoft-sentinel"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Combines entropy analysis, ML-based DGA classification, TXT payload inspection, and known tool signatures for Iodine/dnscat2/dns2tcp/Cobalt Strike DNS in a single C2-detection workflow.","Includes tunable thresholds and detection of hex/base32 encoding patterns for tunneling."],"familyIds":["network-traffic-analysis-and-detection"]},{"id":"detecting-compromised-cloud-credentials","summary":"Operational playbook for detecting and responding to compromised cloud credentials across AWS, Azure, and GCP using GuardDuty, Entra ID Protection, and SCC Event Threat Detection, including impossible-travel and credential-stuffing correlation and containment.","primaryDomain":"cloud-security","domainTags":["credential-compromise","threat-detection","incident-response","anomaly-detection"],"capabilityTags":["multi-cloud-credential-compromise-detection","impossible-travel-analysis","credential-stuffing-detection","exposed-credential-notification-response","session-revocation"],"capabilityDetails":["Provides a step-by-step workflow for detecting compromised cloud credentials across AWS, Azure, and GCP using native security services and cross-cloud correlation."],"techniqueTags":["impossible-travel","anomalous-api-activity","credential-stuffing","tor-ip-detection","service-account-key-abuse"],"techniqueDetails":["Uses GuardDuty finding types, Entra ID risk sign-ins, SCC Event Threat Detection categories, and audit log queries to identify credential abuse."],"tools":["AWS GuardDuty","Microsoft Defender for Identity","Google SCC Event Threat Detection","CloudTrail","Azure Activity Log","GCP Audit Log","SIEM"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","remediation"],"distinctiveFeatures":["Covers credential compromise detection and response across multiple cloud providers (AWS, Azure, GCP) with provider-specific native tooling and cross-cloud SIEM correlation rules."],"familyIds":["cloud-incident-response-and-forensics"]},{"id":"detecting-container-drift-at-runtime","summary":"Operational playbook for detecting container drift at runtime using Falco/Sysdig rules, Kubernetes immutability enforcement, image digest verification, and Microsoft Defender integration, with a structured incident response flow.","primaryDomain":"cloud-security","domainTags":["container-security","kubernetes-security","runtime-security","immutable-infrastructure"],"capabilityTags":["container-drift-detection","runtime-security-monitoring","immutable-infrastructure-validation","binary-execution-monitoring","filesystem-change-detection"],"capabilityDetails":["Provides Falco rules to detect unauthorized binary execution, package manager usage, and filesystem writes in containers.","Includes Kubernetes configurations for read-only root filesystems and Pod Security Standards to enforce immutability.","Offers a drift response playbook for validating, isolating, investigating, and evicting drifted containers."],"techniqueTags":["falco-rules","ebpf-monitoring","image-digest-verification","read-only-root-filesystem","pod-security-standards"],"techniqueDetails":["Uses Falco's proc.is_exe_upper_layer to detect binaries not present in the original image.","Employs filesystem write monitoring to identify changes to the container upper layer.","Continuously compares running container digests against approved deployment manifests."],"tools":["falco","sysdig","microsoft-defender-for-containers","kubectl"],"targetTypes":["container","kubernetes","cloud"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Focuses exclusively on runtime drift from immutable container images, distinguishing it from general container security or vulnerability scanning.","Combines behavioral monitoring (Falco), Kubernetes enforcement (read-only filesystem, Pod Security Standards), and image digest verification in one workflow.","Includes an operational response playbook with Detect, Isolate, Evict steps tailored to drifted containers."],"familyIds":["container-and-kubernetes-runtime-security"]},{"id":"detecting-container-escape-attempts","summary":"Operational playbook for detecting container escape attempts in Docker/Kubernetes environments using Falco runtime rules, seccomp logging profiles, and Linux audit rules to cover privileged containers, kernel exploits, namespace manipulation, and sensitive path access.","primaryDomain":"linux-security","domainTags":["container-security","kubernetes-security","docker-security","runtime-security"],"capabilityTags":["container-escape-detection","runtime-threat-detection","falco-rule-engineering","seccomp-hardening","audit-rule-configuration"],"capabilityDetails":["Provides a structured detection engineering workflow to identify container escape attempts using Falco rules, seccomp profiles, and Linux audit rules."],"techniqueTags":["privileged-container-exploitation","docker-socket-abuse","kernel-exploit-detection","capability-abuse","namespace-manipulation","cgroup-release-agent","sensitive-mount-detection"],"techniqueDetails":["Covers detection of privileged containers that can mount host filesystems or load kernel modules.","Detects container access to /var/run/docker.sock to create privileged containers.","Monitors for kernel exploits such as CVE-2022-0185, Dirty Pipe, and runc vulnerabilities via suspicious syscalls.","Identifies abuse of capabilities like CAP_SYS_ADMIN, CAP_SYS_PTRACE, and CAP_NET_ADMIN.","Detects namespace manipulation through setns and unshare syscalls.","Monitors writes to cgroup release_agent and notify_on_release files for escape attempts.","Flags access to sensitive proc/sys paths and mount operations targeting host filesystems."],"tools":["falco","sysdig","auditd","seccomp","kubectl","helm","falcosidekick"],"targetTypes":["container","kubernetes","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","validation"],"distinctiveFeatures":["Unlike generic container security monitoring, this skill provides a comprehensive detection playbook specifically for container escape attempts, including ready-to-use Falco rules for seven escape vectors, a seccomp profile that logs suspicious syscalls, and auditd rules for kernel-level monitoring."],"familyIds":["linux-runtime-threat-detection"]},{"id":"detecting-container-escape-with-falco-rules","summary":"A specialist playbook for deploying and tuning Falco to detect container escape attempts via syscall monitoring, including custom rules for host mounts, nsenter, privileged containers, kernel module loading, cgroup release agent abuse, and sensitive file access, with validation commands.","primaryDomain":"linux-security","domainTags":["container-security","runtime-security","kubernetes-security","falco"],"capabilityTags":["container-escape-detection","syscall-monitoring","falco-rule-writing","runtime-threat-detection"],"capabilityDetails":["Provides a set of Falco rules designed to detect container escape techniques via Linux syscall monitoring.","Includes deployment and configuration guidance for Falco in Kubernetes and standalone environments.","Offers validation commands to simulate escape attempts and confirm alert generation."],"techniqueTags":["host-filesystem-mount","namespace-escape","privileged-container-detection","kernel-module-loading","cgroup-release-agent-exploit","docker-socket-access","sensitive-file-access"],"techniqueDetails":["Monitors mount and nsenter commands for namespace escape attempts.","Detects writes to /proc/sysrq-trigger and cgroup release_agent for host manipulation.","Flags containers launched with privileged=true or accessing /var/run/docker.sock.","Detects attempts to read sensitive host files such as /etc/shadow and kubelet configs."],"tools":["falco","falcosidekick","helm","kubectl"],"targetTypes":["container","kubernetes","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Provides a purpose-built Falco rule set for a targeted list of container escape vectors, not generic runtime security.","Includes executable YAML rules and concrete validation commands for each escape technique."],"familyIds":["linux-runtime-threat-detection"]},{"id":"detecting-container-runtime-threats-with-falco","summary":"Provides a workflow for installing Falco with the modern eBPF driver, authoring custom detection rules for container escape primitives (cgroup release_agent, setns, privileged mounts, docker.sock abuse), validating and loading them, triggering purple-team experiments, and forwarding alerts via Falcosidekick.","primaryDomain":"cloud-security","domainTags":["container-security","kubernetes-security","runtime-security"],"capabilityTags":["falco-rule-authoring","runtime-threat-detection","container-escape-detection","syscall-anomaly-detection","purple-team-validation"],"capabilityDetails":["Provides a workflow for installing Falco with the modern eBPF driver, authoring and deploying custom rules to detect container escape, namespace abuse, privileged mounts, reverse shells, and sensitive file access, and validating them in a Kubernetes or Docker environment."],"techniqueTags":["container-escape-detection","setns-namespace-abuse","privileged-mount-detection","docker-socket-abuse","reverse-shell-detection","sensitive-file-read"],"techniqueDetails":["Covers detection of cgroup release_agent writes, setns/nsenter host namespace breakouts, mount in privileged containers, docker.sock access, reverse shells with network fds, and reads of host sensitive files like /etc/shadow."],"tools":["falco","falcoctl","falcosidekick","helm"],"targetTypes":["container","kubernetes","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","validation","reporting"],"distinctiveFeatures":["Focuses specifically on writing custom Falco rules for container-escape primitives and validating them with purple-team exercises, rather than general runtime security or monitoring guidance."],"familyIds":["container-and-kubernetes-runtime-security"]},{"id":"detecting-credential-dumping-techniques","summary":"Detection playbook for credential dumping on Windows/AD using Sysmon Event ID 10, Windows Security logs, and SIEM correlation to identify LSASS memory access, SAM registry hive exports, NTDS.dit theft, and comsvcs.dll MiniDump abuse.","primaryDomain":"windows-security","domainTags":["active-directory","credential-dumping","threat-detection","sysmon","siem-correlation"],"capabilityTags":["detection-rule-development","threat-hunting","log-analysis","siem-query-development","event-correlation"],"capabilityDetails":["Provides structured procedures for building detection rules and hunting queries for credential dumping indicators.","Covers configuration of Sysmon and Windows Security logging, SIEM correlation, and risk-scoring of detections."],"techniqueTags":["lsass-memory-access","sam-registry-hive-export","ntds-dit-extraction","comsvcs-dll-minidump","grantedaccess-bitmask"],"techniqueDetails":["Monitors GrantedAccess bitmask patterns (0x1010, 0x1FFFFF) for LSASS process access detection.","Detects reg.exe export of SAM/SECURITY/SYSTEM hives, ntdsutil/vssadmin shadow copy NTDS.dit extraction, and comsvcs.dll MiniDump abuse."],"tools":["sysmon","splunk","elastic-siem","python"],"targetTypes":["windows-host","active-directory"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Combines multiple credential dumping techniques (LSASS access, SAM hive export, NTDS.dit theft, comsvcs.dll MiniDump) into one detection workflow with specific Sysmon Event ID 10 GrantedAccess bitmask patterns.","Focuses on detection and triage for SOC analysts rather than generic Windows event monitoring."],"familyIds":["credential-access-and-dumping"]},{"id":"detecting-cryptomining-in-cloud","summary":"Provides security teams a step-by-step playbook for detecting, investigating, containing, and reporting unauthorized cryptocurrency mining in AWS and Azure cloud environments using GuardDuty, cost anomaly detection, VPC flow logs, and runtime monitoring.","primaryDomain":"cloud-security","domainTags":["cryptomining-detection","cloud-abuse","resource-hijacking","cost-anomaly-detection"],"capabilityTags":["cryptomining-detection","cloud-incident-response","cryptomining-containment","initial-access-investigation","container-workload-monitoring"],"capabilityDetails":["Provides a multi-signal workflow for detecting unauthorized cryptocurrency mining in cloud environments, including cost anomalies, network traffic, runtime processes, and GuardDuty findings, along with containment and investigation guidance."],"techniqueTags":["guardduty-findings-analysis","cost-anomaly-detection","vpc-flow-log-analysis","runtime-process-monitoring","cloudtrail-investigation","container-image-inspection"],"techniqueDetails":["Uses GuardDuty CryptoCurrency and Impact finding types, AWS Cost Anomaly Detection, VPC Flow Log mining pool port connections, runtime process monitoring (GuardDuty Runtime Monitoring, Falco), and CloudTrail event analysis to detect and trace mining activity."],"tools":["Amazon GuardDuty","AWS Cost Anomaly Detection","VPC Flow Logs","AWS CloudTrail","CloudWatch","AWS Lambda","Amazon Detective","Falco","Amazon Athena"],"targetTypes":["cloud","container","kubernetes"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on detecting and responding to unauthorized cryptocurrency mining in cloud environments, integrating multiple AWS/Azure detection signals and including automated containment and forensic snapshot actions."],"familyIds":["aws-threat-detection-and-response"]},{"id":"detecting-data-and-model-poisoning","summary":"Operational workflow for detecting poisoned training data and backdoored ML models using Cleanlab label-quality scanning, IBM ART activation-clustering/spectral-signature analysis, supply-chain integrity checks (hash verification, safetensors), and backdoor trigger probing.","primaryDomain":"security-knowledge","domainTags":["ai-security","data-poisoning","model-backdoor","ml-supply-chain"],"capabilityTags":["poisoned-data-detection","model-backdoor-detection","label-quality-scanning","ml-supply-chain-integrity","trigger-probing"],"capabilityDetails":["Detects poisoned training data using Cleanlab label-issue scans and statistical outlier detection.","Detects backdoored models via activation clustering and spectral signature analysis with IBM ART.","Verifies model checkpoint integrity through hash verification and safetensors enforcement.","Probes suspect models for backdoor triggers and quantifies attack success rate."],"techniqueTags":["activation-clustering","spectral-signatures","label-issue-detection","weight-hash-verification","safe-serialization","trigger-probing"],"techniqueDetails":["Activations of poisoned samples cluster separately from clean samples within a class.","Spectral signatures identify samples whose feature representations are outliers in the covariance spectrum.","Cleanlab flags mislabeled, outlier, and near-duplicate samples indicative of label-flip poisoning.","Comparing SHA-256 hashes against published digests and preferring safetensors over pickle-based formats prevents malicious artifacts.","Backdoor trigger probing measures the increase in target-class prediction rate when a candidate trigger is applied."],"tools":["IBM Adversarial Robustness Toolbox","Cleanlab","safetensors","sha256sum"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Focuses on ML-specific poisoning/backdoor detection rather than traditional application or network security.","Combines supply-chain integrity checks, label-quality scanning, ART-based model analysis, and trigger probing in one pipeline.","Maps findings to MITRE ATLAS AML.T0020 / AML.T0018 and OWASP LLM04:2025."],"familyIds":["ai-ml-security-detection"]},{"id":"detecting-dcsync-attack-in-active-directory","summary":"Operational threat-hunting playbook for detecting DCSync (MITRE T1003.006) in Active Directory by auditing Event ID 4662 replication-GUID access, correlating non-DC requests, and triaging with SIEM/Sigma queries.","primaryDomain":"active-directory","domainTags":["active-directory","threat-hunting","credential-access"],"capabilityTags":["dcsync-detection","replication-rights-auditing","ad-credential-theft-hunting"],"capabilityDetails":["Provides a structured workflow for identifying DCSync attacks in Active Directory by auditing Windows Event ID 4662 and replication-related GUIDs, and distinguishing non-domain-controller replication requests."],"techniqueTags":["event-id-4662-monitoring","replication-guid-analysis","siem-query-development"],"techniqueDetails":["Uses DS-Replication-Get-Changes GUIDs to flag unauthorized DsGetNCChanges RPC calls; includes Splunk, KQL, and Sigma detection queries."],"tools":["Mimikatz","Impacket","DSInternals","BloodHound","Splunk","Elastic","Microsoft Defender for Identity","CrowdStrike Falcon"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Dedicated to DCSync detection via directory service replication audit events rather than general credential-theft hunting; provides ready-to-use SIEM and Sigma queries keyed to specific replication permission GUIDs, with guidance on filtering legitimate DC and service accounts."],"familyIds":["dcsync-detection"]},{"id":"detecting-deepfake-audio-in-vishing-attacks","summary":"A specialist workflow for detecting AI-generated deepfake audio in vishing calls, using spectral and pitch analysis with ensemble ML classification and forensic report generation.","primaryDomain":"forensics","domainTags":["audio-forensics","deepfake-detection","vishing","social-engineering-defense"],"capabilityTags":["deepfake-audio-detection","spectral-feature-extraction","machine-learning-classification","forensic-reporting"],"capabilityDetails":["Provides a workflow for detecting AI-generated audio in vishing attacks using spectral and temporal feature analysis."],"techniqueTags":["mfcc-analysis","spectral-contrast-analysis","pitch-jitter-analysis","spectrogram-inspection","ensemble-model-classification"],"techniqueDetails":["Uses MFCC, spectral centroid, spectral contrast, zero-crossing rate, and pitch jitter to identify synthetic speech artifacts."],"tools":["librosa","scikit-learn","resemblyzer","speechbrain","praat","ffmpeg"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Specializes in audio forensics for vishing attacks, combining acoustic feature analysis with ensemble ML classification and forensic report generation."],"familyIds":["deepfake-audio-forensics"]},{"id":"detecting-dependency-confusion","summary":"Detects claimable internal package names on public registries using confused and dep-scan, and prevents dependency confusion through registry source pinning and defensive placeholder registration.","primaryDomain":"source-code-security","domainTags":["dependency-confusion","supply-chain-security","package-manager-security"],"capabilityTags":["dependency-confusion-detection","registry-pinning","defensive-registration","manifest-enumeration"],"capabilityDetails":["Workflow to enumerate internal package names in manifests and verify claimability on public registries, then apply prevention controls."],"techniqueTags":["package-name-probing","manifest-scanning","public-registry-lookup"],"techniqueDetails":["Uses registry API status codes (404) to confirm names are unclaimed and public-over-private substitution risk."],"tools":["confused","owasp-dep-scan","curl"],"targetTypes":["source-code","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Focuses specifically on dependency confusion across npm, PyPI, Maven, Composer, and RubyGems, combining both detection and remediation with registry pinning and placeholder registration."],"familyIds":["package-registry-supply-chain-risk-screening"]},{"id":"detecting-dll-sideloading-attacks","summary":"Operational hunting playbook that detects DLL sideloading and search-order hijacking by analyzing Sysmon Event ID 7 DLL load events, checking signatures/hashes, and correlating EDR process behavior.","primaryDomain":"windows-security","domainTags":["dll-sideloading","threat-hunting","mitre-attack","defense-evasion","edr"],"capabilityTags":["dll-sideloading-detection","search-order-hijack-hunting","dll-signature-analysis","dll-hash-verification"],"capabilityDetails":["Provides a workflow for detecting DLL sideloading and search-order hijacking by analyzing Sysmon Event ID 7 DLL load events and EDR alerts, checking signatures/hashes, and correlating process behavior."],"techniqueTags":["dll-side-loading","dll-search-order-hijacking","phantom-dll","dll-proxying","t1574"],"techniqueDetails":["Covers multiple T1574 sub-techniques including DLL side-loading, search order hijacking, phantom DLLs, and DLL proxying; uses Sysmon Event ID 7 monitoring to identify path and signature anomalies."],"tools":["Sysmon","CrowdStrike Falcon","Microsoft Defender for Endpoint","Process Monitor","Sigcheck","pe-sieve"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","remediation"],"distinctiveFeatures":["Focused exclusively on DLL sideloading/search-order hijacking detection rather than general malware analysis","Explicitly covers Phantom DLL and DLL proxying variants","Combines Sysmon Event ID 7 with EDR tools and signature/hash verification for multi-layered detection"],"familyIds":["windows-persistence-detection-and-hunting"]},{"id":"detecting-dnp3-protocol-anomalies","summary":"Provides a Scapy-based DNP3 traffic analyzer for SCADA/ICS networks that detects unauthorized masters, restart/file operations, unexpected control commands, and protocol baseline deviations, with MITRE ATT&CK ICS mapping.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","scada-security","dnp3"],"capabilityTags":["protocol-anomaly-detection","unauthorized-command-detection","baseline-deviation-detection","firmware-update-detection"],"capabilityDetails":["Monitors DNP3 traffic for unauthorized control commands, device restarts, file operations, and function codes outside a learned baseline."],"techniqueTags":["deep-packet-inspection","dnp3-function-code-analysis","baseline-comparison"],"techniqueDetails":["Parses DNP3 headers and compares observed function codes against an authorized baseline to flag anomalies."],"tools":["scapy","suricata","zeek"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Specialized for DNP3 protocol in energy-sector OT networks; distinct from generic network anomaly detection by using DNP3-specific function codes and MITRE ATT&CK ICS mappings."],"familyIds":["ot-ics-attack-detection-and-monitoring"]},{"id":"detecting-dns-exfiltration-with-dns-query-analysis","summary":"Provides an operational playbook for detecting DNS exfiltration via passive DNS query analysis, including statistical/ML indicators, a complete Python detector, Suricata rules, and Splunk queries for alerting and investigation.","primaryDomain":"network-security","domainTags":["dns-exfiltration","dns-tunneling","data-exfiltration","network-monitoring"],"capabilityTags":["dns-exfiltration-detection","dns-tunneling-detection","entropy-analysis","query-anomaly-detection"],"capabilityDetails":["Provides a workflow for detecting DNS exfiltration via passive DNS monitoring, using statistical analysis of query entropy, subdomain length, query volume, and record-type abuse, with implementation in Python, Suricata, and Splunk."],"techniqueTags":["entropy-analysis","subdomain-length-analysis","query-volume-analysis","record-type-analysis","response-size-analysis","base64-hex-detection"],"techniqueDetails":["Uses Shannon entropy to identify high-entropy subdomains typical of tunneling.","Flags long subdomain labels and excessive label counts.","Detects abnormal query volume and unique subdomain ratios to single domains.","Monitors TXT and NULL record queries and oversized response payloads.","Identifies base64/hex-encoded subdomain patterns."],"tools":["zeek","suricata","tcpdump","python","splunk"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on DNS exfiltration/tunneling detection with a multi-indicator scoring system (entropy, subdomain length, volume, record-type), and provides ready-to-use Python, Suricata, and Splunk implementations, unlike general network anomaly detection skills."],"familyIds":["data-exfiltration-detection"]},{"id":"detecting-email-account-compromise","summary":"Delivers a workflow for detecting Microsoft 365 email account compromise through inbox rule analysis, sign-in anomaly detection, and OAuth grant review, ending in a severity-scored JSON investigation report.","primaryDomain":"cloud-security","domainTags":["email-security","office365","azure-ad","microsoft-graph","business-email-compromise"],"capabilityTags":["inbox-rule-analysis","sign-in-log-analysis","oauth-grant-review","compromise-detection"],"capabilityDetails":["Provides a step-by-step workflow for detecting compromised email accounts using Microsoft 365 audit logs and Azure AD sign-in data."],"techniqueTags":["impossible-travel-detection","inbox-rule-manipulation","external-forwarding-detection","user-agent-analysis","oauth-token-abuse"],"techniqueDetails":["Identifies mailbox rules that forward or delete messages, especially targeting financial keywords.","Correlates sign-in locations and user agents to flag impossible travel and suspicious clients."],"tools":["microsoft-graph-api","python","msal","azure-ad"],"targetTypes":["cloud","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on email account compromise (BEC) detection rather than general cloud security.","Combines inbox rule anomaly detection with sign-in log and OAuth consent review for an end-to-end investigation workflow."],"familyIds":["email-compromise-and-persistence-hunting"]},{"id":"detecting-email-forwarding-rules-attack","summary":"Provides a hypothesis-driven threat-hunting playbook to detect malicious email forwarding rules and mailbox delegation abuse, supporting BEC investigations and persistent access discovery in email environments.","primaryDomain":"cloud-security","domainTags":["email-security","threat-hunting","persistence","bec"],"capabilityTags":["email-forwarding-detection","threat-hunting","persistence-detection","bec-investigation"],"capabilityDetails":["Provides a structured hypothesis-driven hunting workflow for detecting malicious email forwarding rules and related collection/persistence techniques."],"techniqueTags":["email-forwarding-rule","remote-email-collection","additional-email-delegate-permissions"],"techniqueDetails":["Targets MITRE ATT&CK T1114.003 (Email Forwarding Rule), T1114.002 (Remote Email Collection), and T1098.002 (Additional Email Delegate Permissions)."],"tools":["crowdstrike-falcon","microsoft-defender-for-endpoint","splunk","elastic","sysmon","velociraptor","sigma"],"targetTypes":["cloud","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Concentrates exclusively on email forwarding rules and mailbox delegation abuse for persistence and collection, distinguishing it from generic email security or threat hunting skills.","Emphasizes a hypothesis-driven methodology with explicit validation and correlation steps rather than providing vendor-specific detection queries."],"familyIds":["email-compromise-and-persistence-hunting"]},{"id":"detecting-entra-offensive-tools-in-graph-logs","summary":"Hunts AADGraphActivityLogs and MicrosoftGraphActivityLogs in Sentinel/Log Analytics with KQL to detect offensive Entra ID tools (ROADtools, AADInternals, AzureHound) via User-Agent and behavioral endpoint-sweep fingerprints, enabling sign-in correlation and analytics rule creation.","primaryDomain":"cloud-security","domainTags":["entra-id","microsoft-graph","microsoft-sentinel","detection-engineering"],"capabilityTags":["threat-hunting","offensive-tool-detection","log-analysis","detection-rule-creation"],"capabilityDetails":["Provides a KQL workflow for hunting Microsoft Sentinel/Log Analytics Graph activity logs to detect offensive Entra ID tools (ROADtools, AADInternals, AzureHound) via User-Agent and behavioral endpoint-sweep fingerprints.","Includes sign-in correlation and operationalization of queries as analytics rules mapped to MITRE ATT&CK T1078.004."],"techniqueTags":["user-agent-fingerprinting","behavioral-sweep-detection","high-volume-outlier-analysis","sign-in-correlation"],"techniqueDetails":["Fingerprints ROADtools, AADInternals, and AzureHound by characteristic User-Agent strings (e.g., python/aiohttp, AADInternals, Go-http-client).","Detects roadrecon gather endpoint sweeps by requiring a set of directory resources within a 5-minute window, surviving User-Agent spoofing.","Flags high-volume directory read outliers by user/AppId within a short time window.","Correlates suspicious Graph API calls back to originating sign-ins via SignInActivityId/UniqueTokenIdentifier."],"tools":["microsoft-sentinel","azure-log-analytics","kusto-query-language","roadtools","aadinternals","azurehound"],"targetTypes":["cloud","api"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses specifically on detecting offensive Entra ID tooling via Graph activity logs, combining User-Agent fingerprints with a spoof-resistant behavioral endpoint-sweep detection.","Addresses the legacy Azure AD Graph visibility gap by using both AADGraphActivityLogs and MicrosoftGraphActivityLogs."],"familyIds":["azure-identity-and-entra-threat-detection"]},{"id":"detecting-evasion-techniques-in-endpoint-logs","summary":"Provides detection queries and workflow for identifying defense evasion techniques in Windows endpoint telemetry, including log clearing, timestomping, process injection, security tool disabling, masquerading, and LOLBin abuse, with correlation logic to combine weak signals into high-confidence detections.","primaryDomain":"windows-security","domainTags":["endpoint-security","defense-evasion","detection-engineering","threat-hunting"],"capabilityTags":["evasion-detection","log-analysis","detection-rule-development","log-correlation"],"capabilityDetails":["Provides a step-by-step workflow for detecting defense evasion techniques in Windows endpoint logs, including log clearing, timestomping, process injection, security tool disabling, masquerading, and LOLBin abuse. Includes detailed Sysmon, Splunk, and MDE/KQL detection queries as well as multi-signal correlation logic."],"techniqueTags":["log-clearing","timestomping","process-injection","security-tool-disabling","masquerading","lolbin-abuse"],"techniqueDetails":["Detects Windows Event Log clearing via wevtutil, Clear-EventLog, and Event IDs 1102/104.","Detects timestomping via Sysmon Event ID 2 correlated with file creation events.","Detects process injection via Sysmon Event IDs 8, 10, and 25.","Detects security tool disabling via service stop commands and registry modifications like DisableAntiSpyware.","Detects masquerading by comparing process names/images with expected paths and PE metadata.","Detects LOLBin abuse via command-line patterns for mshta, certutil, regsvr32, rundll32, and MSBuild."],"tools":["sysmon","microsoft-defender-for-endpoint","crowdstrike-falcon","splunk","elastic-security","sigma"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Specializes in defense evasion (MITRE ATT&CK TA0005) detection in endpoint logs, not general endpoint monitoring or malware analysis.","Provides concrete Sysmon/SIEM/EDR queries for six evasion techniques and a multi-signal correlation search to reduce alert fatigue."],"familyIds":["fileless-and-evasion-detection"]},{"id":"detecting-exfiltration-over-dns-with-zeek","summary":"Detects DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains, long labels, and anomalous query patterns, producing a ranked report of suspicious domains.","primaryDomain":"network-security","domainTags":["dns-exfiltration","zeek","entropy-analysis"],"capabilityTags":["dns-exfiltration-detection","zeek-log-analysis","entropy-based-detection"],"capabilityDetails":["Provides a workflow for detecting DNS-based data exfiltration by analyzing Zeek dns.log, including entropy calculation, label length checks, and query volume analysis."],"techniqueTags":["shannon-entropy","subdomain-label-length","unique-subdomain-count","query-volume-analysis"],"techniqueDetails":["Uses Shannon entropy of subdomain labels, flags labels exceeding 52 characters, counts unique subdomains per parent domain, and analyzes queries per minute per source IP."],"tools":["zeek"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Combines multiple DNS exfiltration signals (entropy, label length, subdomain uniqueness, query volume) into a composite risk score specifically for Zeek dns.log."],"familyIds":["data-exfiltration-detection"]},{"id":"detecting-fileless-attacks-on-endpoints","summary":"Playbook for detecting fileless malware on Windows endpoints by enabling and querying telemetry from Sysmon, AMSI, and PowerShell logging. Covers PowerShell attacks, reflective DLL injection, process hollowing, WMI persistence, and registry-based execution with concrete detection queries.","primaryDomain":"windows-security","domainTags":["fileless-malware","powershell-attacks","wmi-persistence","in-memory-execution"],"capabilityTags":["detection-engineering","threat-hunting","telemetry-configuration","attack-detection"],"capabilityDetails":["Provides detection workflows for fileless malware operating in memory, including PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-based execution."],"techniqueTags":["reflective-dll-injection","process-hollowing","apc-injection","encoded-powershell","wmi-event-subscription","registry-run-key"],"techniqueDetails":["Detects encoded PowerShell command execution, download cradles, AMSI bypass attempts, reflective DLL loading, process hollowing, APC injection, WMI event subscriptions, and registry-resident payloads."],"tools":["Sysmon","AMSI","PowerShell Logging","Microsoft Defender for Endpoint","Volatility 3"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses specifically on detecting fileless/in-memory attacks using Windows telemetry (Sysmon, AMSI, PowerShell logging) rather than on exploitation or file-based malware analysis, and includes concrete detection queries for Sysmon, Splunk, KQL, and PowerShell."],"familyIds":["fileless-and-evasion-detection"]},{"id":"detecting-fileless-malware-techniques","summary":"Provides a step-by-step Windows forensics and detection playbook for identifying and analyzing fileless malware that relies on LOLBins, WMI event subscriptions, registry-resident payloads, and reflective in-memory loading, including memory dump analysis and Sigma rule generation.","primaryDomain":"windows-security","domainTags":["fileless-malware","lolbins","wmi-persistence","memory-analysis","windows-forensics"],"capabilityTags":["fileless-malware-detection","lolbin-abuse-analysis","wmi-persistence-hunting","memory-forensics","registry-payload-hunting","sigma-rule-development"],"capabilityDetails":["Provides a workflow for detecting fileless malware that operates entirely in memory via LOLBins, WMI, registry-resident payloads, and reflective loading.","Includes memory forensics with Volatility to identify injected code and in-memory .NET assemblies.","Guides creation of Sigma detection rules for process creation and WMI events.","Includes a structured report template for documenting the fileless attack chain."],"techniqueTags":["lolbin-abuse","wmi-event-subscription","registry-encoded-payloads","reflective-loading","memory-yara-scanning","powershell-script-block-logging"],"techniqueDetails":["Uses Sysmon Event IDs 19/20/21 to detect WMI event subscription creation.","Checks for common abusable LOLBins like mshta, regsvr32, certutil, and wmic with suspicious command-line arguments.","Scans registry for large Base64-encoded values and PowerShell keywords.","Uses Volatility malfind and yarascan to find injected code and .NET assemblies in memory.","Leverages PowerShell Script Block Logging (Event ID 4104) for deobfuscated script content."],"tools":["sysmon","volatility3","procmon","autoruns","wmic","wevtutil","python3","yara"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Focuses exclusively on fileless malware detection rather than disk-resident malware.","Provides concrete Sigma rules and Sysmon event IDs for WMI and LOLBin detection.","Integrates memory forensics with Volatility and YARA rules for in-memory-only payloads.","Includes a report generation template specifically for documenting fileless attack chains."],"familyIds":["fileless-and-evasion-detection"]},{"id":"detecting-golden-ticket-attacks-in-kerberos-logs","summary":"Provides detection queries and a hunting workflow for identifying Golden Ticket forgery in Active Directory by analyzing Kerberos authentication events (4768/4769/4771) for encryption mismatches, impossible lifetimes, TGS-without-TGT, and PAC validation failures, using Splunk and KQL.","primaryDomain":"active-directory","domainTags":["active-directory","kerberos","threat-hunting","log-analysis"],"capabilityTags":["golden-ticket-detection","kerberos-log-anomaly-detection"],"capabilityDetails":["Provides a workflow and Splunk/KQL queries for detecting forged Kerberos Golden Tickets via security event log anomalies."],"techniqueTags":["encryption-type-mismatch","ticket-lifetime-check","tgs-without-tgt","pac-signature-validation","krbtgt-reset-tracking"],"techniqueDetails":["Uses patterns such as RC4 encryption in AES-only environments, TGT lifetimes exceeding policy, service tickets without preceding AS-REQ, and PAC validation errors."],"tools":["splunk"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Exclusively targets Golden Ticket persistence in Kerberos logs with query-ready detections, differing from broader Kerberos attack detection playbooks."],"familyIds":["kerberos-attack-detection"]},{"id":"detecting-golden-ticket-forgery","summary":"Provides a structured detection workflow for identifying Kerberos Golden Ticket forgery in Active Directory by analyzing Windows Event IDs 4768/4769 for RC4 downgrades, orphaned TGS requests, abnormal ticket lifetimes, and krbtgt password age anomalies, using Splunk and Elastic SIEM queries.","primaryDomain":"active-directory","domainTags":["kerberos","windows-security","threat-detection"],"capabilityTags":["golden-ticket-detection","kerberos-ticket-analysis","siem-query-development"],"capabilityDetails":["Provides a workflow for detecting Kerberos Golden Ticket forgery by analyzing Windows Event IDs 4768 and 4769 for RC4 encryption downgrades, abnormal ticket lifetimes, and krbtgt account anomalies using Splunk and Elastic SIEM queries."],"techniqueTags":["rc4-downgrade-detection","ticket-lifetime-analysis","event-correlation","krbtgt-anomaly-detection"],"techniqueDetails":["Uses Event ID 4769 to identify RC4 (0x17) TGS requests in environments enforcing AES, correlates orphaned TGS requests without corresponding TGT requests (Event ID 4768), alerts on ticket lifetimes exceeding domain policy, and monitors krbtgt password age anomalies."],"tools":["splunk","elastic-siem","python"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses specifically on Kerberos Golden Ticket forgery detection using multiple correlated signals from Windows Event IDs, rather than general AD compromise detection.","Provides concrete SIEM query workflows for Splunk and Elastic, and includes offline Python-based event log analysis."],"familyIds":["kerberos-attack-detection"]},{"id":"detecting-indirect-prompt-injection","summary":"Detects indirect prompt injection in web pages, PDFs, and images ingested by LLM agents by extracting hidden text, normalizing obfuscated content, scanning with LLM Guard and Prompt Guard 2, and enforcing a block/allow decision with SIEM telemetry.","primaryDomain":"injection","domainTags":["ai-security","prompt-injection","llm-security","agent-security"],"capabilityTags":["indirect-prompt-injection-detection","content-sanitization","obfuscation-normalization","llm-input-guard"],"capabilityDetails":["Provides a detection pipeline for indirect prompt injection in external content (web pages, PDFs, images) consumed by LLM agents.","Extracts hidden text via HTML parsing, PDF text extraction, and OCR; normalizes obfuscations; scans with LLM Guard and dedicated classifier models.","Emits block/sanitize/allow decisions and structured SIEM telemetry mapped to MITRE ATLAS."],"techniqueTags":["hidden-text-extraction","unicode-normalization","base64-decoding","rot13-decoding","ocr-extraction","transformer-classification"],"techniqueDetails":["Uses BeautifulSoup to collect HTML comments, CSS-hidden elements, and image alt-text.","Strips zero-width and Unicode tag characters, applies NFKC normalization, decodes Base64 and ROT13.","Runs OCR with pytesseract on images to extract pixel-rendered text.","Employs LLM Guard's PromptInjection scanner and optionally Meta Prompt Guard 2 or ProtectAI deberta-v3 classifier for binary injection scoring."],"tools":["llm-guard","prompt-guard-2","deberta-v3","beautifulsoup4","pytesseract","pypdf","transformers","pillow"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Specializes in indirect prompt injection (AML.T0051.001) rather than direct user-prompt injection, focusing on trusted-looking data channels.","Combines heuristic content extraction and de-obfuscation with transformer-based detector models for a multi-signal decision.","Includes multimodal coverage via OCR and metadata extraction, and maps findings to ATLAS and OWASP LLM01:2025."],"familyIds":["llm-prompt-injection-detection"]},{"id":"detecting-insider-data-exfiltration-via-dlp","summary":"Practical workflow and pandas-based analytics to detect insider data exfiltration using DLP events, baseline upload volumes, and off-hours activity.","primaryDomain":"forensics","domainTags":["insider-threat","data-loss-prevention","security-operations"],"capabilityTags":["exfiltration-detection","behavioral-analytics","anomaly-detection","dlp-analysis"],"capabilityDetails":["Provides a workflow for analyzing endpoint activity logs, cloud storage access, and email DLP events to detect insider data exfiltration using behavioral baselines and statistical anomaly detection."],"techniqueTags":["statistical-baselining","volume-thresholding","off-hours-analysis","user-behavior-profiling"],"techniqueDetails":["Uses historical daily upload volume per user to compute baselines and flags values exceeding 3x the average.","Detects off-hours file access and other patterns indicative of insider threat."],"tools":["pandas"],"targetTypes":["windows-host","linux-host","cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Specialized in insider threat exfiltration detection through DLP and behavioral analytics, using concrete pandas baselines and off-hours heuristics rather than generic network traffic analysis."],"familyIds":["insider-data-exfiltration-detection"]},{"id":"detecting-insider-threat-behaviors","summary":"A pragmatic hunt playbook for detecting insider threat behavioral indicators, including unusual data access, off-hours activity, mass downloads, and resignation-correlated theft, using EDR/SIEM telemetry and a structured output format.","primaryDomain":"security-knowledge","domainTags":["insider-threat","threat-hunting","behavioral-analysis","data-exfiltration","ueba"],"capabilityTags":["insider-threat-detection","user-behavior-analytics","data-theft-detection","log-analysis","hunt-workflow"],"capabilityDetails":["Provides a structured workflow for proactive detection of insider threat behavioral indicators using EDR and SIEM telemetry."],"techniqueTags":["valid-accounts","cloud-data-exfiltration","exfiltration-over-web-service","bulk-file-download","off-hours-access"],"techniqueDetails":["Examines T1078 Valid Accounts, T1530 Data from Cloud Storage Object, T1567 Exfiltration Over Web Service, plus off-hours and privilege abuse indicators."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Splunk","Elastic Security","Sysmon","Velociraptor","Sigma Rules"],"targetTypes":["windows-host","cloud","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Focuses specifically on insider threat behaviors and resignation-correlated data theft rather than external attack detection."],"familyIds":["threat-hunting"]},{"id":"detecting-insider-threat-with-ueba","summary":"Builds a UEBA pipeline with Elasticsearch to detect insider threats by creating behavioral baselines, computing anomaly scores via statistical deviation and peer groups, and correlating indicators into actionable alerts.","primaryDomain":"security-knowledge","domainTags":["ueba","insider-threat","anomaly-detection","behavior-analytics"],"capabilityTags":["behavioral-baselining","anomaly-scoring","peer-group-analysis","insider-threat-alerting"],"capabilityDetails":["Provides a workflow for building UEBA pipelines using Elasticsearch/OpenSearch to model normal user behavior and detect insider threats."],"techniqueTags":["z-score-deviation","peer-group-comparison","composite-risk-scoring"],"techniqueDetails":["Uses statistical deviation from baselines and peer group comparison to flag anomalous activity; combines multiple low-confidence indicators into composite risk scores."],"tools":["elasticsearch","opensearch","python"],"targetTypes":["active-directory","network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses on constructing a persistent UEBA pipeline rather than a one-off manual hunt, with explicit steps for baseline building, anomaly scoring, and alert correlation."],"familyIds":["behavioral-anomaly-detection"]},{"id":"detecting-kerberoasting-attacks","summary":"A threat-hunting playbook for detecting Kerberoasting attacks by analyzing Kerberos TGS requests targeting SPN-enabled service accounts, using SIEM/EDR telemetry and MITRE ATT&CK correlation.","primaryDomain":"active-directory","domainTags":["kerberos-authentication","threat-hunting","windows-event-logs"],"capabilityTags":["kerberoasting-detection","tgs-request-monitoring","siem-hunting"],"capabilityDetails":["Provides a structured threat-hunting workflow to detect Kerberoasting by monitoring anomalous Kerberos TGS requests (Event ID 4769) targeting service accounts with SPNs."],"techniqueTags":["kerberoasting","as-rep-roasting"],"techniqueDetails":["Focuses on T1558.003 Kerberoasting and also references T1558.004 AS-REP Roasting and T1558.001 Golden Ticket."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Splunk","Elastic Security","Sysmon","Velociraptor","Sigma Rules"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Specialized in detecting Kerberoasting via TGS request telemetry, not general credential access hunting.","Includes a hypothesis-driven hunt process with output format for consistent reporting and integration with MITRE ATT&CK and D3FEND."],"familyIds":["kerberos-attack-detection"]},{"id":"detecting-lateral-movement-in-network","summary":"Operational playbook for detecting lateral movement in enterprise networks by correlating Windows Event Logs, Zeek network flows, and SIEM rules, with detection tuning, threat hunting, automated containment, and investigation reporting.","primaryDomain":"network-security","domainTags":["lateral-movement","network-monitoring","threat-detection","siem"],"capabilityTags":["lateral-movement-detection","siem-rule-development","network-traffic-analysis","threat-hunting","automated-response"],"capabilityDetails":["Provides a step-by-step operational workflow for detecting lateral movement using Windows Event Logs, Zeek logs, SIEM correlation rules, Sigma rules, and SOAR-style containment."],"techniqueTags":["pass-the-hash","psexec","rdp-lateral-movement","kerberos-anomaly","smb-traffic-analysis"],"techniqueDetails":["Covers detection of pass-the-hash via NTLM Type 3 logons, PsExec via service creation (Event 7045), RDP hopping via Type 10 logons, SMB spreading via connection analysis, and Kerberos anomalies via DCE-RPC and ticket logs."],"tools":["zeek","splunk","elastic","sigma","velociraptor","bloodhound"],"targetTypes":["network","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["End-to-end lateral movement detection playbook integrating Windows Event ID analysis, Zeek network logs, SIEM/Sigma rules, and automated response actions, including a detailed ransomware lateral movement investigation scenario and reporting template."],"familyIds":["lateral-movement-detection"]},{"id":"detecting-lateral-movement-with-splunk","summary":"A specialist threat-hunting playbook that uses Splunk SPL to detect lateral movement across Windows networks, with a structured workflow, Windows event log analysis, MITRE ATT&CK technique mapping, and an output template for reporting findings.","primaryDomain":"windows-security","domainTags":["threat-hunting","lateral-movement","splunk","siem","mitre-attack"],"capabilityTags":["lateral-movement-detection","authentication-log-analysis","splunk-query-development","threat-hunting","incident-response"],"capabilityDetails":["Provides a structured workflow to hunt for and detect lateral movement across Windows networks using Splunk SPL queries, leveraging Windows security event logs and Sysmon telemetry."],"techniqueTags":["remote-services","rdp","smb","winrm","wmi","psexec","pass-the-hash"],"techniqueDetails":["Covers lateral movement techniques including RDP (T1021.001), SMB/Admin Shares (T1021.002), DCOM (T1021.003), SSH (T1021.004), WinRM (T1021.006), WMI (T1047), PsExec (T1569.002), and lateral tool transfer (T1570)."],"tools":["Splunk Enterprise","Splunk Enterprise Security","Windows Event Forwarding","Sysmon","BloodHound","PingCastle"],"targetTypes":["windows-host","active-directory","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Combines Splunk-specific SPL hunting with explicit Windows Event IDs (4624, 4648, etc.) and MITRE ATT&CK mapping","Covers multiple lateral movement techniques (RDP, SMB, WMI, PsExec, WinRM, Pass-the-Hash) in a single structured playbook","Includes a hunt output format for documenting lateral movement path and risk"],"familyIds":["windows-event-log-siem-hunting"]},{"id":"detecting-lateral-movement-with-zeek","summary":"Analyzes Zeek network logs to detect lateral movement indicators such as SMB admin share access, DCE/RPC remote service execution, and NTLM account spray; provides Zeek scripts, zeek-cut commands, and an automated Python agent for log analysis.","primaryDomain":"network-security","domainTags":["zeek","lateral-movement","smb","dce-rpc","ntlm-spray","network-forensics"],"capabilityTags":["lateral-movement-detection","zeek-log-analysis","network-traffic-analysis","smb-analysis","dce-rpc-analysis"],"capabilityDetails":["Provides a workflow for detecting lateral movement in network traffic by analyzing Zeek logs for SMB admin share access, DCE/RPC remote service execution, NTLM account spray, and anomalous internal connections."],"techniqueTags":["zeek-log-parsing","smb-admin-share-analysis","dce-rpc-operation-monitoring","ntlm-spray-threshold-detection"],"techniqueDetails":["Uses Zeek log fields and custom Zeek scripts to identify admin share access, DCE/RPC service operations, and NTLM authentication spikes."],"tools":["zeek","zeek-cut","python3","agent.py"],"targetTypes":["network","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Combines multiple Zeek log sources (conn, SMB, DCE/RPC, NTLM, Kerberos) specifically to detect lateral movement, including deployable Zeek scripts and an automated Python agent, while noting the limitation of network-only visibility and need to cross-reference with endpoint telemetry."],"familyIds":["lateral-movement-detection"]},{"id":"detecting-living-off-the-land-attacks","summary":"Provides a detection engineering playbook for identifying living-off-the-land attacks on Windows hosts, including Sysmon configuration, Sigma rule authoring, log analysis in Python, parent-child anomaly detection, and AppLocker/WDAC mitigation guidance.","primaryDomain":"windows-security","domainTags":["windows-security","living-off-the-land","lolbins","threat-detection"],"capabilityTags":["lolbin-detection","sysmon-log-analysis","sigma-rule-authoring","process-tree-analysis","applocker-hardening"],"capabilityDetails":["Provides a workflow for detecting abuse of legitimate Windows binaries (LOLBins) using Sysmon configurations, Sigma rules, and Python log analysis.","Includes guidance on building detection rules for certutil, mshta, rundll32, regsvr32, and other binaries.","Covers network connection correlation and anomalous parent-child process relationship detection.","Includes AppLocker/WDAC hardening recommendations to restrict dangerous LOLBin usage."],"techniqueTags":["fileless-attack-detection","process-monitoring","command-line-analysis","parent-child-anomaly-detection","network-connection-correlation"],"techniqueDetails":["Monitors process creation and command-line arguments for suspicious LOLBin execution patterns.","Correlates Sysmon network events with LOLBin processes to detect outbound connections.","Identifies suspicious parent-child relationships such as Office applications spawning LOLBins.","Uses Sigma rules to create SIEM-queryable detection logic."],"tools":["sysmon","sigma","python","applocker","wdac"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on detecting living-off-the-land abuse of legitimate Windows binaries rather than general malware detection.","Provides concrete Sysmon configurations, Sigma rules, and Python analyzers tailored to LOLBin detection.","Includes both detection engineering and mitigation hardening (AppLocker/WDAC) in a single workflow."],"familyIds":["living-off-the-land-detection"]},{"id":"detecting-living-off-the-land-with-lolbas","summary":"Detects abuse of Windows built-in binaries (LOLBins) by analyzing Sysmon process telemetry and Windows event logs with Sigma rules, focusing on parent-child process anomalies and suspicious command-line arguments to uncover living-off-the-land attacks.","primaryDomain":"windows-security","domainTags":["lolbas","endpoint-detection","threat-hunting","sigma-rules"],"capabilityTags":["lolbas-detection","sigma-rule-development","process-telemetry-analysis","parent-child-process-analysis"],"capabilityDetails":["Provides a structured procedure for detecting abuse of Windows built-in binaries (LOLBins) using Sysmon process telemetry and Sigma rules, including parent-child process anomaly analysis and alert prioritization."],"techniqueTags":["living-off-the-land","process-tree-analysis","command-line-argument-analysis","sigma-based-detection"],"techniqueDetails":["Uses Sysmon Event ID 1 and Windows 4688 command-line data, Sigma rule matching for suspicious arguments and network activity, and parent-child process relationships to identify LOLBin abuse."],"tools":["sysmon","sigma","sigmac","pySigma"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on Living Off the Land Binaries (LOLBins) abuse detection, covering a curated set of binaries (certutil, mshta, regsvr32, rundll32, msbuild, etc.) rather than general malware detection.","Combines Sysmon process telemetry with Sigma rule matching and parent-child process anomaly analysis for threat hunting."],"familyIds":["living-off-the-land-detection"]},{"id":"detecting-malicious-npm-packages","summary":"Provides a defensive triage workflow to detect malicious npm packages and lockfile-pinned malicious dependencies using GuardDog heuristic scanning, manual install-script review, OSV cross-checks, and sandboxed dynamic detonation with network/filesystem monitoring.","primaryDomain":"source-code-security","domainTags":["supply-chain-security","npm-security","malware-analysis"],"capabilityTags":["malicious-package-detection","install-script-abuse-detection","credential-exfiltration-detection","lockfile-verification"],"capabilityDetails":["Detects install-script malware, credential exfiltration, obfuscation, and worming behavior in npm packages.","Cross-checks package-lock.json pinned versions against known-malicious advisory lists via OSV-Scanner.","Supports safe dynamic detonation with network and filesystem monitoring in a disposable sandbox."],"techniqueTags":["heuristic-static-analysis","lifecycle-script-review","lockfile-dependency-cross-check","sandboxed-detonation","network-egress-monitoring","ioc-extraction"],"techniqueDetails":["Uses GuardDog's Semgrep-based source heuristics and metadata rules to flag malicious indicators.","Analyzes preinstall/install/postinstall lifecycle scripts and source for obfuscation, child_process execution, and exfiltration URLs.","Compares lockfile package versions against OSV malicious package advisories.","Runs suspect packages in a disposable sandbox with tcpdump egress capture and filesystem baseline diffing."],"tools":["GuardDog","OSV-Scanner","npm","jq","tcpdump","tar","scripts/agent.py"],"targetTypes":["source-code","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Covers the full npm supply-chain triage workflow from static GuardDog scanning to sandboxed dynamic detonation, including lockfile cross-checking against known-malicious versions and worming-behavior detection."],"familyIds":["package-registry-supply-chain-risk-screening"]},{"id":"detecting-malicious-scheduled-tasks-with-sysmon","summary":"A specialist playbook for using Sysmon and Windows Security events to detect malicious scheduled task creation, focusing on persistence and lateral movement via schtasks.exe, encoded commands, and remote task creation.","primaryDomain":"windows-security","domainTags":["sysmon","scheduled-tasks","persistence","threat-hunting","windows-event-log"],"capabilityTags":["detection-rule-development","event-correlation","threat-hunting","lateral-movement-detection"],"capabilityDetails":["Provides a structured workflow for detecting malicious scheduled task creation and modification using Sysmon Event IDs 1 and 11 correlated with Windows Security Event 4698/4702."],"techniqueTags":["scheduled-task-persistence","lateral-movement","encoded-command-execution","remote-task-creation"],"techniqueDetails":["Uses Sysmon process creation (Event 1) and file creation (Event 11) along with Security 4698/4702 to identify persistence via schtasks.exe and remote task creation."],"tools":["sysmon","windows-event-log"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses specifically on correlating Sysmon Event IDs 1 and 11 with Windows Security Event 4698/4702 for scheduled task persistence and lateral movement, emphasizing encoded command arguments and remote creation."],"familyIds":["windows-persistence-detection-and-hunting"]},{"id":"detecting-mimikatz-execution-patterns","summary":"A threat-hunting playbook for detecting Mimikatz credential-dumping activity via command-line, LSASS access, binary/hash, and in-memory indicators across EDR and SIEM platforms, aligned to MITRE ATT&CK techniques.","primaryDomain":"windows-security","domainTags":["credential-dumping","threat-hunting","active-directory","mitre-attack"],"capabilityTags":["mimikatz-detection","credential-dumping-detection","edr-querying","siem-correlation","threat-hunting"],"capabilityDetails":["Provides a workflow for detecting Mimikatz execution patterns using command-line pattern matching, LSASS access signatures, binary/hash indicators, and in-memory module detection across EDR and SIEM platforms."],"techniqueTags":["credential-dumping","lsass-memory","dcsync","golden-ticket","kerberoasting"],"techniqueDetails":["Detects T1003.001 LSASS memory access, T1003.006 DCSync, T1558.001 golden ticket, and T1558.003 Kerberoasting via telemetry signatures and log analysis."],"tools":["crowdstrike-falcon","microsoft-defender-for-endpoint","splunk","elastic","sysmon","velociraptor","sigma-rules"],"targetTypes":["windows-host","active-directory"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Focuses specifically on detecting Mimikatz execution rather than general credential dumping, combining multiple detection signals (command-line, LSASS access, binary/hash, in-memory) and including concrete scenarios like DCSync and golden ticket creation with a structured hunt output format."],"familyIds":["credential-access-and-dumping"]},{"id":"detecting-misconfigured-azure-storage","summary":"Audit Azure Storage accounts for public blob access, missing encryption, overly permissive SAS tokens, disabled logging, and open network access using Azure CLI, Resource Graph, and Defender for Storage.","primaryDomain":"cloud-security","domainTags":["azure","storage-security","blob-storage","sas-tokens","data-protection"],"capabilityTags":["azure-storage-audit","public-blob-detection","encryption-key-review","shared-access-signature-audit","diagnostic-logging-check"],"capabilityDetails":["Provides a step-by-step workflow to audit Azure Storage accounts for public blob containers, missing infrastructure encryption, overly permissive SAS tokens and stored access policies, disabled logging/monitoring, and network access vulnerabilities, with remediation guidance."],"techniqueTags":["configuration-review","cross-subscription-enumeration","anonymous-access-testing","sas-token-analysis","network-acl-analysis","tls-version-check"],"techniqueDetails":["Uses Azure CLI and Resource Graph queries to enumerate storage accounts, then reviews public access flags, container ACLs, network default actions, encryption key sources, SAS policies, and diagnostic settings."],"tools":["azure-cli","azure-resource-graph","azure-powershell","microsoft-defender-for-storage","prowler","scoutsuite"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","reporting","remediation"],"distinctiveFeatures":["Azure-focused storage security audit covering public blob access, network ACLs, encryption key management, SAS token governance, and logging—distinct from general cloud security skills by its exclusive Azure Storage scope and use of Azure CLI/Resource Graph cross-subscription queries."],"familyIds":["azure-storage-security-audit"]},{"id":"detecting-mobile-malware-behavior","summary":"A practical playbook that guides analysts through static and dynamic analysis of suspicious mobile apps to detect malware behaviors such as SMS interception, C2 communication, and dynamic code loading, culminating in malware type classification.","primaryDomain":"mobile-security","domainTags":["android","ios","malware-analysis"],"capabilityTags":["behavioral-analysis","permission-abuse-detection","network-traffic-monitoring","runtime-monitoring"],"capabilityDetails":["Provides a comprehensive workflow for triaging suspicious mobile apps, including static indicator analysis, automated MobSF scanning, network traffic capture, and Frida-based runtime hooking to identify malicious behaviors."],"techniqueTags":["sms-interception","c2-detection","dynamic-code-loading","overlay-attack"],"techniqueDetails":["Uses permission combinations to flag high-risk behaviors, monitors network traffic for beaconing and C2 patterns, and leverages Frida hooks to observe SMS, file I/O, network, and code-loading activities."],"tools":["MobSF","VirusTotal","Frida","Wireshark","tcpdump","mitmproxy","CuckooDroid"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Integrates static permission analysis, automated MobSF scanning, network traffic tracing, and Frida runtime instrumentation into a single mobile malware triage and classification workflow."],"familyIds":["mobile-malware-analysis"]},{"id":"detecting-modbus-command-injection-attacks","summary":"Provides a workflow to detect Modbus command injection in ICS/SCADA networks by monitoring unauthorized writes, anomalous function codes, malformed frames, and baseline deviations using a Python/Scapy detector and Suricata rules.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","modbus","scada","protocol-security"],"capabilityTags":["modbus-command-injection-detection","protocol-anomaly-detection","unauthorized-write-detection","ot-threat-detection"],"capabilityDetails":["Provides a Python/Scapy-based detector for live and offline Modbus TCP traffic analysis.","Includes Suricata rules for detecting unauthorized writes, broadcast writes, write floods, and diagnostic commands.","Defines a baseline-driven detection methodology for Modbus masters, function codes, register ranges, and polling intervals."],"techniqueTags":["baseline-monitoring","function-code-analysis","packet-inspection","behavioral-anomaly-detection","suricata-signature-development"],"techniqueDetails":["Uses a baseline of authorized Modbus masters, write sources, function codes, and register ranges to identify deviations.","Analyzes Modbus MBAP headers and PDUs for suspicious function codes and write operations.","Employs threshold-based detection for write floods and diagnostic command abuse.","Leverages Scapy for packet parsing and Suricata for signature-based detection."],"tools":["scapy","suricata"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses exclusively on Modbus TCP command injection in OT/ICS environments, distinguishing it from generic network IDS playbooks.","Provides both a custom Python/Scapy detector and ready-to-use Suricata rules, enabling both research and operational deployment.","Includes FrostyGoop-specific detection patterns and response guidance for unauthorized PLC register changes."],"familyIds":["ot-ics-attack-detection-and-monitoring"]},{"id":"detecting-modbus-protocol-anomalies","summary":"Provides a complete Python-based workflow for detecting anomalies in Modbus/TCP traffic in OT environments, including function code allowlisting, write detection, timing baseline deviations, protocol violations, and broadcast write alerts.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","modbus"],"capabilityTags":["modbus-anomaly-detection","ot-ids","function-code-allowlisting","baseline-modeling"],"capabilityDetails":["Provides a complete Python framework for detecting anomalies in Modbus/TCP industrial traffic using rule-based and statistical detection methods."],"techniqueTags":["function-code-monitoring","z-score-timing-analysis","mbap-header-validation","broadcast-write-detection","authorized-client-filtering"],"techniqueDetails":["Checks source IP against authorized clients, validates function codes per session allowlists, flags write operations, uses z-score to detect timing deviations from baselined polling intervals, and inspects protocol ID and unit ID for violations."],"tools":["scapy","zeek","suricata","wireshark","pymodbus"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Dedicated to Modbus protocol anomaly detection in OT/ICS environments, including a complete Python implementation with specific detection rules for unauthorized clients, function code allowlists, write operations, timing outliers, protocol violations, and broadcast writes."],"familyIds":["ot-ics-attack-detection-and-monitoring"]},{"id":"detecting-model-extraction-attacks","summary":"Detect and defend against model extraction attacks (MITRE ATLAS AML.T0024) on inference APIs through per-principal query monitoring, ART-based red-teaming, and output perturbation/rate-limiting controls.","primaryDomain":"api-security","domainTags":["ai-security","model-security","inference-api","mitre-atlas"],"capabilityTags":["model-extraction-detection","membership-inference-testing","model-inversion-detection","inference-api-monitoring","ai-red-teaming"],"capabilityDetails":["Provides a workflow to instrument inference APIs, monitor per-principal query behavior, run ART-based red-team attacks, measure extractability, and validate defenses."],"techniqueTags":["query-pattern-analysis","rate-limiting","output-perturbation","surrogate-model-extraction","membership-inference-attack","knockoff-nets"],"techniqueDetails":["Uses query volume, unique-input ratio, and confidence-vector requests to identify extraction-like patterns.","Applies rate limiting and confidence perturbation to reduce information leakage.","Employs ART KnockoffNets to measure surrogate model fidelity and MembershipInferenceBlackBox to quantify training-data leakage."],"tools":["adversarial-robustness-toolbox","scikit-learn","numpy"],"targetTypes":["api"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on AI model extraction/inversion/membership inference via inference API abuse, rather than generic API vulnerabilities.","Combines defensive monitoring with offensive red-teaming using ART to quantify extraction risk and validate controls."],"familyIds":["api-attack-detection-and-log-analysis"]},{"id":"detecting-network-anomalies-with-zeek","summary":"Operational playbook for deploying Zeek as a passive network security monitor, generating structured protocol logs, writing custom scripts to detect DNS tunneling and beaconing, and performing threat hunting analysis on Zeek logs.","primaryDomain":"network-security","domainTags":["zeek","network-monitoring","anomaly-detection","passive-analysis"],"capabilityTags":["zeek-deployment","custom-zeek-scripting","log-analysis","threat-hunting","beacon-detection","dns-tunneling-detection"],"capabilityDetails":["Provides a complete workflow for deploying Zeek for passive network monitoring, generating protocol metadata logs, writing custom detection scripts for anomalies, and performing threat hunting on Zeek logs."],"techniqueTags":["passive-traffic-analysis","protocol-log-analysis","threshold-based-detection","statistical-anomaly-detection","policy-violation-detection"],"techniqueDetails":["Uses Zeek's event-driven scripting to process network events and generate structured logs.","Leverages SumStats for threshold-based statistical anomaly detection such as beaconing.","Utilizes zeek-cut for targeted log extraction and analysis.","Custom Zeek scripts detect DNS tunneling via long queries or high query counts and beaconing via connection frequency."],"tools":["zeek","zeek-cut","zeekctl","rita","filebeat"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses on passive protocol metadata analysis and custom Zeek scripting for anomaly detection, rather than inline IDS/IPS or signature-based detection.","Provides concrete Zeek script examples for DNS tunneling and beaconing detection with threshold tuning."],"familyIds":["network-traffic-analysis-and-detection"]},{"id":"detecting-network-scanning-with-ids-signatures","summary":"Practical playbook for detecting network scanning with Suricata/Snort IDS signatures, including rule deployment, threshold tuning, EVE JSON alert analysis, and response guidance.","primaryDomain":"network-security","domainTags":["network-security","intrusion-detection","port-scanning","reconnaissance","signature-detection"],"capabilityTags":["network-scanning-detection","ids-signature-authoring","threshold-based-detection","scan-alert-correlation"],"capabilityDetails":["Provides a structured workflow for authoring Suricata/Snort signatures and threshold rules to detect network scanning activities, analyzing EVE JSON alert logs, and responding to scanning campaigns."],"techniqueTags":["signature-based-detection","threshold-based-detection","traffic-anomaly-analysis","eve-json-analysis"],"techniqueDetails":["Uses IDS signatures matching known scanner packet patterns, threshold counters for connection attempts, and Python analysis of Suricata EVE JSON logs to identify scanning campaigns."],"tools":["suricata","snort","python"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on detecting network reconnaissance scanning via IDS signatures rather than performing or exploiting scans.","Includes ready-to-deploy Suricata rule sets for Nmap, Masscan, FIN, NULL, Xmas, ACK, and UDP scan type detection with threshold tuning.","Adds a Python EVE JSON correlation engine to classify scan sources by severity and internal/external status."],"familyIds":["network-scanning-detection"]},{"id":"detecting-ntlm-relay-with-event-correlation","summary":"A defensive detection playbook for NTLM relay attacks in Active Directory, using Windows Event 4624 LogonType 3 correlation, IP-to-hostname mismatch detection, Responder artifact identification, SMB/LDAP signing audits, and NTLM downgrade detection through SIEM queries and PowerShell scripts.","primaryDomain":"active-directory","domainTags":["active-directory","windows-security","network-security","threat-hunting"],"capabilityTags":["ntlm-relay-detection","event-correlation","siem-query-development","ad-security-auditing","responder-detection","ntlm-downgrade-detection","coercion-attack-hunting"],"capabilityDetails":["Provides a workflow for detecting NTLM relay attacks in Active Directory by correlating Windows Event 4624 LogonType 3 entries with IP-to-hostname mismatches.","Includes detection of Responder/LLMNR/NBT-NS poisoning artifacts via network and firewall log analysis.","Audits SMB signing and LDAP signing enforcement to assess relay exposure.","Detects NTLM downgrade from NTLMv2 to NTLMv1 and identifies coercion-related authentication anomalies."],"techniqueTags":["event-4624-analysis","ip-hostname-mismatch-correlation","llmnr-nbns-poisoning-detection","smb-signing-audit","ldap-signing-audit","ntlmv1-downgrade-detection","petitpotam-coercion-detection"],"techniqueDetails":["Uses LogonType 3 event data to flag NTLM authentications where the source IP does not match the expected workstation hostname.","Detects Responder activity by analyzing LLMNR (UDP 5355) and NBT-NS (UDP 137) traffic patterns and non-DNS responders.","Audits SMB signing configuration locally, domain-wide, and via Zeek SMB logging to find hosts vulnerable to relay.","Checks LDAP signing and channel binding on domain controllers to identify relay-to-LDAP exposure.","Detects NTLMv1 use and NTLM downgrade patterns, including LmCompatibilityLevel policy assessment.","Hunts for PetitPotam/DFSCoerce-style coercion by analyzing machine account NTLM authentications from unexpected IPs."],"tools":["splunk","microsoft-sentinel","powershell","sigma","zeek"],"targetTypes":["active-directory","windows-host","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on defensive detection of NTLM relay attacks through event correlation rather than offensive relay execution.","Provides ready-to-use SIEM queries in Splunk SPL and KQL for relay, Responder, downgrade, and coercion detection.","Includes PowerShell audit scripts for SMB/LDAP signing enforcement and NTLM policy assessment.","Covers both direct relay signals and precursor artifacts like LLMNR poisoning and machine account coercion anomalies."],"familyIds":["ntlm-authentication-abuse-detection"]},{"id":"detecting-oauth-token-theft","summary":"Operational playbook for detecting and responding to OAuth token theft and replay in Microsoft Entra ID, covering sign-in log analysis, conditional access defenses, Token Protection, CAE, and incident response actions.","primaryDomain":"cloud-security","domainTags":["oauth","azure-ad","identity-security","conditional-access","token-theft"],"capabilityTags":["oauth-token-theft-detection","token-replay-investigation","sign-in-log-analysis","conditional-access-configuration","token-revocation-response"],"capabilityDetails":["Provides a step-by-step workflow to detect and respond to OAuth token theft and replay in Microsoft Entra ID.","Covers Identity Protection risk detections and KQL queries for sign-in log and token replay analysis.","Includes response procedures for revoking refresh tokens, resetting passwords, and reviewing OAuth consent grants.","Describes configuration of Token Protection, Continuous Access Evaluation, and Defender for Cloud Apps session policies."],"techniqueTags":["token-replay-detection","primary-refresh-token-abuse","pass-the-cookie","device-code-phishing","aitm-phishing","continuous-access-evaluation","token-binding"],"techniqueDetails":["Detects anomalous token usage using Entra ID Identity Protection risk detections.","Uses KQL queries over sign-in logs to identify token reuse from multiple IPs or impossible travel.","Identifies Primary Refresh Token extraction and pass-the-cookie session hijacking scenarios.","Mitigates replay with Token Protection proof-of-possession device binding and CAE immediate revocation."],"tools":["Microsoft Entra admin center","Microsoft Graph PowerShell","Microsoft Sentinel","Microsoft Defender for Cloud Apps","KQL"],"targetTypes":["cloud","api"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on OAuth token theft and replay in Microsoft Entra ID, including PRT abuse and pass-the-cookie attacks.","Combines detection, defense configuration, and incident response for Azure/M365 identity security.","Includes Token Protection, CAE, and device-code phishing coverage not found in generic OAuth security guides."],"familyIds":["azure-identity-and-entra-threat-detection"]},{"id":"detecting-pass-the-hash-attacks","summary":"Operational threat hunting playbook for detecting pass-the-hash attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos is expected, and correlating with credential-dumping indicators, applicable to EDR/SIEM triage and purple team testing.","primaryDomain":"active-directory","domainTags":["windows-security","authentication","credential-access"],"capabilityTags":["pass-the-hash-detection","ntlm-logon-analysis","credential-dumping-correlation","lateral-movement-hunting"],"capabilityDetails":["Provides a workflow for detecting pass-the-hash attacks via NTLM authentication pattern analysis and correlation with credential dumping indicators."],"techniqueTags":["pass-the-hash","ntlm-authentication","kerberos-comparison","credential-dumping"],"techniqueDetails":["Flags NTLM Type 3 logons where Kerberos would be expected, correlating with credential dumping processes."],"tools":["crowdstrike-falcon","microsoft-defender-for-endpoint","splunk","elastic-security","sysmon","velociraptor","sigma-rules"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Focuses on detection of pass-the-hash specifically via NTLM Type 3 logon anomalies and credential dumping correlation, rather than generic lateral movement detection.","Provides scenario examples for Mimikatz, Impacket, CrackMapExec, and WMI-based attacks."],"familyIds":["ntlm-authentication-abuse-detection"]},{"id":"detecting-pass-the-ticket-attacks","summary":"Provides a structured detection workflow and SIEM query guidance for identifying Kerberos Pass-the-Ticket attacks by correlating Windows security event logs, with emphasis on ticket reuse and RC4 downgrades.","primaryDomain":"active-directory","domainTags":["active-directory","windows-security","kerberos","threat-detection"],"capabilityTags":["pass-the-ticket-detection","kerberos-ticket-analysis","detection-rule-development","threat-hunting"],"capabilityDetails":["Provides a workflow for detecting Kerberos Pass-the-Ticket attacks by analyzing anomalous Windows Event ID 4768, 4769, and 4771 patterns."],"techniqueTags":["kerberos-ticket-replay","rc4-downgrade","event-id-correlation","anomaly-baselining"],"techniqueDetails":["Uses correlation of event logs to detect ticket reuse across hosts and RC4 encryption downgrades."],"tools":["splunk","elastic","sysmon","python"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Specializes exclusively in Pass-the-Ticket detection via Kerberos event log analysis, including ready-to-use SIEM queries for Splunk and Elastic."],"familyIds":["kerberos-attack-detection"]},{"id":"detecting-port-scanning-with-fail2ban","summary":"A practical workflow for configuring Fail2ban with custom filters and actions to detect port scanning, SSH/HTTP brute force, and network reconnaissance, automatically banning offending IPs and alerting security teams.","primaryDomain":"network-security","domainTags":["network-security","intrusion-prevention","automated-defense"],"capabilityTags":["port-scan-detection","brute-force-detection","ip-banning","fail2ban-configuration","custom-filter-creation"],"capabilityDetails":["Provides a step-by-step workflow to configure Fail2ban with custom jails, filters, and actions for detecting port scans, SSH brute force, and HTTP scanning.","Includes iptables integration to automatically ban offending IPs, escalation via recidive jail, and notification/reporting capabilities."],"techniqueTags":["fail2ban","iptables","log-regex-pattern-matching","nmap-scan-detection","ssh-brute-force-detection","http-scan-detection"],"techniqueDetails":["Uses Fail2ban filter regexes to match scanning and brute-force patterns in system and application logs.","Relies on iptables rules and actions to block banned IPs at the network layer.","Implements escalating ban durations through the recidive jail for repeat offenders.","Validates filters with fail2ban-regex against real log files before deployment."],"tools":["fail2ban","iptables","fail2ban-client","fail2ban-regex","nmap"],"targetTypes":["linux-host","network"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Focuses specifically on using Fail2ban as a host-based intrusion prevention tool for detecting and automatically blocking port scans and brute-force attempts.","Provides custom filter definitions for Nmap SYN scanning, HTTP vulnerability probing, and SSH brute force, along with advanced action definitions and escalation mechanisms."],"familyIds":["network-scanning-detection"]},{"id":"detecting-privilege-escalation-attempts","summary":"A threat-hunting playbook that uses EDR and SIEM data to detect a range of privilege escalation techniques, including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse, with structured output and confidence assessment.","primaryDomain":"security-knowledge","domainTags":["threat-hunting","privilege-escalation","edr-detection","siem-analytics"],"capabilityTags":["privilege-escalation-detection","threat-hunting","edr-analysis","siem-querying"],"capabilityDetails":["Provides a playbook for proactively detecting privilege escalation attempts using endpoint and SIEM telemetry."],"techniqueTags":["access-token-manipulation","uac-bypass","unquoted-service-path","kernel-exploitation","sudo-abuse"],"techniqueDetails":["Covers detection of access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Splunk","Elastic Security","Sysmon","Velociraptor","Sigma Rules"],"targetTypes":["windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses on defensive detection rather than exploitation, with hypothesis-driven hunting across both Windows and Linux environments."],"familyIds":["threat-hunting-on-endpoint-and-network"]},{"id":"detecting-privilege-escalation-in-kubernetes-pods","summary":"Playbook for detecting privilege escalation in Kubernetes pods using Pod Security Admission, OPA Gatekeeper policies, Falco runtime rules, and audit log queries, with investigation commands and hardening best practices.","primaryDomain":"cloud-security","domainTags":["kubernetes-security","container-security","pod-security"],"capabilityTags":["privilege-escalation-detection","admission-control","runtime-monitoring","audit-log-analysis"],"capabilityDetails":["Detects privilege escalation in Kubernetes pods via security context inspection, admission control, runtime monitoring, and audit log analysis.","Provides ready-to-use OPA/Gatekeeper policies, Falco rules, and audit log queries.","Includes an investigation playbook for checking pod security context, effective capabilities, root execution, and hostPath volumes."],"techniqueTags":["pod-security-admission","opa-rego-policy","falco-rules","kubernetes-audit-log","linux-capabilities","security-context"],"techniqueDetails":["Uses Pod Security Admission labels to enforce restricted pod security in namespaces.","Defines OPA Gatekeeper ConstraintTemplate with Rego to block privileged pods and dangerous capabilities.","Provides Falco rules for detecting setuid/setgid execution, capability gains, and writes to /etc/passwd in containers.","Demonstrates querying Kubernetes audit logs via kubectl and jq to find privileged pod creation and RBAC escalation attempts."],"tools":["kubectl","falco","opa-gatekeeper","jq"],"targetTypes":["kubernetes","container"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Combines three detection layers (admission control, runtime Falco, audit logs) rather than a single method.","Includes concrete OPA Rego constraint templates and Falco rule YAML files.","Covers Kubernetes-specific escalation vectors such as hostPID, hostNetwork, SYS_ADMIN, and automountServiceAccountToken."],"familyIds":["container-and-kubernetes-runtime-security"]},{"id":"detecting-process-hollowing-technique","summary":"Provides a detection workflow for process hollowing (T1055.012) using EDR telemetry, memory forensics, and process anomaly analysis, with specific indicators and output format.","primaryDomain":"windows-security","domainTags":["process-injection","threat-hunting","defense-evasion","memory-forensics"],"capabilityTags":["process-hollowing-detection","memory-anomaly-analysis","parent-child-process-analysis","edr-telemetry-analysis"],"capabilityDetails":["Provides a workflow for detecting process hollowing by analyzing memory sections, process anomalies, and parent-child relationships using EDR and memory forensics tools."],"techniqueTags":["process-hollowing","process-injection","memory-manipulation"],"techniqueDetails":["Uses indicators such as CREATE_SUSPENDED process creation, NtUnmapViewOfSection calls, image mismatches, and abnormal parent-child process relationships."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Sysmon","Volatility","pe-sieve","Hollows Hunter","Process Hacker","API Monitor"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on detecting process hollowing (T1055.012) using multiple telemetry sources and memory forensics, providing concrete indicators and a structured output format for hunt findings."],"familyIds":["process-injection-detection"]},{"id":"detecting-process-injection-techniques","summary":"A specialist playbook for detecting and analyzing Windows process injection techniques (DLL injection, hollowing, APC, thread hijacking, reflective loading, doppelganging, AtomBombing) through Volatility memory forensics, Sysmon event analysis, and injected code inspection.","primaryDomain":"windows-security","domainTags":["malware-analysis","memory-forensics","process-injection","defense-evasion"],"capabilityTags":["process-injection-detection","memory-forensics-analysis","edr-detection-tuning","injection-technique-classification"],"capabilityDetails":["Provides a multi-step workflow for detecting and classifying process injection techniques using Volatility memory forensics, Sysmon event analysis, and injected code inspection."],"techniqueTags":["process-hollowing","dll-injection","apc-injection","thread-hijacking","reflective-dll-injection","process-doppelganging","atombombing"],"techniqueDetails":["Details detection artifacts for each injection technique including API call sequences and memory forensics indicators."],"tools":["Volatility","Sysmon","Process Hacker","Process Explorer","API Monitor","x64dbg","pe-sieve"],"targetTypes":["windows-host","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on detecting and classifying multiple Windows process injection techniques using a combination of memory forensics, Sysmon event analysis, and injected code inspection, with step-by-step procedures for each major injection method."],"familyIds":["process-injection-detection"]},{"id":"detecting-qr-code-phishing-with-email-security","summary":"Operational playbook for detecting and mitigating QR code phishing (quishing) by enabling image-based email gateway scanning, decoding and analyzing QR URLs, deploying mobile-side protection, creating detection rules, and training users on quishing recognition.","primaryDomain":"network-security","domainTags":["phishing","email-security","qr-code","quishing","image-analysis","mobile-security"],"capabilityTags":["qr-code-phishing-detection","image-threat-detection","ocr-decoding","url-reputation-scanning","mobile-threat-defense","security-awareness-training","detection-rule-creation"],"capabilityDetails":["Provides a workflow for detecting and preventing QR code phishing (quishing) by configuring email gateway image scanning, decoding QR-embedded URLs, deploying mobile-side protection, building detection rules, and training users."],"techniqueTags":["qr-code-decoding","image-ocr","url-reputation-analysis","sandbox-analysis","split-qr-code-detection","ascii-qr-code-detection","time-of-click-protection"],"techniqueDetails":["Describes evasion variants including split QR codes, nested QR codes, ASCII-based QR codes, and styled/artistic QR codes, and explains how to catch them with image analysis, OCR, and multimodal AI."],"tools":["Barracuda Multimodal AI","Palo Alto ALFA","Microsoft Defender for O365","Proofpoint TAP","Lookout/Zimperium"],"targetTypes":["other","web-application","mobile"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Focuses specifically on QR code phishing (quishing), a phishing variant that embeds malicious URLs in QR images to bypass link-based email security","Covers advanced evasion techniques such as split QR, nested QR, ASCII QR, and styled/artistic QR codes","Combines email gateway configuration, mobile threat defense, and user awareness training into a single detection and prevention workflow"],"familyIds":["email-phishing-detection"]},{"id":"detecting-ransomware-encryption-behavior","summary":"This skill provides a practical, code-backed workflow for building real-time ransomware encryption detection using entropy analysis, file system I/O monitoring, and behavioral scoring, including threshold tuning and automated response guidance.","primaryDomain":"windows-security","domainTags":["ransomware-defense","behavioral-detection","entropy-analysis","file-monitoring"],"capabilityTags":["ransomware-encryption-detection","entropy-based-detection","behavioral-scoring","real-time-monitoring"],"capabilityDetails":["Provides a workflow for detecting ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral scoring to identify mass file modification and abnormal entropy spikes."],"techniqueTags":["shannon-entropy-analysis","io-pattern-analysis","behavioral-scoring","file-modification-monitoring"],"techniqueDetails":["Uses Shannon entropy calculation to detect high-entropy encrypted content, monitors process-level file I/O patterns for rapid sequential modifications and renames, and combines weak signals into a composite ransomware score."],"tools":["sysmon","watchdog","psutil","elastic-endpoint","wazuh"],"targetTypes":["windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on entropy and behavioral detection of ransomware encryption as opposed to signature-based or canary-file approaches.","Provides concrete Python code for entropy calculation and behavioral scoring, plus threshold tuning guidance."],"familyIds":["ransomware-encryption-detection"]},{"id":"detecting-ransomware-precursors-in-network","summary":"Operational playbook for detecting pre-ransomware network activity using Zeek, Suricata, and SIEM correlation, covering kill-chain mapping, detection rule development, threat intel integration, and alert triage.","primaryDomain":"network-security","domainTags":["ransomware","network-traffic-analysis","detection"],"capabilityTags":["ransomware-precursor-detection","detection-rule-development","siem-correlation","threat-intelligence-integration"],"capabilityDetails":["Provides a multi-step workflow for identifying early ransomware indicators in network traffic before encryption.","Includes concrete Suricata/Zeek detection rules, SIEM correlation queries, and threat intel feed integration."],"techniqueTags":["beacon-detection","dns-tunneling","dcsync-detection","kerberoasting-detection","rdp-brute-force","smb-staging"],"techniqueDetails":["Detects Cobalt Strike HTTPS/DNS beacons via TLS certificate and DNS query patterns.","Identifies DCSync via DRS GetNCChanges signature and Mimikatz patterns.","Uses threshold-based SIEM queries to correlate RDP brute force, admin share access, and port scanning."],"tools":["zeek","suricata","arkime","splunk","sentinel","ritta","ac-hunter"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses exclusively on the pre-encryption detection window (precursors) rather than post-encryption response.","Provides a kill-chain mapping of network-observable indicators to ransomware phases and a triage/escalation matrix."],"familyIds":["ransomware-precursor-detection"]},{"id":"detecting-rdp-brute-force-attacks","summary":"Parses Windows Security EVTX logs to detect RDP brute force attempts by analyzing failed logon patterns (Event ID 4625, Logon Types 3/10), correlating with successful logons (4624), and ranking attacking source IPs, producing a structured JSON detection report.","primaryDomain":"windows-security","domainTags":["rdp","windows-event-logs","brute-force-detection"],"capabilityTags":["rdp-brute-force-detection","evtx-parsing","failed-logon-correlation"],"capabilityDetails":["Provides a workflow for parsing Windows Security EVTX logs to detect RDP brute force patterns (Event ID 4625/4624) and identify potential compromised accounts."],"techniqueTags":["event-id-correlation","source-ip-frequency-analysis","logon-type-analysis"],"techniqueDetails":["Correlates failed logon events (4625) with successful logons (4624) from the same source IP to identify compromise indicators.","Uses frequency counting of failed logons per source IP to detect brute force and username spray patterns.","Differentiates RDP Logon Types (3 for NLA, 10 for RemoteInteractive) to focus on RDP-specific authentication attempts."],"tools":["python-evtx","wevtutil","lxml"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Specifically targets RDP brute force detection from EVTX files, unlike generic brute force detection skills.","Uses python-evtx for direct EVTX parsing, enabling offline analysis of exported Windows Security logs.","Emphasizes correlation of failed and successful logon events to flag potentially compromised accounts."],"familyIds":["rdp-brute-force-detection"]},{"id":"detecting-rootkit-activity","summary":"Detects rootkit presence on compromised Windows/Linux systems using memory forensics, cross-view process and hook analysis, kernel driver scanning, hidden network connection discovery, and integrity verification.","primaryDomain":"forensics","domainTags":["rootkit-detection","memory-forensics","malware-analysis","kernel-analysis"],"capabilityTags":["rootkit-detection","hidden-process-detection","system-call-hook-analysis","kernel-module-analysis","hidden-network-connection-detection"],"capabilityDetails":["Provides a workflow for identifying rootkit hiding mechanisms including hidden processes, SSDT/IDT/IRP hooks, unauthorized kernel drivers, hidden files/registry keys, and covert network connections."],"techniqueTags":["cross-view-detection","ssdt-hook-inspection","dkom-analysis","inline-hook-detection","driver-scanning","memory-dump-analysis"],"techniqueDetails":["Compares Volatility pslist vs psscan to find processes unlinked via DKOM.","Inspects SSDT, IDT, and API hooks for entries pointing outside legitimate kernel modules.","Scans loaded drivers and compares against baselines to find hidden or unsigned kernel components.","Uses windows.netscan to enumerate connections hidden from user-mode netstat."],"tools":["volatility3","gmer","rkhunter","chkrootkit","rootkitrevealer","sysinternals"],"targetTypes":["windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on rootkit hiding behaviors rather than general malware detection.","Integrates live host scanners (GMER, rkhunter, chkrootkit) with offline Volatility memory forensics.","Provides concrete Python/Volatility commands for cross-view detection and SSDT hook analysis.","Emphasizes verifying findings against clean baselines and offline analysis to avoid rootkit subversion."],"familyIds":["stealth-malware-detection"]},{"id":"detecting-s3-data-exfiltration-attempts","summary":"Operational playbook for detecting S3 data exfiltration attempts by combining CloudTrail S3 data events, GuardDuty S3 Protection findings, Macie sensitive data classification, and automated CloudWatch/EventBridge detection rules, with optional preventive controls for restricting S3 access.","primaryDomain":"cloud-security","domainTags":["cloud-security","aws","s3-security","data-exfiltration","threat-detection"],"capabilityTags":["data-exfiltration-detection","cloudtrail-log-analysis","guardduty-threat-detection","macie-sensitive-data-analysis","security-event-monitoring"],"capabilityDetails":["Provides a step-by-step workflow for detecting S3 data exfiltration attempts using CloudTrail S3 data events, GuardDuty findings, Macie alerts, and automated detection rules.","Includes Athena and CloudWatch Logs Insights queries for identifying bulk downloads and cross-account transfers."],"techniqueTags":["bulk-download-pattern-analysis","cross-account-transfer-detection","sensitive-data-correlation","vpc-endpoint-policy-restriction","cloudwatch-metric-alarms"],"techniqueDetails":["Analyzes CloudTrail S3 GetObject request counts and byte volumes to identify bulk downloads.","Correlates GuardDuty Exfiltration:S3 finding types with Macie data classification results.","Deploys VPC endpoint policies and bucket policies to restrict access paths."],"tools":["aws-cli","cloudtrail","guardduty","macie","athena","cloudwatch-logs"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on S3 data exfiltration detection using a multi-layered AWS-native approach (CloudTrail data events, GuardDuty S3 Protection, Macie data classification) rather than generic cloud log monitoring.","Provides concrete AWS CLI/Athena queries and configuration commands for detection rules and preventive controls."],"familyIds":["cloud-threat-detection-and-hunting"]},{"id":"detecting-secure-boot-bypass","summary":"Operational playbook for detecting UEFI Secure Boot bypasses and bootkits by verifying Secure Boot state, auditing dbx revocation currency, checking UEFI variable protections with CHIPSEC, and hashing/inspecting ESP boot binaries on Linux and Windows.","primaryDomain":"forensics","domainTags":["firmware-security","uefi-secure-boot","bootkit-detection"],"capabilityTags":["secure-boot-state-verification","dbx-revocation-audit","efi-binary-integrity-check","bootkit-artifact-hunting","firmware-variable-protection-assessment"],"capabilityDetails":["Verifies whether Secure Boot is enabled and in user mode across Linux and Windows.","Audits the UEFI revocation list (dbx) against official updates to identify missing bootkit mitigations.","Hashes and signature-verifies EFI boot binaries to detect vulnerable or tampered bootloaders.","Uses CHIPSEC to validate Secure Boot variable protections and S3 boot script integrity."],"techniqueTags":["mokutil-sb-state","efi-readvar-db-dump","dbxtool-dbx-compare","chipsec-secureboot-variables","sbverify-signature-check","known-bad-hash-matching","tpm-pcr7-validation"],"techniqueDetails":["Uses mokutil and Windows Confirm-SecureBootUEFI to confirm Secure Boot state.","Dumps db/dbx via efi-readvar or Get-SecureBootUEFI and compares to the official UEFI revocation list.","Runs CHIPSEC modules to verify Secure Boot variables are authenticated and the S3 boot script is protected.","Verifies EFI binary signatures with sbverify/pesign and hashes ESP binaries with sha256sum, then cross-checks against known-bad sets.","Optionally reads TPM PCR[7] to corroborate measured-boot policy deviations."],"tools":["mokutil","efi-readvar","dbxtool","chipsec","sbverify","pesign","Confirm-SecureBootUEFI","agent.py"],"targetTypes":["windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Targets the specific evasion class of UEFI Secure Boot bypasses (e.g., BlackLotus, Bootkitty), not general OS compromise.","Combines OS-level commands with CHIPSEC firmware analysis and dbx revocation comparison in one workflow.","Explicitly covers both Linux and Windows detection commands.","Cross-references on-disk EFI binary hashes with published revocation and known-bad sets."],"familyIds":["stealth-malware-detection"]},{"id":"detecting-serverless-function-injection","summary":"A specialist playbook for detecting and preventing code injection in serverless functions, covering event source poisoning, malicious layer injection, and IAM privilege escalation through Lambda modification, with static analysis, CloudTrail correlation, and runtime controls.","primaryDomain":"cloud-security","domainTags":["serverless-security","lambda-injection","event-source-poisoning","iam-privilege-escalation"],"capabilityTags":["code-injection-detection","event-source-poisoning-analysis","lambda-layer-hijacking-detection","iam-privilege-escalation-detection","static-analysis","cloudtrail-event-correlation","runtime-prevention"],"capabilityDetails":["Provides a comprehensive detection and prevention workflow for identifying code injection in serverless functions across AWS Lambda, Azure Functions, and Google Cloud Functions.","Combines static analysis of function code with CloudTrail event correlation and runtime monitoring.","Covers event source poisoning via S3, SQS, API Gateway, and DynamoDB Streams.","Includes detection of malicious Lambda layers and IAM privilege escalation via function modification.","Provides remediation and prevention controls including input validation, least privilege, and SCPs."],"techniqueTags":["command-injection","code-injection","insecure-deserialization","server-side-template-injection","sql-injection","event-source-poisoning","lambda-layer-hijacking","iam-privilege-escalation"],"techniqueDetails":["Demonstrates injection sinks such as eval, exec, os.system, subprocess, pickle.loads, yaml.load, and template rendering.","Shows how S3 object keys, SQS message bodies, API Gateway headers, and DynamoDB Stream records can carry injection payloads.","Explains layer hijacking by placing malicious code in the runtime module search path.","Details IAM privilege escalation path using lambda:UpdateFunctionCode and iam:PassRole."],"tools":["AWS CLI","Semgrep","Bandit","AWS CloudTrail","CloudWatch Logs Insights","AWS EventBridge","AWS Config","Prowler","AWS Lambda Powertools"],"targetTypes":["cloud","api"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on serverless function injection rather than general cloud or web injection.","Covers the full attack chain from event source poisoning to IAM privilege escalation via Lambda modification.","Integrates static analysis, CloudTrail event correlation, and runtime prevention in one playbook.","Provides concrete detection queries for CloudTrail and CloudWatch Logs Insights for serverless-specific attack patterns."],"familyIds":["cloud-threat-detection-and-hunting"]},{"id":"detecting-service-account-abuse","summary":"Structured threat-hunting playbook for detecting service account abuse via EDR/SIEM telemetry, covering hypothesis formulation, query execution, validation, and reporting across multiple platforms.","primaryDomain":"active-directory","domainTags":["threat-hunting","service-accounts","privilege-escalation","lateral-movement"],"capabilityTags":["threat-hunting","query-execution","log-correlation","finding-validation"],"capabilityDetails":["Provides a step-by-step workflow for hunting service account abuse, including hypothesis formulation, data source identification, query execution, anomaly analysis, validation, correlation, and documentation."],"techniqueTags":["t1078-valid-accounts","t1021-remote-services","t1098-account-manipulation","t1550-alternate-auth-material","dcsync"],"techniqueDetails":["Detects abuse of valid accounts (T1078.002), remote services (T1021), account manipulation (T1098), alternate authentication material (T1550), and includes DCSync in common scenarios."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Splunk Enterprise","Elastic Security","Sysmon","Velociraptor","Sigma Rules"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Focused specifically on detecting service account abuse rather than general credential misuse.","Provides a hypothesis-driven hunting workflow applicable across multiple EDR/SIEM platforms.","Includes concrete scenarios like service account RDP to domain controllers and DCSync."],"familyIds":["service-account-abuse-detection"]},{"id":"detecting-shadow-api-endpoints","summary":"Enables security teams to discover undocumented shadow API endpoints by comparing live API traffic to OpenAPI specs, auditing cloud API gateways, and mining source code for hidden routes, with risk scoring and governance guidance.","primaryDomain":"api-security","domainTags":["api-security","shadow-apis","api-discovery","undocumented-apis"],"capabilityTags":["shadow-api-detection","api-inventory","attack-surface-analysis","api-governance"],"capabilityDetails":["Provides a workflow for detecting undocumented/shadow API endpoints by comparing live traffic against OpenAPI specifications, scanning cloud configurations, and mining source code repositories."],"techniqueTags":["traffic-analysis","openapi-comparison","path-normalization","risk-scoring","cloud-config-scanning","source-code-matching"],"techniqueDetails":["Uses Python to parse API access logs, normalize dynamic path segments, and compare against documented OpenAPI paths to identify undocumented endpoints.","Scores shadow endpoints based on authentication, traffic volume, source diversity, HTTP methods, and sensitive path patterns to prioritize risk.","Includes AWS CLI commands for discovering API Gateway and Lambda URL endpoints not in documentation.","Uses grep and diff to find route definitions in source code and compare against OpenAPI specs."],"tools":["python3","aws-cli","grep","yq","kong"],"targetTypes":["api","web-application","cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Combines traffic analysis, cloud configuration scanning, and source code mining specifically for discovering shadow/undocumented APIs, with a risk classification framework and governance policy example."],"familyIds":["api-asset-discovery-and-reconnaissance"]},{"id":"detecting-shadow-it-cloud-usage","summary":"Provides a workflow for detecting unauthorized SaaS and cloud usage by parsing proxy, DNS, and netflow logs, aggregating traffic by domain with pandas, classifying domains against SaaS categories, and producing a risk-scored shadow IT report with remediation recommendations.","primaryDomain":"cloud-security","domainTags":["shadow-it","saas-discovery","cloud-usage-analysis"],"capabilityTags":["shadow-it-detection","saas-discovery","traffic-log-analysis","risk-scoring"],"capabilityDetails":["Provides a step-by-step workflow for detecting unauthorized cloud service usage from proxy, DNS, and netflow logs.","Includes methodology for aggregating traffic metrics per domain and classifying domains against known SaaS categories."],"techniqueTags":["log-aggregation","domain-classification","dns-analysis","netflow-analysis","risk-scoring"],"techniqueDetails":["Uses pandas group-by operations to aggregate total bytes, request counts, and unique users per destination domain.","Classifies domains against a known SaaS catalog using tldextract for domain extraction and normalization."],"tools":["python","pandas","tldextract"],"targetTypes":["network","cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting","remediation"],"distinctiveFeatures":["Focuses specifically on unsanctioned SaaS/cloud discovery via multi-source log aggregation (proxy, DNS, netflow) rather than cloud misconfiguration scanning.","Provides risk scoring based on data volume and user count to prioritize unauthorized services for remediation."],"familyIds":["cloud-threat-detection-and-hunting"]},{"id":"detecting-spearphishing-with-email-gateway","summary":"This skill provides a step-by-step workflow to configure email security gateways (Microsoft Defender, Proofpoint, Mimecast, Barracuda) to detect and block spearphishing through impersonation protection, URL detonation, attachment sandboxing, and custom detection rules.","primaryDomain":"network-security","domainTags":["phishing","email-security","social-engineering","spearphishing"],"capabilityTags":["phishing-detection","email-gateway-configuration","impersonation-protection","attachment-sandboxing","url-detection"],"capabilityDetails":["Provides a workflow for configuring email security gateway (SEG) impersonation protection, URL rewriting, attachment sandboxing, and custom detection rules to detect and block spearphishing."],"techniqueTags":["display-name-spoofing-detection","lookalike-domain-detection","url-detonation","macro-vba-analysis","spf-dkim-dmarc-validation"],"techniqueDetails":["Uses email authentication (SPF/DKIM/DMARC) and impersonation heuristics to identify spoofed senders.","Uses sandboxing and URL detonation in isolated environments to analyze attachments and links."],"tools":["Microsoft Defender for Office 365","Proofpoint Email Protection","Mimecast Email Security","Barracuda Email Protection"],"targetTypes":["network","cloud"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Vendor-specific configuration steps for multiple SEG products","Defensive phishing detection rather than phishing simulation or manual email analysis"],"familyIds":["email-phishing-detection"]},{"id":"detecting-sql-injection-via-waf-logs","summary":"Provides a SOC workflow to parse ModSecurity, AWS WAF, and Cloudflare logs, detect SQLi payloads via regex, classify attacks by OWASP type, cluster attackers, and generate incident reports.","primaryDomain":"web-security","domainTags":["sql-injection","waf-log-analysis","security-monitoring"],"capabilityTags":["sql-injection-detection","waf-log-analysis","threat-hunting"],"capabilityDetails":["Parses ModSecurity, AWS WAF, and Cloudflare firewall events to identify SQL injection payloads, classify attack types, cluster attackers, and generate incident reports with OWASP classification."],"techniqueTags":["union-based-sqli","boolean-based-sqli","time-based-sqli","regex-pattern-matching"],"techniqueDetails":["Matches common SQLi payload signatures in WAF logs using regex patterns and correlates multi-request sequences to infer blind or time-based injection campaigns."],"tools":["python"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Passive detection of SQL injection from WAF logs rather than active application testing.","Supports multiple WAF log formats (ModSecurity audit, AWS WAF JSON, Cloudflare events) with campaign correlation and OWASP classification."],"familyIds":["web-attack-evidence-analysis"]},{"id":"detecting-stuxnet-style-attacks","summary":"A specialized OT/ICS detection playbook that identifies Stuxnet-style cyber-physical attacks by monitoring PLC logic integrity against baselines and using physics-based anomaly detection to uncover sensor spoofing, with practical Python implementations.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","scada-security","plc-security","cyber-physical"],"capabilityTags":["stuxnet-style-attack-detection","plc-integrity-monitoring","physics-based-anomaly-detection","sensor-spoofing-detection","process-manipulation-detection"],"capabilityDetails":["Provides a workflow for detecting Stuxnet-style attacks that modify PLC logic and spoof sensor readings.","Includes a Python PLCIntegrityMonitor that compares PLC program blocks against known-good baselines.","Includes a Python CentrifugePhysicsModel that detects anomalies via frequency-RPM, power-speed, and vibration correlations."],"techniqueTags":["plc-baseline-comparison","checksum-verification","new-block-detection","frequency-rpm-correlation","power-speed-correlation","vibration-analysis"],"techniqueDetails":["PLC program integrity is checked by comparing block metadata, checksums, and counts against baselines.","Physics-based models cross-correlate motor frequency, RPM, power, and vibration to detect spoofed sensors.","The workflow maps the full attack chain with MITRE ATT&CK for ICS techniques."],"tools":["Claroty xDome","Nozomi Guardian","SIGA OT Solutions","Siemens SINEMA Remote Connect","Python script (PLCIntegrityMonitor)","Python script (CentrifugePhysicsModel)"],"targetTypes":["network","windows-host","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Combines PLC logic integrity monitoring with physics-based process anomaly detection to catch both logic injection and sensor spoofing.","Focuses specifically on Stuxnet-style cyber-physical attacks, not general OT intrusion detection.","Provides executable Python implementations for both monitoring and anomaly detection."],"familyIds":["ot-ics-attack-detection-and-monitoring"]},{"id":"detecting-supply-chain-attacks-in-ci-cd","summary":"Provides a structured workflow and Python automation to audit GitHub Actions CI/CD pipelines for supply chain attack vectors such as unpinned actions, script injection via events, secrets exposure, and overly permissive token permissions.","primaryDomain":"source-code-security","domainTags":["ci-cd-security","github-actions","supply-chain-security","secrets-management"],"capabilityTags":["ci-cd-auditing","supply-chain-detection","secrets-exposure-check","dependency-pinning-validation"],"capabilityDetails":["Provides a workflow for scanning GitHub Actions workflow files to detect supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure."],"techniqueTags":["unpinned-action-detection","script-injection-scan","secrets-analysis","yaml-parsing"],"techniqueDetails":["Uses YAML parsing to inspect GitHub Actions workflows. Checks `uses` fields for SHA pinning rather than mutable tags. Inspects `run` steps for unsafe `github.event` expression interpolation. Looks for over-permissive GITHUB_TOKEN permissions and third-party actions with write access."],"tools":["PyGithub","yaml","python"],"targetTypes":["source-code","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on supply chain attack vectors in GitHub Actions and CI/CD pipelines, combining multiple checks (unpinned dependencies, script injection, secrets exposure) into a single automated audit, unlike general source code scanners or pipeline security overviews."],"familyIds":["ci-cd-pipeline-configuration-auditing"]},{"id":"detecting-suspicious-oauth-application-consent","summary":"Detects illicit consent grant attacks in Azure AD/Entra ID by enumerating OAuth2 permission grants, analyzing high-risk scopes, checking publisher verification, and reviewing audit logs to generate risk reports.","primaryDomain":"cloud-security","domainTags":["oauth","azure-ad","entra-id","microsoft-graph","illicit-consent"],"capabilityTags":["oauth-consent-triage","permission-grant-audit","risk-scoring"],"capabilityDetails":["Provides a workflow for detecting risky OAuth application consent grants in Azure AD/Entra ID by enumerating permission grants, analyzing high-risk scopes, checking publisher verification, and reviewing audit logs."],"techniqueTags":["graph-api-enumeration","audit-log-review","permission-scope-analysis","publisher-verification"],"techniqueDetails":["Uses Microsoft Graph API to enumerate OAuth2 permission grants and service principals, queries directory audit logs for consent events, and evaluates application risk based on scopes and publisher verification status."],"tools":["microsoft-graph","msal","requests"],"targetTypes":["cloud","api"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Specifically targets illicit consent grant attacks in Azure AD/Entra ID","Combines Graph API permission grant enumeration with audit log consent event review","Flags unverified publishers and high-risk OAuth scopes"],"familyIds":["cloud-threat-detection-and-hunting"]},{"id":"detecting-suspicious-powershell-execution","summary":"Provides a structured threat-hunting workflow to detect suspicious PowerShell execution, including encoded commands, download cradles, and AMSI bypass, using EDR and SIEM telemetry from CrowdStrike, MDE, Splunk, Elastic, and Sysmon.","primaryDomain":"windows-security","domainTags":["powershell","threat-hunting","windows-security","mitre-attack"],"capabilityTags":["powershell-execution-detection","edr-telemetry-analysis","siem-query-execution","amsi-bypass-detection"],"capabilityDetails":["Provides a structured hypothesis-driven workflow for proactively hunting and triaging suspicious PowerShell execution using EDR telemetry, Sysmon, and SIEM queries."],"techniqueTags":["encoded-powershell","download-cradles","amsi-bypass","constrained-language-mode-evasion"],"techniqueDetails":["Uses EDR and SIEM queries to identify base64-encoded PowerShell commands, IEX download cradles, AMSI bypass via reflection patching, and PowerShell Empire C2 activity."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Splunk Enterprise","Elastic Security","Sysmon","Velociraptor","Sigma Rules"],"targetTypes":["windows-host","network"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Focuses specifically on PowerShell execution T1059.001, including encoded commands, download cradles, AMSI bypass, and constrained language mode evasion, across multiple EDR and SIEM platforms."],"familyIds":["powershell-abuse-detection"]},{"id":"detecting-t1003-credential-dumping-with-edr","summary":"A specialist threat-hunting playbook for detecting OS credential dumping (T1003) by correlating EDR telemetry, Sysmon process-access events, and Windows security logs, with ready-to-use Splunk/KQL/Sigma queries for LSASS, SAM, NTDS, and DCSync.","primaryDomain":"windows-security","domainTags":["credential-access","threat-hunting","windows-security"],"capabilityTags":["credential-dumping-detection","edr-telemetry-correlation","sysmon-analysis","threat-hunting"],"capabilityDetails":["Provides a threat-hunting workflow to detect OS credential dumping by correlating EDR telemetry, Sysmon process-access events, and Windows security logs.","Includes ready-to-run Splunk, KQL, and Sigma queries for detecting LSASS memory access, credential dumping tools, NTDS.dit extraction, and SAM hive access."],"techniqueTags":["lsass-memory-access","sam-hive-extraction","ntds-dit-extraction","dcsync"],"techniqueDetails":["Focuses on MITRE ATT&CK T1003 sub-techniques: LSASS memory (T1003.001), SAM (T1003.002), NTDS (T1003.003), and DCSync (T1003.006).","Uses suspicious process access to LSASS with access rights like PROCESS_VM_READ and PROCESS_ALL_ACCESS to identify credential dumping.","Detects NTDS.dit extraction via Volume Shadow Copy and ntdsutil IFM, and SAM extraction via reg.exe save commands."],"tools":["sysmon","splunk","microsoft-defender-for-endpoint","sigma"],"targetTypes":["windows-host","active-directory"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Combines EDR alerts, Sysmon process-access (Event ID 10), and Windows security logs to cover all major T1003 sub-techniques.","Provides concrete detection queries in Splunk, KQL, and Sigma formats, plus an output format for threat hunt reports.","Includes common attacker scenarios such as Mimikatz, ProcDump, comsvcs.dll MiniDump, and DCSync."],"familyIds":["credential-dumping-detection"]},{"id":"detecting-t1055-process-injection-with-sysmon","summary":"Operational playbook that enables threat hunters to detect T1055 process injection variants—DLL injection, process hollowing, APC injection, and others—by correlating Sysmon Event IDs 1, 7, 8, 10, and 25, and provides Splunk/KQL detection queries, a Sigma rule, and investigative tools for validation and forensics.","primaryDomain":"windows-security","domainTags":["process-injection","sysmon","threat-hunting","windows-event-log"],"capabilityTags":["process-injection-detection","sysmon-analysis","threat-hunting-workflow"],"capabilityDetails":["Provides a workflow for detecting T1055 process injection techniques by correlating Sysmon Event IDs 1, 7, 8, 10, and 25, including DLL injection, process hollowing, APC injection, and other sub-techniques."],"techniqueTags":["dll-injection","process-hollowing","apc-injection","remote-thread-creation","process-access"],"techniqueDetails":["Uses Sysmon Event 8 (CreateRemoteThread) to detect remote thread creation, Event 10 (ProcessAccess) for cross-process memory writes, Event 7 (ImageLoaded) for anomalous DLL loads, Event 25 (ProcessTampering) for process hollowing, and Event 1 (ProcessCreation) for attack chain correlation."],"tools":["sysmon","process-hacker","pe-sieve","moneta","hollows-hunter","volatility","splunk","elastic"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses on Sysmon Event ID-based detection of T1055 sub-techniques including DLL injection, process hollowing, and APC injection, with ready-to-use Splunk/KQL queries and a Sigma rule."],"familyIds":["process-injection-detection"]},{"id":"detecting-t1548-abuse-elevation-control-mechanism","summary":"Delivers a threat-hunting playbook to detect abuse of elevation control mechanisms (T1548), including Windows UAC bypass via auto-elevating binaries and Linux sudo/setuid exploitation, using Sysmon and Windows Security events with concrete detection queries.","primaryDomain":"windows-security","domainTags":["windows-security","linux-security","threat-hunting","privilege-escalation"],"capabilityTags":["uac-bypass-detection","elevation-control-monitoring","process-integrity-tracking","registry-auditing","linux-elevation-abuse-hunting"],"capabilityDetails":["Provides a structured hunt workflow for detecting T1548 abuse of elevation control mechanisms, focusing on Windows UAC bypass via auto-elevating binaries and Linux sudo/setuid exploitation, using Sysmon and Windows Security events."],"techniqueTags":["uac-bypass","registry-hijack","auto-elevating-binaries","setuid-setgid-abuse","sudo-caching"],"techniqueDetails":["Detects registry modifications under HKCU\\Software\\Classes that hijack auto-elevating binaries (fodhelper.exe, eventvwr.exe, sdclt.exe, cmstp.exe).","Tracks integrity level transitions to identify process escalation without UAC consent.","Monitors parent-child process relationships for abnormal elevated process spawning.","Covers Linux setuid/setgid and sudo caching abuse."],"tools":["sysmon","splunk","sigma"],"targetTypes":["windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Specifically targets MITRE ATT&CK T1548 elevation control mechanism abuse rather than general privilege-escalation hunting.","Combines Windows UAC bypass detection and Linux elevation abuse monitoring in a single workflow.","Provides ready-to-use Splunk, KQL, and Sigma detection queries for direct implementation."],"familyIds":["elevation-control-abuse-detection"]},{"id":"detecting-typosquatting-packages","summary":"Defensive workflow to detect typosquatted, brandjacked, and AI-hallucinated dependency names across npm, PyPI, and crates.io before installation; screens candidates using edit-distance, mutation primitives, registry metadata, and CI/CD gates.","primaryDomain":"source-code-security","domainTags":["supply-chain-security","typosquatting","package-registry","npm","pypi"],"capabilityTags":["typosquatting-detection","dependency-screening","package-mutation-analysis","registry-metadata-triage"],"capabilityDetails":["Provides a workflow to screen candidate package names against popular-name corpora to flag near-misses that may be typosquats."],"techniqueTags":["edit-distance","keyboard-proximity","mutation-primitives","corpus-matching"],"techniqueDetails":["Uses mutation primitives (transposition, omission, repetition, delimiter swaps, homoglyphs, suffix manipulation) and compares candidate names against a known-good corpus using edit-distance and keyboard proximity."],"tools":["typomania","oss-find-squats","pypi-scan","ecosyste-ms typosquatting-dataset"],"targetTypes":["source-code"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","remediation"],"distinctiveFeatures":["Specialized in pre-installation typosquatting detection across npm, PyPI, and crates.io, distinct from general vulnerability scanning or dependency auditing.","Combines academic mutation primitives (typogard) with practical tooling (typomania, OSSGadget, pypi-scan) and ground-truth known-squat data."],"familyIds":["package-registry-supply-chain-risk-screening"]},{"id":"detecting-typosquatting-packages-in-npm-pypi","summary":"Provides a structured workflow to detect typosquatting packages in PyPI and npm by generating name variants, querying registry APIs, and scoring metadata signals such as Levenshtein distance, publish date, download counts, and author information.","primaryDomain":"security-knowledge","domainTags":["supply-chain-security","package-security","typosquatting","dependency-confusion","npm","pypi"],"capabilityTags":["typosquatting-detection","package-name-similarity-analysis","metadata-heuristic-scoring","registry-monitoring"],"capabilityDetails":["Provides a workflow to detect typosquatting packages in PyPI and npm by generating name variants, querying registry APIs, and scoring metadata heuristics."],"techniqueTags":["levenshtein-distance","string-similarity-metrics","publish-date-recency","download-count-disparity","author-maintainer-analysis"],"techniqueDetails":["Uses Levenshtein distance and QWERTY keyboard distance to generate and compare name variants."],"tools":["pypi-json-api","npm-registry-api","python-Levenshtein","rapidfuzz","pypistats-api","npm-download-api"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","enumeration","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on detecting typosquatting in software package registries (npm and PyPI) using string similarity metrics and metadata heuristics, rather than general dependency vulnerability scanning."],"familyIds":["software-supply-chain-detection"]},{"id":"detecting-wmi-persistence","summary":"Provides a threat-hunting playbook to detect WMI event subscription persistence (T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21, cross-referencing with WMI namespaces and Autoruns, and documenting remediation steps.","primaryDomain":"windows-security","domainTags":["threat-hunting","persistence","wmi","sysmon","mitre-attack","dfir"],"capabilityTags":["wmi-persistence-hunting","sysmon-event-analysis","persistence-detection","incident-response"],"capabilityDetails":["Provides a threat-hunting workflow for detecting WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21, cross-referencing with root\\subscription namespace contents, and validating with Sysinternals Autoruns."],"techniqueTags":["wmi-event-subscription","event-triggered-execution","sysmon-event-analysis","wql-query-analysis"],"techniqueDetails":["Analyzes WMI EventFilter, EventConsumer, and FilterToConsumerBinding creation via Sysmon events to identify malicious persistence mechanisms executing code on process start or timer."],"tools":["Sysmon","WMI Explorer","Autoruns","PowerShell Get-WMIObject","Splunk","Velociraptor"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","remediation"],"distinctiveFeatures":["Focuses specifically on WMI event subscription persistence (T1546.003) using Sysmon Event IDs 19/20/21, validating suspicions against live WMI namespaces and Autoruns, and includes a structured hunt output format for reporting."],"familyIds":["windows-persistence-detection-and-hunting"]},{"id":"dns-rebinding-attacks","summary":"Expert playbook for executing DNS rebinding attacks to bypass same-origin policy from a victim's browser, access internal services, and exfiltrate data; includes TTL manipulation, browser cache bypasses, attack variants, tools, and decision tree.","primaryDomain":"web-security","domainTags":["dns-security","browser-security","client-side-attacks","internal-network-access"],"capabilityTags":["dns-rebinding","same-origin-policy-bypass","internal-service-access","browser-dns-cache-bypass","websocket-rebinding"],"capabilityDetails":["Provides a complete playbook for executing DNS rebinding attacks from a victim's browser to bypass same-origin policy and access internal services.","Includes detailed techniques for TTL manipulation, browser DNS cache bypass, and multiple attack variants.","Covers high-value internal targets such as cloud metadata, Docker, Kubernetes, and internal admin panels."],"techniqueTags":["ttl-manipulation","multiple-a-records","subdomain-flooding","websocket-rebinding","toctou-rebinding","dns-pinning-bypass"],"techniqueDetails":["Uses TTL=0 and alternating DNS responses to force re-resolution and change the resolved IP behind the same hostname.","Leverages multiple A records to fall back to an internal IP when the attacker IP becomes unreachable.","Uses unique subdomains to bypass browser DNS caching and achieve immediate rebinding.","Maintains WebSocket connections across rebinding to access internal services that use WebSocket.","Describes a TOCTOU hybrid with SSRF where server-side validation is bypassed during connection reuse."],"tools":["Singularity","rbndr.us","whonow","dnsrebinder"],"targetTypes":["web-application","api","network","cloud","container","kubernetes","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Exclusively focuses on client-side DNS rebinding rather than server-side SSRF, explicitly distinguishing the two.","Covers browser-specific DNS cache behaviors and multiple bypass strategies (multi-A, subdomain flooding, service worker flushing).","Includes WebSocket rebinding and TOCTOU hybrid variants, along with high-value internal service targeting and cloud metadata exfiltration."],"familyIds":["cross-origin-attacks"]},{"id":"docx","summary":"Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files) or Word templates (.dotx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', '.dotx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx or .dotx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding task","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"email-header-injection","summary":"Expert playbook for exploiting email header injection (CRLF) in forms/APIs, bypassing SPF/DKIM/DMARC to spoof domains, and abusing mail client rendering for phishing and data exfiltration.","primaryDomain":"injection","domainTags":["email-security","smtp","header-injection","email-authentication-bypass"],"capabilityTags":["email-header-injection-testing","crlf-injection-testing","email-spoofing","spf-dkim-dmarc-bypass"],"capabilityDetails":["Provides a workflow for testing email-sending features for CRLF/header injection, then escalating to BCC exfiltration, body injection, and Content-Type override; also covers SPF/DKIM/DMARC bypass and display name spoofing."],"techniqueTags":["crlf-injection","bcc-injection","body-injection","reply-to-manipulation","content-type-injection","spf-bypass","dkim-bypass","dmarc-bypass","display-name-spoofing","css-exfiltration"],"techniqueDetails":["Uses %0d%0a (CRLF) injection to add arbitrary SMTP headers, including Bcc, Cc, Reply-To, and Content-Type; blank line injection writes email body; SPF/DKIM/DMARC weaknesses allow spoofing of the From domain; display name spoofing bypasses authentication despite valid SPF/DKIM/DMARC."],"tools":["dig"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","exploitation"],"distinctiveFeatures":["Combines SMTP header injection with email authentication bypass (SPF/DKIM/DMARC) in one playbook","Includes mail client rendering attacks such as CSS-based data exfiltration and remote image tracking","Provides language-specific vulnerable patterns for PHP mail(), Python smtplib, and Node nodemailer","Has a decision tree distinguishing header injection, spoofing, and password reset flows"],"familyIds":["header-injection"]},{"id":"emulating-cloud-attacks-with-stratus-red-team","summary":"Provides a safe, repeatable workflow to install and run Stratus Red Team for detonating MITRE-mapped AWS, Azure, GCP, and Kubernetes attack techniques, verifying the generated telemetry, and validating that cloud detections actually fire.","primaryDomain":"cloud-security","domainTags":["cloud-security","adversary-emulation","detection-validation","purple-team","mitre-attack"],"capabilityTags":["attack-technique-detonation","detection-validation","telemetry-verification","purple-team-execution"],"capabilityDetails":["Detonates granular MITRE ATT&CK-mapped attack techniques in AWS, Azure, GCP, and Kubernetes","Runs a deterministic warmup-detonate-revert-cleanup lifecycle to safely emulate attacks and revert side effects","Verifies the cloud telemetry (CloudTrail, GuardDuty, Sentinel, etc.) each technique generates","Validates that detection rules fire end-to-end and documents coverage gaps"],"techniqueTags":["valid-accounts","cloud-infrastructure-discovery","data-from-cloud-storage","account-manipulation"],"techniqueDetails":["Uses Stratus Red Team's built-in technique catalog covering credential access, persistence, discovery, and exfiltration techniques","Each technique is mapped to the cloud API calls and telemetry it produces","Techniques can be inspected, warmed up, detonated, reverted, and cleaned individually"],"tools":["stratus-red-team","terraform","aws-cli","azure-cli","gcloud","kubectl","docker"],"targetTypes":["cloud","kubernetes"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection","validation"],"distinctiveFeatures":["Focuses on safe, reversible cloud attack emulation specifically to validate detections, not to exploit or compromise targets","Provides a deterministic warmup-detonate-revert-cleanup lifecycle with embedded Terraform","Covers multiple cloud providers and Kubernetes in a single workflow","Includes a detection-validation mapping from specific techniques to expected telemetry and detection rules","Offers programmatic coverage runs via a Python agent script"],"familyIds":["cloud-offensive-security-and-emulation"]},{"id":"enumerating-cloud-with-cloudfox","summary":"Operational playbook for using CloudFox to perform read-only enumeration of AWS and Azure cloud environments, prioritizing role-trust mapping, secret discovery, and internet-exposed endpoints to establish situational awareness and plan lateral movement after obtaining cloud credentials.","primaryDomain":"cloud-security","domainTags":["aws","azure","cloud-infrastructure"],"capabilityTags":["cloud-enumeration","attack-path-mapping","secret-discovery","role-trust-analysis"],"capabilityDetails":["Provides a step-by-step workflow for running CloudFox read-only enumeration to enumerate AWS and Azure resources, surface secrets and endpoints, and map IAM role-trust relationships for attack-path planning."],"techniqueTags":["cloud-service-discovery","iam-role-trust-enumeration","secret-discovery","endpoint-discovery"],"techniqueDetails":["Uses CloudFox's read-only Describe/List/Get API calls to map cloud resources, trust relationships, and exposed credentials without modifying the environment."],"tools":["cloudfox","awscli","azure-cli","pacu"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","analysis","detection"],"distinctiveFeatures":["Attacker-centric cloud enumeration using CloudFox instead of defensive configuration auditing","Emphasizes role-trust mapping and generated pivot commands for lateral movement","Covers both AWS and Azure with read-only Describe/List/Get calls"],"familyIds":["cloud-offensive-security-and-emulation"]},{"id":"eradicating-malware-from-infected-systems","summary":"Actionable playbook to map and remove malware persistence on Windows/Linux, rotate compromised credentials, patch root-cause vulnerabilities, and validate eradication before recovery.","primaryDomain":"forensics","domainTags":["incident-response","malware-eradication","persistence-removal","windows-security","linux-security"],"capabilityTags":["persistence-mapping","malware-artifact-identification","malware-removal","credential-rotation","vulnerability-patching","eradication-validation"],"capabilityDetails":["Provides a systematic workflow for eradicating malware from Windows and Linux systems by mapping and removing attacker persistence mechanisms, resetting compromised credentials, patching the initial access vulnerability, and validating a clean state."],"techniqueTags":["autoruns-enumeration","registry-run-key-analysis","wmi-subscription-removal","scheduled-task-removal","yara-scanning","krbtgt-reset","cron-inspection"],"techniqueDetails":["Uses Autoruns and system queries to enumerate registry, scheduled tasks, WMI subscriptions, services, cron/init.d; YARA and AV scans to identify malicious artifacts; PowerShell and shell commands to remove artifacts and reset credentials."],"tools":["Sysinternals Autoruns","YARA","ClamAV","PowerShell","CrowdStrike Falcon","Velociraptor"],"targetTypes":["windows-host","linux-host","active-directory"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","remediation"],"distinctiveFeatures":["Focuses specifically on the eradication/recovery phase after containment and forensics rather than initial malware analysis","Covers both Windows and Linux persistence removal, including WMI subscriptions and KRBTGT reset"],"familyIds":["malware-incident-response-and-eradication"]},{"id":"escaping-containers-to-host","summary":"Provides authorized container-security procedures to enumerate container privileges and exploit privileged containers, exposed Docker sockets, hostPath mounts, and runC CVEs for host code execution, with patch validation and remediation guidance.","primaryDomain":"cloud-security","domainTags":["container-security","kubernetes-security","privilege-escalation"],"capabilityTags":["container-escape-exploitation","privilege-enumeration","runtime-cve-exploitation"],"capabilityDetails":["Provides step-by-step procedures to enumerate container privileges and exploit privileged containers, exposed Docker sockets, hostPath mounts, and runC CVEs to achieve host-level code execution."],"techniqueTags":["cgroup-release-agent-abuse","docker-socket-exploitation","hostpath-mount-abuse","runc-fd-leak-exploitation","runc-procfs-write-redirect"],"techniqueDetails":["Uses cgroup release_agent to execute commands on the host, Docker socket to launch privileged containers, hostPath mounts to write host files, and runC CVEs to escape via leaked file descriptors or procfs write redirects."],"tools":["amicontained","deepce","CDK","docker","runc","kubectl"],"targetTypes":["container","kubernetes","linux-host"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","validation","remediation"],"distinctiveFeatures":["Specializes in the four highest-impact container escape primitives (misconfigurations, Docker socket, runC CVE-2024-21626, and 2025 runC procfs write-redirects) with concrete commands and patch baselines.","Combines attacker techniques with detection signals and remediation guidance."],"familyIds":["container-and-kubernetes-runtime-security"]},{"id":"evaluating-threat-intelligence-platforms","summary":"Provides a structured decision-support workflow for evaluating and selecting Threat Intelligence Platforms (TIPs) based on organizational requirements, including criteria definition, vendor comparison, PoC testing, weighted scoring, and implementation planning.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","platform-evaluation","procurement"],"capabilityTags":["tip-evaluation","vendor-selection","stix-taxii-compliance","proof-of-concept-design"],"capabilityDetails":["Provides a structured workflow for evaluating and selecting Threat Intelligence Platforms (TIPs) based on organizational requirements.","Includes defined evaluation criteria (mandatory/desired) covering core TIP functions, integrations, and operational needs.","Offers a comparative overview of major open-source and commercial TIPs with cost estimates and best-fit scenarios.","Guides proof-of-concept testing, weighted scoring, and implementation planning."],"techniqueTags":["requirements-analysis","weighted-scoring","proof-of-concept-testing","comparative-vendor-analysis"],"techniqueDetails":["Requires defining mandatory vs. desired criteria aligned to organizational maturity and budget.","Uses a weighted scoring matrix to quantitatively compare vendor capabilities and fit.","Recommends a 30-day PoC with specific tests for feed onboarding, SIEM integration, ATT&CK mapping, and API performance.","Provides a 90-day implementation timeline with milestones."],"tools":["MISP","OpenCTI","ThreatConnect","Anomali ThreatStream","EclecticIQ"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis"],"distinctiveFeatures":["Focuses on product evaluation and procurement decisions rather than technical exploitation or intelligence analysis.","Provides a structured comparison of open-source and commercial TIPs including cost estimates.","Includes a weighted scoring matrix and PoC plan for vendor selection."],"familyIds":["threat-intelligence-platform-evaluation"]},{"id":"executing-active-directory-attack-simulation","summary":"Executes authorized Active Directory attack simulation from a low-privileged domain user to domain compromise, using BloodHound to map attack paths and Impacket/Mimikatz-based Kerberoasting, delegation abuse, credential relay, and AD CS exploitation.","primaryDomain":"active-directory","domainTags":["active-directory-security","kerberos-security","domain-compromise","privilege-path-analysis"],"capabilityTags":["attack-path-analysis","kerberoasting","as-rep-roasting","dcsync","pass-the-hash","delegation-abuse","certificate-services-abuse"],"capabilityDetails":["Executes authorized AD attack simulation from low-privilege domain user to domain compromise using BloodHound attack path analysis and Impacket/Mimikatz techniques for Kerberos attacks, credential harvesting, lateral movement, and privilege escalation."],"techniqueTags":["kerberoasting","as-rep-roasting","silver-ticket","golden-ticket","unconstrained-delegation-abuse","pass-the-hash","pass-the-ticket","ntlm-relay","dcsync","lsass-dump","password-spraying","adcs-abuse","gpp-password","laps-abuse"],"techniqueDetails":["Extracts and cracks Kerberos TGS/AS-REP tickets offline","Forges Kerberos tickets with krbtgt/service NTLM hashes","Abuses unconstrained delegation to capture TGTs via coerced authentication","Relays NTLM authentication and uses DCSync for credential dumping","Exploits misconfigured AD CS templates and certificate services"],"tools":["BloodHound","SharpHound","Impacket","Mimikatz","CrackMapExec","Certipy","Hashcat"],"targetTypes":["active-directory","windows-host","network"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis","exploitation","post-exploitation"],"distinctiveFeatures":["End-to-end AD attack simulation combining BloodHound shortest-path analysis with Kerberoasting, delegation abuse, credential relay, and AD CS exploitation","Includes a realistic healthcare domain compromise scenario with full attack chain and remediation guidance"],"familyIds":["comprehensive-ad-attack-simulation"]},{"id":"executing-nist-rmf-authorization-to-operate","summary":"Practical guide for executing NIST RMF to obtain an ATO, covering categorization, control baseline selection, assessment, authorization decision, and continuous monitoring, with templates and scripts for producing the authorization package.","primaryDomain":"security-knowledge","domainTags":["nist-rmf","fisma","fedramp","ato","continuous-monitoring"],"capabilityTags":["ato-workflow","security-categorization","control-baseline-selection","ssp-development","sar-assessment","poam-management","continuous-monitoring"],"capabilityDetails":["Provides a step-by-step workflow to achieve Authorization to Operate, including producing SSP, SAR, and POA&M artifacts."],"techniqueTags":["fips-199-categorization","control-tailoring","examine-interview-test","high-water-mark"],"techniqueDetails":["Uses FIPS 199 high-water-mark impact categorization, SP 800-53B baseline tailoring, and SP 800-53A assessment methods."],"tools":["OSCAL","eMASS","Xacta","ServiceNow","RegScale","process.py"],"targetTypes":["cloud","other"],"role":"workflow","workflowFocus":["analysis","reporting","remediation","knowledge-reference"],"distinctiveFeatures":["Complete end-to-end coverage of NIST RMF to ATO, including authorization boundary definition, control tailoring, and ongoing authorization models like cATO."],"familyIds":["compliance-governance"]},{"id":"executing-phishing-simulation-campaign","summary":"Executes authorized phishing simulation campaigns end-to-end: pretext design, GoPhish infrastructure setup, batched email delivery, credential harvesting, and analysis of open/click/submission/report metrics to assess and improve human security awareness.","primaryDomain":"general-pentesting","domainTags":["phishing-simulation","social-engineering","email-security","security-awareness"],"capabilityTags":["phishing-campaign-execution","credential-harvesting","campaign-metrics-analysis","security-awareness-assessment"],"capabilityDetails":["Provides an end-to-end workflow for planning, executing, and reporting authorized phishing simulation campaigns.","Includes pretext design, GoPhish infrastructure setup, email delivery, and credential capture process.","Covers analysis of delivery, open, click, credential submission, and report rates."],"techniqueTags":["pretext-design","typosquatting","credential-harvesting-page","batched-email-sending","tracking-pixel"],"techniqueDetails":["Uses realistic pretexts like IT support and executive impersonation to increase engagement.","Registers typosquatted or brand-adjacent domains with SPF/DKIM/DMARC to improve deliverability.","Builds credential harvesting landing pages that mirror legitimate login portals.","Sends emails in batches to avoid rate limits and spam filters.","Embeds tracking pixels to measure opens and link clicks."],"tools":["GoPhish","Evilginx2","King Phisher","SET"],"targetTypes":["web-application","other"],"role":"specialist-playbook","workflowFocus":["exploitation","analysis","validation","reporting"],"distinctiveFeatures":["End-to-end phishing simulation campaign management, not just email sending.","Focus on measuring human susceptibility with metrics like credential submission and report rates.","Includes infrastructure setup with GoPhish and email authentication configuration for deliverability."],"familyIds":["social-engineering-testing"]},{"id":"executing-red-team-engagement-planning","summary":"Provides a structured methodology for producing a red team engagement plan, including scope definition, rules of engagement, MITRE ATT&CK-aligned threat selection, and operational timelines, resulting in an engagement brief for stakeholder approval.","primaryDomain":"general-pentesting","domainTags":["red-teaming","engagement-planning","adversary-simulation","rules-of-engagement"],"capabilityTags":["engagement-planning","scope-definition","rules-of-engagement-development","threat-modeling"],"capabilityDetails":["Provides a structured workflow to produce a red team engagement plan including scope, rules of engagement, threat profile selection, and operational timelines for stakeholder approval."],"techniqueTags":["mitre-attack-mapping","threat-actor-profiling","emergency-stop-procedure-development"],"techniqueDetails":["Uses MITRE ATT&CK to map threat actor TTPs to organizational attack surface.","Defines emergency stop procedures, communication plans, and legal boundaries."],"tools":["mitre-attack-navigator","vectr","cobalt-strike","plextrac","scythe"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","reporting"],"distinctiveFeatures":["Focuses exclusively on pre-engagement planning rather than tactical execution","Provides a structured framework for rules of engagement, scope definition, and threat profile selection based on MITRE ATT&CK","Includes deconfliction procedures with SOC/blue team"],"familyIds":["red-team-adversary-simulation"]},{"id":"executing-red-team-exercise","summary":"Provides a complete methodology for planning and executing stealthy, ATT&CK-mapped adversary emulation exercises against an organization's people, processes, and technology, using C2 infrastructure (Cobalt Strike, Sliver, etc.) and focusing on testing SOC detection and response capabilities across the full attack lifecycle.","primaryDomain":"general-pentesting","domainTags":["red-team","adversary-emulation","c2-infrastructure","mitre-attack","soc-detection-testing"],"capabilityTags":["adversary-emulation-planning","stealthy-c2-operations","soc-detection-gap-analysis","purple-team-integration","full-attack-lifecycle-execution"],"capabilityDetails":["Provides a full-scope red team exercise methodology from adversary emulation planning through stealthy execution, detection gap analysis, and purple team reporting.","Focuses on testing SOC detection and response rather than just identifying vulnerabilities."],"techniqueTags":["spear-phishing","powershell-execution","process-injection","kerberoasting","lateral-movement","dns-exfiltration","domain-fronting"],"techniqueDetails":["Uses spear-phishing, external exploitation, and supply chain as initial access vectors; PowerShell/scripting and process injection for execution and evasion; Kerberoasting and LSASS dumping for credential access; RDP/WinRM/SMB for lateral movement; and C2 channels with domain fronting for stealthy command and control."],"tools":["Cobalt Strike","Sliver","Brute Ratel","Mythic","MITRE ATT&CK Navigator","BloodHound"],"targetTypes":["active-directory","windows-host","network","web-application"],"role":"specialist-playbook","workflowFocus":["reconnaissance","exploitation","post-exploitation","detection","reporting"],"distinctiveFeatures":["Focuses on testing an organization's detection and response capabilities rather than simply discovering vulnerabilities.","Provides end-to-end red team exercise methodology with C2 infrastructure, OPSEC, deconfliction, and purple team integration.","Explicitly maps to MITRE ATT&CK and regulatory adversary simulation frameworks (TIBER-EU, CBEST, AASE, iCAST)."],"familyIds":["red-team-adversary-simulation"]},{"id":"exploit-file-download","summary":"Practical playbook for detecting and exploiting LFI and arbitrary file download vulnerabilities in web applications, covering path traversal, PHP wrapper-based source code reads, sensitive file enumeration, and escalation to RCE via log poisoning, with curl and ffuf workflows.","primaryDomain":"web-security","domainTags":["local-file-inclusion","arbitrary-file-download","path-traversal"],"capabilityTags":["lfi-detection","lfi-exploitation","sensitive-file-read","rce-via-log-poisoning","php-wrapper-utilization"],"capabilityDetails":["Provides a workflow for detecting and exploiting Local File Inclusion (LFI) and arbitrary file download vulnerabilities, including path traversal testing, PHP wrapper usage, sensitive file reading, and log poisoning for remote code execution."],"techniqueTags":["path-traversal","php-filter-wrapper","base64-encoding","log-poisoning","null-byte-injection","url-encoding-bypass"],"techniqueDetails":["Uses curl and ffuf to test traversal sequences of varying depth; leverages php://filter with base64 encoding to read PHP source code; demonstrates log poisoning via User-Agent injection; covers encoding bypasses such as double URL encoding, Unicode obfuscation, and null byte truncation."],"tools":["curl","ffuf","wget","gobuster","dirsearch","feroxbuster","httpx","nuclei"],"targetTypes":["web-application","linux-host","windows-host"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","exploitation"],"distinctiveFeatures":["Combines arbitrary file download and LFI exploitation into one workflow, with comprehensive payload and bypass checklists, including PHP wrapper streams, encoding obfuscation, and log poisoning to RCE. Provides both manual curl commands and automated ffuf fuzzing workflows."],"familyIds":["local-file-inclusion-and-arbitrary-file-download"]},{"id":"exploit-lfi","summary":"Hands-on workflow for detecting and exploiting local file inclusion vulnerabilities in web applications, covering path traversal, PHP wrapper-based source disclosure, log poisoning for RCE, and reading sensitive files, with curl/ffuf automation and bypass techniques.","primaryDomain":"web-security","domainTags":["local-file-inclusion","file-inclusion","path-traversal"],"capabilityTags":["lfi-detection","lfi-exploitation","sensitive-file-read","rce-via-log-poisoning","php-wrapper-usage"],"capabilityDetails":["Provides an operational workflow for detecting LFI parameters, confirming file inclusion via sensitive-file responses, and escalating to source disclosure or remote code execution through PHP wrappers, log poisoning, /proc/self/environ, and temp-file race attacks."],"techniqueTags":["path-traversal","php-filter-wrapper","data-wrapper","expect-wrapper","log-poisoning","proc-self-environ","encoding-bypass"],"techniqueDetails":["Uses ../ traversal depth testing, php://filter base64 source reading, data:// and expect:// wrappers, PHP payload injection into web-server logs and environment files, and encoding variations such as double URL encoding, Unicode, and null byte to bypass filters."],"tools":["curl","ffuf","bash"],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Distinctive focus on LFI as a vulnerability class, explicitly differentiated from file-download vulnerabilities; includes concrete payloads for php://filter source disclosure, log poisoning RCE, /proc/self/environ, and temp-file race attacks, plus OS-specific sensitive file paths and encoding bypass techniques."],"familyIds":["local-file-inclusion-and-arbitrary-file-download"]},{"id":"exploit-sqli","summary":"Operational SQL injection playbook that enables both automated sqlmap and manual exploitation of web application parameters, including blind inference, database enumeration, WAF evasion, and recording findings for reporting.","primaryDomain":"injection","domainTags":["sql-injection","database-security"],"capabilityTags":["sql-injection-testing","database-enumeration","blind-injection-validation","waf-evasion"],"capabilityDetails":["Provides a practical workflow for SQL injection detection and exploitation using sqlmap and manual techniques, covering URL, POST, cookie, header, and API parameter testing, plus database enumeration and finding persistence."],"techniqueTags":["automated-sqlmap-scanning","boolean-based-sqli","time-based-sqli","union-based-sqli","error-based-sqli","manual-payload-injection"],"techniqueDetails":["Covers automated sqlmap scans for detection and exploitation, manual union/error-based payloads, boolean/time-based blind inference using response differences and delays, and WAF evasion via tamper scripts and technique selection."],"tools":["sqlmap","BBQSQL","NoSQLMap","curl"],"targetTypes":["web-application","api","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","enumeration"],"distinctiveFeatures":["Blends sqlmap automation with manual DBMS-specific payloads for MySQL, PostgreSQL, SQL Server, and Oracle, and includes blind injection validation, WAF evasion, and a persistence script for storing findings."],"familyIds":["sql-injection"]},{"id":"exploit-xss","summary":"A specialized XSS detection and exploitation playbook supporting reflected, stored, DOM, blind, mutation, and WebSocket XSS, with advanced techniques for WAF/CSP bypass, framework-specific payloads, and integration with automated tools and custom scripts.","primaryDomain":"web-security","domainTags":["cross-site-scripting","client-side-security"],"capabilityTags":["xss-detection","xss-exploitation","blind-xss-testing","dom-xss-testing","stored-xss-testing"],"capabilityDetails":["Provides a comprehensive workflow for detecting and exploiting reflected, stored, DOM-based, and blind XSS vulnerabilities, including payload generation, context analysis, WAF bypass, and vulnerability reporting."],"techniqueTags":["reflected-xss","stored-xss","dom-xss","blind-xss","waf-bypass","csp-bypass","mutation-xss","websocket-xss"],"techniqueDetails":["Covers reflected, stored, DOM, blind, mutation, and WebSocket XSS variants; includes WAF bypass, CSP bypass, polyglot payloads, and framework-specific injection techniques."],"tools":["XSStrike","Dalfox","XSpear","Burp Suite","OWASP ZAP"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Comprehensive XSS specialist skill covering multiple XSS subtypes (reflected, stored, DOM, blind, mutation, WebSocket) with advanced WAF/CSP bypass, framework-specific testing, and built-in auxiliary scripts for payload generation, context analysis, and vulnerability storage."],"familyIds":["client-side-injection-and-policy-bypass"]},{"id":"exploiting-active-directory-certificate-services-esc1","summary":"A practical guide to enumerating and exploiting AD CS ESC1 misconfigurations to escalate to Domain Admin via forged certificates.","primaryDomain":"active-directory","domainTags":["ad-cs","certificate-abuse","privilege-escalation","domain-escalation"],"capabilityTags":["certificate-request","certificate-abuse","kerberos-authentication","domain-escalation"],"capabilityDetails":["Provides an end-to-end workflow for exploiting the ESC1 misconfiguration in Active Directory Certificate Services to impersonate high-privileged users via forged certificates."],"techniqueTags":["san-injection","pkinit","certificate-template-abuse"],"techniqueDetails":["Exploits the 'Supply in Request' flag to include a Domain Admin SAN in a certificate request, then authenticates via PKINIT to obtain a TGT."],"tools":["Certify","Certipy","Rubeus","Mimikatz","secretsdump.py","PSPKIAudit","ForgeCert"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","post-exploitation"],"distinctiveFeatures":["Focused exclusively on the ESC1 AD CS misconfiguration, covering enumeration, certificate request, PKINIT authentication, and domain escalation with cross-platform tooling (Certify/Certipy)."],"familyIds":["ad-cs-abuse-and-exploitation"]},{"id":"exploiting-active-directory-with-bloodhound","summary":"Provides a structured workflow for using BloodHound and SharpHound to collect Active Directory relationship data, analyze attack paths to Domain Admin, and plan exploitation through ACL abuse, Kerberoasting, AS-REP Roasting, GPO abuse, and DCSync.","primaryDomain":"active-directory","domainTags":["active-directory-reconnaissance","graph-analysis","privilege-escalation"],"capabilityTags":["ad-attack-path-analysis","bloodhound-workflow","exploitation-planning"],"capabilityDetails":["Provides a structured workflow for collecting Active Directory relationship data with SharpHound and analyzing it in BloodHound to identify and prioritize attack paths to Domain Admins."],"techniqueTags":["kerberoasting","as-rep-roasting","acl-abuse","gpo-abuse","dcsync","shortest-path-analysis"],"techniqueDetails":["Uses graph theory and Cypher queries to uncover hidden relationships, including Kerberoastable accounts, AS-REP Roastable users, ACL-based abuse paths, GPO misuse, and DCSync rights."],"tools":["BloodHound CE","SharpHound","BloodHound.py","Cypher","PlumHound","Max (BloodHound)"],"targetTypes":["active-directory"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis","exploitation","post-exploitation"],"distinctiveFeatures":["Covers a complete bloodhound-centric workflow from data collection to exploitation planning, integrating multiple AD attack techniques in one methodology."],"familyIds":["active-directory-reconnaissance-and-path-mapping"]},{"id":"exploiting-adcs-with-certipy","summary":"Operational playbook using Certipy to enumerate AD CS infrastructure, exploit certificate misconfigurations (ESC1-ESC16) including SAN abuse, NTLM relay to web enrollment, template hijacking, Shadow Credentials, and golden certificate forgery, and authenticate via PKINIT to escalate a foothold to Domain Admin.","primaryDomain":"active-directory","domainTags":["active-directory","certificate-services","ad-cs","privilege-escalation"],"capabilityTags":["adcs-enumeration","esc-exploitation","certificate-forgery","ntlm-relay-to-enrollment","shadow-credentials","pkinit-authentication"],"capabilityDetails":["Provides a Certipy-based workflow for enumerating AD CS CAs/templates over LDAP/RPC and identifying ESC1-ESC16 misconfigurations.","Exploits vulnerable templates via SAN abuse (ESC1), NTLM relay to web enrollment (ESC8), template ACL hijack (ESC4), golden certificate forgery, and Shadow Credentials to escalate to Domain Admin.","Authenticates with issued/forged certificates via PKINIT or Schannel/LDAP to recover TGTs and NT hashes."],"techniqueTags":["esc1-san-abuse","esc8-ntlm-relay","esc4-template-acl-hijack","golden-certificate-forgery","shadow-credentials","pkinit-authentication","certificate-request"],"techniqueDetails":["Uses Certipy's certificate request with template/UPN/SID to exploit enrollee-supplied SAN (ESC1).","Sets up a Certipy relay server and coerces Domain Controller authentication into AD CS web enrollment to obtain a DC certificate (ESC8).","Temporarily alters certificate template ACLs with Certipy template to make an ESC1-exploitable state and restores them after (ESC4).","Extracts the CA private key and uses Certipy forge to mint golden certificates for any principal.","Uses Certipy shadow auto to take over accounts via msDS-KeyCredentialLink.","Authenticates with PFX certificates using PKINIT to get a TGT and recover NT hash."],"tools":["certipy","coercer","impacket"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","validation","exploitation","post-exploitation"],"distinctiveFeatures":["Focuses exclusively on AD CS certificate misconfigurations rather than general Active Directory privilege escalation.","Covers the full ESC1-ESC16 catalog with concrete Certipy commands, including ESC8 relay, Golden Certificate forgery, and Shadow Credentials in one playbook."],"familyIds":["ad-cs-abuse-and-exploitation"]},{"id":"exploiting-api-injection-vulnerabilities","summary":"A specialist playbook that provides an end-to-end API injection testing methodology for SQL, NoSQL, SSRF, and command injection, including Python test functions, payload catalogs, and a realistic attack scenario for authorized security assessments.","primaryDomain":"api-security","domainTags":["sql-injection","nosql-injection","ssrf","command-injection"],"capabilityTags":["injection-testing","sqli-testing","nosql-testing","ssrf-testing","command-injection-testing"],"capabilityDetails":["Provides a structured workflow for identifying API injection points and testing for SQL injection, NoSQL injection, SSRF, and OS command injection using tailored payloads and Python scripts."],"techniqueTags":["union-based-sqli","error-based-sqli","time-based-sqli","nosql-operator-injection","ssrf-cloud-metadata","command-injection-time-delay"],"techniqueDetails":["SQL injection testing covers union-based, error-based, and time-based techniques.","NoSQL testing uses MongoDB operator injection such as $ne, $gt, and $regex.","SSRF testing targets cloud metadata endpoints, internal services, and bypass filters.","Command injection detection uses time delays and output-based indicators."],"tools":["sqlmap","burp-suite","nosqlmap","ssrfmap","commix"],"targetTypes":["api","web-application","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Covers multiple API injection classes (SQLi, NoSQLi, SSRF, command injection) in a single workflow with automatic payload generation and detection functions.","Maps to OWASP API8:2023 and API7:2023 SSRF, and includes a realistic e-commerce API assessment scenario."],"familyIds":["api-injection-testing"]},{"id":"exploiting-aws-with-pacu","summary":"End-to-end Pacu workflow for authorized AWS penetration testing: session/credential setup, IAM enumeration, automated privilege-escalation scanning, persistence via backdoor keys/role trusts, and data access in EC2/S3/Secrets Manager.","primaryDomain":"cloud-security","domainTags":["aws-security","iam","privilege-escalation","persistence"],"capabilityTags":["aws-penetration-testing","iam-enumeration","privilege-escalation-scanning","persistence-backdooring","cloud-data-enumeration"],"capabilityDetails":["Provides an end-to-end workflow for running Pacu against AWS, including IAM enumeration, automated privilege-escalation scanning, persistence via backdoor keys and role trusts, and data access in EC2, S3, and Secrets Manager."],"techniqueTags":["iam-privesc-scan","backdoor-access-keys","assume-role-trust-abuse","ec2-enum","s3-download","secrets-enum"],"techniqueDetails":["Uses iam__privesc_scan to check the compromised principal against known AWS IAM privilege-escalation primitives and optionally auto-exploit them.","Creates backdoor access keys with iam__backdoor_users_keys or adds attacker-controlled trusts with iam__backdoor_assume_role.","Enumerates EC2 instances, S3 buckets, and Secrets Manager/SSM parameters using dedicated Pacu modules."],"tools":["pacu","aws-cli"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","exploitation","post-exploitation","reporting","remediation"],"distinctiveFeatures":["End-to-end Pacu-specific workflow for AWS post-compromise exploitation, covering session setup, IAM privesc scanning, persistence/backdooring, and cleanup — rather than general AWS security assessment or a single technique.","Includes non-interactive execution for CI/scripting and explicit OPSEC/detection considerations with cleanup guidance."],"familyIds":["cloud-offensive-security-and-emulation"]},{"id":"exploiting-bgp-hijacking-vulnerabilities","summary":"A specialized playbook for safely simulating BGP prefix hijacking and route leaks in isolated lab environments, validating RPKI/ROA defenses, and setting up BGP anomaly monitoring to assess an organization's resilience to internet routing attacks.","primaryDomain":"network-security","domainTags":["bgp","routing-security","rpki","route-hijacking"],"capabilityTags":["bgp-hijack-simulation","rpki-validation-testing","bgp-anomaly-detection"],"capabilityDetails":["Provides a step-by-step workflow for simulating BGP prefix hijacking and route leak attacks in isolated lab environments using Containerlab and FRRouting.","Tests the effectiveness of RPKI Route Origin Validation (ROV) and Route Origin Authorization (ROA) configurations against various hijacking techniques.","Demonstrates detection and monitoring of BGP anomalies using BGPalerter, pybgpstream, and RIPEstat."],"techniqueTags":["prefix-hijacking","more-specific-route-attack","origin-hijack","as-path-prepending","route-leak","rpki-rov"],"techniqueDetails":["Covers more-specific prefix hijacking (longest-prefix-match wins), exact-match origin hijacking, and route leak scenarios.","Explores BGP path selection attributes such as AS path length and prefix length.","Includes RPKI-based filtering using route-maps to block invalid origin announcements.","Uses BGPalerter and pybgpstream for real-time and historical anomaly detection."],"tools":["containerlab","frrouting","bgpalerter","routinator","pybgpstream","ripestat"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on BGP routing security and hijacking simulation in authorized lab environments, not general network penetration testing.","Distinctively combines attack simulation with defense validation, covering both RPKI ROV and BGP monitoring tools.","Provides a complete lab topology and configuration examples for Containerlab and FRRouting, enabling hands-on replication.","Addresses operational pitfalls such as relying solely on RPKI and ignoring more-specific route attacks."],"familyIds":["network-infrastructure-routing-and-ddos-security"]},{"id":"exploiting-broken-function-level-authorization","summary":"Provides a specialized playbook for discovering and validating Broken Function Level Authorization (BFLA) in APIs, enabling testers to detect vertical privilege escalation where regular users can access admin endpoints via direct URL access, HTTP method switching, parameter tampering, and path/version bypasses.","primaryDomain":"api-security","domainTags":["authorization","access-control","bfla","privilege-escalation"],"capabilityTags":["bfla-testing","vertical-privilege-escalation-testing","admin-endpoint-discovery","http-method-switching","parameter-tampering"],"capabilityDetails":["Provides a workflow for detecting Broken Function Level Authorization (OWASP API5:2023).","Tests whether low-privilege users can invoke admin API functions via direct endpoint access, HTTP method switching, parameter tampering, and path manipulation.","Builds a role-based access matrix to compare expected vs actual authorization per role.","Covers admin endpoint discovery from common path patterns and frontend JavaScript."],"techniqueTags":["http-method-switching","url-path-manipulation","parameter-tampering","api-version-bypass","forced-browsing","role-matrix-testing"],"techniqueDetails":["Sends the same admin request with different HTTP methods to detect method-dependent authorization.","Tests path variations (case, encoding, traversal, trailing slash, semicolons) to bypass route-level authorization.","Injects role/admin parameters into regular user requests to attempt privilege escalation.","Enumerates API versions and shadow endpoints (v1, v2, legacy, internal) that may lack authorization.","Directly requests unlinked admin endpoints based on naming conventions (forced browsing)."],"tools":["burp-suite","owasp-zap","autorize","ffuf","nuclei","python-requests"],"targetTypes":["api"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","exploitation"],"distinctiveFeatures":["Specifically targets Broken Function Level Authorization (API5:2023), not general access-control testing.","Covers multiple bypass techniques (HTTP method switching, path traversal, parameter injection, API version reuse) for vertical privilege escalation.","Includes a role-matrix testing methodology to assess RBAC enforcement across privilege levels."],"familyIds":["api-authorization-and-data-exposure-testing"]},{"id":"exploiting-broken-link-hijacking","summary":"Discovers and exploits broken link hijacking by crawling websites for external references, identifying expired or unclaimed domains/CNAMEs, and registering or provisioning them to demonstrate impact.","primaryDomain":"web-security","domainTags":["broken-link-hijacking","subdomain-takeover","supply-chain"],"capabilityTags":["dead-link-discovery","expired-domain-detection","dangling-cname-identification","external-script-hijacking"],"capabilityDetails":["Provides a workflow for discovering dead external links and exploiting unclaimed resources."],"techniqueTags":["cname-dangling","whois-lookup","http-status-check","dns-resolution","resource-fingerprinting"],"techniqueDetails":["Uses DNS, WHOIS, and HTTP status checks to identify expired or unclaimed external resources."],"tools":["broken-link-checker","burp-suite","scrapy","curl","whois","dig","aws-cli","subjack","nuclei","subfinder","wayback-machine","can-i-take-over-xyz"],"targetTypes":["web-application","cloud"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses on claiming expired or unclaimed external resources rather than only testing in-scope owned infrastructure.","Covers both subdomain takeover via dangling CNAME and third-party script/resource hijacking supply-chain angle.","Uses historical URL sources like the Wayback Machine to discover dead links."],"familyIds":["broken-link-hijacking"]},{"id":"exploiting-constrained-delegation-abuse","summary":"Operational playbook for exploiting Kerberos Constrained Delegation in Active Directory: enumerates delegation accounts, abuses S4U2Self/S4U2Proxy to impersonate privileged users, and accesses delegated services, including advanced alternate service name and protocol transition attacks, using Rubeus and Impacket.","primaryDomain":"active-directory","domainTags":["kerberos","delegation","windows-security"],"capabilityTags":["constrained-delegation-abuse","s4u2self-abuse","s4u2proxy-abuse","kerberos-ticket-impersonation"],"capabilityDetails":["Provides an offensive workflow to enumerate and exploit Kerberos Constrained Delegation misconfigurations in Active Directory, enabling impersonation of privileged users (e.g., Domain Admin) and access to delegated services such as CIFS, LDAP, or HTTP."],"techniqueTags":["s4u2self","s4u2proxy","protocol-transition","alternate-service-name","pass-the-ticket"],"techniqueDetails":["Uses S4U2Self to obtain a forwardable ticket for any user on behalf of the constrained delegation account, then S4U2Proxy to forward that ticket to a delegated service SPN.","Exploits lax SPN validation via alternate service names to access additional services such as LDAP for DCSync.","Identifies and leverages the TRUSTED_TO_AUTH_FOR_DELEGATION flag to impersonate users without requiring their credentials."],"tools":["Rubeus","getST.py","findDelegation.py","PowerView","BloodHound","Kekeo"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","validation","post-exploitation"],"distinctiveFeatures":["Focuses specifically on Kerberos Constrained Delegation abuse, contrasting with other AD attacks like Kerberoasting or unconstrained delegation.","Covers both Windows (Rubeus/Kekeo) and Linux (Impacket) exploitation paths, including alternate service name and protocol transition attacks.","Includes a comparison of delegation types and detection signatures for defensive awareness."],"familyIds":["kerberos-attack-and-ticket-abuse"]},{"id":"exploiting-deeplink-vulnerabilities","summary":"Provides a hands-on workflow for discovering and exploiting deep link vulnerabilities in Android and iOS apps, covering URL scheme enumeration, injection testing, intent/webview hijacking, and link verification bypass.","primaryDomain":"mobile-security","domainTags":["mobile-security","android","ios","deep-links"],"capabilityTags":["deep-link-testing","url-scheme-exploitation","intent-hijacking-testing","webview-injection-testing"],"capabilityDetails":["Provides a step-by-step workflow for enumerating deep link entry points, testing injection payloads via ADB and Frida, assessing link hijacking risks, and evaluating WebView deep link loading for redirects, file access, and JavaScript execution."],"techniqueTags":["deep-link-invocation","intent-filter-enumeration","app-links-verification","universal-links-verification","webview-payload-injection"],"techniqueDetails":["Uses ADB 'am start' commands to invoke custom URL schemes with injection payloads.","Extracts intent filters from AndroidManifest.xml and URL schemes from Info.plist to discover attack surface.","Verifies App Links and Universal Links association files to test for hijacking vulnerabilities.","Uses Frida to invoke deep links on iOS dynamically.","Tests WebView deep links for open redirects, local file access, and JavaScript execution."],"tools":["adb","drozer","apktool","frida","burp-suite"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on deep link attack surface in mobile apps, covering both Android and iOS with specific techniques for URL schemes, App Links, Universal Links, and intent hijacking."],"familyIds":["mobile-app-entry-point-security-testing"]},{"id":"exploiting-excessive-data-exposure-in-api","summary":"Tests REST and GraphQL APIs for excessive data exposure by comparing full response schemas against fields displayed in the UI, scanning for sensitive PII, internal identifiers, debug data, and over-fetching; includes Python automation scripts and a structured finding format.","primaryDomain":"api-security","domainTags":["data-exposure","pii-leakage","rest-api-security","graphql-security"],"capabilityTags":["data-exposure-testing","response-schema-analysis","sensitive-pattern-detection","graphql-over-fetching-testing","debug-data-leak-testing"],"capabilityDetails":["Provides a workflow for comparing API response schemas against UI-displayed fields to identify leaked sensitive data, including nested objects, GraphQL over-fetching, and debug/error response leakage."],"techniqueTags":["ui-vs-response-comparison","recursive-field-extraction","regex-sensitive-data-scanning","graphql-introspection","error-response-analysis"],"techniqueDetails":["Uses recursive extraction of all response fields, regex patterns for PII and credentials, GraphQL introspection queries, and analysis of debug headers/error messages."],"tools":["python","burp-suite","mitmproxy","owasp-zap","postman","jq"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation"],"distinctiveFeatures":["Specialized in excessive data exposure (OWASP API3:2023) rather than general API security testing; focuses on comparing UI-rendered fields against actual API responses, including GraphQL introspection and nested object leakage."],"familyIds":["api-authorization-and-data-exposure-testing"]},{"id":"exploiting-http-request-smuggling","summary":"A specialist playbook for detecting and exploiting HTTP request smuggling (desync) vulnerabilities in multi-tier web architectures behind proxies, load balancers, or CDNs. Covers CL.TE, TE.CL, TE.TE, and HTTP/2 smuggling techniques, manual Burp Suite Repeater methods, automated scanning with smuggler.py and HTTP Request Smuggler, and real-world impacts including front-end control bypass, user request capture, XSS escalation, and cache poisoning.","primaryDomain":"web-security","domainTags":["web-application-security","http-desync","request-smuggling"],"capabilityTags":["request-smuggling-detection","request-smuggling-exploitation","http-desync-testing","front-end-bypass","request-capture"],"capabilityDetails":["Provides a workflow for detecting and exploiting HTTP request smuggling vulnerabilities (CL.TE, TE.CL, TE.TE, and HTTP/2 variants) in multi-tier web architectures."],"techniqueTags":["cl-te-smuggling","te-cl-smuggling","te-te-smuggling","http2-request-smuggling","connection-poisoning","timing-based-detection"],"techniqueDetails":["Uses Content-Length/Transfer-Encoding parsing discrepancies between front-end and back-end servers to smuggle crafted request prefixes, with timing and differential response techniques for detection."],"tools":["Burp Suite Professional","HTTP Request Smuggler","smuggler.py","h2cSmuggler","Turbo Intruder","curl"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on HTTP request smuggling rather than general web app pentesting, covering both front-end/back-end parsing desyncs and HTTP/2 downgrade vectors.","Includes manual Burp Suite Repeater techniques alongside automated tools (smuggler.py, HTTP Request Smuggler, h2cSmuggler).","Provides concrete exploitation payloads for admin bypass, user request capture, XSS escalation, and cache poisoning."],"familyIds":["http-request-tampering-and-bypass"]},{"id":"exploiting-idor-vulnerabilities","summary":"Playbook for discovering and exploiting IDOR by manipulating object identifiers in URLs and API requests, using Burp Authorize for cross-user session testing, curl for manual validation, ffuf for enumeration, and producing structured findings.","primaryDomain":"web-security","domainTags":["access-control","idor","authorization","web-application-security"],"capabilityTags":["idor-detection","idor-exploitation","object-level-authorization-testing"],"capabilityDetails":["Provides a step-by-step workflow to identify and exploit Insecure Direct Object Reference vulnerabilities in web applications and APIs by manipulating object identifiers across user sessions."],"techniqueTags":["horizontal-idor","vertical-idor","id-enumeration","parameter-manipulation"],"techniqueDetails":["Uses Burp Authorize to replay requests with different user sessions and curl/ffuf to compare responses and enumerate object IDs."],"tools":["burp-suite-professional","burp-authorize-extension","ffuf","curl","postman","owasp-zap"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","enumeration"],"distinctiveFeatures":["Specializes exclusively in IDOR/broken object-level authorization, differentiating horizontal and vertical IDOR, with automated cross-session testing via Burp Authorize and ID enumeration."],"familyIds":["broken-object-level-authorization"]},{"id":"exploiting-insecure-data-storage-in-mobile","summary":"Provides an operational workflow for discovering and extracting sensitive data stored insecurely on Android and iOS devices, covering SharedPreferences XML, SQLite databases, keychain/keystore usage, backups, and process memory using ADB, Objection, and sqlite3.","primaryDomain":"mobile-security","domainTags":["android","ios","data-storage"],"capabilityTags":["data-storage-testing","sharedpreferences-analysis","sqlite-inspection","keychain-inspection","backup-exposure-assessment"],"capabilityDetails":["Provides an operational workflow for identifying and exploiting insecure local data storage on Android and iOS, including unencrypted databases, world-readable files, insecure SharedPreferences, plaintext credentials, and improper keychain/keystore usage."],"techniqueTags":["adb-extraction","sqlite3-inspection","objection-keychain-dump","backup-extraction","runtime-memory-search"],"techniqueDetails":["Uses adb shell run-as or adb pull to extract app-private files and SharedPreferences XML files for sensitive data grepping.","Uses sqlite3 to open and query app databases, including dumping tables and searching for sensitive columns.","Uses Objection to dump iOS keychain entries and inspect kSecAttrAccessible protection classes.","Uses adb backup and Android Backup Extractor to unpack and inspect app backup data for sensitive, non-excluded files.","Uses Objection memory search to find sensitive strings (e.g., passwords, private keys) in process memory."],"tools":["adb","objection","sqlite3","android-backup-extractor","iexplorer"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on mobile data-at-rest vulnerabilities (OWASP M9 categories / MASVS-STORAGE) rather than general mobile app testing.","Covers both Android and iOS in a single playbook, spanning storage mapping, SharedPreferences XML analysis, SQLite inspection, keychain review, backup exposure, and runtime memory extraction."],"familyIds":["mobile-data-storage-security"]},{"id":"exploiting-insecure-deserialization","summary":"Provides a multi-language workflow to detect, exploit, and validate insecure deserialization vulnerabilities in Java, PHP, .NET, and Python applications, enabling remote code execution during authorized penetration tests.","primaryDomain":"web-security","domainTags":["insecure-deserialization","web-application-security","remote-code-execution"],"capabilityTags":["deserialization-detection","gadget-chain-generation","rce-exploitation","out-of-band-validation"],"capabilityDetails":["Provides a step-by-step workflow for detecting serialized data in HTTP traffic and exploiting deserialization vulnerabilities across Java, PHP, .NET, and Python to achieve remote code execution."],"techniqueTags":["java-serialization","php-unserialize","dotnet-viewstate","python-pickle","gadget-chain","out-of-band-callback"],"techniqueDetails":["Uses marker detection (rO0AB, /wEP, etc.) to identify serialized objects.","Generates gadget chains with ysoserial, PHPGGC, and ysoserial.net for exploitation.","Confirms code execution via DNS/HTTP callbacks to interactsh or Burp Collaborator."],"tools":["ysoserial","ysoserial.net","phpggc","burp-suite","interactsh","marshalsec","freddy"],"targetTypes":["web-application","api","database","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","reporting"],"distinctiveFeatures":["Multi-language coverage (Java, PHP, .NET, Python) with language-specific payload generators and command examples.","Includes safe detection techniques like URLDNS and timing-based confirmation for blind deserialization."],"familyIds":["code-injection-and-runtime-exploitation"]},{"id":"exploiting-ipv6-vulnerabilities","summary":"Operational playbook for discovering and exploiting IPv6-specific vulnerabilities on dual-stack networks, including SLAAC/RA/NDP spoofing, DHCPv6-based DNS takeover, NTLM relay, and IPv6 tunnel bypass, with detection and remediation guidance.","primaryDomain":"network-security","domainTags":["ipv6","slaac","router-advertisement","dual-stack-security","network-protocols"],"capabilityTags":["ipv6-vulnerability-exploitation","slaac-mitm","router-advertisement-spoofing","ndp-spoofing","ipv6-tunnel-bypass"],"capabilityDetails":["Provides a workflow for discovering and exploiting IPv6-specific weaknesses, including rogue Router Advertisements, SLAAC MITM, Neighbor Discovery Protocol spoofing, and IPv6 tunneling to bypass security controls."],"techniqueTags":["slaac-spoofing","router-advertisement-injection","neighbor-discovery-spoofing","dhcpv6-dns-spoofing","ntlm-relay","ipv6-tunneling"],"techniqueDetails":["Uses rogue Router Advertisements to enable IPv6 on victims, mitm6 for DHCPv6-based DNS takeover, Neighbor Advertisement spoofing for traffic redirection, and detection of 6to4/Teredo/ISATAP tunnels to bypass IPv4-only firewall rules."],"tools":["mitm6","THC-IPv6","Scapy","nmap","tcpdump","tshark","ndpmon","impacket-ntlmrelayx"],"targetTypes":["network","windows-host"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","exploitation","validation"],"distinctiveFeatures":["Focuses specifically on IPv6 protocol attacks rather than general network penetration testing; combines SLAAC/RA/NDP spoofing with DHCPv6-based DNS takeover and IPv6 tunnel bypass."],"familyIds":["ipv6-protocol-security"]},{"id":"exploiting-jwt-algorithm-confusion-attack","summary":"Step-by-step playbook for exploiting JWT algorithm confusion attacks, covering RS256-to-HS256 downgrade, alg:none bypass, and kid/jku/x5u header injection to forge authentication tokens and escalate privileges on APIs.","primaryDomain":"api-security","domainTags":["jwt","algorithm-confusion","token-forgery","cryptographic-attack"],"capabilityTags":["jwt-algorithm-confusion-exploitation","jwt-none-algorithm-bypass","jwt-header-injection","jwt-token-forgery","authentication-bypass-testing"],"capabilityDetails":["Provides workflows for exploiting JWT algorithm confusion (RS256 to HS256), alg:none bypass, and kid/jku/x5u header injection to forge valid tokens and achieve authentication bypass."],"techniqueTags":["rs256-to-hs256-confusion","alg-none-bypass","jku-injection","kid-injection","x5u-injection"],"techniqueDetails":["Switches JWT algorithm from RS256 to HS256 and signs with the server's RSA public key as HMAC secret.","Uses 'none' and case-varied algorithm headers with various signature formats to bypass signature verification.","Injects attacker-controlled JWK Set URLs via the jku header to supply custom signing keys.","Injects SQL, path traversal, and URL payloads into the kid header to manipulate key lookup or read arbitrary files.","References x5u header injection for supplying attacker certificates via URL."],"tools":["jwt_tool","Burp Suite JWT Editor","hashcat","John the Ripper","jwt.io"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Covers a comprehensive set of JWT algorithm confusion vectors (RS256→HS256, alg:none, jku/kid/x5u) in one workflow, including multiple public key formats, privilege escalation payloads, and a report template."],"familyIds":["api-authentication-and-token-security"]},{"id":"exploiting-kerberoasting-with-impacket","summary":"Practical guide for executing Kerberoasting attacks against Active Directory service accounts using Impacket, including SPN enumeration, TGS ticket extraction, offline password cracking, and validation of recovered credentials for lateral movement.","primaryDomain":"active-directory","domainTags":["kerberoasting","active-directory","kerberos","credential-access","service-accounts"],"capabilityTags":["spn-enumeration","tgs-request","offline-hash-cracking","credential-validation"],"capabilityDetails":["Provides a step-by-step workflow for performing Kerberoasting against Active Directory: enumerating accounts with SPNs, requesting TGS tickets via Impacket's GetUserSPNs.py, cracking RC4/AES-encrypted hashes offline, and validating recovered credentials for further access."],"techniqueTags":["kerberoasting","tgs-request","offline-cracking","pass-the-hash"],"techniqueDetails":["Requests Kerberos TGS tickets for SPN-registered accounts, then cracks the encrypted tickets offline using Hashcat modes 13100 (RC4) and 19700 (AES) to recover service account passwords."],"tools":["impacket","hashcat","john-the-ripper","rubeus","powerview","crackmapexec","psexec.py","secretsdump.py"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","validation","post-exploitation"],"distinctiveFeatures":["End-to-end Kerberoasting playbook covering SPN discovery, TGS ticket requests, offline hash cracking, and credential validation, with both Linux (Impacket) and Windows (Rubeus/PowerView) implementations, plus detection and defensive guidance."],"familyIds":["kerberos-attack-and-ticket-abuse"]},{"id":"exploiting-mass-assignment-in-rest-apis","summary":"Discover and exploit mass assignment vulnerabilities in REST APIs by injecting sensitive fields like role, isAdmin, price, and email_verified into create/update requests, using manual curl commands, Burp Intruder, Arjun, and param-miner for hidden parameter discovery and automated testing.","primaryDomain":"api-security","domainTags":["mass-assignment","rest-api","privilege-escalation","orm-autobinding"],"capabilityTags":["mass-assignment-discovery","parameter-injection-testing","privilege-escalation-testing","hidden-parameter-enumeration"],"capabilityDetails":["Provides a workflow for discovering and exploiting mass assignment vulnerabilities in REST APIs by injecting hidden or unexpected parameters into create/update requests."],"techniqueTags":["parameter-injection","hidden-parameter-discovery","orm-binding-analysis","field-enumeration"],"techniqueDetails":["Uses curl, Burp Suite Intruder, Arjun, and param-miner to send sensitive fields (role, isAdmin, price, email_verified) in JSON bodies and infer unintended ORM binding from server responses."],"tools":["curl","burp-suite","postman","arjun","param-miner","owasp-zap","swagger-codegen","nuclei"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Specializes specifically in mass assignment (autobinding) as an API vulnerability class, covering privilege escalation, price manipulation, verification bypass, and relationship/foreign key attacks, with automation via multiple tools."],"familyIds":["api-authorization-and-data-exposure-testing"]},{"id":"exploiting-ms17-010-eternalblue-vulnerability","summary":"Operational playbook for detecting and exploiting MS17-010 (EternalBlue) on legacy Windows systems, using Nmap for detection, Metasploit and standalone tools for remote code execution, with post-exploitation and detection guidance.","primaryDomain":"windows-security","domainTags":["smb-security","remote-code-execution","windows-exploitation"],"capabilityTags":["eternalblue-detection","metasploit-exploitation","post-exploitation","smb-vulnerability-scanning"],"capabilityDetails":["Provides a structured workflow for detecting MS17-010 (EternalBlue) vulnerable SMBv1 hosts using Nmap NSE and Metasploit auxiliary modules.","Details exploitation using Metasploit modules (ms17_010_eternalblue, ms17_010_psexec) and standalone tools like AutoBlue-MS17-010.","Covers post-exploitation activities including persistence, credential dumping, and pivoting.","Includes detection indicators and validation criteria for authorized red-team or penetration testing engagements."],"techniqueTags":["remote-code-execution","buffer-overflow","service-exploitation","credential-dumping","pivoting"],"techniqueDetails":["Exploits a buffer overflow in Microsoft's SMBv1 implementation to achieve remote code execution.","Uses Metasploit service execution techniques (T1569.002) to run payloads.","Post-exploitation techniques include credential dumping from memory and using the compromised host as a pivot point."],"tools":["nmap","metasploit","auto-blue-ms17-010","crackmapexec"],"targetTypes":["windows-host","network"],"role":"specialist-playbook","workflowFocus":["detection","exploitation","post-exploitation"],"distinctiveFeatures":["Dedicated exclusively to the MS17-010 (EternalBlue) SMBv1 vulnerability, covering the full lifecycle from scanning to post-exploitation.","Provides multiple exploitation paths (Metasploit modules, standalone Python exploit) and mass scanning with CrackMapExec.","Includes specific detection indicators (IDS/IPS signatures, Event ID 7045) and validation criteria for authorized testing."],"familyIds":["ms17-010-eternalblue-exploitation"]},{"id":"exploiting-nopac-cve-2021-42278-42287","summary":"Provides a complete operational workflow for exploiting noPac (CVE-2021-42278/42287) in Active Directory, from vulnerability scanning and MachineAccountQuota checks to automated or manual Kerberos-based privilege escalation and DCSync credential dumping, with detection signatures and validation criteria.","primaryDomain":"active-directory","domainTags":["active-directory","kerberos","privilege-escalation","windows-security"],"capabilityTags":["nopac-exploitation","ad-privilege-escalation","dcsync-credential-dumping"],"capabilityDetails":["Provides a complete operational workflow for exploiting the noPac Active Directory privilege-escalation chain (CVE-2021-42278 and CVE-2021-42287), from vulnerability scanning and MachineAccountQuota verification to automated and manual exploitation and post-exploitation DCSync credential dumping."],"techniqueTags":["samaccountname-spoofing","kdc-pac-confusion","kerberos-ticket-forgery","s4u2self","machine-account-abuse"],"techniqueDetails":["CVE-2021-42278 enables spoofing a machine account sAMAccountName to match a Domain Controller name; CVE-2021-42287 causes KDC PAC confusion, allowing a forged TGT for the DC account. The chain uses machine account creation, renaming, TGT requests, S4U2self impersonation, and DCSync for domain compromise."],"tools":["noPac","Impacket","secretsdump.py","CrackMapExec","Rubeus","addcomputer.py","renameMachine.py","getTGT.py","getST.py"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","post-exploitation"],"distinctiveFeatures":["Dedicated to the noPac two-CVE chain rather than generic AD Kerberos attacks.","Covers both automated noPac exploitation implementations and a manual Impacket-based attack sequence.","Includes detection signatures and validation criteria specific to this privilege-escalation chain.","Provides DCSync post-exploitation steps for full domain credential dumping."],"familyIds":["specific-ad-vulnerability-exploitation"]},{"id":"exploiting-nosql-injection-vulnerabilities","summary":"A specialized playbook for detecting and exploiting NoSQL injection in MongoDB-backed web applications and APIs, covering operator-based authentication bypass, blind regex data extraction, and JavaScript injection via $where, with guidance for manual and automated testing.","primaryDomain":"injection","domainTags":["nosql-injection","database-security","web-security","api-security"],"capabilityTags":["nosql-injection-testing","authentication-bypass","data-extraction","javascript-injection"],"capabilityDetails":["Provides a workflow for detecting and exploiting NoSQL injection vulnerabilities in MongoDB and similar databases.","Includes techniques for authentication bypass using query operators, blind data extraction via regex, and arbitrary JavaScript execution through the $where operator.","Covers manual curl-based testing, automated scanning with NoSQLMap and nosqli, and integration into web application and API penetration testing."],"techniqueTags":["operator-injection","regex-blind-extraction","where-javascript-injection","time-based-detection"],"techniqueDetails":["Uses MongoDB query operators ($ne, $gt, $regex, $exists, $in) to manipulate authentication and query logic.","Character-by-character extraction using $regex boolean responses when no direct output is visible.","Exploits the $where operator to execute arbitrary JavaScript on the database server, including sleep-based timing and data exfiltration.","Includes type juggling and BSON injection concepts for bypassing input validation."],"tools":["curl","NoSQLMap","Burp Suite","nosqli","MongoDB Shell","PayloadsAllTheThings","Nuclei","Postman"],"targetTypes":["web-application","api","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Specifically targets NoSQL injection rather than SQL injection, emphasizing MongoDB operator injection and JavaScript execution.","Provides concrete authentication bypass payloads, blind regex extraction loops, and $where exploitation examples.","Combines manual testing with automated tools like NoSQLMap and nosqli, making it a specialist playbook for NoSQL backends."],"familyIds":["nosql-injection"]},{"id":"exploiting-oauth-misconfiguration","summary":"Provides a structured methodology for identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations, including redirect URI bypass, token leakage, code reuse, scope escalation, and account takeover, using Burp Suite and curl.","primaryDomain":"authentication","domainTags":["oauth","openid-connect","web-security","authorization"],"capabilityTags":["oauth-misconfiguration-testing","redirect-uri-manipulation","token-theft-testing","scope-escalation-testing","account-takeover-testing"],"capabilityDetails":["Provides structured workflows for discovering and exploiting OAuth 2.0 and OpenID Connect misconfigurations, including redirect URI manipulation, token leakage, authorization code reuse, scope escalation, and account takeover."],"techniqueTags":["redirect-uri-bypass","state-parameter-csrf","authorization-code-reuse","referer-token-leakage","scope-escalation","missing-pkce"],"techniqueDetails":["Uses a list of redirect_uri bypass payloads including subdomain tricks, path traversal, and case variations.","Tests for missing or predictable state parameters enabling CSRF on OAuth flows.","Attempts to reuse authorization codes multiple times and tests token revocation.","Checks for token leakage via Referer headers and URL fragments in implicit flows.","Manipulates OAuth scopes and tokens to escalate privileges."],"tools":["Burp Suite Professional","OWASP ZAP","Postman","curl","jwt.io","Browser DevTools"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","exploitation"],"distinctiveFeatures":["Covers OAuth provider and consumer misconfigurations end-to-end, with a heavy focus on practical redirect_uri bypass payloads and account takeover scenarios rather than just theory."],"familyIds":["oauth-idp-attacks"]},{"id":"exploiting-prototype-pollution-in-javascript","summary":"Provides a comprehensive workflow for detecting and exploiting JavaScript prototype pollution in client-side and server-side applications, including gadget chain development for DOM XSS and RCE, auth bypass, and automated scanning with tools like DOM Invader and ppfuzz.","primaryDomain":"web-security","domainTags":["prototype-pollution","javascript-security","node-js-security"],"capabilityTags":["prototype-pollution-detection","prototype-pollution-exploitation","dom-xss","server-side-rce","authentication-bypass"],"capabilityDetails":["Provides workflows to detect prototype pollution in client-side and server-side JavaScript, exploit it for DOM XSS, RCE, and privilege escalation, and validate with automated and manual methods."],"techniqueTags":["prototype-chain-pollution","gadget-chain-analysis","template-engine-gadget","dom-sink-analysis","json-parameter-pollution"],"techniqueDetails":["Uses __proto__ and constructor.prototype injection to pollute Object.prototype, then leverages application gadgets that read polluted properties to reach dangerous sinks like innerHTML, child_process, or template rendering."],"tools":["burp-suite","dom-invader","ppfuzz","nuclei","eslint-security-plugin"],"targetTypes":["web-application","api","source-code"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","reporting","remediation"],"distinctiveFeatures":["Covers both client-side and server-side prototype pollution, providing concrete gadget chains for template engines (EJS, Pug, Handlebars) and auth bypass that are rarely combined in a single skill."],"familyIds":["code-injection-and-runtime-exploitation"]},{"id":"exploiting-race-condition-vulnerabilities","summary":"Actionable workflow to detect and exploit race condition (TOCTOU) vulnerabilities in web applications by sending synchronized concurrent requests via Turbo Intruder's single-packet attack or Python threading, covering limit overrun, multi-endpoint races, and result analysis.","primaryDomain":"web-security","domainTags":["race-condition","toctou","concurrency","web-application-security"],"capabilityTags":["race-condition-exploitation","toctou-testing","limit-overrun","concurrent-request-synchronization"],"capabilityDetails":["Provides a step-by-step workflow for detecting and exploiting TOCTOU/race condition vulnerabilities in web applications using synchronized parallel requests.","Covers single-packet attacks, limit overrun scenarios, multi-endpoint race conditions, and Python threading alternatives."],"techniqueTags":["single-packet-attack","last-byte-sync","thread-based-race","request-gating"],"techniqueDetails":["Uses Turbo Intruder gate mechanism to hold requests until all are queued, then releases them simultaneously.","Leverages HTTP/2 single-packet attack to send multiple requests in one TCP packet, minimizing network jitter.","Includes Python threading barrier synchronization as an alternative for custom concurrency testing."],"tools":["Turbo Intruder","Burp Suite","Nuclei","Python","racepwn","asyncio/aiohttp"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","exploitation","validation"],"distinctiveFeatures":["Specializes specifically in race condition/TOCTOU exploitation rather than general web vulnerability testing.","Emphasizes precise HTTP/2 single-packet request synchronization via Turbo Intruder, with practical scripts for limit overrun and multi-endpoint races.","Includes guidance on analyzing race windows and confirming successful exploitation through status codes, response lengths, and backend state verification."],"familyIds":["race-condition-exploitation"]},{"id":"exploiting-server-side-request-forgery","summary":"End-to-end SSRF exploitation playbook for finding URL-fetching features, accessing cloud metadata, enumerating internal services, bypassing SSRF filters, and escalating to internal application/data compromise.","primaryDomain":"web-security","domainTags":["ssrf","cloud-security","internal-network"],"capabilityTags":["ssrf-detection","ssrf-exploitation","cloud-metadata-access","ssrf-filter-bypass","internal-network-scanning"],"capabilityDetails":["Provides a step-by-step workflow to identify SSRF-prone functionality, test for blind and full SSRF, access cloud metadata endpoints, scan internal networks, and chain SSRF to internal services for impact escalation."],"techniqueTags":["out-of-band-detection","cloud-metadata-enumeration","gopher-protocol","dns-rebinding","protocol-bypass","blind-ssrf-testing"],"techniqueDetails":["Covers OOB detection via Burp Collaborator/interactsh, encoded IP and DNS rebinding filter bypasses, and gopher/dict/file protocol abuse to reach internal services."],"tools":["Burp Suite Professional","interactsh","SSRFmap","curl","Gopherus","rbndr.us","singularity"],"targetTypes":["web-application","api","cloud","network","database","kubernetes"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Dedicated to end-to-end SSRF exploitation, including cloud metadata credential theft, internal network/service pivoting, and protocol-level bypasses.","Includes blind SSRF detection with OOB interaction and DNS rebinding."],"familyIds":["ssrf-and-open-redirect"]},{"id":"exploiting-smb-vulnerabilities-with-metasploit","summary":"Provides an advanced operational playbook for discovering and exploiting SMB vulnerabilities (EternalBlue, PrintNightmare, SMBGhost) using Metasploit alongside CrackMapExec and Impacket, including relay and pass-the-hash lateral movement, with reporting and cleanup guidance.","primaryDomain":"network-security","domainTags":["smb-security","windows-security","network-security"],"capabilityTags":["smb-enumeration","smb-vulnerability-scanning","smb-exploitation","ntlm-relay","pass-the-hash","lateral-movement"],"capabilityDetails":["Provides a comprehensive workflow for identifying and exploiting SMB protocol vulnerabilities using Metasploit and complementary tools.","Covers known critical SMB vulnerabilities such as EternalBlue (MS17-010), MS08-067, SMBGhost, and PrintNightmare.","Includes techniques for SMB relay, pass-the-hash, and lateral movement across Windows networks."],"techniqueTags":["eternalblue-exploitation","smb-relay","pass-the-hash","credential-spraying","null-session-enumeration"],"techniqueDetails":["Uses Metasploit auxiliary scanners to detect vulnerable SMB services and exploit modules to gain remote code execution.","Demonstrates SMB relay attacks using Impacket ntlmrelayx and Metasploit modules to forward NTLM authentication.","Leverages pass-the-hash with CrackMapExec and Impacket to move laterally without plaintext passwords."],"tools":["metasploit","nmap","crackmapexec","impacket","responder","enum4linux-ng"],"targetTypes":["windows-host","active-directory","network"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","detection","exploitation","post-exploitation"],"distinctiveFeatures":["Combines Metasploit exploitation with complementary tooling (CrackMapExec, Impacket, Responder) for a realistic enterprise SMB testing workflow.","Covers a broader range of SMB attack techniques than Metasploit-only guides, including relay and pass-the-hash lateral movement.","Includes specific guidance for SMB signing assessment and common pitfalls like EDR alerts and BSOD risks."],"familyIds":["network-adversary-simulation"]},{"id":"exploiting-sql-injection-vulnerabilities","summary":"A practical playbook for identifying, validating, exploiting, and reporting SQL injection vulnerabilities in web applications using manual techniques and sqlmap, with database fingerprinting, WAF bypass, and impact demonstration.","primaryDomain":"web-security","domainTags":["sql-injection","database-security"],"capabilityTags":["sql-injection-testing","blind-injection-validation","database-fingerprinting","waf-bypass"],"capabilityDetails":["Provides a complete workflow for detecting, validating, exploiting, and reporting SQL injection vulnerabilities in web applications.","Covers manual techniques and sqlmap automation across MySQL, PostgreSQL, MSSQL, and Oracle.","Includes second-order injection detection and WAF bypass methods."],"techniqueTags":["boolean-based-sqli","time-based-sqli","union-based-sqli","error-based-sqli","stacked-queries","second-order-injection"],"techniqueDetails":["Uses response differences in content length or status to infer boolean conditions.","Uses time delays via SLEEP/WAITFOR/pg_sleep to infer injection when responses are not observable.","Uses UNION SELECT to extract data from other tables in the same response.","Forces database errors to leak data via EXTRACTVALUE/UPDATEXML.","Executes multiple SQL statements via semicolon-separated stacked queries.","Tests stored payloads that execute in a later SQL query context."],"tools":["sqlmap","burp-suite","havij","jsql-injection"],"targetTypes":["web-application","api","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","reporting"],"distinctiveFeatures":["Covers the full SQLi lifecycle across four major database engines, combining manual techniques (error/union/blind/stacked/second-order) with sqlmap automation.","Includes WAF bypass tamper scripts and OS-level command execution via --os-shell."],"familyIds":["sql-injection"]},{"id":"exploiting-sql-injection-with-sqlmap","summary":"Automates detection and exploitation of SQL injection in web applications using sqlmap, including database enumeration, data extraction, WAF bypass, and evidence reporting for authorized penetration tests.","primaryDomain":"web-security","domainTags":["sql-injection","database-security"],"capabilityTags":["sql-injection-testing","database-enumeration","data-extraction","waf-bypass"],"capabilityDetails":["Provides a step-by-step automated workflow using sqlmap to test for SQL injection, enumerate database structure, extract sensitive data, and attempt OS-level access."],"techniqueTags":["union-based-sqli","boolean-based-sqli","time-based-sqli","error-based-sqli","stacked-queries","out-of-band-sqli","second-order-sqli"],"techniqueDetails":["Covers union-based, error-based, boolean blind, and time-based blind SQL injection, plus stacked queries, out-of-band exfiltration, and second-order injection concepts."],"tools":["sqlmap","burp-suite","owasp-zap","havij","jsql-injection","dbeaver","datagrip"],"targetTypes":["web-application","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","enumeration","exploitation","reporting"],"distinctiveFeatures":["Provides an end-to-end sqlmap-specific workflow from injection point identification through database enumeration, data dumping, WAF bypass, and OS-level exploitation, including report generation."],"familyIds":["sql-injection"]},{"id":"exploiting-template-injection-vulnerabilities","summary":"Operational playbook for detecting and exploiting server-side template injection vulnerabilities across multiple template engines, from identification and fingerprinting to RCE, including automated tooling and client-side injection variants.","primaryDomain":"web-security","domainTags":["template-injection","server-side-template-injection","remote-code-execution"],"capabilityTags":["ssti-detection","template-engine-identification","ssti-exploitation","csti-testing"],"capabilityDetails":["Provides a full workflow to detect and exploit Server-Side Template Injection (SSTI) across multiple template engines, including Jinja2, Twig, Freemarker, Velocity, Smarty, ERB, and Pebble, and also addresses Client-Side Template Injection (CSTI)."],"techniqueTags":["polyglot-payloads","mro-introspection","sandbox-escape","client-side-template-injection"],"techniqueDetails":["Uses engine-specific mathematical payloads to detect SSTI, then identifies the engine via behavior differences.","Leverages Python MRO and object introspection for Jinja2 RCE, and engine-specific built-in functions for other engines.","Includes automated tools tplmap and SSTImap for exploitation and OS shell access."],"tools":["curl","tplmap","SSTImap","Burp Suite Professional","PayloadsAllTheThings","OWASP ZAP"],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Covers a wide range of template engines with engine-specific detection and exploitation payloads, combining manual curl-based testing with automated tplmap/SSTImap workflows and including client-side template injection scenarios."],"familyIds":["code-injection-and-runtime-exploitation"]},{"id":"exploiting-type-juggling-vulnerabilities","summary":"Provides a hands-on exploitation workflow for PHP type juggling vulnerabilities, including loose comparison auth bypass, magic hash collisions, strcmp array bypasses, and JSON type manipulation, with manual and automated testing methods.","primaryDomain":"web-security","domainTags":["php-security","authentication-bypass","magic-hash"],"capabilityTags":["type-juggling-exploitation","authentication-bypass-testing","hash-comparison-bypass"],"capabilityDetails":["Provides a workflow for exploiting PHP type juggling vulnerabilities to bypass authentication and access controls."],"techniqueTags":["loose-comparison-bypass","magic-hash-collision","strcmp-array-bypass","json-type-control","type-coercion"],"techniqueDetails":["Exploits PHP == operator coercion where 0 equals non-numeric strings.","Uses strings whose hashes start with 0e to collide with 0.","Passes arrays to strcmp to cause NULL return treated as 0.","Controls input types via JSON to trigger loose comparison behaviors."],"tools":["burp-suite","python","payloadsallthethings","phpggc"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on PHP loose comparison edge cases, magic hash collisions, and type coercion via JSON input, unlike general auth-bypass or injection skills.","Combines manual curl payloads with Python automation and Burp Intruder for semi-automated testing."],"familyIds":["php-type-juggling-exploitation"]},{"id":"exploiting-vulnerabilities-with-metasploit-framework","summary":"Workflow for using Metasploit to validate the exploitability of scan-identified vulnerabilities, collect post-exploitation evidence, and verify patch remediation.","primaryDomain":"general-pentesting","domainTags":["vulnerability-management","metasploit","exploitation","penetration-testing"],"capabilityTags":["vulnerability-validation","post-exploitation-evidence","patch-verification"],"capabilityDetails":["Provides a structured workflow to validate CVEs using Metasploit's check command, auxiliary scanners, and exploit modules; gathers post-exploitation evidence via Meterpreter; and verifies remediation after patching."],"techniqueTags":["check-before-exploit","auxiliary-scanning","meterpreter-post-exploitation","db-import-export"],"techniqueDetails":["Uses the check command to confirm vulnerability without exploitation; uses auxiliary modules for non-intrusive scanning; uses Meterpreter post modules for impact demonstration; imports scanner results into msfdb and exports evidence."],"tools":["Metasploit Framework","msfconsole","Meterpreter","msfdb"],"targetTypes":["windows-host","web-application","database","network"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","post-exploitation","reporting","remediation"],"distinctiveFeatures":["Focuses on vulnerability management validation and patch verification with Metasploit, not just exploitation; emphasizes check-before-exploit and importing scanner data."],"familyIds":["vulnerability-validation-and-exploitation"]},{"id":"exploiting-websocket-vulnerabilities","summary":"Provides a structured workflow for penetration testing WebSocket implementations, including endpoint discovery, authentication bypass, cross-site hijacking (CSWSH), message injection, authorization, and rate limiting.","primaryDomain":"web-security","domainTags":["websocket-security","web-application-security"],"capabilityTags":["websocket-endpoint-enumeration","authentication-bypass-testing","cswsh-testing","message-injection-testing","authorization-testing","rate-limit-testing"],"capabilityDetails":["Provides a structured workflow for discovering WebSocket endpoints and testing for authentication bypass, CSWSH, message injection, message-level authorization, and rate limiting."],"techniqueTags":["origin-validation-bypass","cookie-replay","message-injection","idor","rate-limit-flooding","protocol-analysis"],"techniqueDetails":["Uses Origin header manipulation to test cross-site WebSocket hijacking.","Sends crafted WebSocket messages containing SQLi, XSS, command injection, and path traversal payloads.","Tests authorization by sending messages requesting other users' channels or admin actions.","Checks rate limiting by flooding messages and observing connection behavior."],"tools":["burp-suite","wscat","websocat","python-websockets","browser-devtools","curl"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","exploitation","analysis"],"distinctiveFeatures":["Specialized in WebSocket protocol security, covering CSWSH and message-level authorization rather than generic web app testing.","Includes both manual and Python-automated testing for WebSocket-specific attack vectors like connection-time authentication flaws and compression side-channels."],"familyIds":["websocket-security-testing"]},{"id":"exploiting-zerologon-vulnerability-cve-2020-1472","summary":"Practical exploit playbook for Zerologon (CVE-2020-1472) covering DC identification, machine account password reset via Impacket, DCSync credential dumping, pass-the-hash access, and critical password restoration, with detection and remediation guidance.","primaryDomain":"active-directory","domainTags":["active-directory","windows-security","vulnerability"],"capabilityTags":["zerologon-exploitation","dcsync","machine-account-password-reset","credential-dumping"],"capabilityDetails":["Provides a step-by-step exploit workflow for CVE-2020-1472 to reset a domain controller's machine account password to empty and dump domain credentials via DCSync, including restoration."],"techniqueTags":["netlogon-auth-bypass","aes-cfb8-iv-zero","pass-the-hash","dcsync"],"techniqueDetails":["Exploits the Netlogon AES-CFB8 zero IV flaw to bypass authentication; uses the compromised machine account for DCSync and pass-the-hash lateral movement."],"tools":["impacket","secretsdump","cve_2020_1472.py","zerologon_tester.py","crackmapexec","nmap","psexec","wmiexec"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["validation","exploitation","post-exploitation","detection","remediation"],"distinctiveFeatures":["Covers the full Zerologon lifecycle from DC identification and exploitation to credential dumping, domain admin access, and mandatory machine account password restoration, including detection and defensive guidance."],"familyIds":["specific-ad-vulnerability-exploitation"]},{"id":"expression-language-injection","summary":"Expert playbook for detecting and exploiting Expression Language injection in Java web frameworks (Spring/SpEL, Struts2/OGNL, JSP/JSF EL), covering polyglot detection, RCE payloads, sandbox bypasses, and CVE-specific exploitation.","primaryDomain":"injection","domainTags":["expression-language-injection","java-framework-security"],"capabilityTags":["el-injection-testing","rce-exploitation","sandbox-bypass","cve-exploitation"],"capabilityDetails":["Provides an expert playbook for detecting and exploiting Expression Language injection in Java frameworks (SpEL, OGNL, Java EL), including polyglot probe disambiguation, RCE payloads, sandbox bypasses, and CVE-specific attack chains."],"techniqueTags":["spel-injection","ognl-injection","java-el-injection","sandbox-bypass"],"techniqueDetails":["Uses polyglot expressions (${7*7}, #{7*7}, %{7*7}) to identify the EL engine, then applies framework-specific payloads for command execution and privilege bypass."],"tools":[],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Distinct from SSTI by targeting Java expression evaluators rather than template engines; includes Struts2 _memberAccess blacklist bypass, SpEL SimpleEvaluationContext reflection bypass, and CVE chains for Spring Cloud Gateway (CVE-2022-22947) and Confluence (CVE-2021-26084)."],"familyIds":["expression-language-injection"]},{"id":"extracting-browser-history-artifacts","summary":"Provides a forensic workflow for extracting and analyzing Chrome, Firefox, and Edge browser history, cookies, downloads, bookmarks, cache, and form data using SQLite queries, Hindsight, and NirSoft tools to build timeline evidence of user web activity.","primaryDomain":"forensics","domainTags":["browser-forensics","digital-forensics","web-history","artifact-extraction"],"capabilityTags":["browser-history-extraction","cookie-extraction","download-history-extraction","bookmark-extraction","cache-analysis","form-history-extraction","browser-artifact-analysis"],"capabilityDetails":["Provides a workflow for extracting and analyzing browser history, cookies, downloads, bookmarks, cache, and form data from Chrome, Firefox, and Edge."],"techniqueTags":["sqlite-querying","timestamp-conversion","browser-profile-analysis","artifact-hashing","cache-forensics"],"techniqueDetails":["Uses SQLite queries against browser databases, converts Chrome/Firefox timestamps, hashes artifacts for integrity, and leverages Hindsight and NirSoft tools for comprehensive extraction."],"tools":["sqlite3","hindsight","db-browser-for-sqlite","browsinghistoryview","chromecacheview","mzcacheview","kape","autopsy"],"targetTypes":["windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Focuses specifically on multi-browser (Chrome, Firefox, Edge) forensic artifact extraction, including SQLite query examples, Hindsight automation, and NirSoft utilities for history, cookies, downloads, bookmarks, cache, and form data."],"familyIds":["browser-forensics"]},{"id":"extracting-config-from-agent-tesla-rat","summary":"A specialist workflow for recovering exfiltration and C2 configuration from Agent Tesla RAT samples using .NET decompilation, string extraction, and decryption, covering SMTP/FTP/Telegram/Discord channels.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","rat","dotnet","config-extraction","credential-theft"],"capabilityTags":["malware-configuration-recovery","dotnet-decompilation","string-extraction","decryption"],"capabilityDetails":["Provides a workflow for deobfuscating and extracting embedded configuration from Agent Tesla RAT samples, including SMTP/FTP/Telegram/Discord exfiltration credentials, keylogger settings, and C2 endpoints, via .NET decompilation, string extraction, and decryption."],"techniqueTags":["dotnet-il-analysis","regex-pattern-matching","base64-decoding","xor-decryption","sha256-key-derivation"],"techniqueDetails":["Uses regex patterns to extract readable strings from .NET metadata, decodes base64-encoded blobs, and applies XOR/SHA256-based decryption to recover encrypted configuration strings."],"tools":["dnSpy","ILSpy","de4dot","Python","dnlib"],"targetTypes":["binary","windows-host"],"role":"specialist-playbook","workflowFocus":["analysis"],"distinctiveFeatures":["Focuses specifically on Agent Tesla RAT configuration extraction, covering multiple exfiltration channels (SMTP, FTP, Telegram, Discord) with automated Python scripts for string extraction and decryption, distinct from generic malware triage or other RAT config extractors."],"familyIds":["malware-c2-and-configuration-extraction"]},{"id":"extracting-credentials-from-memory-dump","summary":"Provides a step-by-step forensic workflow to extract Windows credentials—NTLM hashes, Kerberos tickets, DPAPI master keys, cached domain credentials, and cloud tokens—from memory dumps using Volatility 3 and pypykatz for incident response and credential compromise assessment.","primaryDomain":"forensics","domainTags":["memory-forensics","windows-security","incident-response","credential-extraction"],"capabilityTags":["credential-recovery","lsass-analysis","memory-dump-analysis","password-hash-extraction","kerberos-ticket-extraction"],"capabilityDetails":["Provides a step-by-step workflow for extracting cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps using Volatility 3 and pypykatz."],"techniqueTags":["windows-hashdump","lsass-dump","pypykatz-minidump","string-scanning","kerberos-ticket-extraction"],"techniqueDetails":["Uses Volatility 3 hashdump/lsadump/cachedump plugins to extract hashes and LSA secrets, dumps LSASS process memory, and runs pypykatz to parse logon sessions, NTLM hashes, Kerberos tickets, and DPAPI keys; also scans memory strings for cloud credentials and tokens."],"tools":["volatility3","pypykatz","mimikatz"],"targetTypes":["windows-host","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Covers extraction of multiple credential types from memory dumps using a combination of Volatility 3 and pypykatz, including Kerberos ticket export, DPAPI master keys, cloud credential hunt via string scanning, and a report generation step for incident response."],"familyIds":["memory-forensics"]},{"id":"extracting-iocs-from-malware-samples","summary":"Structured playbook for extracting, validating, defanging, and exporting file, network, and host IOCs from malware samples in STIX/CSV formats, enabling rapid threat-intel and detection content creation.","primaryDomain":"forensics","domainTags":["malware-analysis","threat-intelligence","indicator-of-compromise"],"capabilityTags":["ioc-extraction","ioc-validation","ioc-export","ioc-defanging","hash-computation","network-indicator-harvesting","host-artifact-harvesting"],"capabilityDetails":["Extracts file hashes (MD5, SHA-1, SHA-256, imphash, ssdeep, TLSH) from malware samples","Extracts network indicators including IPs, domains, URLs, JA3 hashes, and User-Agent strings from binaries and PCAPs","Extracts host-based artifacts such as file paths, registry keys, mutexes, and services from sandbox reports","Defangs IOCs to safely share in reports","Validates IOCs against VirusTotal","Exports IOCs in STIX 2.1 and CSV formats for TIP and SIEM ingestion"],"techniqueTags":["static-analysis","dynamic-analysis","regex-pattern-matching","pcap-analysis","pe-analysis","threat-intelligence-validation","stix-formatting","fuzzy-hashing"],"techniqueDetails":["Uses string extraction and regex patterns to identify IPs, domains, and URLs in binary files","Uses pefile to compute imphash and PE metadata from malware binaries","Uses tshark to parse PCAP for DNS queries, HTTP requests, TLS SNI, JA3 hashes, and destination IPs","Leverages sandbox reports (Cuckoo) to identify host-based artifacts like mutexes, registry keys, and services","Validates indicators via VirusTotal API and defangs them before sharing","Exports indicators using STIX 2.1 bundle and CSV formats"],"tools":["iocextract","pefile","yara-python","ssdeep","tlsh","tshark","VirusTotal","MISP","CyberChef","stix2"],"targetTypes":["binary","network","windows-host","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","reporting"],"distinctiveFeatures":["Comprehensive end-to-end IOC extraction workflow covering file, network, and host indicators from a single malware sample","Integrates IOC extraction with validation, defanging, and export to STIX/CSV for immediate threat-intel and detection use"],"familyIds":["malware-sample-analysis-and-ioc-extraction"]},{"id":"extracting-memory-artifacts-with-rekall","summary":"Analyzes Windows memory dumps with Rekall to identify hidden processes, injected code, and rootkit indicators during incident response.","primaryDomain":"forensics","domainTags":["memory-forensics","windows-forensics","incident-response"],"capabilityTags":["memory-image-analysis","process-injection-detection","hidden-process-detection","rootkit-detection"],"capabilityDetails":["Provides a workflow for analyzing Windows memory dumps using Rekall to detect process hollowing, injected code, hidden processes, and rootkits."],"techniqueTags":["process-list-comparison","vad-anomaly-analysis","injected-code-detection","module-enumeration"],"techniqueDetails":["Uses Rekall plugins to compare process lists, scan VADs for malicious allocations, detect hidden processes, and enumerate loaded modules."],"tools":["rekall"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses specifically on Rekall memory forensics with plugin-based comparison of pslist/psscan and VAD analysis via malfind, unlike generic memory forensics tools."],"familyIds":["memory-forensics"]},{"id":"extracting-windows-event-logs-artifacts","summary":"Provides a workflow for extracting, parsing, and analyzing Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and python-evtx to detect lateral movement, persistence, and privilege escalation through Sigma rules and event ID analysis.","primaryDomain":"forensics","domainTags":["windows-event-logs","digital-forensics","incident-response","threat-hunting"],"capabilityTags":["evtx-extraction","evtx-parsing","sigma-detection","timeline-generation","attack-pattern-detection"],"capabilityDetails":["Provides a step-by-step workflow for collecting EVTX files from forensic images or live systems.","Uses Chainsaw with Sigma rules for automated threat detection.","Uses Hayabusa to generate CSV and JSON timelines of relevant events.","Includes Python scripts using python-evtx to parse critical event IDs and detect specific attack patterns like Pass-the-Hash and log clearing."],"techniqueTags":["event-id-analysis","logon-type-analysis","sigma-rule-matching","python-evtx-parsing","authentication-log-analysis"],"techniqueDetails":["Maps critical Windows Event IDs to security-relevant actions (4624, 4688, 4720, etc.).","Analyzes logon types (type 3 network, type 9 pass-the-hash) to detect lateral movement.","Uses Sigma rules via Chainsaw to match event log patterns against known attack behaviors.","Custom Python scripts parse EVTX structure to extract and filter events.","Correlates multiple event IDs to reconstruct attack chains like lateral movement or privilege escalation."],"tools":["Chainsaw","Hayabusa","EvtxECmd","python-evtx"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Combines multiple EVTX parsing tools (Chainsaw, Hayabusa, python-evtx) in a single forensic workflow, with specific Python-based detection for Pass-the-Hash and log clearing beyond standard timeline generation."],"familyIds":["windows-event-log-forensics"]},{"id":"file-access-vuln","summary":"Routes file-access and upload-related testing to specialized path traversal or upload security playbooks based on entry point and processing stage.","primaryDomain":"web-security","domainTags":["file-access","upload-security","path-traversal"],"capabilityTags":["skill-routing","category-selection","workflow-guidance"],"capabilityDetails":["Provides a decision tree to route file access and upload testing to specialized playbooks based on entry point and processing stage."],"techniqueTags":["entry-point-identification","stage-classification"],"techniqueDetails":["Uses entry-point type and processing stage to decide which vulnerability playbook to follow."],"tools":[],"targetTypes":["web-application","api"],"role":"router","workflowFocus":["navigation"],"distinctiveFeatures":["Router specifically for file-access and upload workflows, bifurcating into path traversal/LFI vs upload validation/processing-chain playbooks.","Contains no exploitation steps; pure decision support based on entry point and pipeline stage."],"familyIds":["local-file-inclusion-and-arbitrary-file-download"]},{"id":"find-security-vulnerabilities-in-code","summary":"White-box source-code vulnerability review using Strix AI, which reads the repository, models data flow and authorization, and validates findings via live sandbox exploitation, producing PoCs for each confirmed vulnerability. Supports local directories, GitHub repos, and diff-scoped PR reviews.","primaryDomain":"source-code-security","domainTags":["injection","xss","ssrf","broken-access-control","idor","insecure-deserialization","secrets-in-code","unsafe-dependencies","business-logic-flaws"],"capabilityTags":["vulnerability-scanning","proof-of-concept-generation","exploit-validation","white-box-code-review","diff-scoped-review"],"capabilityDetails":["Provides white-box security review of source code using Strix, which reads the code, models data flow and authorization, and attempts real exploitation in a sandbox to produce validated findings with proof-of-concept."],"techniqueTags":["data-flow-analysis","authorization-modeling","sandbox-exploitation","ai-assisted-code-review"],"techniqueDetails":["Uses AI to reason about routes, sinks, and authorization checks from source, then validates by exploiting in a live sandbox."],"tools":["strix"],"targetTypes":["source-code","web-application","api"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","exploitation"],"distinctiveFeatures":["Every reported vulnerability is accompanied by a working proof-of-concept produced via live sandbox exploitation, not just static-analysis alerts.","Supports diff-scoped review for pull requests and can validate against a running instance of the application."],"familyIds":["source-code-sast-vulnerability-analysis"]},{"id":"fix-security-vulnerabilities-with-strix","summary":"Operational remediation playbook for fixes validated Strix pentest findings: triage by severity, patch root causes using finding artifacts and framework defenses, then verify by re-running Strix (diff-based or focused retest) and re-executing PoCs before reporting per-finding results.","primaryDomain":"general-pentesting","domainTags":["web-security","remediation","vulnerability-management"],"capabilityTags":["vulnerability-triage","root-cause-fix","fix-verification","remediation-validation","retesting"],"capabilityDetails":["Workflow to triage validated Strix pentest findings by severity, patch root causes across common vulnerability classes, and re-run Strix to prove each fix closes the exploit."],"techniqueTags":["severity-prioritization","code-diff-scanning","poc-reproduction","framework-built-in-defenses","parameterization","output-encoding"],"techniqueDetails":["Uses Strix findings with PoCs, code locations, and fix_before/fix_after suggestions to guide minimal patches and verification.","Recommends framework-native defenses (ORM parameterization, template auto-escaping, CSRF middleware, centralized authz) over ad-hoc sanitization.","Uses diff-based re-scanning with a properly resolved diff base, and focused retest via --instruction when no diff base exists."],"tools":["strix","git","curl","jq"],"targetTypes":["source-code","web-application","api"],"role":"workflow","workflowFocus":["remediation","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on remediating and verifying fixes for vulnerabilities already validated by Strix, rather than discovering or exploiting new vulnerabilities.","Explicitly differentiates OSS CLI and cloud scan artifacts and provides commands for re-scanning, budget-aware status checking, and cloud API retest endpoints.","Emphasizes proving fixes by re-running the original PoC and detecting false-clean results from budget stops or diff-base mistakes."],"familyIds":["strix-security-testing-and-remediation-workflows"]},{"id":"fleet-hunting-with-velociraptor","summary":"Deploys Velociraptor server and agents, then lets analysts write VQL artifacts and launch fleet-wide hunts to detect TTPs and collect forensic artifacts across thousands of endpoints, including offline collectors for unmanaged hosts.","primaryDomain":"forensics","domainTags":["threat-hunting","digital-forensics","endpoint-visibility","incident-response"],"capabilityTags":["velociraptor-deployment","vql-authoring","fleet-hunt-execution","forensic-artifact-collection","offline-collector-generation","endpoint-agent-enrollment"],"capabilityDetails":["Provides step-by-step deployment of a Velociraptor server, GUI admin, and endpoint agents.","Explains how to author and test VQL queries and custom artifact YAML for endpoint data collection.","Covers launching fleet-wide hunts from the GUI or server-side VQL and aggregating results.","Includes generating standalone offline collectors for unmanaged or air-gapped hosts.","Illustrates hunting for suspicious PowerShell command lines using regex-based VQL."],"techniqueTags":["vql-queries","artifact-based-collection","process-and-command-line-analysis","fleet-hunt","offline-collector","regex-based-detection"],"techniqueDetails":["Uses SQL-like VQL SELECT queries against live endpoint state via plugins such as pslist().","Packages VQL into parameterized artifact YAML documents for reuse across the fleet.","Fans a hunt out to all enrolled clients and streams structured result rows back to the server.","Builds standalone collector executables that bundle chosen artifacts into a ZIP for import.","Applies regex filters to command lines to surface encoded or download-cradle PowerShell invocations."],"tools":["velociraptor"],"targetTypes":["windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","analysis"],"distinctiveFeatures":["Fleet-scale threat hunting and DFIR with centrally managed agents rather than single-host analysis.","Heavy emphasis on authoring VQL artifacts and deploying them as hunts across hundreds or thousands of endpoints.","Includes offline collector generation for air-gapped or unmanaged hosts, a capability many endpoint tools lack.","Blends GUI and CLI/server-side VQL workflows for deployment, validation, and hunt launch."],"familyIds":["velociraptor-endpoint-collection-and-hunting"]},{"id":"format-string-exploitation","summary":"Expert playbook for exploiting format string vulnerabilities: identifies printf-family misuse, leaks stack/canary/libc/PIE values via %p/%s, and achieves arbitrary writes via %n to overwrite GOT or hook targets, with 32-/64-bit handling, FORTIFY bypass, pointer chains, and pwntools automation.","primaryDomain":"binary-exploitation","domainTags":["format-string","memory-corruption","arbitrary-write","got-overwrite"],"capabilityTags":["format-string-exploitation","stack-leaking","arbitrary-memory-write","got-overwrite","blind-exploitation"],"capabilityDetails":["Provides a workflow for identifying printf-family format string vulnerabilities and using them to leak stack values, read arbitrary memory, and write arbitrary data via %n specifiers, including GOT/hook overwrites and RCE."],"techniqueTags":["printf-format-string","positional-parameters","n-specifier-writes","stack-pointer-chains","fortify-source-bypass","64bit-null-byte-handling"],"techniqueDetails":["Uses %p/%N$p for stack and pointer leaks and %N$s for arbitrary memory reads.","Uses %n/%hn/%hhn for byte-precise arbitrary writes, including sequential and pointer-chain based writes.","Includes blind format string methodology and pwntools automation with fmtstr_payload and FmtStr."],"tools":["pwntools"],"targetTypes":["binary","linux-host","ctf"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Comprehensive format-string-specific exploit playbook covering both leak and write primitives, GOT/hook overwrites, pointer chain indirection, blind exploitation, FORTIFY_SOURCE bypass, and 64-bit null-byte handling."],"familyIds":["format-string-exploitation"]},{"id":"generating-and-analyzing-sboms","summary":"Provides a step-by-step workflow to generate CycloneDX and SPDX SBOMs from container images and filesystems using Syft, scan them for known vulnerabilities with Grype, gate CI/CD builds on severity, and sign/attest SBOMs with Cosign for tamper-evident provenance.","primaryDomain":"source-code-security","domainTags":["supply-chain-security","software-composition-analysis","vulnerability-management"],"capabilityTags":["sbom-generation","vulnerability-scanning","sbom-signing","ci-cd-gating"],"capabilityDetails":["Generates CycloneDX and SPDX SBOMs from container images and source directories using Syft.","Scans SBOMs and images for known vulnerabilities using Grype, with severity-based exit codes.","Signs and attaches SBOMs as in-toto attestations using Cosign and verifies them downstream.","Provides workflow for CI/CD integration and re-scanning of stored SBOMs on vulnerability database updates."],"techniqueTags":["dependency-inventory","cve-correlation","in-toto-attestation","severity-gating"],"techniqueDetails":["Uses Syft to generate CycloneDX and SPDX standard formats from images or directories.","Correlates SBOM component inventory against vulnerability databases using Grype.","Signs SBOMs as in-toto attestations with Cosign, supporting key and keyless (Sigstore) modes.","Enforces vulnerability policy in CI/CD using --fail-on and --only-fixed flags."],"tools":["syft","grype","cosign"],"targetTypes":["container","source-code"],"role":"specialist-playbook","workflowFocus":["analysis","detection","remediation"],"distinctiveFeatures":["Covers the full SBOM lifecycle: generation, vulnerability scanning, signing, and attestation verification.","Supports both CycloneDX and SPDX standards and multi-format output in a single pass.","Integrates CI/CD gating with severity thresholds and re-scanning of stored SBOMs on Grype DB updates."],"familyIds":["sca-dependency-scanning"]},{"id":"generating-forensic-timelines-with-hayabusa","summary":"Provides a Hayabusa-based workflow to convert Windows EVTX logs into a prioritized, chronological CSV/JSON forensic timeline using Sigma detection rules, with severity filtering, metrics, and export to Timesketch/Timeline Explorer.","primaryDomain":"forensics","domainTags":["dfir","windows-event-logs","sigma","threat-hunting"],"capabilityTags":["dfir-triage","timeline-generation","sigma-based-detection","ioc-searching"],"capabilityDetails":["Converts raw EVTX files into a prioritized chronological timeline with severity levels and MITRE ATT&CK mappings.","Applies a built-in Sigma rule library to detect suspicious activity (e.g., PowerShell, logon anomalies, persistence).","Provides metrics per computer/Event ID/log and pivot keyword extraction for hunting leads."],"techniqueTags":["sigma-rules","windows-event-analysis","powershell-detection","evtx-parsing"],"techniqueDetails":["Leverages Sigma detection rules over Windows Event IDs (4104, 4103, 4624, etc.) and Sysmon process creation.","Supports live analysis and offline EVTX parsing with UTC normalization for cross-host correlation."],"tools":["hayabusa","takajo","timeline-explorer","timesketch"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Specialized for Hayabusa, a Sigma-based EVTX timeline generator, not generic forensic analysis.","Includes output profiles for Timesketch and Timeline Explorer, plus metrics commands for per-host/Event-ID pivoting.","Covers both offline log directory analysis and live local host triage."],"familyIds":["windows-event-log-forensics"]},{"id":"generating-threat-intelligence-reports","summary":"A skill that guides creation of structured cyber threat intelligence reports at strategic, operational, and tactical levels, including flash reports, with TLP handling and confidence qualifiers.","primaryDomain":"reporting","domainTags":["threat-intelligence","cti","intelligence-reporting","tlp"],"capabilityTags":["report-writing","strategic-intelligence-report","operational-intelligence-report","tactical-intelligence-bulletin","flash-report"],"capabilityDetails":["Provides structured workflows to produce finished intelligence products tailored to executive, operational, and tactical audiences.","Includes audience-specific report formats, key judgment phrasing, and quality control checks."],"techniqueTags":["icd-203-confidence","tlp-classification","audience-segmentation","intelligence-standards"],"techniqueDetails":["Uses DNI ICD 203 confidence qualifiers (high/medium/low) to express analytical certainty.","Applies FIRST-standard Traffic Light Protocol (TLP) for controlled information sharing.","Adopts government and professional intelligence writing standards for key judgments and evidence attribution."],"tools":["ThreatConnect","Recorded Future","OpenCTI","Microsoft Word","Confluence"],"targetTypes":["other"],"role":"reporting","workflowFocus":["reporting","analysis"],"distinctiveFeatures":["Specializes in finished cyber threat intelligence reports with distinct product types (strategic, operational, tactical, flash) rather than generic report generation.","Integrates TLP distribution controls and ICD 203 confidence language into the report-writing process."],"familyIds":["threat-intelligence-report-generation"]},{"id":"ghost-bits-cast-attack","summary":"A Java-specific WAF bypass playbook exploiting 16-bit char to 8-bit byte narrowing to smuggle dangerous ASCII payloads, with recipes for SQLi, deserialization RCE, file upload, path traversal, CRLF injection, request smuggling, and SMTP injection, plus detection and validation workflows.","primaryDomain":"injection","domainTags":["java-security","waf-bypass","unicode-normalization","injection-bypass"],"capabilityTags":["waf-bypass","character-mapping","payload-generation","cve-bypass"],"capabilityDetails":["Provides a framework for generating Unicode characters that silently narrow to dangerous ASCII bytes in Java, enabling WAF/IDS bypass for multiple attack classes."],"techniqueTags":["char-to-byte-narrowing","bit-arithmetic-folding","lax-unicode-normalization","multi-view-normalization"],"techniqueDetails":["Explains three root-cause families (high-bit truncation, bit-arithmetic folding, lax Unicode normalization) and how to generate characters with desired low bytes.","Includes per-component payload recipes and a differential testing workflow to discover new narrowing sinks."],"tools":["python","yaklang"],"targetTypes":["web-application","api","network","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on Java char-to-byte narrowing ('Ghost Bits') as a WAF/IDS bypass primitive, not on a single vulnerability class.","Includes a character generator and per-component payload recipes for 10+ Java frameworks and CVEs."],"familyIds":["waf-bypass-payload-smuggling"]},{"id":"graphql-and-hidden-parameters","summary":"Focused methodology for probing GraphQL APIs through introspection, batching, and hidden parameter discovery to uncover authorization gaps and undocumented functionality.","primaryDomain":"api-security","domainTags":["graphql","api-abuse","schema-discovery"],"capabilityTags":["graphql-introspection","batch-request-testing","hidden-field-discovery","authorization-testing"],"capabilityDetails":["Provides queries and techniques for GraphQL schema introspection, including handling restricted introspection via field suggestions and type probes.","Demonstrates using GraphQL batching to amplify authorization and rate-limit testing.","Outlines discovery of hidden parameters and undocumented fields from admin docs, frontend code, and mobile bundles."],"techniqueTags":["introspection","batching","parameter-enumeration","error-based-discovery"],"techniqueDetails":["Uses __schema and __type queries to enumerate types and fields.","Uses field suggestions and known type probes when introspection is disabled.","Sends batched operations to test for IDOR and nested authorization gaps.","Identifies hidden parameters by inspecting admin documentation, frontend code, and mobile endpoint payloads."],"tools":[],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","detection","exploitation"],"distinctiveFeatures":["Combines GraphQL-specific introspection and batching techniques with hidden parameter discovery from client-side sources.","Focuses on undocumented fields and schema abuse unique to GraphQL APIs rather than general API testing."],"familyIds":["graphql-api-security-testing"]},{"id":"hack","summary":"Top-level routing skill for bug bounty, web security, API security, and authorized penetration testing. It directs agents to appropriate specialized skills based on testing phase and observed behavior, and provides expert intuitions to avoid common blind spots.","primaryDomain":"general-pentesting","domainTags":["web-security","api-security","bug-bounty"],"capabilityTags":["routing","vulnerability-triage","phase-determination","attack-surface-mapping"],"capabilityDetails":["Top-level router skill for HackSkills. It guides the agent to determine testing phase, then select the correct specialized skill based on observed behavior and attack surface."],"techniqueTags":["behavior-based-routing","signal-to-vulnerability-mapping"],"techniqueDetails":["Uses a signal-to-vulnerability routing table (e.g., input reflects into HTML -> XSS/SSTI, server fetches URL -> SSRF) to prioritize appropriate specialized skills and testing order."],"tools":[],"targetTypes":["web-application","api","mobile"],"role":"router","workflowFocus":["navigation","reconnaissance","analysis"],"distinctiveFeatures":["Entry-level router for bug bounty and authorized pentesting, distinct from leaf playbooks. Provides a compact routing table and expert-level heuristics for commonly missed attack surface areas across many vulnerability classes."],"familyIds":["security-test-routing-and-orchestration"]},{"id":"hardening-docker-containers-for-production","summary":"Provides a comprehensive, CIS Docker Benchmark v1.8.0-aligned playbook for hardening Docker containers for production, covering Dockerfile best practices, daemon TLS and logging configuration, runtime least-privilege flags, content trust, host auditing, and validation with docker-bench-security, Hadolint, and Dockle.","primaryDomain":"linux-security","domainTags":["container-security","docker","hardening","cis-benchmark"],"capabilityTags":["docker-hardening","container-image-hardening","runtime-configuration-hardening","dockerfile-linting","docker-bench-audit"],"capabilityDetails":["Provides a step-by-step workflow for hardening Dockerfiles, Docker daemon configuration, and container runtime settings for production deployment.","Includes validation techniques using docker-bench-security, Hadolint, and Dockle to audit against CIS Docker Benchmark v1.8.0."],"techniqueTags":["least-privilege","read-only-rootfs","drop-capabilities","multi-stage-builds","seccomp","apparmor"],"techniqueDetails":["Uses non-root user directives, dropped capabilities, and no-new-privileges to enforce least privilege.","Applies read-only root filesystems with tmpfs for writable directories.","Implements seccomp profiles and AppArmor for isolation.","Employ multi-stage builds and minimal base images to reduce attack surface."],"tools":["docker","docker-bench-security","hadolint","dockle","auditd"],"targetTypes":["container","linux-host"],"role":"specialist-playbook","workflowFocus":["remediation","validation","detection"],"distinctiveFeatures":["Aligns specifically with CIS Docker Benchmark v1.8.0 controls across host, daemon, images, and runtime.","Offers concrete copy-paste Dockerfile, daemon.json, and docker run commands with hardening flags.","Integrates three open-source validation tools (docker-bench-security, Hadolint, Dockle) into the workflow."],"familyIds":["linux-cis-benchmark-hardening"]},{"id":"hardening-docker-daemon-configuration","summary":"Provides a comprehensive Docker daemon hardening playbook including daemon.json configuration, user namespace remapping, TLS client authentication, seccomp/AppArmor profiles, socket protection, rootless mode, and verification via Docker Bench Security.","primaryDomain":"linux-security","domainTags":["container-security","docker-hardening","cis-benchmark"],"capabilityTags":["docker-daemon-hardening","user-namespace-remapping","tls-docker-api-security","container-runtime-security"],"capabilityDetails":["Provides hardened /etc/docker/daemon.json configuration with icc, userns-remap, no-new-privileges, live-restore, and seccomp profiles.","Generates and configures TLS certificates for authenticated remote Docker API access.","Applies Docker socket access restrictions and auditing.","Supports rootless Docker setup and content trust enforcement."],"techniqueTags":["userns-remap","no-new-privileges","seccomp","apparmor","content-trust"],"techniqueDetails":["User namespace remapping maps container root to an unprivileged host UID to prevent breakout privilege escalation.","TLS client authentication uses CA-signed certificates for both server and client.","Seccomp and AppArmor profiles restrict syscalls and application access.","Docker Bench Security automation checks daemon settings against the CIS Docker Benchmark."],"tools":["docker","dockerd","openssl","docker-bench-security"],"targetTypes":["container","linux-host"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Focuses exclusively on hardening the Docker daemon (dockerd) via daemon.json and TLS, differentiating from general Linux or container security skills.","Covers TLS certificate generation commands and user namespace remapping in depth, including rootless Docker and socket protection.","Includes automated verification and auditing with Docker Bench Security against CIS controls."],"familyIds":["linux-cis-benchmark-hardening"]},{"id":"hardening-linux-endpoint-with-cis-benchmark","summary":"A practical hardening playbook that applies CIS Benchmark controls to Linux endpoints, covering filesystem partitions, disabling unneeded services, network sysctl hardening, SSH and PAM security, auditd rules, and OpenSCAP compliance assessment.","primaryDomain":"linux-security","domainTags":["linux-security","endpoint-security","cis-benchmark","compliance"],"capabilityTags":["linux-hardening","cis-benchmark-remediation","compliance-baseline"],"capabilityDetails":["Provides a step-by-step workflow for applying CIS Benchmark recommendations to Linux endpoints, including filesystem, services, network parameters, access control, auditd, and logging."],"techniqueTags":["system-configuration-hardening","openscap-assessment","auditd-logging","ssh-pam-hardening"],"techniqueDetails":["Uses system configuration changes and kernel parameters to enforce security policies; uses OpenSCAP for automated compliance assessment; configures auditd for system call and file monitoring."],"tools":["OpenSCAP","auditd","ufw","chrony","sysctl","Ansible"],"targetTypes":["linux-host"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Offers concrete CIS Benchmark implementation commands for multiple Linux distributions (Ubuntu/RHEL/CentOS), combining manual hardening steps with OpenSCAP compliance scanning and reporting."],"familyIds":["linux-cis-benchmark-hardening"]},{"id":"hardening-windows-endpoint-with-cis-benchmark","summary":"Provides a practical methodology for hardening Windows endpoints to CIS Benchmark Level 1 or 2 using GPO baselines, validating with CIS-CAT, managing exceptions, and setting up continuous compliance monitoring.","primaryDomain":"windows-security","domainTags":["endpoint-hardening","windows-hardening","group-policy","compliance"],"capabilityTags":["cis-benchmark-hardening","endpoint-baseline-configuration","gpo-deployment","compliance-validation"],"capabilityDetails":["Provides a workflow for applying CIS Benchmark recommendations to Windows endpoints, including GPO baseline import, CIS-CAT assessment, exception handling, and continuous compliance monitoring."],"techniqueTags":["cis-benchmark-levels","gpo-import","cis-cat-assessment","exception-documentation"],"techniqueDetails":["Uses CIS Build Kit GPO templates for Level 1 or Level 2 profiles, validates compliance via CIS-CAT scans, and manages exceptions with compensating controls."],"tools":["CIS-CAT","GPMC","LGPO","PowerShell","Nessus"],"targetTypes":["windows-host","active-directory"],"role":"specialist-playbook","workflowFocus":["remediation","validation","reporting"],"distinctiveFeatures":["Targets Windows CIS Benchmark hardening specifically, with both Level 1 and Level 2 profiles","Includes GPO import/linking commands and scheduled CIS-CAT validation","Covers formal exception documentation and continuous compliance drift monitoring"],"familyIds":["windows-endpoint-hardening"]},{"id":"hash-attack-techniques","summary":"Expert playbook for attacking cryptographic hash weaknesses in CTFs and assessments: performs length extension on Merkle-Damgard hashes, generates MD5/SHA-1 collisions, recovers HMACs via timing leaks, finds truncated-hash collisions via birthday attacks, solves hash-based proof-of-work, and guides rainbow-table/password-hash decisions.","primaryDomain":"ctf","domainTags":["cryptanalysis","hash-security","ctf-cryptography"],"capabilityTags":["length-extension-exploitation","hash-collision-generation","hmac-timing-recovery","birthday-attack","proof-of-work-solving","password-hash-analysis"],"capabilityDetails":["Provides executable workflows for exploiting hash construction weaknesses: extending Merkle-Damgard MACs without the secret, generating identical/chosen-prefix MD5 and SHA-1 collisions, recovering HMAC secrets byte-by-byte via timing, finding truncated-hash collisions with birthday techniques, solving hash-based proof-of-work, and evaluating rainbow-table exposure."],"techniqueTags":["merkle-damgard-length-extension","identical-prefix-collision","chosen-prefix-collision","birthday-paradox","hmac-timing-side-channel","meet-in-the-middle"],"techniqueDetails":["Covers technical internals: using the MAC as internal hash state after padding, fastcoll/hashclash for collision pairs, median-based timing measurement for byte-by-byte HMAC recovery, O(2^(n/2)) birthday bounds, meet-in-the-middle splitting of hash computations, and time-memory tradeoffs for rainbow tables."],"tools":["HashPump","hash_extender","fastcoll","hashclash","hashcat","John the Ripper","CyberChef","hlextend"],"targetTypes":["ctf","web-application","api","binary","source-code","database","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on cryptanalytic hash attacks rather than general password cracking; explicitly distinguishes vulnerable Merkle-Damgard hashes from non-vulnerable sponge/HMAC constructions and provides both tool and custom-code paths for each attack."],"familyIds":["ctf-cryptanalysis"]},{"id":"heap-exploitation","summary":"Expert playbook for exploiting glibc ptmalloc2 heap vulnerabilities (UAF, double free, overflow, off-by-one/null) using tcache, fastbin, and unsortedbin attacks, with glibc-version-aware attack selection, heap/libc leak methods, and safe-linking handling.","primaryDomain":"binary-exploitation","domainTags":["glibc-heap","heap-memory-management","memory-corruption"],"capabilityTags":["heap-exploitation","libc-leak-development","heap-leak-development","arbitrary-write-development","code-execution-development"],"capabilityDetails":["Provides a glibc ptmalloc2 heap exploitation playbook for converting heap bugs into arbitrary write or code execution.","Documents leak methods for libc and heap bases, including safe-linking decode/encode for glibc >= 2.32.","Supports attack selection across glibc versions, including tcache, fastbin, unsortedbin, and post-2.34 targets."],"techniqueTags":["use-after-free","double-free","heap-overflow","off-by-one","tcache-poisoning","fastbin-dup","unsortedbin-attack","safe-linking-bypass"],"techniqueDetails":["UAF read/write of freed chunks to leak fd/bk or poison tcache pointers.","Double-free exploitation via tcache dup, fastbin dup, or House of Botcake depending on glibc version.","Heap overflow/off-by-one/null to corrupt next chunk metadata and create overlapping chunks.","Safe-linking (PROTECT_PTR) encode/decode for glibc >= 2.32 heap pointer protection."],"tools":["pwndbg","how2heap","heapinspect","pwntools"],"targetTypes":["binary","ctf"],"role":"specialist-playbook","workflowFocus":["detection","analysis","exploitation","knowledge-reference"],"distinctiveFeatures":["Covers ptmalloc2/glibc heap internals and version-specific attack selection rather than a single exploit technique.","Includes tcache safe-linking (PROTECT_PTR) decode/encode and glibc >= 2.34 hook-removal impact, which generic heap guides often miss.","Provides a decision tree mapping primitives (UAF, double free, overflow, off-by-one) to appropriate attacks and leak requirements."],"familyIds":["heap-exploitation"]},{"id":"hello_js_reverse_skill","summary":"Delivers an operational methodology and toolchain for reverse engineering Web API request signatures and anti-bot protections, including JSVMP-protected scripts, using Camoufox-assisted dynamic analysis and JSVMP dual-path analysis, then reproducing the logic as pure Node.js/Python protocol scripts that run stably without a browser.","primaryDomain":"reverse-engineering","domainTags":["web-security","anti-bot-bypass","javascript-obfuscation","jsvmp-protection"],"capabilityTags":["request-signature-analysis","jsvmp-dual-path-analysis","environment-emulation","signature-reproduction","pure-protocol-client-generation"],"capabilityDetails":["Provides an end-to-end workflow for reverse engineering Web API request signing and anti-bot parameter generation on authorized platforms.","Supports two complementary approaches for JSVMP-protected scripts: algorithm tracing (hook/instrumentation/logging/source-level instrumentation) and environment emulation (jsdom/vm sandbox plus browser fingerprint patching).","Uses Camoufox anti-detection browser with MCP-based tooling for dynamic debugging, network capture, JS hooking, and JSVMP interpreter instrumentation.","Enforces delivery of final implementations as pure Node.js or Python protocol scripts that do not depend on browser automation."],"techniqueTags":["jsvmp-hooking","ast-instrumentation","jsdom-env-patching","browser-hook-injection","network-capture-analysis","call-stack-tracing","signature-offline-verification","anti-debugger-bypass"],"techniqueDetails":["Uses redirect chain and loaded SDK characteristics to classify anti-bot type as signature-based, behavior-based, or pure obfuscation.","Path A for JSVMP: hooks, interpreter instrumentation, log analysis, and AST source-level instrumentation to trace the signing algorithm.","Path B for JSVMP: environment fingerprint collection with Camoufox, diff against jsdom, and layered patching (markNative, navigator, window, document, DOM layout, Symbol.toStringTag).","Validates reproduced signer with offline samples using verify_signer_offline to locate first divergence.","Includes anti-debugger techniques (debugger bypass, Function.toString protection, non-overridable hooks)."],"tools":["camoufox","jsdom","sdenv","curl_cffi","got-scraping","execjs"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis","detection","validation","exploitation"],"distinctiveFeatures":["Specializes exclusively in Web API request signature restoration and anti-bot protection bypass, especially JSVMP virtual machine protection, rather than general web vulnerability testing.","Mandates a hard checklist (repeat three checks, consult cases/ experience library, declare final intent) and four red lines that prohibit browser automation or hardcoded cookies in final protocol scripts.","Provides a documented experience library (cases/) with platform-specific case studies for TikTok, Douyin, Ruishu/Akamai, and Aliyun WAF, plus known pitfalls."],"familyIds":["web-api-signature-reverse-engineering"]},{"id":"http-host-header-attacks","summary":"Actionable specialist playbook for exploiting Host header injection and routing abuse, with practical workflows for password reset poisoning, cache poisoning, SSRF via routing, virtual host bypass, and Host validation bypass techniques.","primaryDomain":"web-security","domainTags":["injection","http-header-attacks"],"capabilityTags":["host-header-injection-testing","password-reset-poisoning","web-cache-poisoning","ssrf-via-routing","virtual-host-bypass","host-validation-bypass"],"capabilityDetails":["Provides a decision-tree workflow for discovering and exploiting Host header injection, covering password reset poisoning, web cache poisoning, SSRF via routing, virtual host bypass, and Host validation bypasses."],"techniqueTags":["host-header-injection","password-reset-poisoning","web-cache-poisoning","ssrf-via-host-header","virtual-host-enumeration","header-validation-bypass","connection-state-attack"],"techniqueDetails":["Uses direct Host mutation, override headers (X-Forwarded-Host, Forwarded), absolute-URI request lines, double Host headers, URL parser confusion, trailing dots, tab/space injection, and keep-alive connection-state tricks to bypass validation and trigger server-side Host-dependent behaviors."],"tools":["ffuf","burp-suite"],"targetTypes":["web-application","api","network","cloud"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","exploitation"],"distinctiveFeatures":["Covers unusual Host header bypasses often missed by scanners, such as double Host headers, absolute-URI override, and connection-state attacks, and maps framework-specific Host handling."],"familyIds":["http-request-parsing-and-smuggling"]},{"id":"http-parameter-pollution","summary":"A practical playbook for discovering and exploiting HTTP Parameter Pollution, emphasizing how different layers (WAF, proxy, app frameworks) interpret duplicate parameters, enabling WAF bypass, SSRF, CSRF token confusion, and business logic abuse.","primaryDomain":"web-security","domainTags":["web-security","injection","waf-bypass"],"capabilityTags":["http-parameter-pollution-testing","parser-differential-analysis","waf-bypass","ssrf-exploitation","csrf-confusion"],"capabilityDetails":["Provides a methodology to identify and exploit HTTP Parameter Pollution by analyzing how different components (WAF, proxy, application framework) parse duplicate keys.","Includes attack templates for WAF bypass, SSRF via alternate URL values, CSRF token confusion, and business logic abuse such as payment or quantity manipulation.","Covers both query string and body variants including form-urlencoded, multipart, and JSON duplicate keys."],"techniqueTags":["duplicate-key-injection","first-last-value-analysis","parameter-array-techniques","encoded-ampersand-confusion","json-duplicate-keys"],"techniqueDetails":["Uses duplicate parameter names (e.g., a=1&a=2) and observes which value each parser selects or combines.","Employs ordering swaps (a=1&a=2 vs a=2&a=1) to detect order-sensitive behavior.","Exploits array-style syntax (id[]=1&id[]=2) and nested brackets for framework-specific parsing.","Tests encoded delimiters (%26) to induce parser differentials.","Includes JSON duplicate key scenarios for applications accepting JSON bodies."],"tools":["burp-suite","owasp-zap","custom-scripts"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on parser discrepancies across the full request path (browser, CDN/WAF, reverse proxy, app framework) rather than single-server parameter handling.","Provides a server behavior matrix (PHP, ASP.NET, JSP, Django, Flask, Express, etc.) to predict which duplicate value will be used.","Includes a decision tree for choosing the correct attack template based on whether a WAF/proxy chain is present."],"familyIds":["http-request-parsing-and-smuggling"]},{"id":"http2-specific-attacks","summary":"Operational expert playbook for exploiting HTTP/2-specific attack surface: h2c smuggling to bypass proxy rules, pseudo-header injection for access control bypass, HPACK compression oracles, single-packet race conditions, H2->H1 downgrade header injection, and server push cache poisoning, including a decision tree and tooling.","primaryDomain":"web-security","domainTags":["http2","protocol-security","web-protocol"],"capabilityTags":["h2c-smuggling","pseudo-header-injection","hpack-attacks","stream-multiplexing-abuse","h2-downgrade-injection","server-push-cache-poisoning"],"capabilityDetails":["Provides an expert playbook for exploiting HTTP/2-specific protocol flaws, including h2c upgrade smuggling, pseudo-header injection, HPACK compression attacks, single-packet race conditions, RST_STREAM floods, H2 to H1 downgrade header injection, and server push cache poisoning."],"techniqueTags":["h2c-smuggling","pseudo-header-injection","hpack-compression-oracle","single-packet-race-condition","rst-stream-flood","priority-starvation","header-injection","server-push-cache-poisoning"],"techniqueDetails":["Uses h2c Upgrade header smuggling to bypass reverse proxy access controls and WAFs.","Manipulates HTTP/2 pseudo-headers to create routing discrepancies and bypass access controls.","Exploits HPACK header compression as a side-channel for token leakage or table poisoning.","Leverages HTTP/2 multiplexing to send multiple requests in a single TCP packet for race conditions.","Abuses RST_STREAM and PRIORITY frames for denial-of-service.","Exploits binary header values containing CRLF to inject headers during H2 to H1 downgrade.","Triggers server push to poison caches with attacker-controlled content."],"tools":["h2csmuggler","http2smugl","h2 (Python library)","nghttp2","Burp HTTP Request Smuggler","curl"],"targetTypes":["web-application","api","network"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on HTTP/2-unique attack surface rather than generic HTTP request smuggling.","Includes a decision tree to select the appropriate H2 attack based on proxy support, downgrade behavior, and objectives.","Covers both protocol-level exploitation (h2c, pseudo-header, HPACK) and DoS (RST_STREAM flood, priority starvation)."],"familyIds":["http-request-parsing-and-smuggling"]},{"id":"hunting-advanced-persistent-threats","summary":"Proactive APT threat hunting playbook that develops hypotheses from MITRE ATT&CK, executes endpoint and network hunts via Velociraptor/osquery/Splunk, analyzes results with the Diamond Model, and converts successful queries into Sigma detection rules for operationalization.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","mitre-attack","endpoint-security","network-security","memory-forensics"],"capabilityTags":["threat-hunting","hypothesis-driven-hunting","endpoint-querying","network-log-analysis","memory-artifact-analysis","detection-rule-development"],"capabilityDetails":["Develops threat hunting hypotheses based on MITRE ATT&CK threat actor TTPs.","Executes endpoint hunts using Velociraptor VQL and osquery SQL queries.","Analyzes network flow data (Zeek conn.log, NetFlow) to detect C2 and lateral movement.","Correlates memory artifacts to detect memory injection techniques.","Converts successful hunt queries into Sigma detection rules for SIEM portability."],"techniqueTags":["mitre-attack-mapping","threat-hunting-loop","living-off-the-land-detection","memory-injection-detection","lateral-movement-detection","sigma-rule-generation"],"techniqueDetails":["Maps ATT&CK techniques to required data sources and executes hunts against those sources.","Applies the Threat Hunting Loop framework: hypothesis → data collection → pattern analysis → response.","Hunts for living-off-the-land binaries (mshta.exe, rundll32.exe) via process execution queries.","Detects memory injection using EDR telemetry and Volatility outputs.","Identifies lateral movement through PsExec service creation (EventCode 7045).","Generates Sigma rules to translate hunt queries into SIEM-agnostic detection content."],"tools":["velociraptor","osquery","zeek","mitre-attack-navigator","splunk","elastic-security"],"targetTypes":["windows-host","linux-host","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Structured threat hunting loop with explicit hypothesis development and documentation of null results.","Combines endpoint, network, and memory artifact hunting across multiple tool platforms.","Provides concrete VQL, osquery SQL, and Splunk SPL queries for APT TTP detection.","Ends with Sigma rule conversion to operationalize successful hunts."],"familyIds":["threat-hunting-on-endpoint-and-network"]},{"id":"hunting-bootkits-in-efi-system-partition","summary":"Operational playbook to baseline the EFI System Partition, verify Secure Boot signatures, compare hashes against a golden baseline, YARA-scan for known UEFI bootkits, and validate boot entries and measured boot to expose pre-OS persistence such as ESPecter, BlackLotus, Bootkitty, Glupteba, and CosmicStrand.","primaryDomain":"forensics","domainTags":["hardware-firmware-security","uefi","bootkit","efi-system-partition"],"capabilityTags":["bootkit-hunting","efi-binary-analysis","secure-boot-verification","yara-scanning","golden-baseline-comparison"],"capabilityDetails":["Provides a workflow for baselining the EFI System Partition and hunting malicious UEFI boot loaders."],"techniqueTags":["esp-mounting","sha256-hashing","secure-boot-signature-verification","baseline-diffing","yara-scanning","measured-boot-pcr-validation","boot-entry-validation"],"techniqueDetails":["Mounts ESP read-only, hashes EFI binaries, verifies signatures, diffs against a golden baseline, scans with YARA, and validates boot entries and TPM PCRs."],"tools":["sbsigntool","pesign","efitools","efibootmgr","mokutil","UEFITool","YARA","tpm2-tools","Velociraptor","binwalk"],"targetTypes":["windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Focuses specifically on pre-OS bootkit persistence in the EFI System Partition, using ESP baselining, Secure Boot signature verification, YARA scanning, and measured boot validation to uncover threats like ESPecter, BlackLotus, Bootkitty, Glupteba, and CosmicStrand."],"familyIds":["uefi-bootkit-forensics"]},{"id":"hunting-credential-stuffing-attacks","summary":"A threat-hunting workflow that detects credential stuffing and password spraying by analyzing authentication logs for IP diversity, ASN concentration, geographic inconsistencies, and user-agent uniformity, with Python code examples.","primaryDomain":"authentication","domainTags":["credential-stuffing","password-spraying","authentication-logs","threat-hunting"],"capabilityTags":["credential-stuffing-detection","password-spray-detection","authentication-log-analysis","anomaly-detection"],"capabilityDetails":["Provides a workflow for detecting credential stuffing and password spray attacks by analyzing authentication logs for high IP diversity, ASN concentration, geographic anomalies, and user-agent uniformity."],"techniqueTags":["login-velocity-analysis","asn-diversity-analysis","geographic-correlation","user-agent-analysis"],"techniqueDetails":["Uses statistical indicators such as unique IPs per account, success rate thresholds, ASN concentration from cloud/proxy providers, geographic impossibility, and user-agent consistency to identify credential stuffing."],"tools":["python","pandas","splunk"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Specializes in credential stuffing and password spray detection using cross-cutting indicators (IP diversity, ASN, geo, user-agent) rather than relying solely on velocity thresholds; includes Python code examples for both raw logs and Splunk."],"familyIds":["authentication-threat-detection-and-user-behavior-analytics"]},{"id":"hunting-evtx-with-chainsaw","summary":"Provides commands and workflows to hunt Windows EVTX files with Chainsaw using Sigma rules, built-in rules, keyword/regex search, and artifact analysis (shimcache, SRUM, log gaps), enabling fast offline triage without a SIEM.","primaryDomain":"windows-security","domainTags":["evtx","threat-hunting","sigma","dfir","detection"],"capabilityTags":["sigma-hunting","evtx-search","artifact-analysis","threat-detection","first-response-triage"],"capabilityDetails":["Provides a workflow for hunting Windows EVTX files with Chainsaw, combining SigmaHQ rules, built-in detection rules, targeted keyword/regex search, and analysis of shimcache, SRUM, and event-log gaps.","Supports output as colorized tables, CSV, and JSON for reporting and downstream ingestion."],"techniqueTags":["sigma-rule-mapping","regex-search","tau-expression","shimcache-analysis","srum-analysis","event-log-gap-analysis"],"techniqueDetails":["Uses the SigmaHQ rule corpus and Chainsaw's mapping file to translate Sigma fields to Windows event fields.","Employs high-speed keyword/regex search and Tau expressions for time-bounded event querying.","Analyzes shimcache (AppCompatCache) with Amcache timestamp pairing to identify executed binaries.","Detects event-log gaps that may indicate log clearing or timestomp."],"tools":["chainsaw"],"targetTypes":["windows-host"],"role":"tool-guide","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Covers Chainsaw-specific workflows for both Sigma-based detection and artifact analysis (shimcache, SRUM, event-log gaps) in a single offline tool.","Focuses on first-response triage without a SIEM, with structured CSV/JSON output for reporting."],"familyIds":["evtx-log-hunting"]},{"id":"hunting-for-anomalous-powershell-execution","summary":"Hunts for malicious PowerShell activity by parsing Windows Event Logs (4104/4103) and process creation events to detect obfuscated commands, AMSI bypasses, encoded payloads, and credential dumping indicators.","primaryDomain":"windows-security","domainTags":["powershell","script-block-logging","threat-hunting","windows-event-logs"],"capabilityTags":["powershell-threat-hunting","script-block-logging-analysis","amsi-bypass-detection","obfuscation-detection","encoded-command-detection"],"capabilityDetails":["Provides a workflow for hunting malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events.","Detects obfuscated commands, AMSI bypass attempts, encoded payloads, and download cradles.","Uses ScriptBlock ID correlation to reassemble multi-part script blocks.","Scores and prioritizes findings by threat severity."],"techniqueTags":["script-block-logging","module-logging","process-creation-analysis","base64-decoding","amsi-bypass-detection","obfuscation-analysis"],"techniqueDetails":["Parses EVTX files to extract Event 4104 script block text and metadata.","Reassembles multi-part script blocks using ScriptBlock ID correlation.","Scans script text for AMSI bypass indicators, obfuscation patterns, encoded command execution, and base64 payloads.","Identifies download cradles, credential dumping, and lateral movement commands."],"tools":["python-evtx","lxml","python"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Specializes in PowerShell-specific threat hunting using Event 4104 and 4103 logs, not general endpoint analysis.","Explicitly combines AMSI bypass detection with obfuscation analysis and credential access keyword scanning.","Provides a structured EVTX parsing workflow with python-evtx, including script block reassembly via ScriptBlock ID."],"familyIds":["powershell-abuse-detection"]},{"id":"hunting-for-beaconing-with-frequency-analysis","summary":"A statistical threat-hunting playbook that uses frequency analysis, coefficient of variation, and jitter detection to uncover C2 beaconing in network traffic, with SIEM-ready queries and prioritization guidance.","primaryDomain":"network-security","domainTags":["threat-hunting","c2-detection","beaconing","network-traffic-analysis"],"capabilityTags":["beacon-detection","frequency-analysis","jitter-analysis","c2-hunting"],"capabilityDetails":["Provides a workflow for identifying command-and-control beaconing in network traffic using statistical frequency analysis.","Includes detection queries for Splunk, KQL, and Sigma to automate beacon scoring."],"techniqueTags":["coefficient-of-variation","jitter-detection","connection-interval-analysis","data-size-consistency"],"techniqueDetails":["Calculates coefficient of variation (CV) of connection intervals to detect periodic callbacks; CV below 0.20 indicates strong periodicity.","Analyzes jitter patterns to catch randomized beaconing used by frameworks like Cobalt Strike and Sunburst.","Checks data size consistency of connections to differentiate automated C2 traffic from legitimate periodic activity."],"tools":["RITA","AC-Hunter","Splunk","Elastic Security","Zeek","Suricata","FLARE","VirusTotal"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses specifically on statistical frequency analysis for beacon detection rather than signature-based C2 discovery.","Provides concrete thresholds (CV < 0.20, minimum 50 connections, interval 30s-24h) and ready-to-use SIEM queries.","Addresses sophisticated evasion techniques including jitter, DNS tunneling, and legitimate service abuse."],"familyIds":["c2-beacon-detection"]},{"id":"hunting-for-cobalt-strike-beacons","summary":"Operational playbook for detecting Cobalt Strike beacon callbacks in network traffic using TLS/JA3/JARM fingerprints, beacon timing analysis, HTTP malleable C2 profile matching, and composite scoring, with Zeek, Suricata, and Python.","primaryDomain":"network-security","domainTags":["cobalt-strike","c2","threat-hunting","network-forensics"],"capabilityTags":["beacon-detection","c2-traffic-analysis","network-traffic-analysis","tls-fingerprint-analysis"],"capabilityDetails":["Provides a multi-step workflow to detect Cobalt Strike beacons via TLS certificate, JA3/JARM fingerprinting, HTTP profile matching, and beacon interval/jitter analysis using Zeek logs, Suricata rules, and Python PCAP analysis."],"techniqueTags":["ja3-fingerprinting","jarm-fingerprinting","certificate-serial-analysis","beacon-interval-analysis","http-profile-matching","pcap-analysis"],"techniqueDetails":["Uses default TLS certificate serial 8BB00EE, JA3/JA3S/JARM fingerprints, and statistical analysis of callback intervals/jitter to identify beacon behavior."],"tools":["Zeek","Suricata","Python","scapy","dpkt","RITA"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Combines multiple independent indicators (TLS certificate, JA3/JA3S/JARM, beacon timing, HTTP malleable profile) into a composite confidence score rather than relying on a single fingerprint.","Builds detection capabilities using both Zeek network logs and Python-based PCAP analysis, offering flexibility for live traffic and offline captures."],"familyIds":["c2-beacon-detection"]},{"id":"hunting-for-command-and-control-beaconing","summary":"A proactive threat hunting playbook for detecting command-and-control beaconing via regular interval and jitter analysis of network logs, with domain reputation checks and endpoint correlation.","primaryDomain":"network-security","domainTags":["c2-beaconing","threat-hunting","network-traffic-analysis","command-and-control","dns-analysis"],"capabilityTags":["beacon-detection","frequency-analysis","jitter-detection","reputation-analysis","endpoint-correlation"],"capabilityDetails":["Provides a proactive hunt workflow to detect C2 beaconing in network traffic using frequency analysis, jitter detection, and domain reputation, then correlate with endpoint context."],"techniqueTags":["statistical-analysis","interval-analysis","jitter-analysis","dns-reputation","known-good-filtering"],"techniqueDetails":["Uses standard deviation and coefficient of variation to identify regular connection intervals.","Analyzes jitter to distinguish malicious beaconing from fixed-interval legitimate traffic.","Filters known-good periodic traffic such as Windows Update and NTP.","Checks domain age, WHOIS, certificate transparency, and threat intel for reputation."],"tools":["RITA","Splunk","Elastic Security","Zeek","Suricata","VirusTotal","PassiveDNS","Flare"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on C2 beaconing patterns (periodic intervals and jitter) rather than general C2 detection.","Combines network telemetry analysis with endpoint context and domain reputation.","Covers common C2 scenarios like Cobalt Strike, DNS tunneling, and DGA-based C2."],"familyIds":["c2-beacon-detection"]},{"id":"hunting-for-data-exfiltration-indicators","summary":"Provides a structured methodology for hunting data exfiltration indicators using network telemetry, baseline anomaly detection, MITRE ATT&CK mapping, and tool suggestions for detection and incident response.","primaryDomain":"network-security","domainTags":["threat-hunting","data-exfiltration","network-analysis","dlp","proactive-detection"],"capabilityTags":["threat-hunting-workflow","exfiltration-indicator-detection","network-telemetry-analysis","dns-tunneling-detection","volume-anomaly-detection"],"capabilityDetails":["Provides a structured hunting workflow for identifying data exfiltration indicators using network telemetry, baseline anomaly detection, and MITRE ATT&CK correlation."],"techniqueTags":["dns-tunneling","http-exfiltration","cloud-storage-exfiltration","email-exfiltration","encrypted-channel-abuse","data-staging"],"techniqueDetails":["Detects DNS tunneling via large/frequent TXT queries and volume anomalies.","Identifies HTTPS uploads to personal cloud storage and external destinations.","Correlates file access events with outbound data transfers to estimate exposure."],"tools":["Splunk","Zeek","Microsoft Defender for Cloud Apps","Netskope","Suricata","RITA","ExtraHop"],"targetTypes":["network","cloud"],"role":"general-playbook","workflowFocus":["detection","analysis","reporting","remediation"],"distinctiveFeatures":["Focuses specifically on data exfiltration detection across multiple channels rather than general network security monitoring.","Combines network telemetry (Zeek/Suricata) with baseline volume anomaly detection and MITRE ATT&CK exfiltration technique mapping.","Includes practical scenarios and an output format for incident response documentation."],"familyIds":["data-exfiltration-detection"]},{"id":"hunting-for-data-staging-before-exfiltration","summary":"Hunt for pre-exfiltration data staging by analyzing EDR/Sysmon process and file telemetry for archive tool execution, suspicious staging directories, and file consolidation patterns, producing a risk-scored report.","primaryDomain":"windows-security","domainTags":["threat-hunting","data-staging","exfiltration","t1074","edr","sysmon"],"capabilityTags":["data-staging-detection","archive-creation-monitoring","staging-directory-identification","risk-scoring","hunt-reporting"],"capabilityDetails":["Provides a structured hunt workflow to detect data staging by monitoring archive tool execution, staging directories, and file consolidation patterns using EDR/Sysmon telemetry."],"techniqueTags":["process-creation-monitoring","file-system-monitoring","archive-tool-detection","heuristic-scoring","t1074-data-staging"],"techniqueDetails":["Uses Windows Event ID 4688 and Sysmon Event IDs 1/11 to correlate process creation and file writes, applying heuristic scoring to identify anomalous staging behavior."],"tools":["sysmon","windows-event-log","python"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on pre-exfiltration data staging rather than exfiltration itself","Uses process-creation and file-system telemetry to detect archive creation and file consolidation","Includes heuristic risk scoring and structured hunt report generation"],"familyIds":["pre-exfiltration-data-staging-detection"]},{"id":"hunting-for-dcom-lateral-movement","summary":"Comprehensive threat hunting and detection engineering playbook for DCOM-based lateral movement (T1021.003), providing Sysmon configurations, Sigma rules, Splunk/KQL queries, Zeek network detection, WMI correlation, and DCOM hardening guidance.","primaryDomain":"windows-security","domainTags":["dcom","lateral-movement","threat-hunting","sysmon","rpc","wmi"],"capabilityTags":["dcom-lateral-movement-detection","threat-hunting","detection-engineering","sysmon-configuration","sigma-rule-development","zeek-detection","dcom-exposure-auditing"],"capabilityDetails":["Provides detection strategies for DCOM abuse using Sysmon, Sigma, Splunk, and Zeek.","Outlines a structured hunting workflow for T1021.003 in enterprise environments.","Includes ready-to-use Sigma rules and SIEM queries.","Gives a Sysmon configuration excerpt for process, network, and image-load events.","Shares three Sigma detection rules for DCOM abuse variants.","Provides a Zeek script for RPC endpoint mapper scanning and DCOM anomaly detection.","Includes PowerShell commands to audit and harden DCOM configuration."],"techniqueTags":["dcom-lateral-movement","mmc20-application-abuse","shellwindows-abuse","shellbrowserwindow-abuse","rpc-endpoint-mapper-analysis","wmi-event-correlation"],"techniqueDetails":["Remote execution via Distributed Component Object Model over RPC (T1021.003).","Using MMC20.Application's ExecuteShellCommand to run arbitrary commands.","ShellWindows COM object hosting in explorer.exe to execute commands stealthily.","ShellBrowserWindow similar to ShellWindows for shell execution.","Monitoring TCP 135 and dynamic high ports for DCOM activation traffic.","Correlating WMI-Activity operational events to identify DCOM-triggered WMI calls."],"tools":["Sysmon","Splunk","Elastic SIEM","Microsoft Sentinel","Sigma","Zeek","Atomic Red Team","Impacket","CIMSession/PowerShell"],"targetTypes":["active-directory","windows-host","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Covers all three DCOM lateral movement vectors (MMC20.Application, ShellBrowserWindow, ShellWindows) with a unified detection methodology.","Offers turnkey detection content across host (Sysmon, Sigma, Splunk/KQL) and network (Zeek) layers.","Includes DCOM attack surface audit and hardening guidance."],"familyIds":["lateral-movement-detection"]},{"id":"hunting-for-dcsync-attacks","summary":"A threat-hunting playbook for detecting DCSync attacks by analyzing Windows Event ID 4662 replication requests from non-domain-controller accounts, including validation and response steps.","primaryDomain":"active-directory","domainTags":["windows-security","credential-access","threat-hunting","dfir"],"capabilityTags":["dcsync-detection","replication-attack-hunting","event-id-4662-analysis","ad-replication-monitoring"],"capabilityDetails":["Provides a workflow for detecting DCSync attacks by analyzing Windows Event ID 4662 with AccessMask 0x100 and filtering for DS-Replication-Get-Changes requests from non-domain-controller accounts."],"techniqueTags":["dcsync","replication-guid-filtering","access-control-rights-analysis"],"techniqueDetails":["Focuses on the DCSync technique (T1003.006) and detection through replication rights auditing, distinguishing legitimate replication from malicious attempts using event IDs and GUIDs."],"tools":["Windows Event Viewer","Splunk","Elastic Security","Mimikatz","Impacket","BloodHound"],"targetTypes":["active-directory","windows-host","network"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","remediation"],"distinctiveFeatures":["Targets only DCSync detection through a specific event ID and GUID filter, including a validation step to exclude legitimate replication tools like Azure AD Connect."],"familyIds":["active-directory-threat-hunting"]},{"id":"hunting-for-defense-evasion-via-timestomping","summary":"Provides a specialist workflow for detecting NTFS timestomping (MITRE T1070.006) by comparing SI and FN timestamps in MFT data, with Python-based heuristic detection, confidence scoring, and corroboration via USN Journal and ShimCache.","primaryDomain":"windows-security","domainTags":["windows-forensics","ntfs-forensics","threat-hunting","defense-evasion"],"capabilityTags":["timestomping-detection","mft-timestamp-analysis","artifact-correlation","defense-evasion-hunting"],"capabilityDetails":["Provides a workflow to detect timestomping (MITRE T1070.006) by comparing $STANDARD_INFORMATION and $FILE_NAME timestamps in NTFS MFT entries.","Includes Python detection logic with five heuristic checks and confidence scoring (medium/high/critical).","Covers corroboration using USN Journal, ShimCache, and Amcache to validate findings.","Generates a structured JSON report of suspicious files."],"techniqueTags":["si-fn-timestamp-comparison","nanosecond-precision-analysis","usn-journal-correlation","shimcache-correlation","mft-parsing"],"techniqueDetails":["Compares $STANDARD_INFORMATION (SI) timestamps to $FILE_NAME (FN) timestamps; SI timestamps are user-modifiable while FN timestamps are updated by the NTFS driver.","Detects anomalies such as SI created before FN created, SI modified before FN created, zeroed nanosecond precision, large SI-FN time gaps, and SI entry modified long after creation.","Corroborates findings with USN Journal BASIC_INFO_CHANGE events and ShimCache/Amcache timestamps.","Uses MFTECmd or analyzeMFT to parse the $MFT into CSV for analysis."],"tools":["MFTECmd","analyzeMFT","Python","KAPE","FTK Imager","RawCopy","Sleuth Kit"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Dedicated entirely to timestomping detection via SI/FN timestamp comparison, rather than general timestamp analysis or broader defense-evasion hunting.","Provides custom Python detection code with confidence scoring and multiple heuristic checks, enabling automated triage.","Includes cross-validation with USN Journal, ShimCache, and Amcache, increasing confidence in findings."],"familyIds":["fileless-and-evasion-detection"]},{"id":"hunting-for-dns-based-persistence","summary":"Provides a threat hunting workflow for detecting DNS-based persistence via passive DNS history, cloud DNS audit logs, and zone transfer analysis, covering DNS hijacking, dangling CNAMEs, wildcard abuse, and unauthorized NS delegation changes.","primaryDomain":"network-security","domainTags":["dns","threat-hunting","persistence"],"capabilityTags":["dns-history-analysis","dns-audit-log-analysis","zone-transfer-analysis","persistence-hunting"],"capabilityDetails":["Provides a workflow for hunting DNS-based persistence mechanisms such as DNS hijacking, dangling CNAME records enabling subdomain takeover, wildcard DNS abuse, and unauthorized zone or NS delegation changes."],"techniqueTags":["dns-hijacking","subdomain-takeover","dangling-cname","wildcard-dns","ns-delegation-abuse"],"techniqueDetails":["Uses passive DNS history comparisons, cloud DNS audit logs, and zone transfer analysis to detect unauthorized DNS record modifications and anomalies."],"tools":["securitytrails","route53","azure-dns","cloudflare","axfr"],"targetTypes":["network","cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on DNS-based persistence that survives credential rotations and endpoint reimaging, combining passive DNS history with cloud DNS audit log analysis and zone transfer checks."],"familyIds":["dns-abuse-threat-hunting"]},{"id":"hunting-for-dns-tunneling-with-zeek","summary":"Advanced network-security playbook for hunting DNS tunneling and data exfiltration using Zeek dns.log analysis, with concrete detection queries for Zeek, Splunk, and RITA to identify high-entropy, long, and high-volume DNS queries indicative of covert channels.","primaryDomain":"network-security","domainTags":["dns-security","threat-hunting","data-exfiltration","covert-channel"],"capabilityTags":["dns-tunneling-detection","high-entropy-analysis","query-length-analysis","exfiltration-hunting"],"capabilityDetails":["Provides a workflow for detecting DNS tunneling and covert-channel data exfiltration by analyzing Zeek dns.log.","Includes specific detection queries for Zeek, Splunk, and RITA to identify high-entropy subdomains, long query lengths, unusual record types, and excessive query volumes."],"techniqueTags":["shannon-entropy","beaconing-analysis","dns-record-type-analysis","query-frequency-analysis"],"techniqueDetails":["Uses Shannon entropy thresholds (>3.5 bits/character) to detect encoded subdomain labels.","Applies query length distribution analysis (normal 20-30 chars vs >50 chars indicating tunneling).","Monitors DNS record type distribution (TXT, NULL, CNAME) for data-carrying potential.","Detects high query volume (>100 queries/hour) and unique subdomain counts (>50) per domain."],"tools":["zeek","splunk","rita"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on DNS tunneling detection using Zeek logs with concrete detection queries for Zeek, Splunk, and RITA.","Integrates multiple indicators (length, entropy, volume, record type, timing) into a cohesive hunting workflow.","References specific tunneling tools (iodine, dnscat2, DNSExfiltrator, Cobalt Strike) and MITRE ATT&CK techniques."],"familyIds":["dns-abuse-threat-hunting"]},{"id":"hunting-for-domain-fronting-c2-traffic","summary":"Provides a specialized workflow for detecting domain fronting C2 traffic by analyzing SNI-vs-HTTP-Host header mismatches in proxy logs and validating TLS certificates with pyOpenSSL.","primaryDomain":"network-security","domainTags":["domain-fronting","command-and-control","tls-inspection"],"capabilityTags":["domain-fronting-detection","c2-traffic-hunting","tls-certificate-inspection","proxy-log-analysis"],"capabilityDetails":["Provides a workflow for detecting domain fronting by comparing SNI and HTTP Host header mismatches and validating TLS certificates with pyOpenSSL."],"techniqueTags":["sni-host-mismatch-analysis","tls-certificate-validation","cdn-ip-correlation"],"techniqueDetails":["Uses comparison of SNI field to HTTP Host header to identify mismatches indicative of domain fronting."],"tools":["pyOpenSSL","cryptography"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses specifically on domain fronting C2 detection using SNI/Host header mismatch analysis and TLS certificate validation with pyOpenSSL.","Provides a structured hunting workflow tailored for proxy and TLS log analysis, correlating CDN provider IP ranges."],"familyIds":["c2-beacon-detection"]},{"id":"hunting-for-lateral-movement-via-wmi","summary":"Detects WMI-based lateral movement by analyzing Windows process creation and WMI-Activity event logs to identify WmiPrvSE.exe spawning remote shell processes and event subscription persistence.","primaryDomain":"windows-security","domainTags":["wmi","lateral-movement","threat-hunting","sysmon","windows-event-logs"],"capabilityTags":["wmi-child-process-detection","command-line-pattern-analysis","wmi-event-subscription-monitoring","lateral-movement-detection"],"capabilityDetails":["Provides a structured workflow for detecting WMI-based lateral movement by parsing process creation events and WMI-Activity logs."],"techniqueTags":["wmiprvse-child-process","wmic-process-call-create","win32-process-create","wmi-event-subscription","command-line-patterns"],"techniqueDetails":["Identifies WmiPrvSE.exe spawning cmd.exe/powershell.exe as an indicator of remote WMI execution; correlates with WMI event subscription events for persistence."],"tools":["python-evtx","lxml"],"targetTypes":["windows-host","active-directory"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses specifically on WMI lateral movement detection using WmiPrvSE.exe parent-child process relationships and WMI-Activity subscription monitoring, combining Event ID 4688 and Sysmon Event 1 with WMI-Activity operational events."],"familyIds":["lateral-movement-detection"]},{"id":"hunting-for-living-off-the-cloud-techniques","summary":"Provides a proactive, hypothesis-driven threat hunting workflow to detect adversary misuse of legitimate cloud services (Azure, AWS, GCP, SaaS) for command-and-control, data staging, and exfiltration, with practical scenarios and MITRE ATT&CK mapping.","primaryDomain":"cloud-security","domainTags":["threat-hunting","living-off-the-cloud","saas-abuse","c2"],"capabilityTags":["hunt-workflow","c2-detection","exfiltration-detection","proactive-hunting"],"capabilityDetails":["Provides a hypothesis-driven threat hunting workflow for detecting adversary abuse of legitimate cloud services for command-and-control, data staging, and exfiltration."],"techniqueTags":["web-service-c2","web-service-exfiltration","data-transfer-to-cloud"],"techniqueDetails":["Hunts for abuse of Discord webhooks, Telegram bot APIs, Azure Functions, and SaaS document storage for C2 and exfiltration."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Splunk Enterprise","Elastic Security","Sysmon","Velociraptor","Sigma Rules"],"targetTypes":["windows-host","cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Specialist playbook for proactive hunting of living-off-the-cloud tradecraft, distinct from general cloud security or endpoint detection.","Covers specific scenarios like C2 over Discord webhooks, exfiltration via Telegram bot API, dynamic C2 on Azure Functions, and data staging on Google Docs/Notion."],"familyIds":["cloud-threat-detection-and-hunting"]},{"id":"hunting-for-living-off-the-land-binaries","summary":"A structured threat-hunting workflow to detect adversaries abusing legitimate Windows binaries (LOLBins) for defense evasion, with guidance on EDR/SIEM telemetry, baselining, and detection rule creation.","primaryDomain":"windows-security","domainTags":["threat-hunting","mitre-attack","lolbins","edr","siem","proactive-detection","defense-evasion"],"capabilityTags":["lolbin-hunting","detection-engineering","edr-telemetry-analysis","threat-hunting","process-analysis"],"capabilityDetails":["Provides a step-by-step workflow for proactively hunting for adversary use of legitimate system binaries (LOLBins) using EDR/SIEM telemetry, including baselining normal behavior, identifying anomalies, and creating detection rules."],"techniqueTags":["signed-binary-proxy-execution","certutil-download-cradle","mshta-execution","rundll32-proxy-load","regsvr32-squiblydoo","bitsadmin-transfer"],"techniqueDetails":["Covers specific LOLBin techniques such as certutil downloading payloads, mshta executing HTA files, rundll32 loading DLLs via proxy, regsvr32 executing remote SCT files, and bitsadmin creating transfer jobs."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Splunk","Elastic Security","Sysmon","LOLBAS Project","Sigma Rules","Velociraptor"],"targetTypes":["windows-host","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Focuses specifically on hunting abuse of legitimate signed binaries rather than generic malware detection.","Includes concrete LOLBin examples with command-line patterns.","Provides a hunt report template for documenting findings and detection rules.","Maps to MITRE ATT&CK techniques T1218, T1197, T1140."],"familyIds":["living-off-the-land-detection"]},{"id":"hunting-for-lolbins-execution-in-endpoint-logs","summary":"Provides a structured threat-hunting workflow with ready-to-use Splunk, KQL, and Sigma detection queries for detecting execution of Living Off the Land Binaries (LOLBins) in Windows endpoint process-creation logs, mapped to MITRE ATT&CK T1218 and covering various abuse scenarios.","primaryDomain":"windows-security","domainTags":["defense-evasion","threat-hunting","endpoint-detection","living-off-the-land"],"capabilityTags":["lolbins-hunting","process-log-analysis","detection-querying","threat-hunting"],"capabilityDetails":["Provides a systematic hunting playbook for detecting abuse of legitimate Windows binaries (LOLBins) through endpoint process-creation logs, including suspicious argument analysis, parent-child relationship review, and anomaly scoring."],"techniqueTags":["certutil-download-cradle","mshta-hta-execution","regsvr32-squiblydoo","rundll32-dll-proxy","msbuild-inline-task","bits-transfer","wmic-xsl-execution"],"techniqueDetails":["Covers specific LOLBin abuse techniques such as certutil download/decode, mshta remote HTA execution, regsvr32 Squiblydoo, rundll32 DLL proxy from temp, MSBuild inline tasks, BITS transfers, and WMIC XSL execution."],"tools":["Sysmon","CrowdStrike Falcon","Microsoft Defender for Endpoint","Splunk","Elastic Security","LOLBAS Project","Sigma Rules"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Specialized in hunting LOLBins across multiple process-log sources with concrete Splunk, KQL, and Sigma detection queries, covering a wide range of specific abuse scenarios and providing a scoring framework."],"familyIds":["living-off-the-land-detection"]},{"id":"hunting-for-ntlm-relay-attacks","summary":"Provides a structured threat-hunting playbook for detecting NTLM relay attacks in Active Directory by correlating Windows Event 4624 logon anomalies, named pipe access, SMB signing status, and Responder/LLMNR poisoning signatures, with MITRE mapping to T1557.001.","primaryDomain":"active-directory","domainTags":["windows-security","active-directory","threat-hunting"],"capabilityTags":["ntlm-relay-detection","windows-event-analysis","authentication-log-analysis"],"capabilityDetails":["Provides a structured hunting workflow for detecting NTLM relay attacks using Windows Security Event 4624 and related event IDs.","Analyzes logon type 3 NTLMSSP authentications for IP-hostname mismatches, machine account anomalies, rapid multi-host authentication, named pipe access, and SMB signing status."],"techniqueTags":["ntlm-relay","llmnr-poisoning","smb-signing-audit"],"techniqueDetails":["Uses Event 4624 logon type 3 with NTLMSSP to identify relayed or coerced authentications.","Detects Responder/LLMNR poisoning signatures and cross-domain authentication anomalies.","Checks SMB signing enforcement across domain hosts to assess relay feasibility."],"tools":["python","windows-event-log"],"targetTypes":["active-directory","windows-host","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on hunting for NTLM relay attack indicators rather than general Active Directory credential abuse.","Leverages Windows Event 4624 logon type 3 plus named pipe access (5145) and SMB signing audit to correlate relay chain activity.","Maps to MITRE T1557.001 and D3FEND techniques, providing both incident investigation and detection engineering value."],"familyIds":["active-directory-threat-hunting"]},{"id":"hunting-for-persistence-mechanisms-in-windows","summary":"Systematically hunts for Windows adversary persistence across registry Run keys, services, scheduled tasks, WMI subscriptions, COM/IFEO/AppInit locations using EDR/Sysmon/Autoruns data, baseline comparison, and anomaly investigation.","primaryDomain":"windows-security","domainTags":["persistence","threat-hunting","mitre-attack"],"capabilityTags":["persistence-hunting","endpoint-telemetry-analysis","baseline-comparison","anomaly-detection","forensic-investigation"],"capabilityDetails":["Systematically collects persistence artifacts from Windows endpoints, baselines legitimate entries, and identifies anomalies in run keys, services, tasks, WMI, and other persistence locations."],"techniqueTags":["registry-run-keys","windows-services","scheduled-tasks","wmi-event-subscriptions","com-hijacking","ifeo-injection","appinit-dlls","dll-search-order-hijacking"],"techniqueDetails":["Covers T1547 sub-techniques (Run keys, Winlogon, SSP), T1543.003, T1053.005, T1546.003/010/012/015, T1574.001."],"tools":["Autoruns","Velociraptor","CrowdStrike Falcon","Sysmon","OSQuery","RECmd","Splunk"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Covers the full breadth of Windows persistence techniques in a single hunting workflow","Integrates baseline comparison (Autoruns snapshots) with EDR/Sysmon event correlation","Includes an output format for standardized findings with MITRE technique mapping"],"familyIds":["windows-persistence-detection-and-hunting"]},{"id":"hunting-for-persistence-via-wmi-subscriptions","summary":"A practical threat-hunting playbook for identifying WMI event subscription-based persistence on Windows hosts, using Sysmon and WMI activity logs, repository enumeration, and process analysis to detect and validate malicious event filters/consumers.","primaryDomain":"windows-security","domainTags":["wmi-persistence","windows-security","threat-hunting","t1546-003"],"capabilityTags":["wmi-persistence-hunting","endpoint-detection","threat-hunting","sysmon-analysis","wmi-repository-audit"],"capabilityDetails":["Provides a structured workflow to hunt for persistence via WMI event subscriptions by enumerating existing subscriptions and monitoring new creations via Sysmon and WMI Activity logs."],"techniqueTags":["wmi-event-subscription","active-script-event-consumer","command-line-event-consumer","mof-compilation","wmiprvse-process-analysis"],"techniqueDetails":["Focuses on the MITRE ATT&CK subtechnique T1546.003, analyzing the relationship between __EventFilter, __EventConsumer, and __FilterToConsumerBinding, and using consumer types and process creation to detect malicious subscriptions."],"tools":["Sysmon","Splunk","PowerShell","KQL","Sigma"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","analysis","validation","remediation"],"distinctiveFeatures":["Dedicated to WMI event subscription persistence (T1546.003), covering both static enumeration of the WMI repository and real-time monitoring of event filter/consumer/binding creation, with ready-to-use detection queries in Splunk, PowerShell, KQL, and Sigma."],"familyIds":["windows-persistence-detection-and-hunting"]},{"id":"hunting-for-process-injection-techniques","summary":"A structured threat-hunting playbook that detects process injection on Windows endpoints by analyzing Sysmon Event IDs 8 and 10, correlating source-target process relationships, filtering false positives, scoring severity, and mapping to MITRE ATT&CK T1055 sub-techniques.","primaryDomain":"windows-security","domainTags":["process-injection","windows-endpoint","sysmon","threat-hunting"],"capabilityTags":["process-injection-detection","sysmon-event-analysis","threat-hunting-playbook"],"capabilityDetails":["Provides a structured threat-hunting workflow for detecting process injection on Windows endpoints by parsing Sysmon Event IDs 1, 8, and 10, analyzing access rights, and building a source-target process relationship graph."],"techniqueTags":["create-remote-thread","dll-injection","process-hollowing"],"techniqueDetails":["Uses Sysmon Event ID 8 to detect CreateRemoteThread and Event ID 10 to identify ProcessAccess with dangerous access masks such as PROCESS_VM_WRITE and PROCESS_CREATE_THREAD, then maps findings to MITRE ATT&CK T1055 sub-techniques."],"tools":["sysmon","python"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focused specifically on process injection hunting using Sysmon Event IDs 8 and 10, with a source-target relationship graph, known-benign filtering, severity scoring, and MITRE sub-technique mapping."],"familyIds":["process-injection-detection"]},{"id":"hunting-for-registry-persistence-mechanisms","summary":"Structured hunting playbook for detecting registry-based persistence (MITRE T1547) on Windows endpoints using EDR/SIEM telemetry and covering Run/RunOnce, Winlogon, IFEO, and COM hijacking.","primaryDomain":"windows-security","domainTags":["threat-hunting","registry-persistence","mitre-attack","windows"],"capabilityTags":["registry-persistence-hunting","autostart-detection","detection-query-development"],"capabilityDetails":["Provides a structured workflow for proactively hunting registry-based persistence mechanisms using EDR/SIEM telemetry and documenting findings."],"techniqueTags":["registry-run-keys","winlogon-helper-dll","ifeo-debugger-injection","com-hijacking"],"techniqueDetails":["Covers Registry Run/RunOnce keys (T1547.001), Winlogon Helper DLL (T1547.004), IFEO debugger injection (T1546.012), and COM hijacking (T1546.015)."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Splunk Enterprise","Elastic Security","Sysmon","Velociraptor","Sigma Rules"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Focuses specifically on proactive hunting of registry persistence mechanisms rather than generic malware analysis or incident response; provides a hunt output format and covers multiple T1547 sub-techniques with EDR/SIEM integration."],"familyIds":["windows-threat-hunting"]},{"id":"hunting-for-registry-run-key-persistence","summary":"Provides a structured workflow to detect Windows registry Run key persistence (T1547.001) by analyzing Sysmon Event ID 13 logs, identifying suspicious auto-start entries, and generating detection rules.","primaryDomain":"windows-security","domainTags":["persistence","registry-run-keys","sysmon","threat-hunting","windows-forensics","mitre-attack"],"capabilityTags":["registry-run-key-hunting","persistence-detection","sysmon-analysis","detection-rule-generation"],"capabilityDetails":["Provides a structured workflow for detecting registry Run key persistence by analyzing Sysmon Event ID 13 logs."],"techniqueTags":["mitre-attack-t1547-001","sysmon-event-id-13","registry-analysis","lolbin-detection","encoded-powershell-detection"],"techniqueDetails":["Uses Sysmon Event ID 13 to identify modifications to Run and RunOnce keys, then flags suspicious executables, encoded commands, and LOLBin abuse."],"tools":["sysmon","python","splunk","elastic","azure-sentinel"],"targetTypes":["windows-host","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on T1547.001 registry Run key persistence rather than general persistence; combines Sysmon Event ID 13 analysis with baseline comparison and generation of Sigma/Splunk detection rules."],"familyIds":["windows-threat-hunting"]},{"id":"hunting-for-scheduled-task-persistence","summary":"Provides a repeatable, hypothesis-driven workflow for proactively hunting Windows Scheduled Task persistence (T1053) using SIEM/EDR queries, validating and correlating findings, and producing structured hunt reports.","primaryDomain":"windows-security","domainTags":["threat-hunting","mitre-attack","persistence","scheduled-tasks"],"capabilityTags":["hypothesis-driven-hunting","siem-querying","edr-analysis","detection-engineering"],"capabilityDetails":["Provides a hypothesis-driven threat hunting workflow for Windows Scheduled Task persistence (T1053), including SIEM/EDR query guidance, anomaly analysis, and validation of findings."],"techniqueTags":["scheduled-task-persistence","t1053","persistence","schtasks"],"techniqueDetails":["Focuses on detecting persistence via Windows Scheduled Tasks, covering task creation events (e.g., Event ID 4698), suspicious task actions, and unusual scheduling patterns."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Splunk Enterprise","Elastic Security","Sysmon","Velociraptor","Sigma Rules"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Focuses specifically on proactive hunting for scheduled-task persistence rather than general Windows persistence or incident response, with structured hypotheses, multi-platform SIEM/EDR query guidance, and a formal hunt output format."],"familyIds":["windows-threat-hunting"]},{"id":"hunting-for-shadow-copy-deletion","summary":"A threat hunting playbook that detects Volume Shadow Copy deletion (T1490) by querying SIEM and EDR telemetry, useful for identifying ransomware preparation and anti-forensics activity.","primaryDomain":"windows-security","domainTags":["threat-hunting","mitre-attack","shadow-copy","ransomware","anti-forensics"],"capabilityTags":["threat-hunting","shadow-copy-deletion-detection","ransomware-prep-hunting"],"capabilityDetails":["Provides a hypothesis-driven threat hunting workflow to detect Volume Shadow Copy deletion (T1490) across SIEM/EDR telemetry."],"techniqueTags":["vssadmin-delete","wmic-shadowcopy-delete","powershell-shadow-copy","inhibit-system-recovery"],"techniqueDetails":["Detects deletion of shadow copies via vssadmin, WMIC, and PowerShell, as well as disabling recovery mode with bcdedit."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Splunk","Elastic Security","Sysmon","Velociraptor","Sigma Rules"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Focuses specifically on hunting for shadow copy deletion as an anti-forensics/ransomware precursor, with a hypothesis-driven methodology and multi-tool telemetry correlation."],"familyIds":["windows-threat-hunting"]},{"id":"hunting-for-spearphishing-indicators","summary":"Provides a structured, hypothesis-driven workflow to proactively hunt for spearphishing indicators across endpoint, email, and network telemetry using EDR and SIEM tools, enabling early detection of T1566 campaigns.","primaryDomain":"forensics","domainTags":["threat-hunting","email-security","endpoint-security","network-security","mitre-attack"],"capabilityTags":["threat-hunting","indicator-correlation","log-analysis","detection-engineering"],"capabilityDetails":["Provides a structured workflow for proactively hunting spearphishing indicators across email, endpoint, and network telemetry using EDR and SIEM platforms."],"techniqueTags":["spearphishing-attachment","spearphishing-link","spearphishing-via-service","t1566"],"techniqueDetails":["Focuses on detecting T1566 spearphishing sub-techniques by correlating email content, endpoint execution, and network communication indicators."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Splunk","Elastic Security","Sysmon","Velociraptor","Sigma Rules"],"targetTypes":["windows-host","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Combines multiple telemetry sources (email logs, EDR, SIEM, Sysmon) in a hypothesis-driven hunt workflow specifically for spearphishing indicators."],"familyIds":["threat-specific-forensic-investigations"]},{"id":"hunting-for-startup-folder-persistence","summary":"A Windows threat-hunting playbook for detecting startup folder persistence implants via file enumeration, metadata analysis, and real-time watchdog monitoring.","primaryDomain":"windows-security","domainTags":["persistence","threat-hunting","startup-folder"],"capabilityTags":["persistence-detection","filesystem-monitoring","file-metadata-analysis"],"capabilityDetails":["Provides a structured procedure for detecting startup folder persistence (T1547.001) by enumerating startup directories, analyzing file metadata, and monitoring in real time with Python watchdog."],"techniqueTags":["startup-directory-enumeration","file-signature-analysis","watchdog-monitoring","baseline-comparison"],"techniqueDetails":["Enumerates user and system startup folders, analyzes file extensions, timestamps and signatures, flags suspicious file types, and uses a watchdog FileSystemEventHandler to detect new files."],"tools":["watchdog","pefile","autoruns"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","analysis"],"distinctiveFeatures":["Specialized in T1547.001 startup folder persistence rather than general autostart mechanisms, with real-time filesystem monitoring and Autoruns correlation."],"familyIds":["windows-threat-hunting"]},{"id":"hunting-for-supply-chain-compromise","summary":"A specialist playbook for proactively hunting supply chain compromise by querying SIEM/EDR telemetry, covering trojanized updates, compromised dependencies, tampered build artifacts, and vendor software attacks.","primaryDomain":"network-security","domainTags":["supply-chain-security","endpoint-security","log-management","mitre-attack"],"capabilityTags":["threat-hunting","query-execution","ioc-correlation","anomaly-analysis"],"capabilityDetails":["Provides a step-by-step hypothesis-driven hunting playbook for supply chain compromise, including querying EDR/SIEM data, correlating indicators, and validating findings."],"techniqueTags":["supply-chain-compromise","dependency-compromise","update-tampering","build-pipeline-compromise"],"techniqueDetails":["Targets MITRE ATT&CK T1195 (supply chain compromise) sub-techniques T1195.001 (compromise software dependencies) and T1195.002 (compromise software supply chain), as well as T1199 (trusted relationship)."],"tools":["CrowdStrike Falcon","Microsoft Defender for Endpoint","Splunk","Elastic Security","Sysmon","Velociraptor","Sigma Rules"],"targetTypes":["windows-host","linux-host","network","source-code"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Focuses exclusively on supply chain compromise (T1195) rather than generic compromise hunting.","Includes concrete attack scenarios (SolarWinds, npm/PyPI, build server, vendor VPN) and maps to MITRE ATT&CK and D3FEND.","Provides a structured hypothesis-driven hunting methodology with a standardized output format for incident response."],"familyIds":["supply-chain-compromise-threat-hunting"]},{"id":"hunting-for-suspicious-scheduled-tasks","summary":"Provides a threat-hunting playbook to identify suspicious Windows scheduled tasks created for persistence (T1053.005), using Event ID 4698, Sysmon process creation, and scheduled task inventory analysis, with ready-to-use Splunk and KQL detection queries.","primaryDomain":"windows-security","domainTags":["persistence","scheduled-tasks","windows-event-logs","threat-hunting"],"capabilityTags":["scheduled-task-hunting","persistence-detection","event-log-correlation","baseline-analysis"],"capabilityDetails":["Provides a step-by-step hunt workflow to enumerate scheduled tasks, analyze task actions and triggers, identify hidden or disguised tasks, and correlate with process execution."],"techniqueTags":["t1053-005","schtasks-abuse","at-command","event-id-4698"],"techniqueDetails":["Hunts for persistence via Windows scheduled tasks by inspecting Task Scheduler event IDs, command-line usage, and task properties."],"tools":["schtasks","Get-ScheduledTask","Splunk","Azure Sentinel"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","enumeration"],"distinctiveFeatures":["Focused specifically on scheduled-task persistence (T1053.005) rather than general Windows persistence hunting; includes operational SIEM queries and task property analysis."],"familyIds":["windows-threat-hunting"]},{"id":"hunting-for-t1098-account-manipulation","summary":"Provides a structured hunting workflow for MITRE ATT&CK T1098 account manipulation by analyzing Windows Security Event Logs to detect privileged group changes, shadow admin indicators, and correlate with authentication timelines.","primaryDomain":"active-directory","domainTags":["windows-security","threat-hunting","persistence","mitre-attack"],"capabilityTags":["threat-hunting","event-log-analysis","account-manipulation-detection"],"capabilityDetails":["Provides a step-by-step hunting playbook for detecting account manipulation in Active Directory using Windows Security Event IDs 4738, 4728, 4732, 4756, 4670, and 5136."],"techniqueTags":["t1098-account-manipulation","sid-history-injection","group-membership-changes","shadow-admin-creation"],"techniqueDetails":["Detects privileged group membership additions, SID history injection, and shadow admin indicators to identify persistence."],"tools":["python-evtx","lxml"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses specifically on MITRE ATT&CK T1098 account manipulation rather than generic AD security monitoring.","Uses a defined set of Windows Event IDs to trace account tampering and correlate with authentication events."],"familyIds":["active-directory-threat-hunting"]},{"id":"hunting-for-unusual-network-connections","summary":"A specialist threat-hunting playbook for detecting C2 beaconing and unusual outbound network connections through hypothesis-driven SIEM/EDR querying, incorporating MITRE ATT&CK techniques and common scenario guidance.","primaryDomain":"network-security","domainTags":["threat-hunting","command-and-control","mitre-attack","anomaly-detection"],"capabilityTags":["c2-hunting","network-telemetry-analysis","proactive-detection"],"capabilityDetails":["Provides a hypothesis-driven threat hunting workflow for detecting command-and-control activity via anomalous outbound network connections using SIEM and EDR telemetry."],"techniqueTags":["application-layer-protocol","non-application-layer-protocol","non-standard-port","c2-beaconing"],"techniqueDetails":["Focuses on MITRE ATT&CK T1071 (Application Layer Protocol), T1095 (Non-Application Layer Protocol), and T1571 (Non-Standard Port) to identify C2 communication patterns."],"tools":["crowdstrike-falcon","microsoft-defender-for-endpoint","splunk","elastic-security","sysmon","velociraptor","sigma-rules"],"targetTypes":["windows-host","linux-host","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Specialized playbook for proactive C2 hunting rather than general network penetration testing","Hypothesis-driven methodology integrating MITRE ATT&CK and D3FEND","Covers multiple telemetry sources and common C2 scenarios"],"familyIds":["c2-beacon-detection"]},{"id":"hunting-for-unusual-service-installations","summary":"Parses Windows System event logs to detect unusual service installations (Event ID 7045) and flag indicators of persistence, providing risk-scored reports for threat hunting and incident response.","primaryDomain":"windows-security","domainTags":["threat-hunting","persistence","service-installation","event-7045","sysmon"],"capabilityTags":["evtx-parsing","service-installation-detection","binary-path-analysis","persistence-hunting"],"capabilityDetails":["Provides a workflow for parsing Windows System event logs (Event ID 7045) to identify unusual service installations and flag indicators of persistence."],"techniqueTags":["event-log-analysis","binary-path-heuristics","powershell-detection","baseline-comparison","risk-scoring"],"techniqueDetails":["Uses Event ID 7045 parsing, flags binary paths in temp directories or with encoded commands, detects PowerShell-based service creation, cross-references baselines, and assigns risk scores."],"tools":["python-evtx","lxml","sysmon"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on Windows service installation persistence (T1543.003) using Event ID 7045","Emphasizes binary path heuristics and baseline comparison for unusual service detection","Generates a risk-scored threat hunting report with remediation recommendations"],"familyIds":["windows-threat-hunting"]},{"id":"hunting-for-webshell-activity","summary":"A hypothesis-driven threat hunting playbook that uses EDR and SIEM telemetry to detect web shell activity on internet-facing servers through file creation, process anomalies, and HTTP request patterns, with a structured output format for findings.","primaryDomain":"web-security","domainTags":["threat-hunting","webshell","persistence","mitre-attack"],"capabilityTags":["webshell-hunting","hypothesis-driven-hunt","io-correlation"],"capabilityDetails":["Provides a structured hypothesis-driven workflow to detect web shell deployment on internet-facing servers using EDR and SIEM telemetry."],"techniqueTags":["file-creation-analysis","process-tree-analysis","http-pattern-analysis"],"techniqueDetails":["Inspects file creation in web directories, suspicious child processes from web servers, and anomalous HTTP requests to identify T1505.003 web shell activity."],"tools":["crowdstrike-falcon","microsoft-defender","splunk","elastic-security","sysmon","velociraptor","sigma"],"targetTypes":["web-application","windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on proactive hunting for T1505.003 web shells across multiple EDR/SIEM platforms using a hypothesis-driven methodology, rather than reactive detection or exploitation."],"familyIds":["web-application-defense-and-detection"]},{"id":"hunting-saas-sso-token-abuse","summary":"Provides a threat-hunting playbook that detects SaaS SSO token abuse (T1550.001) by correlating Entra ID and Okta session logs to identify token replay, impossible travel, and refresh-token reuse.","primaryDomain":"authentication","domainTags":["sso","oauth","token-theft","entra-id","okta"],"capabilityTags":["threat-hunting","session-correlation","token-replay-detection","impossible-travel-analysis","oauth-consent-hunting"],"capabilityDetails":["Provides a hypothesis-driven hunt workflow for SaaS SSO token abuse (T1550.001), correlating Entra ID SigninLogs and Okta System Logs to detect stolen-session, OAuth token, and PRT replay.","Covers session correlation by SessionId/UniqueTokenIdentifier, impossible travel within a single session, refresh-token reuse, and token use from anomalous ASNs."],"techniqueTags":["pass-the-cookie","token-replay","refresh-token-reuse","impossible-travel","session-hijacking","illicit-consent"],"techniqueDetails":["Identifies a single Entra session used from multiple IPs/ASNs via SigninLogs and AADNonInteractiveUserSignInLogs.","Detects impossible travel within an authenticated session by comparing successive sign-in locations.","Hunts Okta System Log for reused session tokens across divergent IPs or user-agents.","Flags anomalous OAuth consent grants as a token theft precursor."],"tools":["Microsoft Sentinel","Splunk","Okta System Log API","Azure CLI","curl","jq","Python"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Combines Entra ID and Okta telemetry in one playbook specifically for T1550.001 token replay.","Uses session correlation fields (SessionId/UniqueTokenIdentifier) rather than just login failures.","Provides both KQL and Splunk queries for the same hunt, plus Okta API commands and false-positive tuning."],"familyIds":["authentication-threat-detection-and-user-behavior-analytics"]},{"id":"hxbai-knowledge","summary":"Local structured vulnerability knowledge base for retrieving and ingesting exploit recipes; provides fingerprint-based recall with source-tier trust, anti-fingerprint exclusion, and writeup/transcript distillation to support CTF and pentest exploitation.","primaryDomain":"security-knowledge","domainTags":["vulnerability-knowledge","exploit-knowledge","ctf","local-knowledge-base"],"capabilityTags":["knowledge-retrieval","exploit-pattern-matching","writeup-distillation","solution-ingestion"],"capabilityDetails":["Provides a local structured knowledge base (entries/*.json) that returns curated exploit steps, key payloads, preconditions, verification oracles, and pitfalls for known vulnerability patterns across web/pwn/crypto/reverse/forensics/misc/cloud/pentest.","Supports recall and force_recall retrieval with fingerprint scoring, strict-mode filtering by source tier, and anti-fingerprint exclusion."],"techniqueTags":["fingerprint-matching","keyword-recall","source-tier-trust","anti-fingerprint-filtering"],"techniqueDetails":["Retrieval scoring uses fingerprint_hits*3 + text_hits; force_recall requires fingerprint_hits>=2 or score>=6.","Source tiers (verified/writeup/seed) determine trust; first_visit mode excludes unverified writeups.","Entries with matching anti_fingerprint are always excluded from results."],"tools":["KnowledgeStore","store.py","distill.py"],"targetTypes":["web-application","api","binary","cloud","database","ctf","network","other"],"role":"knowledge-base","workflowFocus":["knowledge-reference"],"distinctiveFeatures":["Unlike large external corpora (secknowledge-skill), this is a curated local store of high-value reusable exploit recipes with arbitrary depth.","Implements source-tier trust, strict fingerprint recall (force_recall), anti-fingerprint exclusion, and automated ingestion from writeups/transcripts."],"familyIds":["security-knowledge-management"]},{"id":"idor-broken-object-authorization","summary":"Comprehensive expert playbook for finding IDOR/BOLA vulnerabilities across APIs and web apps, covering A-B account testing, all object ID locations, HTTP method escalation, parameter pollution, mass assignment, state machine abuse, and ORM filter injection.","primaryDomain":"api-security","domainTags":["authorization","access-control","broken-object-level-authorization"],"capabilityTags":["idor-testing","bola-testing","bfla-testing","authorization-testing","mass-assignment-testing","orm-filter-injection-testing"],"capabilityDetails":["Provides a systematic workflow for discovering and validating IDOR/BOLA vulnerabilities using A-B account comparison, enumerating object identifiers across request locations, and testing HTTP methods, parameters, and serialization/deserialization edge cases."],"techniqueTags":["a-b-testing","http-method-escalation","parameter-pollution","type-confusion","id-enumeration","mass-assignment","state-machine-abuse","orm-filter-injection"],"techniqueDetails":["Uses two-account comparison to detect missing object-level authorization; tests object IDs in all request locations; abuses HTTP method differences, parameter/type confusion, and ORM filter injection to bypass checks or extract data."],"tools":["burp-suite","plormber"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","exploitation"],"distinctiveFeatures":["Covers non-obvious IDOR surfaces beyond URL parameters (headers, cookies, GraphQL, WebSockets)","Includes A-B testing methodology, BFLA, mass assignment, and ORM filter chain injection"],"familyIds":["api-authorization-and-data-exposure-testing"]},{"id":"implementing-aes-encryption-for-data-at-rest","summary":"A specialist playbook for implementing AES-256-GCM authenticated encryption for data at rest, covering key derivation, IV/nonce management, streaming large files, and concrete file format design.","primaryDomain":"security-knowledge","domainTags":["cryptography","encryption","data-at-rest","aes","symmetric-encryption"],"capabilityTags":["implementation-guidance","key-derivation","nonce-management","authenticated-encryption"],"capabilityDetails":["Provides a step-by-step workflow for implementing AES-256-GCM encryption for files and data stores, including key derivation, nonce generation, and authenticated encryption."],"techniqueTags":["aes-256-gcm","pbkdf2","argon2id","streaming-encryption"],"techniqueDetails":["Describes key derivation using PBKDF2, Argon2id, and scrypt; emphasizes secure nonce generation and nonce length; covers GCM mode and authenticated encryption."],"tools":["cryptography (Python library)"],"targetTypes":["database","other"],"role":"specialist-playbook","workflowFocus":["remediation","knowledge-reference"],"distinctiveFeatures":["Provides a concrete encrypted file format layout and validation criteria for AES-256-GCM, distinguishing it from generic cryptography guides."],"familyIds":["cryptographic-data-protection"]},{"id":"implementing-alert-fatigue-reduction","summary":"A practical workflow for SOC teams to reduce alert fatigue by measuring alert quality, tuning false-positive-heavy rules, implementing risk-based alerting and alert consolidation, and tracking improvement metrics.","primaryDomain":"security-knowledge","domainTags":["soc-operations","alert-fatigue","detection-engineering","siem"],"capabilityTags":["alert-fatigue-reduction","false-positive-tuning","risk-based-alerting","alert-consolidation","tiered-alert-routing","alert-quality-metrics"],"capabilityDetails":["Provides a structured workflow for reducing SOC alert fatigue through measurement, tuning, consolidation, and risk-based alerting."],"techniqueTags":["rule-tuning","risk-scoring","alert-deduplication","splunk-search","threshold-reduction"],"techniqueDetails":["Uses Splunk SPL queries to measure false positive rates, identify noisy rules, and track alert quality metrics.","Implements risk-based alerting by contributing risk scores to entities and triggering alerts only when cumulative risk exceeds a threshold.","Consolidates related alerts using deduplication and suppression windows.","Routes alerts into tiers based on risk score and confidence to prioritize investigations."],"tools":["Splunk ES","Elastic Detection Rules","Chronicle SOAR","Tines"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","detection","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on SOC alert fatigue reduction rather than general detection engineering or threat hunting.","Provides concrete Splunk SPL queries for risk-based alerting and alert consolidation.","Includes metrics-driven methodology to measure alert quality and track improvement over time.","Covers both rule tuning and implementation of risk-based alerting in a single coordinated workflow."],"familyIds":["soc-alert-management"]},{"id":"implementing-anti-phishing-training-program","summary":"Provides a step-by-step methodology for designing, deploying, and measuring an organizational anti-phishing training program, including baseline simulations, role-based curriculum, continuous simulated phishing, and metrics tracking using platforms like KnowBe4 or Proofpoint.","primaryDomain":"security-knowledge","domainTags":["phishing-defense","email-security","social-engineering","security-awareness","training-program"],"capabilityTags":["anti-phishing-training","phishing-simulation","security-awareness-training","curriculum-design","metric-tracking"],"capabilityDetails":["Provides a structured methodology for designing, deploying, and measuring an organizational anti-phishing training program, including baseline simulations, role-based curriculum, continuous simulated phishing, and metric tracking."],"techniqueTags":["phishing-simulation","just-in-time-training","role-based-training","progressive-difficulty-exercises","baseline-assessment"],"techniqueDetails":["Uses baseline phishing simulations to assess susceptibility, then deploys role-based interactive training with just-in-time remediation after failed simulations."],"tools":["KnowBe4","Proofpoint Security Awareness","Cofense","SANS Security Awareness","Terranova Security"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","reporting","remediation"],"distinctiveFeatures":["Focuses on human-layer phishing defense through organizational training program design, not technical email security mechanisms.","Incorporates SANS Security Awareness Maturity Model and metric-driven optimization using baseline and continuous simulation data."],"familyIds":["security-awareness-training"]},{"id":"implementing-anti-ransomware-group-policy","summary":"Configures Windows Group Policy to block ransomware execution and lateral spread using AppLocker, Controlled Folder Access, ASR rules, and network restrictions, with validation via gpresult and Defender PowerShell commands.","primaryDomain":"windows-security","domainTags":["ransomware","group-policy","windows-hardening","active-directory"],"capabilityTags":["gpo-configuration","applocker-policy","controlled-folder-access","attack-surface-reduction","lateral-movement-restriction"],"capabilityDetails":["Provides a step-by-step workflow to harden Windows endpoints via Group Policy against ransomware execution and propagation."],"techniqueTags":["applocker","controlled-folder-access","attack-surface-reduction","lateral-movement-restriction","gpo-compliance-audit"],"techniqueDetails":["Uses AppLocker path rules to block execution from user-writable directories.","Enables Controlled Folder Access in block mode to protect critical directories.","Configures ASR rules using specific GUIDs to block common ransomware delivery techniques.","Disables SMBv1 and restricts RDP/WMI to limit lateral movement.","Audits GPO application with gpresult and PowerShell cmdlets."],"tools":["GPMC","AppLocker","Microsoft Defender Exploit Guard","GPResult","PowerShell Get-MpPreference"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Integrates multiple Windows built-in controls (AppLocker, CFA, ASR, network restrictions) specifically for ransomware, rather than general endpoint hardening.","Includes specific ASR rule GUIDs and exact GPO paths for actionable deployment."],"familyIds":["ransomware-defense"]},{"id":"implementing-api-abuse-detection-with-rate-limiting","summary":"Provides Redis-backed rate limiting implementations (token bucket, sliding window, adaptive) to detect and mitigate API abuse such as DDoS, brute force, and scraping, including NGINX config and rate limit response headers.","primaryDomain":"api-security","domainTags":["api-security","rate-limiting","abuse-detection","redis"],"capabilityTags":["api-rate-limiting","abuse-detection","adaptive-throttling","redis-backend","nginx-configuration"],"capabilityDetails":["Implements distributed API rate limiting using token bucket, sliding window, and adaptive algorithms backed by Redis, with NGINX deployment configuration and standardized rate limit response headers for mitigating DDoS, brute force, credential stuffing, and scraping."],"techniqueTags":["token-bucket","sliding-window","fixed-window","adaptive-rate-limiting","redis-lua-script"],"techniqueDetails":["Token bucket algorithm implemented via Redis Lua script for atomic refill and burst control.","Sliding window algorithm implemented with Redis sorted sets to track requests over a moving time window.","Adaptive rate limiter uses behavioral scoring (auth failures, error rates, request rates, endpoint enumeration) to adjust limits and temporarily block suspicious clients.","NGINX rate limiting zones applied to different API endpoints with bursts and 429 responses."],"tools":["redis","nginx"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Provides complete implementation code for adaptive rate limiting with threat-level scoring and Redis-backed counters, rather than general rate limiting advice.","Covers integration with NGINX for deployment and standard rate limit response headers."],"familyIds":["api-security-hardening-and-controls"]},{"id":"implementing-api-gateway-security-controls","summary":"Step-by-step playbook for configuring API gateways as centralized security enforcement points, including JWT authentication, rate limiting, OpenAPI validation, mTLS, WAF integration, and security monitoring with CloudWatch.","primaryDomain":"api-security","domainTags":["api-gateway","rate-limiting","waf","authentication","request-validation","tls"],"capabilityTags":["gateway-security-configuration","authentication-enforcement","rate-limiting-implementation","request-validation","mtls-setup"],"capabilityDetails":["Provides a workflow for deploying centralized API gateway security controls, covering JWT authentication, rate limiting, OpenAPI schema validation, mutual TLS, WAF rules, and security monitoring across Kong and AWS API Gateway."],"techniqueTags":["jwt-validation","per-credential-rate-limiting","openapi-schema-validation","mutual-tls","managed-waf-rules","cloudwatch-metric-alarms"],"techniqueDetails":["Validates JWT tokens at the gateway, checking expiration claims and rejecting invalid tokens.","Rate limit keyed by JWT credential rather than IP to prevent bypass through IP rotation.","Rejects requests that do not conform to OpenAPI schemas, blocking mass assignment and injection.","Requires client certificates for service-to-service authentication and identity verification.","Applies AWS managed WAF rule groups for SQLi and XSS protection.","Creates metric filters and alarms for unauthorized access, rate limit hits, and server errors."],"tools":["Kong Gateway","AWS API Gateway","Azure API Management","Apigee","Envoy Proxy","OpenSSL","CloudWatch","boto3"],"targetTypes":["api","cloud"],"role":"specialist-playbook","workflowFocus":["validation","detection","reporting"],"distinctiveFeatures":["Provides vendor-specific configuration for multiple API gateway platforms (Kong declarative YAML and AWS boto3) instead of generic gateway guidance.","Covers the full stack from authentication/rate limiting to mTLS, WAF, and CloudWatch monitoring in a single workflow.","Includes concrete pitfalls like per-user rate limiting and avoiding verbose error responses."],"familyIds":["api-security-hardening-and-controls"]},{"id":"implementing-api-key-security-controls","summary":"Implementation playbook for secure API key lifecycle: generation with 256-bit entropy, SHA-256 hashing storage, per-key scoping, zero-downtime rotation, and automated leak detection/revocation.","primaryDomain":"api-security","domainTags":["api-security","credential-management","secret-management"],"capabilityTags":["api-key-generation","key-storage-hashing","key-rotation","key-scoping","leak-detection","key-revocation"],"capabilityDetails":["Provides a complete workflow for secure API key lifecycle management including generation, hashing, validation, rotation, and automated revocation."],"techniqueTags":["sha256-hashing","key-prefixing","per-key-scoping","grace-period-rotation","secret-scanning"],"techniqueDetails":["Uses SHA-256 to hash keys before storage so plaintext keys are never stored.","Employs identifiable key prefixes (sk_live_, sk_test_) to enable automated leak detection.","Implements per-key scoping with endpoint, IP, and rate-limit restrictions.","Supports zero-downtime rotation via a grace period during which both old and new keys are valid.","Integrates with secret scanning tools to automatically revoke leaked keys."],"tools":["gitleaks","truffleHog","GitHub Secret Scanning","HashiCorp Vault","AWS Secrets Manager","Redis"],"targetTypes":["api","web-application","cloud"],"role":"specialist-playbook","workflowFocus":["remediation","validation","detection"],"distinctiveFeatures":["Provides end-to-end API key lifecycle management with plaintext-free storage, scoping, rotation, and automated leak revocation.","Includes concrete code for key generation, validation middleware, and leaked-key revocation."],"familyIds":["api-authentication-and-token-security"]},{"id":"implementing-api-rate-limiting-and-throttling","summary":"Implementation playbook for adding API rate limiting and throttling defense using Redis-backed sliding window, token bucket, and fixed window algorithms, with tiered per-user/per-IP/per-endpoint quotas, HTTP 429 and Retry-After handling, and validation guidance.","primaryDomain":"api-security","domainTags":["api-security","rate-limiting","throttling","abuse-prevention","denial-of-service-defense"],"capabilityTags":["rate-limit-implementation","throttling-configuration","redis-counter-management","http-429-response","tiered-quota-enforcement"],"capabilityDetails":["Provides implementation workflows for multiple rate limiting algorithms (sliding window, token bucket, fixed window) with code examples using Redis, API gateway plugins, or middleware.","Includes configuration guidance for per-user, per-IP, and per-endpoint limits, as well as tiered quota plans for API consumers.","Shows how to return proper HTTP 429 responses with Retry-After headers and rate limit headers."],"techniqueTags":["sliding-window","token-bucket","fixed-window","per-ip-limits","per-user-limits","per-endpoint-limits"],"techniqueDetails":["Uses Redis sorted sets for sliding window rate limiting.","Uses Redis Lua scripts for atomic token bucket operations.","Describes distributed rate limiting for microservices using Redis Cluster.","Differentiates rate limit strategies by endpoint category and user tier."],"tools":["Redis","Kong","express-rate-limit","Flask-Limiter","Envoy","k6","Prometheus"],"targetTypes":["api"],"role":"specialist-playbook","workflowFocus":["remediation","validation","analysis"],"distinctiveFeatures":["Focuses specifically on defensive API rate limiting and throttling implementation, not on general web security hardening.","Provides production-ready Redis-backed code examples for sliding window, token bucket, and distributed rate limiting, including tiered per-user quota enforcement."],"familyIds":["api-rate-limiting-security"]},{"id":"implementing-api-schema-validation-security","summary":"Implementation guide for API schema validation using OpenAPI/JSON Schema, enforced at API gateway and via FastAPI/Pydantic middleware, with CI/CD checks to prevent injection, mass assignment, and data leakage.","primaryDomain":"api-security","domainTags":["api-schema-validation","input-validation","mass-assignment-prevention","data-leakage-prevention"],"capabilityTags":["openapi-schema-validation","request-validation","response-validation","ci-cd-schema-checking","injection-prevention"],"capabilityDetails":["Provides a workflow to define strict OpenAPI/JSON Schema contracts with additionalProperties: false, enforced at runtime via API gateways and FastAPI/Pydantic middleware.","Includes response body validation middleware to prevent data leakage through API responses.","Adds CI/CD schema linting and contract testing to shift security left."],"techniqueTags":["openapi-contracts","json-schema-constraints","additionalproperties-false","server-side-validation-middleware","gateway-schema-validation","ci-cd-schema-linting"],"techniqueDetails":["Uses OpenAPI Specification and JSON Schema draft-07+ to define request/response structures.","Sets additionalProperties: false to block unknown fields and prevent mass assignment.","Implements middleware-based response validation to detect and block leaked data.","Uses regex patterns, maxLength, enums, and numeric bounds for injection prevention and type safety.","Deploys schemas to API gateways (e.g., Cloudflare API Shield) for blocking mode enforcement."],"tools":["fastapi","pydantic","cloudflare-api-shield","spectral","dredd","kong","aws-api-gateway"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["validation","detection","remediation"],"distinctiveFeatures":["Defensive implementation playbook focused on API contract enforcement rather than offensive testing.","Covers both gateway-level and development-level schema validation with concrete FastAPI/Pydantic code.","Includes response schema validation to stop data leakage, a capability not common in general API scanning skills."],"familyIds":["api-input-validation-and-edge-threat-protection"]},{"id":"implementing-api-security-posture-management","summary":"Provides a Python-based API Security Posture Management engine for continuous discovery, classification, and risk scoring of APIs, with security control assessment, policy enforcement, and reporting capabilities.","primaryDomain":"api-security","domainTags":["api-security","aspm","api-posture-management","api-inventory","api-governance"],"capabilityTags":["api-discovery","api-classification","risk-scoring","policy-enforcement","continuous-monitoring","security-control-assessment"],"capabilityDetails":["Provides a Python-based API-SPM engine for continuous discovery and inventory of API endpoints.","Assesses security controls such as authentication, TLS, rate limiting, CORS, security headers, and input validation.","Calculates composite risk scores for API endpoints based on missing controls, classification, documentation, and sensitive data presence.","Defines and enforces security policies using YAML configuration for external, internal, partner, and deprecated APIs.","Generates organization-wide posture reports with risk distribution and top risks."],"techniqueTags":["traffic-log-analysis","header-inspection","sensitive-data-detection","composite-risk-scoring","policy-as-code"],"techniqueDetails":["Uses traffic logs and header inspection to determine security control presence.","Detects sensitive data types (SSN, credit card, email, API key, JWT, phone) via regex patterns.","Normalizes and multiplies risk scores based on API classification, documentation, and sensitive data.","Implements policy enforcement by checking required controls and conditions in YAML policy files."],"tools":["python","yaml"],"targetTypes":["api"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection","reporting"],"distinctiveFeatures":["Provides a fully functional Python implementation rather than just guidelines or checklists.","Focuses on continuous posture management and policy enforcement, not point-in-time API testing.","Includes a customizable risk-scoring algorithm and organizational dashboard metrics."],"familyIds":["api-asset-inventory-and-posture-management"]},{"id":"implementing-api-security-testing-with-42crunch","summary":"Provides practical implementation guidance for the 42Crunch API security platform, covering static analysis of OpenAPI definitions, dynamic conformance scanning, runtime API protection, and CI/CD integrations to enforce shift-left security testing against OWASP API Top 10 risks.","primaryDomain":"api-security","domainTags":["openapi","owasp-api-top-10","shift-left","ci-cd-security"],"capabilityTags":["api-audit","conformance-scanning","api-protect","static-analysis","dynamic-testing","runtime-enforcement","ci-cd-integration"],"capabilityDetails":["Provides a complete workflow for implementing API security testing on the 42Crunch platform, including static analysis of OpenAPI definitions, dynamic conformance scanning, runtime protection, and CI/CD integration.","Offers specific configurations and commands for API Audit, Conformance Scan, and API Protect, with emphasis on shift-left testing for OWASP API Security Top 10 vulnerabilities."],"techniqueTags":["openapi-specification-analysis","contract-based-testing","dynamic-api-scanning","runtime-enforcement","security-score-assessment"],"techniqueDetails":["Uses 300+ security checks to evaluate OpenAPI definitions and assign a security score, covering data validation, authentication, transport security, and error handling.","Performs dynamic conformance scans against a running API to detect runtime vulnerabilities such as BOLA, BFLA, injection, and excessive data exposure.","Deploys API Protect as a micro-gateway to enforce the OpenAPI contract at runtime with request/response validation, rate limiting, and blocking on failure."],"tools":["42crunch","42crunch-cli"],"targetTypes":["api","web-application"],"role":"tool-guide","workflowFocus":["analysis","detection","validation","remediation"],"distinctiveFeatures":["Combines static API Audit, dynamic Conformance Scan, and runtime API Protect into a single CI/CD-integrated workflow, making it specific to the 42Crunch platform.","Uses OpenAPI definitions as the central source of truth and maps testing categories to OWASP API Security Top 10 with SARIF/JSON/HTML report outputs."],"familyIds":["automated-api-security-testing"]},{"id":"implementing-api-threat-protection-with-apigee","summary":"Provides Apigee-specific security policy configurations to shield APIs from OWASP API Top 10 threats, including JSON/XML payload validation, regex-based injection detection, SpikeArrest rate limiting, OAuth2/API key verification, security headers, and Advanced API Security abuse detection.","primaryDomain":"api-security","domainTags":["apigee","api-gateway","google-cloud","owasp-api-top-10"],"capabilityTags":["json-threat-protection","xml-threat-protection","regex-threat-detection","rate-limiting","oauth2-validation","security-header-enforcement"],"capabilityDetails":["Provides Apigee policy configurations to protect APIs from OWASP API Top 10 threats, including JSON/XML content validation, regex-based injection detection, rate limiting, and token validation.","Demonstrates enabling Apigee Advanced API Security for ML-based malicious client detection and blocking."],"techniqueTags":["structural-limit-validation","xml-bomb-detection","regex-threat-pattern-matching","token-validation","traffic-spike-arrest","ml-based-abuse-detection"],"techniqueDetails":["Limits JSON nesting depth, entry counts, and string lengths to block oversized payloads.","Imposes limits on XML node depth, child counts, attribute counts, and text lengths to prevent XML bombs and XXE attacks.","Uses regular expressions to identify SQL injection, XSS, header injection, and path traversal in API requests.","Verifies OAuth 2.0 access tokens and API keys before forwarding requests to backend services.","Applies SpikeArrest to smooth traffic spikes and protect backend services from overload.","Integrates with Apigee Advanced API Security to detect malicious clients and anomalous API behavior."],"tools":["apigee","gcloud"],"targetTypes":["api","cloud"],"role":"specialist-playbook","workflowFocus":["detection","remediation"],"distinctiveFeatures":["Targets Google Apigee reverse-proxy security policies specifically, not generic API protection.","Provides ready-to-use XML configurations for JSON/XML threat protection, SpikeArrest, OAuth2, security headers, and API key validation.","Covers Advanced API Security add-on for ML-based malicious client detection and blocking via gcloud commands."],"familyIds":["api-input-validation-and-edge-threat-protection"]},{"id":"implementing-application-whitelisting-with-applocker","summary":"Provides a step-by-step implementation workflow for AppLocker application whitelisting on Windows, covering application inventory, rule creation, audit testing, and phased enforcement to block unauthorized executables and LOLBins.","primaryDomain":"windows-security","domainTags":["application-whitelisting","endpoint-security","applocker"],"capabilityTags":["applocker-policy-creation","application-inventory","lolbin-blocking","rule-deployment"],"capabilityDetails":["Provides a complete workflow for implementing AppLocker-based application whitelisting on Windows, from inventorying approved software to enforcing allowlist rules."],"techniqueTags":["publisher-rules","path-rules","hash-rules","audit-mode","enforcement-mode"],"techniqueDetails":["Uses publisher-based rules as the preferred resilient method, path and hash rules as alternatives, and mandates an audit-before-enforce deployment strategy."],"tools":["AppLocker","PowerShell","Group Policy Management Console","WDAC","AaronLocker"],"targetTypes":["windows-host","active-directory"],"role":"specialist-playbook","workflowFocus":["remediation","validation","analysis"],"distinctiveFeatures":["Focuses solely on AppLocker for Windows endpoint application whitelisting","Provides explicit deny rules for LOLBins","Mandates audit mode before enforcement to avoid outages"],"familyIds":["windows-endpoint-hardening"]},{"id":"implementing-aqua-security-for-container-scanning","summary":"Provides deployment guidance for Aqua Security Trivy to scan container images, filesystems, Kubernetes workloads, and IaC for vulnerabilities, misconfigurations, secrets, and SBOM/license issues, with CI/CD integrations and policy enforcement.","primaryDomain":"cloud-security","domainTags":["container-security","devsecops","supply-chain-security","vulnerability-scanning"],"capabilityTags":["container-vulnerability-scanning","misconfiguration-scanning","secret-scanning","sbom-generation","ci-cd-integration"],"capabilityDetails":["Provides deployment and configuration workflows for Aqua Security Trivy to scan container images for OS and language dependency vulnerabilities, misconfigurations, secrets, and license issues.","Covers scanning local images, remote registry images, tar archives, filesystems, repositories, Kubernetes workloads, and IaC templates.","Includes CI/CD pipeline integrations for GitHub Actions, GitLab CI, and Jenkins, plus SBOM generation and custom policy enforcement."],"techniqueTags":["container-image-scanning","dependency-vulnerability-scanning","iac-misconfiguration-scanning","sbom-analysis","policy-as-code"],"techniqueDetails":["Uses Trivy's layer-by-layer analysis and vulnerability database matching to identify known CVEs.","Employs Trivy's filesystem and repository scanners for dependency and secret detection.","Uses Trivy Operator to continuously scan Kubernetes workloads and generate vulnerability/config audit reports.","Creates custom OPA/Rego policies and .trivyignore files for policy enforcement and accepted risk management."],"tools":["trivy","trivy-operator","helm","opa","github-actions","gitlab-ci","jenkins"],"targetTypes":["container","kubernetes","cloud","source-code"],"role":"tool-guide","workflowFocus":["detection","analysis","reporting","remediation"],"distinctiveFeatures":["Implementation-focused guide specifically for deploying Aqua Security Trivy in container security workflows, not generic vulnerability scanning.","Includes full CI/CD integration examples (GitHub Actions, GitLab CI, Jenkins) and Kubernetes operator deployment.","Combines image scanning, IaC misconfiguration scanning, secret scanning, SBOM generation, and OPA policy enforcement in one skill."],"familyIds":["container-and-kubernetes-runtime-security"]},{"id":"implementing-attack-path-analysis-with-xm-cyber","summary":"Deploys XM Cyber to continuously model attack paths, identify choke points, and prioritize remediation based on impact to critical assets.","primaryDomain":"general-pentesting","domainTags":["vulnerability-management","exposure-management","attack-path-analysis","continuous-threat-exposure-management"],"capabilityTags":["attack-path-mapping","choke-point-prioritization","critical-asset-mapping","remediation-prioritization"],"capabilityDetails":["Provides a workflow for deploying XM Cyber to build attack graphs that chain vulnerabilities, misconfigurations, identity risks, and credential weaknesses toward critical assets.","Includes scenario configuration for external attacker, insider threat, cloud account takeover, and ransomware propagation.","Focuses on identifying choke points where multiple attack paths converge to prioritize remediation impact."],"techniqueTags":["attack-graph-analysis","lateral-movement-chaining","identity-exposure-analysis","misconfiguration-analysis"],"techniqueDetails":["Uses continuous attack graph modeling to chain exposures and model lateral movement paths.","Employs choke point analysis to identify entities that block multiple attack paths if remediated."],"tools":["xm-cyber"],"targetTypes":["active-directory","cloud","network","windows-host","database"],"role":"specialist-playbook","workflowFocus":["analysis","detection","remediation"],"distinctiveFeatures":["Focuses on attack path chaining and choke point prioritization rather than individual vulnerability discovery.","Emphasizes continuous exposure management with XM Cyber across hybrid on-premises and cloud environments."],"familyIds":["continuous-security-validation-and-exposure-management"]},{"id":"implementing-attack-surface-management","summary":"End-to-end external attack surface management workflow that discovers subdomains, fingerprints services, queries Shodan/Censys, scans with nuclei, and scores asset risk using a weighted algorithm.","primaryDomain":"reconnaissance","domainTags":["attack-surface-management","asset-discovery","subdomain-enumeration"],"capabilityTags":["subdomain-enumeration","asset-discovery","service-fingerprinting","vulnerability-scanning","exposure-scoring"],"capabilityDetails":["Provides an end-to-end workflow for discovering internet-facing assets, enumerating subdomains, probing live services, performing vulnerability scans, and scoring exposure risks."],"techniqueTags":["passive-dns-enumeration","certificate-transparency-search","internet-wide-scanning","http-probing","template-based-vulnerability-scanning","weighted-risk-scoring"],"techniqueDetails":["Uses subfinder with multiple data sources and amass for passive subdomain enumeration, httpx for service fingerprinting and tech detection, Shodan and Censys API searches for exposed services, nuclei template scans for vulnerabilities, and a weighted scoring algorithm based on OWASP and RSQ."],"tools":["shodan","censys","subfinder","httpx","nuclei","amass"],"targetTypes":["network","web-application"],"role":"workflow","workflowFocus":["reconnaissance","enumeration","detection","analysis"],"distinctiveFeatures":["Combines Shodan, Censys, and ProjectDiscovery tools into a single automated external attack surface management pipeline.","Includes a weighted exposure scoring algorithm based on OWASP attack surface analysis and Relative Attack Surface Quotient (RSQ).","Focused on building continuous ASM programs, not just one-off recon."],"familyIds":["attack-surface-discovery"]},{"id":"implementing-aws-config-rules-for-compliance","summary":"Provides a workflow for implementing AWS Config managed and custom rules to continuously monitor AWS resources for CIS/PCI DSS compliance, with automatic remediation via SSM Automation and multi-account compliance aggregation.","primaryDomain":"cloud-security","domainTags":["aws","compliance","configuration-management"],"capabilityTags":["compliance-monitoring","config-rules-deployment","auto-remediation","multi-account-aggregation","custom-config-rule-development"],"capabilityDetails":["Provides a complete workflow for implementing AWS Config rules for continuous compliance monitoring, including managed rules, custom Lambda-backed rules, SSM Automation remediation, and cross-account aggregation."],"techniqueTags":["aws-config-managed-rules","aws-config-custom-lambda-rules","ssm-automation-remediation","config-aggregator","conformance-packs"],"techniqueDetails":["Uses AWS-provided managed rules for CIS benchmarks, custom Lambda functions for org-specific checks, SSM documents for automatic remediation, and Config aggregators for multi-account compliance views."],"tools":["aws-config","aws-lambda","aws-ssm-automation","aws-config-aggregator","aws-cloudformation-stacksets"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation","reporting"],"distinctiveFeatures":["Covers the end-to-end implementation of AWS Config compliance monitoring, from enabling recording to auto-remediation and multi-account aggregation, including custom rule code; distinguishes from point-in-time assessment tools like Prowler by focusing on continuous compliance and automated remediation."],"familyIds":["cloud-security-posture-management"]},{"id":"implementing-aws-iam-permission-boundaries","summary":"This skill provides a practical workflow for implementing AWS IAM permission boundaries to enforce least-privilege ceilings, enabling security teams to safely delegate IAM role creation to developers while preventing privilege escalation. It includes JSON policy examples, AWS CLI commands, Terraform snippets, and validation checklists.","primaryDomain":"cloud-security","domainTags":["aws-iam","identity-access-management","least-privilege"],"capabilityTags":["iam-permission-boundaries","iam-role-delegation","least-privilege-enforcement"],"capabilityDetails":["Provides a workflow for configuring AWS IAM permission boundaries that cap the maximum permissions an identity-based policy can grant.","Enables secure delegation of IAM role and policy creation to developers while enforcing least-privilege ceilings and preventing privilege escalation."],"techniqueTags":["iam-policy-evaluation","permission-boundary-intersection","condition-key-restriction","deny-statement-patterns"],"techniqueDetails":["Leverages permission boundaries as entity-level maximum permissions intersected with identity-based policies, allowing only actions permitted by both.","Uses explicit deny statements and IAM condition keys to prevent boundary removal, policy modification, and other privilege escalation paths."],"tools":["aws-cli","terraform"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Focuses specifically on IAM permission boundaries for delegated role creation, including ready-to-use JSON policy examples and Terraform deployment snippets.","Covers both the boundary policy and the developer delegation policy, with explicit deny statements to prevent privilege escalation, distinguishing it from generic IAM hardening guides."],"familyIds":["cloud-iam-implementation"]},{"id":"implementing-aws-macie-for-data-classification","summary":"Provides comprehensive operational guidance for deploying Amazon Macie to discover, classify, and protect sensitive data in S3, including automated discovery jobs, custom identifiers, allow lists, findings management, and EventBridge-driven automated remediation.","primaryDomain":"cloud-security","domainTags":["aws","s3","data-classification","sensitive-data","dlp","pii","compliance"],"capabilityTags":["sensitive-data-discovery","data-classification","pii-detection","custom-data-identifiers","findings-management","automated-remediation"],"capabilityDetails":["Provides step-by-step guidance to enable Amazon Macie, configure automated and scheduled sensitive data discovery jobs, create custom data identifiers and allow lists, manage findings, and automate remediation via EventBridge and Lambda for S3 data classification."],"techniqueTags":["managed-data-identifiers","custom-regex-identifiers","ml-based-classification","eventbridge-automation","s3-object-tagging"],"techniqueDetails":["Uses Macie's managed data identifiers based on machine learning and pattern matching, custom regex-based identifiers for organization-specific data, and EventBridge-triggered Lambda functions for automated response."],"tools":["aws-cli","terraform","amazon-macie","aws-lambda","amazon-eventbridge","amazon-s3","amazon-sns","aws-security-hub"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on implementing and configuring AWS Macie for S3 data classification, including multi-account setup, custom data identifiers, allow lists, and EventBridge-based automated remediation, distinguishing it from general DLP or data security methodologies."],"familyIds":["cloud-data-protection-and-classification"]},{"id":"implementing-aws-nitro-enclave-security","summary":"Step-by-step implementation guide for AWS Nitro Enclave security, covering EIF creation, attestation-bound KMS policies, vsock communication, and cryptographic validation of attestation documents.","primaryDomain":"cloud-security","domainTags":["confidential-computing","attestation","kms","enclave-isolation"],"capabilityTags":["nitro-enclave-image-build","kms-attestation-policy-configuration","attestation-document-validation","vsock-pipeline-setup","enclave-monitoring"],"capabilityDetails":["Provides a step-by-step workflow to build AWS Nitro Enclaves, including creating enclave image files (EIF) from Docker images, configuring KMS key policies with PCR-based attestation conditions, establishing secure vsock communication, and validating enclave attestation documents.","Includes hands-on examples for both parent instance and enclave-side code, covering vsock proxies, KMS decrypt flows, and attestation validation against the AWS Nitro PKI root."],"techniqueTags":["pcr-pinning","attestation-validation","vsock-communication","cose-signed-document-validation"],"techniqueDetails":["Uses PCR measurements (PCR0/PCR1/PCR8) to lock KMS decryption permissions to a verified enclave image or signing certificate.","Validates COSE_Sign1-signed attestation documents by checking the certificate chain to the AWS Nitro root CA and comparing PCR values."],"tools":["nitro-cli","aws-kms","aws-nitro-enclaves-sdk-c","kmstool-enclave-cli","docker","openssl"],"targetTypes":["cloud","container","linux-host"],"role":"specialist-playbook","workflowFocus":["analysis","validation","remediation"],"distinctiveFeatures":["Focuses specifically on implementing AWS Nitro Enclave confidential computing rather than general cloud hardening or attestation concepts.","Provides concrete KMS key policy patterns using kms:RecipientAttestation condition keys and multi-PCR defense in depth.","Includes working code for enclave-side attestation document retrieval and validation, plus parent-side vsock proxy setup."],"familyIds":["cloud-data-protection-and-classification"]},{"id":"implementing-aws-security-hub","summary":"Deploys AWS Security Hub as a centralized cloud security posture management (CSPM) platform, enabling compliance standards, aggregating findings from AWS and third-party tools, automating remediation via EventBridge/Systems Manager, and generating audit-ready compliance reports.","primaryDomain":"cloud-security","domainTags":["aws-security-hub","cspm","compliance-automation","security-standards","finding-aggregation"],"capabilityTags":["cspm-deployment","compliance-standard-enablement","finding-aggregation","automated-remediation","audit-evidence-generation"],"capabilityDetails":["Deploys AWS Security Hub as a centralized cloud security posture management (CSPM) platform.","Enables CIS AWS Foundations Benchmark, AWS Foundational Security Best Practices, PCI DSS, and NIST security standards.","Aggregates findings from GuardDuty, Inspector, Macie, and third-party tools across multiple AWS accounts and regions.","Builds automated remediation workflows using EventBridge and Systems Manager for common security misconfigurations.","Generates compliance reports and audit evidence via AWS Audit Manager."],"techniqueTags":["security-standard-enablement","multi-account-aggregation","asff-import","eventbridge-remediation","compliance-scoring"],"techniqueDetails":["Uses AWS CLI commands to enable Security Hub and subscribe to security standards.","Configures cross-region finding aggregation with a delegated administrator and auto-enrollment of organization accounts.","Imports custom findings using the AWS Security Finding Format (ASFF) schema.","Creates custom actions and EventBridge rules to trigger automated remediation via Systems Manager documents.","Tracks compliance scores and failed controls per standard and account."],"tools":["aws-security-hub","aws-config","amazon-eventbridge","aws-systems-manager","aws-audit-manager","aws-cli","guardduty","inspector","macie"],"targetTypes":["cloud","network"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation","reporting","analysis"],"distinctiveFeatures":["Focuses on deploying and configuring AWS Security Hub as a centralized CSPM/compliance platform, not on threat detection or container scanning.","Provides a full workflow from enabling standards, multi-account aggregation, integration of AWS and third-party findings, automated remediation, to audit evidence generation.","Includes concrete CLI commands for Security Hub, EventBridge, and findings import, along with a realistic enterprise scenario of remediating failed CIS controls across 50 accounts."],"familyIds":["cloud-security-posture-management"]},{"id":"implementing-aws-security-hub-compliance","summary":"Operational playbook for deploying AWS Security Hub with CIS/PCI/NIST standards across a multi-account AWS Organization, aggregating findings, creating insights, and automating remediation via EventBridge and Lambda, plus generating compliance reports.","primaryDomain":"cloud-security","domainTags":["cloud-security","aws-security-hub","cspm","compliance-monitoring"],"capabilityTags":["security-hub-deployment","multi-account-aggregation","compliance-standard-enablement","finding-aggregation","automated-remediation","compliance-reporting"],"capabilityDetails":["Provides a step-by-step workflow for enabling AWS Security Hub across a multi-account AWS Organization.","Covers configuration of compliance standards such as CIS AWS Foundations, PCI DSS, and NIST 800-53.","Includes creation of finding aggregators, custom insights, and EventBridge-triggered Lambda remediation.","Explains how to export findings and generate compliance score reports for executive dashboards."],"techniqueTags":["aws-cli","eventbridge-rules","lambda-remediation","security-standard-evaluation","cross-region-aggregation","organization-admin-delegation"],"techniqueDetails":["Uses AWS CLI commands to enable Security Hub, batch-enable standards, and query findings.","Leverages EventBridge event patterns to route Security Hub findings to Lambda or SNS.","Demonstrates a Python Lambda function that auto-remediates public S3 buckets and updates finding workflow status.","Configures delegated administrator and auto-enrollment for organization-wide Security Hub deployment."],"tools":["aws-security-hub","aws-config","amazon-eventbridge","aws-lambda","prowler"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on implementing AWS Security Hub as a central compliance aggregation service, not on threat detection or vulnerability scanning.","Provides end-to-end multi-account setup including delegated admin, auto-enrollment, cross-region aggregation, and automated remediation with EventBridge and Lambda.","Includes a concrete auto-remediation code example and a realistic multi-account rollout scenario with pitfalls."],"familyIds":["cloud-security-posture-management"]},{"id":"implementing-azure-ad-privileged-identity-management","summary":"A specialist playbook for configuring Microsoft Entra PIM to replace standing privileged role assignments with eligible, time-bound activations, including MFA, approval workflows, access reviews, and Graph API automation.","primaryDomain":"cloud-security","domainTags":["azure-ad","identity-governance","privileged-access-management","entra-id","zero-trust"],"capabilityTags":["just-in-time-access","privileged-role-management","role-activation-workflow","access-review-configuration","security-alert-configuration"],"capabilityDetails":["Provides a workflow for implementing Microsoft Entra PIM to convert standing privileged assignments into eligible, time-bound roles requiring justification, MFA, and approval."],"techniqueTags":["microsoft-graph-api","approval-workflow","mfa-enforcement","access-reviews","role-eligibility-schedule"],"techniqueDetails":["Uses Microsoft Graph API to automate role eligibility schedule requests and self-activation; configures approval workflows, MFA requirements, and access reviews in the Entra admin center."],"tools":["microsoft-graph-api","microsoft-entra-admin-center"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["analysis","remediation"],"distinctiveFeatures":["Focuses specifically on implementing Microsoft Entra PIM rather than general identity security; covers Entra roles, Azure resource roles, PIM for Groups, and access reviews with Graph API automation."],"familyIds":["cloud-iam-implementation"]},{"id":"implementing-azure-defender-for-cloud","summary":"Provides an Azure CLI-driven workflow to enable Microsoft Defender for Cloud CSPM and workload protection plans, configure auto-provisioning and compliance standards, review secure score and recommendations, set up alert automation and JIT access, and produce a deployment report.","primaryDomain":"cloud-security","domainTags":["azure","cspm","cwpp","defender-for-cloud","security-monitoring"],"capabilityTags":["enable-defender-plans","configure-auto-provisioning","review-security-recommendations","manage-compliance-standards","setup-alert-automation","implement-jit-access"],"capabilityDetails":["Enables Microsoft Defender for Cloud pricing plans across multiple Azure workload types (VMs, containers, SQL, storage, Key Vault, App Service).","Configures auto-provisioning of Log Analytics agents and monitoring components.","Retrieves and prioritizes security recommendations based on secure score impact.","Enables and monitors regulatory compliance standards (CIS Azure, PCI DSS, NIST SP 800-53).","Sets up security contacts, alert notifications, and Logic Apps workflow automation for high-severity alerts.","Implements Just-In-Time VM access and reviews adaptive application controls for runtime protection."],"techniqueTags":["azure-cli-commands","policy-driven-evaluation","secure-score-analysis","compliance-standards-mapping","automated-response"],"techniqueDetails":["Uses Azure CLI commands (az security ...) for all configuration and verification steps.","Leverages Azure Policy and secure score to evaluate and prioritize security posture.","Maps secure score and assessment data to compliance frameworks for audit readiness.","Uses Log Analytics workspace for central telemetry collection configuration.","Automates incident response through Azure Logic Apps triggered by Defender alerts."],"tools":["azure-cli","microsoft-defender-for-cloud","azure-policy","log-analytics","azure-arc","logic-apps"],"targetTypes":["cloud","container","kubernetes","database"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","reporting","remediation"],"distinctiveFeatures":["Provides an end-to-end Azure CLI-driven implementation playbook for Microsoft Defender for Cloud, covering both CSPM and CWPP plans.","Includes hybrid coverage via Azure Arc and automated response via Logic Apps, differentiating it from generic cloud security assessments.","Emphasizes operational deployment steps (enable plans, auto-provisioning, compliance dashboards, JIT access) rather than detection or exploitation techniques."],"familyIds":["cloud-security-posture-management"]},{"id":"implementing-beyondcorp-zero-trust-access-model","summary":"Guides security engineers through implementing Google's BeyondCorp zero trust model on GCP, enabling VPN-less, identity- and device-aware access to internal web applications using Cloud IAP, Access Context Manager, and Endpoint Verification, with monitoring and migration guidance.","primaryDomain":"authentication","domainTags":["zero-trust","google-cloud","identity-aware-proxy","access-context-manager"],"capabilityTags":["zero-trust-architecture-implementation","vpn-replacement","context-aware-access-control","device-posture-enforcement"],"capabilityDetails":["Provides a step-by-step workflow for implementing Google BeyondCorp zero trust access model, replacing VPN with Cloud IAP, Access Context Manager, Endpoint Verification, and BeyondCorp Enterprise Connectors."],"techniqueTags":["identity-aware-proxy","access-levels","device-posture","condition-based-iam","tcp-tunnel"],"techniqueDetails":["Configures Cloud IAP to enforce per-request identity and device verification, uses Access Context Manager to define trust levels, and deploys Endpoint Verification for device compliance."],"tools":["gcloud","google-cloud-iap","access-context-manager","chrome-enterprise-premium","endpoint-verification","beyondcorp-enterprise-connectors"],"targetTypes":["web-application","cloud"],"role":"specialist-playbook","workflowFocus":["remediation","analysis"],"distinctiveFeatures":["Focuses exclusively on implementing Google's BeyondCorp zero trust architecture on GCP, including specific gcloud CLI commands, migration scenarios, and audit setup; distinct from generic zero trust methodology or other cloud IAM skills."],"familyIds":["zero-trust-access-control"]},{"id":"implementing-bgp-security-with-rpki","summary":"Provides step-by-step guidance for implementing RPKI-based BGP route origin validation, including ROA creation, validator deployment, and ROV filtering on Cisco and Juniper routers to prevent route hijacking.","primaryDomain":"network-security","domainTags":["bgp-security","rpki","route-origin-validation","internet-routing"],"capabilityTags":["rpki-deployment","rov-configuration","roa-management","bgp-filtering"],"capabilityDetails":["Provides a workflow for creating Route Origin Authorizations at RIRs, deploying RPKI validator software, and configuring ROV accept/reject policies on routers."],"techniqueTags":["rpki","rov","roa","bgp-route-hijack-mitigation"],"techniqueDetails":["Uses cryptographic route origin validation to validate BGP route origins against signed ROAs, rejecting invalid routes."],"tools":["routinator","fort","octorpki","python3"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["validation","remediation"],"distinctiveFeatures":["Focuses specifically on RPKI-based route origin validation as a BGP hijack mitigation rather than general BGP routing configuration.","Provides concrete ROA creation steps for multiple RIRs and ROV policy configuration for both Cisco IOS-XE and Juniper Junos routers."],"familyIds":["network-infrastructure-routing-and-ddos-security"]},{"id":"implementing-browser-isolation-for-zero-trust","summary":"Provides a step-by-step, code-driven workflow to deploy remote browser isolation (RBI) within a Zero Trust architecture, including URL risk classification, isolation policy configuration, content disarming and reconstruction (CDR) for file downloads, DLP enforcement, session monitoring, and integration with SWG/ZTNA platforms.","primaryDomain":"network-security","domainTags":["browser-isolation","zero-trust","remote-browser-isolation","content-disarming","data-loss-prevention","secure-web-gateway"],"capabilityTags":["browser-isolation-deployment","url-risk-classification","isolation-policy-configuration","cdr-implementation","dlp-policy-enforcement","zero-trust-integration"],"capabilityDetails":["Provides a workflow for deploying remote browser isolation (RBI) within a Zero Trust architecture, including URL risk classification, isolation policy configuration, content disarming and reconstruction (CDR), and DLP controls."],"techniqueTags":["url-categorization","risk-based-routing","content-disarming-and-reconstruction","session-monitoring","conditional-access-policy","secure-web-gateway-integration"],"techniqueDetails":["Uses threat intelligence and domain reputation to classify URL risk and route traffic to isolation modes, applies CDR to sanitize files by stripping macros and active content, enforces DLP via clipboard/upload/download restrictions, and integrates with identity provider and SWG for conditional access."],"tools":["Cloudflare Browser Isolation","Menlo Security","Zscaler RBI"],"targetTypes":["web-application","network"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Focuses specifically on deploying remote browser isolation (RBI) as a core Zero Trust control, with a policy engine for URL categorization, CDR, DLP, and SWG/ZTNA integration.","Provides executable Python examples using a BrowserIsolationPolicyEngine to configure isolation policies, process CDR, and evaluate access requests."],"familyIds":["content-isolation-and-sandboxing"]},{"id":"implementing-canary-tokens-for-network-intrusion","summary":"Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement, with webhook alert integration and enterprise management via Thinkst Canary.","primaryDomain":"network-security","domainTags":["deception-technology","intrusion-detection","breach-detection","network-monitoring"],"capabilityTags":["canary-token-deployment","canary-token-generation","webhook-alerting","token-placement"],"capabilityDetails":["Provides step-by-step workflows for generating and placing DNS, HTTP, and AWS API key canary tokens, configuring webhook alerts to Slack/Teams/SIEM, and managing deployments via Canarytokens.org or Thinkst Canary."],"techniqueTags":["dns-canary-token","http-canary-token","aws-api-key-canary-token","webhook-integration","honeytoken-deployment"],"techniqueDetails":["Uses fake DNS names, URLs, and AWS credentials as tripwires; alerts on any interaction in near real time."],"tools":["canarytokens.org","thinkst-canary","canarytools","flask"],"targetTypes":["network","cloud"],"role":"specialist-playbook","workflowFocus":["detection","validation"],"distinctiveFeatures":["Focuses specifically on deception-based intrusion detection using canary tokens, not signature or anomaly detection.","Covers multiple token types (DNS, HTTP, AWS API key) with placement strategies across network zones.","Includes webhook alert orchestration for SOC integration and enterprise management via Thinkst Canary API."],"familyIds":["deception-based-threat-detection"]},{"id":"implementing-cisa-zero-trust-maturity-model","summary":"Provides a structured methodology for assessing an organization's zero trust maturity per CISA ZTMM v2.0, identifying gaps, and building a phased roadmap across identity, devices, networks, applications, and data.","primaryDomain":"security-knowledge","domainTags":["zero-trust","maturity-model","federal-compliance","governance"],"capabilityTags":["zero-trust-assessment","gap-analysis","implementation-roadmap"],"capabilityDetails":["Provides a structured workflow for assessing an organization's zero trust maturity across five CISA pillars (Identity, Devices, Networks, Applications & Workloads, Data) and three cross-cutting capabilities, performing gap analysis, and generating a phased implementation roadmap."],"techniqueTags":["maturity-stage-mapping","gap-analysis","compliance-mapping"],"techniqueDetails":["Uses CISA-defined maturity stages (Traditional, Initial, Advanced, Optimal) to score current capabilities, identify gaps, and prioritize improvements."],"tools":["python"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on the CISA Zero Trust Maturity Model v2.0 assessment and phased implementation, distinguishing it from generic zero-trust architecture guides or compliance checklists."],"familyIds":["compliance-governance"]},{"id":"implementing-cloud-dlp-for-data-protection","summary":"Provides a multi-cloud DLP implementation workflow using Amazon Macie, Google Cloud DLP, and Azure Purview/AIP to discover, classify, label, de-identify, and protect sensitive data across cloud storage, databases, and data pipelines, including CI/CD pipeline gating and compliance reporting.","primaryDomain":"cloud-security","domainTags":["dlp","data-protection","data-classification","data-governance","privacy","compliance"],"capabilityTags":["cloud-dlp-implementation","sensitive-data-discovery","data-classification","data-de-identification","sensitivity-labeling","dlp-pipeline-gating","compliance-reporting"],"capabilityDetails":["Cloud DLP implementation: Deploys and configures DLP services across AWS, GCP, and Azure.","Sensitive data discovery: Automates scanning of cloud storage and databases for PII, PHI, financial data, and credentials using managed and custom identifiers.","Data classification: Uses ML and pattern-based methods to classify data and generate findings with severity.","Data de-identification: Applies masking, tokenization, and redaction transforms to protect sensitive data while preserving utility.","Sensitivity labeling: Creates and applies sensitivity labels in Microsoft Purview/AIP to trigger policy enforcement.","DLP pipeline gating: Integrates DLP scanning into CI/CD and ETL pipelines to block promotion of data containing sensitive content.","Compliance reporting: Aggregates findings across providers into compliance-aligned reports."],"techniqueTags":["managed-data-identifiers","custom-data-identifiers","classification-jobs","de-identification-transforms","auto-labeling-policies","sensitivity-labels","pipeline-gating","findings-aggregation"],"techniqueDetails":["Managed data identifiers: Uses built-in info types such as SSN, credit card numbers, and email addresses from cloud DLP services.","Custom data identifiers: Defines regex patterns for organization-specific data formats like employee IDs.","Classification jobs: Schedules or triggers data scanning jobs in Macie and Google DLP with scoping rules to target high-risk object types.","De-identification transforms: Applies character masking, cryptographic tokenization (FFX), and redaction to protect sensitive values.","Auto-labeling policies: Creates sensitivity labels and rules that automatically apply labels based on detection of sensitive information types.","Sensitivity labels: Applies classification tags to data for downstream access control and policy enforcement.","Pipeline gating: Adds a DLP scan gate in data pipelines to allow or block data promotion based on sensitive data findings.","Findings aggregation: Collects findings from different cloud DLP tools and formats them into compliance reports."],"tools":["amazon-macie","google-cloud-dlp","microsoft-purview","azure-information-protection","nightfall-ai","aws-cli","gcloud-cli","azure-cli","powershell","boto3","google-cloud-dlp-python"],"targetTypes":["cloud","database"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting","remediation"],"distinctiveFeatures":["Multi-cloud DLP implementation spanning AWS, GCP, and Azure with concrete CLI/PowerShell deployment steps.","Includes both data discovery/classification and remediation via de-identification, sensitivity labeling, and pipeline gating.","Provides a reusable compliance report template and data pipeline DLP gate scripts."],"familyIds":["cloud-data-protection-and-classification"]},{"id":"implementing-cloud-security-posture-management","summary":"Operational playbook for implementing multi-cloud CSPM with Prowler, ScoutSuite, and native cloud security services, including continuous monitoring, compliance reporting, finding aggregation, and automated remediation.","primaryDomain":"cloud-security","domainTags":["cspm","multi-cloud","compliance","misconfiguration","drift-detection"],"capabilityTags":["continuous-monitoring","compliance-assessment","misconfiguration-detection","drift-detection","finding-aggregation","auto-remediation"],"capabilityDetails":["Provides a workflow for continuously monitoring AWS, Azure, and GCP environments for security misconfigurations.","Assesses cloud environments against CIS, SOC 2, PCI DSS, and NIST compliance frameworks.","Aggregates and deduplicates findings from multiple CSPM sources into a unified view.","Implements automated detection of configuration drift and auto-remediation policies."],"techniqueTags":["prowler-scanning","scoutsuite-auditing","native-cspm-enablement","finding-normalization","eventbridge-scheduling","config-auto-remediation","azure-policy-remediation","gcp-org-policy"],"techniqueDetails":["Runs Prowler CLI with provider-specific compliance checks across AWS, Azure, and GCP.","Uses ScoutSuite to generate unified multi-cloud risk-scored HTML audit reports.","Enables AWS Security Hub, Microsoft Defender for Cloud, and GCP Security Command Center for native posture monitoring.","Normalizes and deduplicates findings using a custom Python aggregation script.","Schedules daily Prowler scans via EventBridge and CodeBuild pipeline.","Configures AWS Config, Azure Policy, and GCP Organization Policy for automated remediation of non-compliant resources."],"tools":["Prowler","ScoutSuite","AWS Security Hub","Microsoft Defender for Cloud","GCP Security Command Center","AWS Config","Azure Policy","GCP Organization Policy","EventBridge","CodeBuild"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Combines open-source multi-cloud scanners (Prowler, ScoutSuite) with cloud-native CSPM services, and includes a complete operational pipeline with scheduled scans, finding normalization/deduplication, and auto-remediation for configuration drift across AWS, Azure, and GCP."],"familyIds":["cloud-security-posture-management"]},{"id":"implementing-cloud-trail-log-analysis","summary":"An advanced implementation playbook for CloudTrail log analysis, using Athena and CloudWatch Logs Insights to detect unauthorized access, privilege escalation, and suspicious API activity, with CIS Benchmark-based alerting and forensic investigation guidance.","primaryDomain":"cloud-security","domainTags":["aws","cloudtrail","log-analysis"],"capabilityTags":["cloudtrail-log-analysis","threat-detection","security-monitoring","forensic-investigation","security-alerting"],"capabilityDetails":["Provides a workflow for implementing CloudTrail log analysis to monitor AWS API activity, detect unauthorized access and privilege escalation, support forensic investigation, and trigger security alerts."],"techniqueTags":["athena-sql-querying","cloudwatch-logs-insights","cloudtrail-event-analysis","cis-benchmark-alerts","iam-privilege-escalation-detection"],"techniqueDetails":["Uses Athena SQL queries to analyze CloudTrail logs for patterns like console logins without MFA, IAM privilege escalation attempts, CloudTrail tampering, and unusual source IPs.","Uses CloudWatch Logs Insights for real-time detection of root account usage, security group changes, and new IAM users or access keys.","Implements CIS Benchmark metric filters and CloudWatch alarms for automated alerting on critical security events."],"tools":["amazon-athena","aws-cloudtrail","cloudwatch-logs-insights","cloudtrail-lake","amazon-security-lake","aws-cloudwatch","aws-cli"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Combines historical forensic analysis via Athena with real-time detection via CloudWatch Logs Insights and metric filters.","Provides concrete, copy-ready AWS CLI commands and SQL queries for CloudTrail security monitoring, including CIS Benchmark-aligned alarms.","Includes a realistic incident investigation scenario (IAM credential compromise) with step-by-step approach and output report format."],"familyIds":["cloud-threat-detection-and-hunting"]},{"id":"implementing-cloud-vulnerability-posture-management","summary":"Implementation guide for multi-cloud CSPM using AWS Security Hub, Azure Defender for Cloud, Prowler, and ScoutSuite, enabling detection of cloud misconfigurations and generation of consolidated posture reports.","primaryDomain":"cloud-security","domainTags":["cspm","cloud-misconfiguration","multi-cloud","iam","compliance"],"capabilityTags":["misconfiguration-detection","multi-cloud-aggregation","posture-reporting","compliance-scanning"],"capabilityDetails":["Provides workflows for enabling and using CSPM tools (AWS Security Hub, Azure Defender for Cloud) and open-source scanners (Prowler, ScoutSuite) to identify cloud misconfigurations and generate aggregated posture reports."],"techniqueTags":["iam-permission-analysis","storage-access-auditing","network-control-validation","compliance-benchmarking"],"techniqueDetails":["Uses CSPM tools to evaluate IAM over-permissions, exposed storage, unencrypted data, and missing network controls; aggregates findings across providers."],"tools":["aws-security-hub","azure-defender-for-cloud","prowler","scoutsuite"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Combines managed CSPM services (AWS Security Hub, Azure Defender) with open-source scanners (Prowler, ScoutSuite) and provides a Python-based cross-cloud finding aggregation and posture reporting workflow."],"familyIds":["cloud-security-posture-management"]},{"id":"implementing-cloud-waf-rules","summary":"Provides a step-by-step operational playbook for deploying, tuning, and validating cloud WAF rules across AWS, Azure, and Cloudflare, including managed rule sets, rate limiting, geo-blocking, false positive reduction, and log analysis.","primaryDomain":"cloud-security","domainTags":["cloud-waf","waf-configuration","rate-limiting","bot-management","false-positive-reduction"],"capabilityTags":["waf-rule-deployment","managed-rule-set-configuration","rate-limit-configuration","geo-blocking","bot-control","false-positive-tuning","waf-log-analysis"],"capabilityDetails":["Deploys managed rule sets from cloud providers in Count mode for initial detection.","Configures rate-based rules to protect login endpoints from brute force and credential stuffing.","Implements geo-blocking and IP reputation lists to restrict traffic by location and known malicious sources.","Tunes WAF rules by analyzing logs (e.g., Athena queries) and applying exclusions to reduce false positives.","Guides transitioning from Count mode to Block mode after validation."],"techniqueTags":["managed-rule-set-deployment","rate-based-rules","geo-ip-blocking","rule-exclusion","count-mode-validation","waf-log-analysis"],"techniqueDetails":["Managed rule set deployment using AWS WAF CLI commands and OverrideAction Count mode.","Rate-based rules with scope-down statements to target specific URI paths like /api/auth/login.","Geo-blocking via IP sets and nation-based rules to restrict access by geography.","IP reputation filtering using AWS managed IP reputation list.","False positive tuning via WAF log analysis with Athena and rule exclusions.","Count mode validation before enforcing Block mode."],"tools":["AWS WAF","Azure WAF","Cloudflare WAF","AWS Firewall Manager","CloudWatch Metrics","Amazon Athena"],"targetTypes":["web-application","api","cloud"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","remediation"],"distinctiveFeatures":["Multi-cloud WAF implementation across AWS, Azure, and Cloudflare with operational tuning and false positive reduction workflow.","Includes concrete AWS CLI commands, Athena queries, and a detailed credential stuffing scenario.","Emphasizes Count mode validation before switching to Block mode, a key operational best practice."],"familyIds":["cloud-network-security-controls"]},{"id":"implementing-cloud-workload-protection","summary":"Implements cloud workload protection for EC2/GCE instances using AWS SSM and Google Cloud APIs, providing runtime security monitoring for cryptomining, reverse shells, unauthorized binaries, and C2 callbacks.","primaryDomain":"cloud-security","domainTags":["cloud-security","cwpp","workload-protection","runtime-security","process-anomaly-detection"],"capabilityTags":["runtime-security-monitoring","process-anomaly-detection","file-integrity-monitoring","network-connection-auditing","resource-utilization-anomaly-detection","unauthorized-binary-detection"],"capabilityDetails":["Provides a workflow for implementing cloud workload protection using boto3 and google-cloud APIs.","Covers process monitoring, file integrity, network connection auditing, and resource utilization anomaly detection on EC2/GCE instances."],"techniqueTags":["cryptomining-detection","reverse-shell-detection","hash-comparison","outbound-connection-analysis","cpu-spike-analysis"],"techniqueDetails":["Uses process list greps to detect cryptominers and reverse shells.","Checks file integrity via hash comparison on critical system files.","Audits established network connections for C2 callbacks.","Detects resource utilization anomalies like CPU spikes."],"tools":["boto3","aws-ssm","google-cloud-api","python"],"targetTypes":["cloud","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses on implementing runtime security controls for cloud compute workloads rather than assessing or exploiting vulnerabilities.","Leverages AWS SSM and Google Cloud APIs for agentless-ish monitoring."],"familyIds":["cloud-threat-detection-and-hunting"]},{"id":"implementing-code-signing-for-artifacts","summary":"Provides step-by-step implementation guidance for digitally signing build artifacts with GPG and Sigstore keyless signing, including CI/CD integration, signature verification, and provenance attestation to protect software supply chain integrity.","primaryDomain":"source-code-security","domainTags":["code-signing","supply-chain-security","artifact-integrity","devsecops"],"capabilityTags":["artifact-signing","signature-verification","keyless-signing","provenance-generation"],"capabilityDetails":["Implements signing of build artifacts using GPG and Sigstore, including verification in deployment pipelines."],"techniqueTags":["gpg-signing","sigstore-keyless-signing","cosign-blob-signing","checksum-verification","transparency-log","oidc-identity"],"techniqueDetails":["Uses detached GPG signatures and Sigstore keyless signatures bound to OIDC identity for artifact authenticity."],"tools":["gpg","cosign","notation","npm","rekor","fulcio"],"targetTypes":["binary","other"],"role":"specialist-playbook","workflowFocus":["remediation","validation","reporting"],"distinctiveFeatures":["Covers both GPG and Sigstore keyless signing in one workflow","Integrates signing and verification into CI/CD pipelines","Includes provenance attestation for npm packages and transparency log checks"],"familyIds":["artifact-signing-and-provenance"]},{"id":"implementing-conditional-access-policies-azure-ad","summary":"Provides a structured approach to configuring Microsoft Entra ID Conditional Access policies for zero trust access control, including risk-based authentication, device compliance, and session controls, aligned with NIST guidance.","primaryDomain":"authentication","domainTags":["identity-access-management","conditional-access","azure-ad","zero-trust"],"capabilityTags":["conditional-access-policy-configuration","risk-based-authentication","device-compliance-enforcement","session-control-configuration"],"capabilityDetails":["Provides a workflow for configuring Microsoft Entra ID Conditional Access policies to enforce access controls based on identity risk, device compliance, location, and session context."],"techniqueTags":["signal-based-policy-design","risk-based-authentication-policy","device-compliance-policy","named-locations","session-controls"],"techniqueDetails":["Uses identity risk and device compliance signals to conditionally enforce access controls, including named locations and session restrictions."],"tools":[],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["remediation","knowledge-reference"],"distinctiveFeatures":["Focuses specifically on Conditional Access policy configuration in Microsoft Entra ID, distinct from general Azure security or on-prem AD management.","Aligns policy design with NIST SP 1800-35 zero trust architecture and NIST 800-53 controls."],"familyIds":["zero-trust-access-control"]},{"id":"implementing-conduit-security-for-ot-remote-access","summary":"Provides a specialist playbook for replacing direct VPN access to OT networks with IEC 62443-compliant conduit architecture, including jump server hardening, MFA enforcement, session recording, approval-based vendor access, and audit reporting.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","remote-access","iec-62443","zero-trust"],"capabilityTags":["remote-access-conduit-design","approval-based-access","session-recording","jump-server-hardening","mfa-enforcement"],"capabilityDetails":["Provides a workflow for designing and implementing IEC 62443-compliant conduit architecture for OT remote access, including jump servers, MFA gateways, session recording, approval workflows, and vendor access management."],"techniqueTags":["zones-and-conduits","dmz-jump-server","dual-firewall","time-limited-access","vendor-escort"],"techniqueDetails":["Uses IEC 62443 zones and conduits to force all remote access through a DMZ jump server with MFA, session recording, approval-based time-limited credentials, and vendor escort monitoring."],"tools":["CyberArk","BeyondTrust","ServiceNow"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["remediation","reporting"],"distinctiveFeatures":["Focuses specifically on OT/ICS remote access conduit design under IEC 62443, distinguishing vendor and internal access workflows rather than general VPN or network segmentation.","Includes an executable Python OTConduitManager for access request handling and audit reporting, not just architecture diagrams."],"familyIds":["ot-ics-network-security-architecture-and-compliance"]},{"id":"implementing-container-image-minimal-base-with-distroless","summary":"Practical guide for hardening container images using Google distroless base images, eliminating shells, package managers, and utilities to drastically reduce attack surface. Includes multi-stage build patterns for Go, Java, Python, and Node.js, along with debugging and scanning techniques for shell-less containers.","primaryDomain":"cloud-security","domainTags":["container-security","kubernetes-security","image-hardening"],"capabilityTags":["container-image-hardening","distroless-base-image","multi-stage-docker-build","attack-surface-reduction"],"capabilityDetails":["Provides a workflow for building container images with Google distroless base images, which contain only the application runtime and dependencies, omitting shells, package managers, and OS utilities.","Includes multi-stage Dockerfile patterns for Go, Java, Python, and Node.js applications to produce minimal production images."],"techniqueTags":["distroless-images","multi-stage-build","container-debugging","image-scanning"],"techniqueDetails":["Uses multi-stage Docker builds to compile and then copy only the app binary or runtime into a distroless base image.","Leverages debug image variants and ephemeral debug containers for troubleshooting shell-less containers.","Employs image scanning tools like Trivy, crane, and dive to inspect and compare vulnerabilities across base images."],"tools":["docker","trivy","crane","dive","kubectl"],"targetTypes":["container","kubernetes"],"role":"specialist-playbook","workflowFocus":["analysis","validation","remediation"],"distinctiveFeatures":["Focuses specifically on distroless base images as a container hardening technique, with a unique comparison of attack surface across Ubuntu, Alpine, and distroless.","Provides language-specific multi-stage Dockerfile examples and debugging strategies for shell-less container environments."],"familyIds":["container-image-hardening-and-provenance"]},{"id":"implementing-container-network-policies-with-calico","summary":"Practical guide for implementing zero-trust network segmentation in Kubernetes clusters using Calico CNI, covering policy auditing, default-deny baseline, granular allow rules, and validation via calicoctl and kubectl.","primaryDomain":"network-security","domainTags":["container-security","kubernetes","calico","network-policy","microsegmentation","cni"],"capabilityTags":["network-policy-creation","network-policy-auditing","default-deny-implementation","egress-restriction","dns-based-policy"],"capabilityDetails":["Provides a workflow for creating and auditing Calico NetworkPolicy and GlobalNetworkPolicy resources to enforce Kubernetes network segmentation.","Includes steps for implementing default-deny policies, workload-specific allow rules, and validating policy enforcement."],"techniqueTags":["calico-network-policy","global-network-policy","default-deny","egress-filtering","dns-policy"],"techniqueDetails":["Uses calicoctl and Kubernetes API to manage Calico-specific policy resources.","Employs default-deny zero-trust baseline and granular allow rules for pod-to-pod and egress traffic."],"tools":["calicoctl","kubectl","kubernetes-python-client"],"targetTypes":["container","kubernetes"],"role":"specialist-playbook","workflowFocus":["analysis","remediation","validation"],"distinctiveFeatures":["Focuses specifically on Calico CNI's extended network policy capabilities (NetworkPolicy and GlobalNetworkPolicy) rather than generic Kubernetes NetworkPolicy.","Includes both policy implementation and audit/validation workflow, with a JSON audit report output."],"familyIds":["network-microsegmentation-and-workload-isolation"]},{"id":"implementing-continuous-security-validation-with-bas","summary":"Operational playbook for deploying Breach and Attack Simulation platforms to safely simulate MITRE ATT&CK techniques and continuously validate security control effectiveness, including architecture, scenario configuration, scoring, and scheduling.","primaryDomain":"general-pentesting","domainTags":["continuous-security-validation","breach-attack-simulation","mitre-attack","security-control-assessment","vulnerability-management"],"capabilityTags":["continuous-validation","control-effectiveness-scoring","attack-scenario-configuration","simulation-orchestration","mitre-attack-mapping"],"capabilityDetails":["Provides a workflow for deploying BAS platforms to safely simulate MITRE ATT&CK techniques and continuously validate endpoint, network, email-gateway, SIEM, and incident-response control effectiveness."],"techniqueTags":["bas","adversary-emulation","kill-chain-simulation","detection-validation","safe-simulation"],"techniqueDetails":["Uses controlled simulation of techniques such as phishing delivery, PowerShell execution, LSASS dump, lateral movement, C2 beaconing, and exfiltration, mapped to MITRE ATT&CK tactics, with prevention/detection scoring."],"tools":["SafeBreach","AttackIQ","Picus","Cymulate","Pentera","SCYTHE"],"targetTypes":["windows-host","linux-host","network","cloud","other"],"role":"specialist-playbook","workflowFocus":["validation","analysis","detection"],"distinctiveFeatures":["Emphasizes continuous BAS-based security control validation rather than point-in-time penetration testing","Covers multi-platform BAS deployment, MITRE ATT&CK mapping, control-effectiveness scoring, and scheduling cadences"],"familyIds":["continuous-security-validation-and-exposure-management"]},{"id":"implementing-data-loss-prevention-with-microsoft-purview","summary":"Advanced implementation playbook for deploying Microsoft Purview Data Loss Prevention across Microsoft 365 workloads, covering sensitivity label taxonomies, regex-based custom sensitive information types, endpoint DLP restrictions, auto-labeling simulation-to-enforcement, and Activity Explorer-based monitoring using PowerShell and Graph API.","primaryDomain":"cloud-security","domainTags":["data-loss-prevention","microsoft-purview","sensitivity-labels","endpoint-dlp","data-classification"],"capabilityTags":["dlp-policy-deployment","sensitivity-label-management","custom-sensitive-info-type-creation","endpoint-dlp-configuration","auto-labeling-policy-setup","activity-explorer-monitoring"],"capabilityDetails":["Deploys DLP policies across Exchange Online, SharePoint, OneDrive, Teams, endpoints, and Power BI using PowerShell and Graph API.","Creates sensitivity label taxonomies with encryption, content marking, and label policies for publication.","Defines custom sensitive information types via XML regex rule packages for organization-specific data formats.","Configures endpoint DLP restrictions for USB copy, print, clipboard, network share, and cloud upload actions.","Implements auto-labeling policies in simulation mode before enforcement, with validation through Activity Explorer and alerts."],"techniqueTags":["powershell-cmdlet-automation","graph-api-alert-querying","regex-pattern-matching","label-based-encryption","simulation-mode-validation","audit-log-analysis"],"techniqueDetails":["Uses Connect-IPPSSession and Microsoft Purview compliance cmdlets for label, policy, and rule automation.","Queries DLP alerts and incidents through Microsoft Graph Security API for SIEM integration and custom dashboards.","Builds custom sensitive information type packages with regex and keyword proximity for precise detection.","Applies sensitivity labels with encryption rights and content marking to enforce access controls on documents and email.","Runs DLP and auto-labeling policies in TestWithNotifications mode before switching to Enable, validating detection accuracy and false positive rates.","Leverages Activity Explorer and Search-UnifiedAuditLog to review DLP matches, overrides, and compliance reporting."],"tools":["security-and-compliance-powershell","microsoft-graph-api","microsoft-purview-portal","microsoft-intune","microsoft-sentinel","unified-audit-log"],"targetTypes":["cloud","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Provides an implementation-level Microsoft Purview DLP deployment workflow with exact PowerShell cmdlets, custom SIT XML rule packages, endpoint DLP settings, and Graph API alert querying.","Distinguishes from generic data-loss-prevention overviews by focusing on concrete configuration, simulation-to-enforcement transitions, and incident investigation through Activity Explorer."],"familyIds":["cloud-data-protection-and-classification"]},{"id":"implementing-ddos-mitigation-with-cloudflare","summary":"Provides a step-by-step workflow to configure Cloudflare's DDoS mitigation stack, including managed rulesets for L3/4 and L7 attacks, rate limiting, WAF custom rules, bot management, origin protection, and automated under-attack mode, with API examples and a Python monitoring script.","primaryDomain":"network-security","domainTags":["ddos","cloudflare","rate-limiting","waf","bot-management","layer-7"],"capabilityTags":["ddos-mitigation","cloudflare-rulesets","rate-limiting","waf-configuration","bot-management","origin-protection"],"capabilityDetails":["Provides a step-by-step workflow to configure Cloudflare's DDoS protection stack including managed rulesets for L3/4 and L7 attacks.","Includes rate limiting rule creation for login and API endpoints.","Covers WAF custom rules to block malicious patterns and high-risk countries.","Integrates Bot Management for bot score challenges and mitigated traffic.","Demonstrates origin protection via Cloudflare IP allowlisting and Authenticated Origin Pulls.","Automates Under Attack Mode enablement through a Python monitoring script."],"techniqueTags":["managed-rulesets","rate-limiting-rules","waf-custom-rules","ip-allowlisting","authenticated-origin-pulls","under-attack-mode"],"techniqueDetails":["Overrides Cloudflare managed DDoS rulesets to adjust sensitivity and action for HTTP and network-layer attacks.","Configures rate limiting based on characteristics like IP and data center.","Blocks requests based on ASN, missing User-Agent, country, and request size.","Restricts origin server access to Cloudflare IP ranges using iptables.","Enables mutual TLS for origin connections to prevent direct-to-origin attacks.","Uses security level automation via Cloudflare API and GraphQL analytics."],"tools":["curl","cloudflare-api","python3","iptables","nginx"],"targetTypes":["web-application","api","network"],"role":"specialist-playbook","workflowFocus":["remediation","detection","validation"],"distinctiveFeatures":["Cloudflare-specific DDoS mitigation stack covering all layers from managed rulesets to origin protection.","Includes both L3/4 volumetric and L7 application-layer attack mitigation configurations.","Provides API-driven automation with a Python script for dynamically enabling Under Attack Mode."],"familyIds":["network-infrastructure-routing-and-ddos-security"]},{"id":"implementing-deception-based-detection-with-canarytoken","summary":"Deploys and monitors Canary Tokens via the Thinkst Canary REST API for deception-based breach detection, covering web bug, DNS, MS Word, and AWS API key tokens, and generates deception coverage reports.","primaryDomain":"network-security","domainTags":["deception-technology","breach-detection","honeytokens","canarytoken"],"capabilityTags":["deception-based-detection","canary-token-management","breach-detection","deception-coverage-reporting"],"capabilityDetails":["Provides a workflow for programmatically creating and monitoring Canary Tokens (web bug, DNS, Word docs, AWS API keys) via the Thinkst Canary REST API for early breach detection."],"techniqueTags":["web-bug-tokens","dns-tokens","word-document-tokens","aws-api-key-tokens"],"techniqueDetails":["Uses lightweight tripwire tokens that alert when accessed, with token types including web bug HTTP URLs, DNS resolution names, MS Word documents, and AWS API keys."],"tools":["thinkst-canary","python-requests"],"targetTypes":["web-application","network","cloud"],"role":"specialist-playbook","workflowFocus":["detection","reporting"],"distinctiveFeatures":["Focuses specifically on deception-based breach detection using Canary Tokens rather than standard IDS/IPS.","Automates creation and monitoring of multiple token types through a single API integration.","Includes deception coverage reporting and deployment recommendations."],"familyIds":["deception-based-threat-detection"]},{"id":"implementing-delinea-secret-server-for-pam","summary":"Provides a step-by-step playbook for deploying Delinea Secret Server as an enterprise PAM solution, including secret vault configuration, discovery/onboarding, automated password rotation, session recording, and SIEM/compliance reporting.","primaryDomain":"authentication","domainTags":["privileged-access-management","credential-management","identity-access-management","secrets-management"],"capabilityTags":["pam-implementation","secret-vault-configuration","password-rotation","session-recording","active-directory-integration","compliance-reporting"],"capabilityDetails":["Provides a step-by-step workflow for deploying Delinea Secret Server, including installation, vault organization, account discovery, password rotation, session monitoring, and SIEM integration.","Includes PowerShell and REST API automation examples for configuration.","Covers compliance reporting metrics for SOX, PCI-DSS, HIPAA, and NIST 800-53."],"techniqueTags":["credential-vaulting","automated-password-rotation","privileged-session-monitoring","role-based-access-control","account-discovery"],"techniqueDetails":["Uses Delinea Secret Server's vaulting, rotation, and session recording features to manage privileged credentials.","Configures Remote Password Changing (RPC) and heartbeat monitoring to verify credential validity.","Enables dual control and approval workflows for sensitive account access."],"tools":["delinea-secret-server","powershell","secret-server-rest-api","active-directory","sql-server","iis","syslog"],"targetTypes":["active-directory","windows-host","linux-host","network","cloud","database"],"role":"specialist-playbook","workflowFocus":["remediation","reporting"],"distinctiveFeatures":["Product-specific implementation guide for Delinea Secret Server rather than generic PAM methodology.","Covers full lifecycle from deployment and discovery to password rotation, session recording, and compliance reporting.","Includes concrete PowerShell and REST API automation examples.","Addresses compliance frameworks (SOX, PCI-DSS, HIPAA, NIST 800-53) with reporting metrics."],"familyIds":["privileged-access-and-identity-lifecycle-operations"]},{"id":"implementing-device-posture-assessment-in-zero-trust","summary":"Provides a step-by-step implementation workflow for enforcing device posture in zero trust architectures, integrating CrowdStrike ZTA, Intune, Jamf, and conditional access policies to block non-compliant devices.","primaryDomain":"cloud-security","domainTags":["zero-trust","device-posture","endpoint-compliance","conditional-access"],"capabilityTags":["device-posture-assessment","compliance-policy-configuration","conditional-access-enforcement","posture-monitoring"],"capabilityDetails":["Implements device posture assessment by integrating endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies that enforce compliance before granting access."],"techniqueTags":["api-integration","policy-configuration","score-thresholding","posture-drift-detection"],"techniqueDetails":["Uses API calls to query CrowdStrike ZTA scores, create Intune/Jamf compliance policies, configure Entra ID / Okta conditional access, and monitor compliance drift."],"tools":["CrowdStrike Falcon","Microsoft Intune","Jamf Pro","Microsoft Entra ID","Okta","Cloudflare","PowerShell","curl","Python"],"targetTypes":["windows-host","cloud","other"],"role":"specialist-playbook","workflowFocus":["validation","detection","remediation"],"distinctiveFeatures":["Integrates CrowdStrike ZTA, Intune, and Jamf device posture signals into conditional access policies, covering the CISA Zero Trust device pillar with continuous posture drift monitoring."],"familyIds":["cloud-identity-and-access-security"]},{"id":"implementing-devsecops-security-scanning","summary":"Actionable workflow for embedding automated SAST, DAST, SCA, secrets detection, and container scanning into CI/CD pipelines, with security gates and pre-commit hooks to block critical/high findings and shift security left.","primaryDomain":"source-code-security","domainTags":["sast","sca","dast","secret-scanning","container-security"],"capabilityTags":["ci-cd-security-scanning","security-gate-enforcement","scanner-orchestration","shift-left-security","sbom-generation"],"capabilityDetails":["Provides step-by-step workflow for integrating SAST, DAST, SCA, secrets detection, and container scanning into CI/CD pipelines, including configuration, security gates, and developer feedback loops."],"techniqueTags":["static-analysis","dynamic-analysis","software-composition-analysis","secret-detection","container-image-scanning"],"techniqueDetails":["Combines static analysis of source code, dynamic testing of deployed applications, dependency vulnerability scanning, secret detection, and container image scanning to detect vulnerabilities across the CI/CD lifecycle."],"tools":["semgrep","trivy","owasp-zap","gitleaks"],"targetTypes":["source-code","web-application","container"],"role":"workflow","workflowFocus":["detection","remediation","reporting"],"distinctiveFeatures":["Presents an integrated multi-tool pipeline rather than a single-scanner guide, covering secrets, SAST, SCA, container, and DAST scans together.","Includes a centralized security gate job that aggregates results and blocks deployments on critical/high findings, plus branch protection enforcement.","Closes the loop with pre-commit hooks and a developer feedback mechanism, enabling shift-left beyond just CI."],"familyIds":["ci-cd-security-scanning-integration"]},{"id":"implementing-diamond-model-analysis","summary":"Implements the Diamond Model of Intrusion Analysis in Python to structure intrusion events, link them into activity threads, discover pivots around shared infrastructure/capability/adversary, and generate reports mapped to MITRE ATT&CK and STIX.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","intrusion-analysis","stix"],"capabilityTags":["diamond-model-analysis","activity-thread-correlation","pivot-analysis","threat-intelligence-reporting"],"capabilityDetails":["Provides a programmatic workflow to model intrusion events using the Diamond Model, correlate events into activity threads, and produce pivot-ready intelligence."],"techniqueTags":["diamond-model","mitre-attack-mapping","stix-modeling","graph-analysis"],"techniqueDetails":["Uses a directed graph to link events chronologically and finds pivots by clustering events that share infrastructure, capability, or adversary attributes."],"tools":["python","networkx","stix2","graphviz","misp","opencti"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Focuses on implementing the Diamond Model as code for CTI event analysis, not on active intrusion detection or response.","Includes Python data structures and graph construction for building activity threads and pivot tables."],"familyIds":["threat-intelligence-analysis"]},{"id":"implementing-digital-signatures-with-ed25519","summary":"Practical implementation guidance for Ed25519 digital signatures, including key-pair generation, signing, verification, multi-signature and code-signing workflows, plus security and performance tradeoffs versus RSA and ECDSA.","primaryDomain":"authentication","domainTags":["cryptography","digital-signatures","ed25519","authentication","integrity"],"capabilityTags":["key-pair-generation","message-signing","signature-verification","code-signing","multi-signature-verification"],"capabilityDetails":["Provides implementation workflows for generating Ed25519 key pairs, signing messages and files, verifying signatures, and building multi-signature or code-signing systems."],"techniqueTags":["ed25519","deterministic-signatures","curve25519","public-key-cryptography","side-channel-resistance"],"techniqueDetails":["Uses Ed25519 deterministic signatures with Curve25519, internal message hashing, and constant-time operations to avoid nonce randomness and side-channel concerns."],"tools":["python"],"targetTypes":["api","source-code","other"],"role":"specialist-playbook","workflowFocus":["analysis","validation"],"distinctiveFeatures":["Specialized in Ed25519 implementation rather than general digital signature guidance, covering deterministic signature behavior, performance tradeoffs vs RSA/ECDSA, and building code signing / API authentication workflows."],"familyIds":["email-and-data-authentication-and-anti-spoofing"]},{"id":"implementing-disk-encryption-with-bitlocker","summary":"Step-by-step guidance for deploying BitLocker full disk encryption on Windows endpoints, including TPM/PIN protector options, enterprise policy deployment via GPO/Intune, recovery key escrow, and compliance status monitoring.","primaryDomain":"windows-security","domainTags":["bitlocker","disk-encryption","tpm","data-at-rest-protection"],"capabilityTags":["bitlocker-implementation","disk-encryption","tpm-configuration","recovery-key-management","compliance-encryption"],"capabilityDetails":["Provides a workflow for deploying BitLocker full disk encryption on Windows endpoints, including TPM verification, GPO/Intune configuration, command-line enablement, recovery key escrow, and compliance monitoring."],"techniqueTags":["tpm-protector","tpm-and-pin-protector","recovery-password-protector","xts-aes-256","group-policy-configuration","intune-deployment"],"techniqueDetails":["Uses PowerShell cmdlets (Enable-BitLocker, Get-BitLockerVolume) and manage-bde.exe to configure encryption; supports TPM-only or TPM+PIN protectors; XTS-AES 256-bit encryption; recovery keys escrowed to Active Directory or Azure AD."],"tools":["PowerShell","manage-bde.exe","Microsoft Intune","Active Directory","RSAT"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Focuses specifically on Microsoft BitLocker for Windows data-at-rest protection, covering TPM/PIN startup protectors, enterprise policy deployment via GPO and Intune, and recovery key escrow to AD/Azure AD; explicitly excludes Linux LUKS and macOS FileVault."],"familyIds":["windows-data-at-rest-encryption"]},{"id":"implementing-dmarc-dkim-spf-email-security","summary":"Implements email authentication controls (SPF, DKIM, DMARC) via DNS TXT records to prevent domain spoofing and enforce quarantine/reject policies on unauthenticated mail, with steps for auditing and validating current DNS state.","primaryDomain":"authentication","domainTags":["email-security","dns","phishing-defense"],"capabilityTags":["email-authentication-hardening","dmarc-implementation","dkim-configuration","spf-configuration"],"capabilityDetails":["Provides a step-by-step workflow to audit existing DNS records and implement SPF, DKIM, and DMARC for email authentication."],"techniqueTags":["dns-txt-record-configuration","dkim-rsa-key-generation","dmarc-policy-phasing","spf-authorization-mechanisms"],"techniqueDetails":["Uses DNS TXT records to publish email authentication policies.","Generates a 2048-bit RSA key pair for DKIM signing.","Phased DMARC rollout from p=none to p=reject.","Configures SPF mechanisms such as ip4, include, -all."],"tools":["dig","openssl","mxtoolbox","dmarcian","google-postmaster-tools","valimail-dmarc-monitor","postmark-dmarc-report-analyzer"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["remediation","validation","analysis"],"distinctiveFeatures":["Covers the complete SPF, DKIM, and DMARC implementation lifecycle from DNS audit to policy enforcement.","Includes a phased DMARC rollout strategy (monitor → quarantine → reject) to minimize legitimate email disruption.","Provides concrete DNS dig commands for auditing current SPF/DKIM/DMARC records."],"familyIds":["email-and-data-authentication-and-anti-spoofing"]},{"id":"implementing-dragos-platform-for-ot-monitoring","summary":"Deploys and configures Dragos Platform for OT/ICS network monitoring, using a Python API to validate sensor deployment, retrieve assets and notifications, and generate SIEM integration configurations; covers Knowledge Pack updates, industrial protocol monitoring, and threat group correlation for known ICS adversaries.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","scada","threat-detection","network-monitoring"],"capabilityTags":["dragos-platform-deployment","ot-sensor-management","threat-intel-pack-configuration","siem-integration","industrial-protocol-monitoring"],"capabilityDetails":["Provides a workflow for deploying and configuring Dragos Platform sensors in OT/ICS environments.","Includes a Python API client for validating sensor health, discovering assets, retrieving notifications, and generating SIEM integration configurations.","Covers Knowledge Pack updates, industrial protocol monitoring, and threat group correlation for known ICS adversaries."],"techniqueTags":["network-baselining","protocol-anomaly-detection","threat-group-correlation","vulnerability-correlation","knowledge-pack-updates"],"techniqueDetails":["Monitors Modbus, DNP3, S7comm, OPC UA, and Ethernet/IP with specific detection rules such as function code baselining, CPU stop detection, and firmware flash monitoring.","Uses threat-intelligence-backed detection analytics to alert on known ICS threat groups and their TTPs.","Configures alert routing and severity mapping for SOC triage and enterprise SIEM forwarding."],"tools":["dragos-platform","dragos-platform-api","python","splunk","microsoft-sentinel"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Vendor-specific implementation playbook for Dragos Platform, distinguishing it from generic OT monitoring or alternative platforms like Claroty/Nozomi.","Integrates a functional Python API client for deployment validation and SIEM configuration generation, not just conceptual guidance.","Emphasizes Dragos Knowledge Packs and tracked threat groups (VOLTZITE, CHERNOVITE, KAMACITE) with industrial protocol monitoring specifics."],"familyIds":["security-monitoring-platform-implementation"]},{"id":"implementing-ebpf-security-monitoring","summary":"Provides practical guidance for implementing kernel-level runtime security monitoring on Linux and Kubernetes using Cilium Tetragon eBPF, including TracingPolicy authoring for process, file, network, and privilege events, plus SIEM export and runtime enforcement.","primaryDomain":"linux-security","domainTags":["ebpf","kernel-security","runtime-security","kubernetes-security","observability"],"capabilityTags":["process-execution-monitoring","network-connection-monitoring","file-access-auditing","runtime-enforcement","tracing-policy-authoring","event-export"],"capabilityDetails":["Provides implementation guidance for deploying Cilium Tetragon to monitor process execution, network connections, and file access at the eBPF kernel level.","Covers authoring TracingPolicy/TracingPolicyNamespaced CRDs with kprobe hooks, selectors, and actions including Post and Sigkill.","Includes configuration for exporting JSON events to SIEM pipelines via file sink or stdout."],"techniqueTags":["ebpf","kprobe-hooking","in-kernel-filtering","selectors","crd-authoring","json-event-export"],"techniqueDetails":["Uses kprobes to hook kernel functions such as fd_install, tcp_connect, and commit_creds to capture file, network, and privilege events.","Uses matchArgs and matchBinaries selectors with operators like Prefix, Postfix, Equal, In to filter events inside the kernel before userspace.","Uses TracingPolicy CRDs to configure hooks and actions centrally on Kubernetes clusters.","Exports events as JSON to stdout or files for SIEM ingestion."],"tools":["cilium-tetragon","tetra","helm","kubectl","jq","curl","filebeat","elasticsearch"],"targetTypes":["linux-host","kubernetes","container"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focused specifically on kernel-level runtime security observability using eBPF and Cilium Tetragon, not userspace EDR or traditional audit logs.","Provides ready-to-use TracingPolicy examples for file access, network connections, privilege escalation, reverse shells, container escape attempts, and in-kernel enforcement with Sigkill.","Covers both Kubernetes and standalone Linux deployment modes with Helm and tarball installation."],"familyIds":["linux-runtime-threat-detection"]},{"id":"implementing-email-sandboxing-with-proofpoint","summary":"Configures Proofpoint Targeted Attack Protection (TAP) to sandbox email attachments and URLs, detect evasive phishing payloads, monitor threats, and integrate with SIEM.","primaryDomain":"network-security","domainTags":["phishing-defense","email-security","social-engineering","proofpoint"],"capabilityTags":["email-sandboxing-configuration","proofpoint-tap-setup","url-defense","attachment-detonation","siem-integration"],"capabilityDetails":["Provides a step-by-step workflow for configuring Proofpoint TAP email sandboxing, including attachment policies, URL rewriting, dashboard monitoring, and SIEM integration."],"techniqueTags":["sandboxing","url-rewriting","time-of-click-detonation","dynamic-delivery","threat-intelligence"],"techniqueDetails":["Uses isolated VM detonation for attachments, URL rewriting with time-of-click checks, and predictive analysis to detect evasive threats."],"tools":["Proofpoint TAP","Proofpoint API"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Vendor-specific implementation of Proofpoint TAP, covering both configuration and tuning of sandbox/URL policies, unlike generic phishing awareness or email authentication (DMARC/SPF) skills."],"familyIds":["content-isolation-and-sandboxing"]},{"id":"implementing-end-to-end-encryption-for-messaging","summary":"Implements a simplified Signal Protocol-style E2EE scheme for messaging, including X3DH key agreement, Double Ratchet state management, and AES-GCM authenticated encryption, with explicit forward secrecy and out-of-order delivery handling.","primaryDomain":"security-knowledge","domainTags":["cryptography","encryption","messaging-security","key-management"],"capabilityTags":["end-to-end-encryption-implementation","signal-protocol-implementation","forward-secrecy","secure-messaging"],"capabilityDetails":["Provides a workflow for implementing Signal Protocol-style E2EE for messaging, covering key exchange, ratcheting, and message encryption."],"techniqueTags":["x25519","hkdf","aes-gcm","double-ratchet","x3dh"],"techniqueDetails":["Uses X25519 for Diffie-Hellman key exchange and HKDF for key derivation; AES-256-GCM for authenticated encryption."],"tools":["python"],"targetTypes":["source-code","other"],"role":"workflow","workflowFocus":["analysis","validation","remediation"],"distinctiveFeatures":["Focuses specifically on implementing forward-secure end-to-end encryption for messaging rather than using pre-built solutions or general cryptography guidance."],"familyIds":["cryptographic-data-protection"]},{"id":"implementing-endpoint-detection-with-wazuh","summary":"Step-by-step implementation guide for Wazuh SIEM/XDR endpoint detection, covering JWT API authentication, agent management, custom decoder/rule creation, alert querying, logtest validation, and active response, resulting in a JSON detection report.","primaryDomain":"network-security","domainTags":["siem","xdr","endpoint-detection","security-monitoring"],"capabilityTags":["wazuh-deployment","agent-management","custom-rule-authoring","alert-querying","logtest-rule-validation","active-response"],"capabilityDetails":["Provides a workflow for deploying Wazuh SIEM/XDR, managing agents via REST API, authoring custom decoders/rules in XML, querying alerts, validating rules with wazuh-logtest, and configuring automated active response."],"techniqueTags":["rest-api","jwt-authentication","xml-rule-authoring","logtest-validation"],"techniqueDetails":["Uses Wazuh REST API with JWT authentication for agent and alert management; creates custom XML decoders/rules for detection logic; leverages wazuh-logtest to validate rule matching against sample logs."],"tools":["wazuh","wazuh-logtest","python-requests"],"targetTypes":["windows-host","linux-host"],"role":"workflow","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on Wazuh SIEM/XDR implementation, including custom decoder/rule XML creation and logtest validation, rather than general endpoint detection methodology."],"familyIds":["security-monitoring-platform-implementation"]},{"id":"implementing-endpoint-dlp-controls","summary":"Workflow for implementing endpoint Data Loss Prevention controls using Microsoft Purview DLP, covering sensitive data classification, policy definition, audit-mode deployment, monitoring, and incident response.","primaryDomain":"security-knowledge","domainTags":["endpoint-security","data-loss-prevention","data-protection","content-inspection"],"capabilityTags":["dlp-policy-implementation","sensitive-data-detection","content-inspection","endpoint-activity-monitoring"],"capabilityDetails":["Provides step-by-step workflow to implement endpoint DLP using Microsoft Purview, including defining sensitive info types, creating policies, and configuring actions.","Describes methods to detect sensitive data such as PII, PHI, PCI using built-in and custom SITs.","Explains deep content inspection to identify sensitive patterns in files and data.","Covers monitoring endpoint activities like USB, cloud upload, print, clipboard to prevent data exfiltration."],"techniqueTags":["sensitive-information-types","exact-data-match","audit-mode-testing","policy-tip-notification"],"techniqueDetails":["Uses Microsoft Purview Sensitive Information Types with regex, keywords, and ML classifiers.","Uses Exact Data Match to detect known sensitive values with high precision.","Deploys DLP in audit mode first to tune policies and reduce false positives.","Configures user notifications and optional user override for blocked actions."],"tools":["Microsoft Purview DLP","Symantec DLP","Digital Guardian","Forcepoint DLP","Code42 Incydr"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","validation","reporting","remediation"],"distinctiveFeatures":["Focused exclusively on endpoint DLP, explicitly excluding network DLP and cloud-only DLP.","Provides a Microsoft Purview-centric deployment workflow with SIT definition, audit-mode tuning, and incident response metrics."],"familyIds":["endpoint-data-loss-prevention"]},{"id":"implementing-envelope-encryption-with-aws-kms","summary":"Implementation guide for envelope encryption using AWS KMS, providing procedures for generating and managing data encryption keys, local AES-256-GCM encryption, key caching, rotation, and validation criteria to reduce KMS API calls and secure large data objects.","primaryDomain":"cloud-security","domainTags":["cryptography","aws","kms","key-management","envelope-encryption"],"capabilityTags":["envelope-encryption-implementation","data-key-management","local-encryption","kms-integration"],"capabilityDetails":["Provides a complete implementation workflow for envelope encryption using AWS KMS, covering key generation, local encryption, key caching, rotation, and validation."],"techniqueTags":["envelope-encryption","aes-256-gcm","generate-data-key","key-encryption-key","data-encryption-key","encryption-context"],"techniqueDetails":["Uses AWS KMS GenerateDataKey to create a DEK, encrypts data locally with AES-256-GCM, and wraps the DEK with a KEK managed by KMS."],"tools":["aws-kms","python","cloudtrail"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["remediation","validation","knowledge-reference"],"distinctiveFeatures":["Focuses on envelope encryption with AWS KMS, including DEK/KEK separation and local encryption, rather than generic KMS usage.","Covers operational aspects like key caching, rotation, and multi-region disaster recovery."],"familyIds":["cloud-data-protection-and-classification"]},{"id":"implementing-epss-score-for-vulnerability-prioritization","summary":"Provides a data-driven approach to prioritize vulnerability remediation by querying FIRST's EPSS API for exploitation probability and percentile scores, combining them with CVSS severity to assign P0-P4 priorities, and detecting emerging threats via EPSS trend analysis.","primaryDomain":"security-knowledge","domainTags":["vulnerability-prioritization","epss","exploit-prediction","risk-based","cve"],"capabilityTags":["epss-score-querying","vulnerability-prioritization","cve-enrichment","exploitation-probability-analysis","trend-analysis"],"capabilityDetails":["Provides a workflow for querying FIRST's EPSS API to fetch exploitation probability and percentile scores for CVEs.","Includes a Python implementation to enrich vulnerability scan results with EPSS scores and assign P0-P4 priority levels.","Offers EPSS trend analysis to detect score spikes indicative of emerging exploitation threats."],"techniqueTags":["epss-api-querying","cvss-plus-epss-combined-scoring","percentile-thresholding","time-series-trend-analysis"],"techniqueDetails":["Combines EPSS scores with CVSS scores using a decision matrix to assign remediation priorities.","Uses EPSS percentile ranks to identify top-risk vulnerabilities and guide urgency.","Detects increases in EPSS scores over time to flag emerging threats."],"tools":["python","requests","pandas","matplotlib","curl","first-epss-api"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","reporting","remediation"],"distinctiveFeatures":["Focuses specifically on EPSS data-driven exploitation likelihood scoring rather than CVSS-only severity.","Provides a complete Python automation workflow for enriching scan results with EPSS scores and prioritizing them.","Includes time-series trend analysis to detect EPSS spikes for early warning of emerging exploitation."],"familyIds":["vulnerability-prioritization-and-risk-scoring"]},{"id":"implementing-file-integrity-monitoring-with-aide","summary":"Provides a practical workflow for deploying AIDE on Linux, including baseline creation, integrity checks, cron-based automation, and change reporting for compliance.","primaryDomain":"linux-security","domainTags":["file-integrity","hids","intrusion-detection","compliance"],"capabilityTags":["baseline-creation","integrity-checking","change-detection","automated-monitoring"],"capabilityDetails":["Configures AIDE to create a cryptographic baseline of critical files and detect unauthorized changes."],"techniqueTags":["checksum-comparison","cron-scheduled-scanning","baseline-comparison"],"techniqueDetails":["Uses cryptographic checksums to compare current file state against a baseline."],"tools":["aide"],"targetTypes":["linux-host"],"role":"specialist-playbook","workflowFocus":["detection","reporting"],"distinctiveFeatures":["Provides a complete AIDE workflow from configuration to scheduled integrity checks and change report generation."],"familyIds":["linux-host-integrity-validation"]},{"id":"implementing-fuzz-testing-in-cicd-with-aflplusplus","summary":"Provides a step-by-step playbook for integrating AFL++ coverage-guided fuzzing into CI/CD pipelines, covering harness construction, instrumentation with ASan and CmpLog, persistent mode, parallel fuzzing, and crash triage to discover memory-corruption vulnerabilities in C/C++ code.","primaryDomain":"binary-exploitation","domainTags":["fuzz-testing","coverage-guided-fuzzing","cicd","c-cpp","memory-safety"],"capabilityTags":["fuzz-harness-development","ci-integration","instrumentation-build","corpus-optimization","crash-triage","parallel-fuzzing-execution"],"capabilityDetails":["Provides end-to-end workflow for integrating AFL++ coverage-guided fuzzing into CI/CD pipelines.","Covers construction of fuzzing harnesses for C/C++ parser and input-handling code.","Explains compilation with AFL++ instrumentation, AddressSanitizer, and CmpLog modes.","Includes persistent-mode fuzzing and parallel fuzzing strategies for high-throughput discovery.","Details crash triage, corpus minimization, and monitoring of fuzzing campaigns."],"techniqueTags":["coverage-guided-fuzzing","persistent-mode-fuzzing","addresssanitizer","cmplog","instrumentation","parallel-fuzzing"],"techniqueDetails":["Uses AFL++ genetic input mutation and code coverage feedback to explore program pathways.","Persistent mode reuses process state across iterations to achieve high execution speeds.","Instrumentation builds with afl-clang-fast, LTO, or GCC modes add coverage tracking.","AddressSanitizer detects memory errors such as overflows and use-after-free during fuzzing.","CmpLog mode extracts comparison operands to bypass magic-byte checks.","Parallel fuzzing with multiple -S instances accelerates coverage discovery.","Corpus minimization with afl-cmin and afl-tmin reduces input set while preserving coverage."],"tools":["aflplusplus","afl-fuzz","afl-clang-fast","afl-cmin","afl-tmin","afl-whatsup","afl-collect","addresssanitizer","github-actions"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Dedicated specifically to embedding AFL++ fuzzing in CI/CD pipelines, including corpus caching across builds, time-limited runs, and scheduled campaigns.","Provides ready-to-use GitHub Actions YAML with nightly runs, crash counting, and corpus cache updates.","Covers persistent mode and CmpLog instrumentation for high-speed fuzzing in automated environments."],"familyIds":["aflplusplus-coverage-guided-fuzzing"]},{"id":"implementing-gcp-binary-authorization","summary":"Provides a complete implementation workflow for GCP Binary Authorization, enabling deploy-time enforcement of attested container images on GKE and Cloud Run, including creation of KMS-backed attestors, Container Analysis notes, admission policies, and attestation signing.","primaryDomain":"cloud-security","domainTags":["gcp","binary-authorization","container-security","supply-chain-security","attestation"],"capabilityTags":["binary-authorization-implementation","attestor-creation","admission-policy-configuration","attestation-signing","continuous-validation-monitoring"],"capabilityDetails":["Provides an end-to-end workflow to implement Binary Authorization on GCP, including enabling APIs, creating KMS-backed attestors, configuring admission policies, signing attestations, and validating enforcement."],"techniqueTags":["kms-backed-attestation","container-analysis-note","deploy-time-policy","continuous-validation"],"techniqueDetails":["Uses KMS asymmetric signing keys for attestation signing, Container Analysis notes to define attestation authorities, YAML-based admission policies for enforcement, and Cloud Logging for monitoring continuous validation violations."],"tools":["gcloud","curl","kubectl","docker","cloud-build"],"targetTypes":["cloud","container","kubernetes"],"role":"specialist-playbook","workflowFocus":["remediation","validation","detection"],"distinctiveFeatures":["Provides authoritative configuration for GCP Binary Authorization with KMS-backed attestors and Container Analysis notes, including per-cluster admission rules and break-glass override for emergency deployments.","Distinct from generic container hardening by focusing specifically on deploy-time attestation enforcement across GKE and Cloud Run."],"familyIds":["container-image-hardening-and-provenance"]},{"id":"implementing-gcp-organization-policy-constraints","summary":"Provides a practical guide to implementing GCP Organization Policy constraints using gcloud and Terraform, covering essential security constraints, custom constraints, dry-run testing, and baseline policies for cloud hardening.","primaryDomain":"cloud-security","domainTags":["gcp","organization-policy","compliance","governance"],"capabilityTags":["policy-implementation","security-hardening","infrastructure-as-code","custom-constraint-management"],"capabilityDetails":["Provides a workflow for implementing GCP Organization Policy constraints via gcloud CLI and Terraform."],"techniqueTags":["list-constraints","boolean-constraints","custom-constraints","dry-run-testing","policy-inheritance"],"techniqueDetails":["Demonstrates configurable list, boolean, and custom constraints; uses dry-run policies to assess impact before enforcement."],"tools":["gcloud","terraform"],"targetTypes":["cloud","container"],"role":"specialist-playbook","workflowFocus":["remediation","validation","knowledge-reference"],"distinctiveFeatures":["Focuses specifically on GCP Organization Policy constraints rather than general cloud security; includes both gcloud CLI and Terraform implementations and dry-run testing with Policy Intelligence."],"familyIds":["cloud-security-posture-management"]},{"id":"implementing-gcp-vpc-firewall-rules","summary":"Practical gcloud-based playbook to audit, implement, and validate GCP VPC firewall rules, including restrictive ingress/egress, hierarchical policies, and flow log monitoring.","primaryDomain":"cloud-security","domainTags":["cloud-security","network-security","gcp","vpc-firewall"],"capabilityTags":["gcp-firewall-audit","firewall-rule-implementation","least-privilege-egress","hierarchical-policy","vpc-flow-log-validation"],"capabilityDetails":["Provides a workflow to audit existing GCP VPC firewall rules for overly permissive configurations.","Implements least-privilege ingress and egress firewall rules using gcloud commands.","Deploys organization-level hierarchical firewall policies for consistent security controls.","Configures VPC Flow Logs and queries them to validate firewall rule effectiveness."],"techniqueTags":["gcloud-cli","network-tag-targeting","service-account-targeting","default-deny-egress","flow-log-analysis"],"techniqueDetails":["Uses gcloud CLI filtering to identify rules with broad source ranges (0.0.0.0/0) or all protocols.","Targets firewall rules using network tags and service accounts for precise instance selection.","Enforces default-deny egress and explicit allow rules to prevent data exfiltration.","Leverages VPC Flow Logs and Cloud Logging queries to detect denied traffic and rule hits."],"tools":["gcloud","VPC Flow Logs","Cloud Logging","Security Command Center"],"targetTypes":["cloud","network"],"role":"specialist-playbook","workflowFocus":["detection","remediation","validation"],"distinctiveFeatures":["Specializes in GCP VPC firewall rule lifecycle (audit, implement, monitor), including hierarchical firewall policies and VPC Flow Logs validation; explicitly excludes application-layer WAF (Cloud Armor) and DNS filtering."],"familyIds":["cloud-network-security-controls"]},{"id":"implementing-gdpr-data-protection-controls","summary":"A structured playbook for implementing GDPR data protection controls across an organization, covering data mapping, DPIA, technical safeguards, subject rights workflows, breach notification, and cross-border transfer compliance.","primaryDomain":"security-knowledge","domainTags":["compliance","governance","privacy","data-protection","gdpr"],"capabilityTags":["gdpr-implementation","data-subject-rights","privacy-by-design","breach-notification","cross-border-transfer"],"capabilityDetails":["Provides a phased workflow for implementing GDPR technical and organizational controls, including data mapping, DPIA, DSR handling, and 72-hour breach notification procedures."],"techniqueTags":["data-mapping","pseudonymization","encryption","access-control","consent-management"],"techniqueDetails":["Covers Article 32 security measures such as pseudonymization, encryption, access controls, and regular testing; includes data subject rights handling mechanisms."],"tools":[],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","remediation","reporting"],"distinctiveFeatures":["Focuses on GDPR compliance and governance rather than technical vulnerability assessment","Integrates legal requirements (EU 2016/679) with technical and organizational controls","Covers the full lifecycle from data mapping to ongoing compliance monitoring"],"familyIds":["compliance-governance"]},{"id":"implementing-gdpr-data-subject-access-request","summary":"Provides an automated workflow for building and auditing GDPR Data Subject Access Request processing, covering identity verification, PII discovery with regex/NER, data mapping, exemption handling, response generation, and audit logging.","primaryDomain":"security-knowledge","domainTags":["gdpr","privacy-compliance","data-subject-rights","pii-discovery"],"capabilityTags":["dsar-workflow-automation","pii-discovery","data-mapping","response-generation","compliance-audit"],"capabilityDetails":["Provides an automated workflow for GDPR Article 15 DSAR processing including identity verification, PII discovery, data mapping, exemption review, response generation, and audit logging."],"techniqueTags":["regex-pattern-matching","named-entity-recognition","data-classification","template-based-generation"],"techniqueDetails":["Uses regex patterns and named entity recognition (spacy/presidio) to identify personal data across structured and unstructured sources.","Applies data classification to map PII to Article 15 categories such as purpose, legal basis, retention, and recipients."],"tools":["spacy","presidio-analyzer","jinja2"],"targetTypes":["database","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on GDPR DSAR response workflow automation rather than offensive security testing.","Integrates PII discovery, data mapping, exemption handling, response generation, and audit logging into a single compliance pipeline."],"familyIds":["compliance-governance"]},{"id":"implementing-github-advanced-security-for-code-scanning","summary":"Provides configuration playbooks for implementing GitHub Advanced Security, including CodeQL code scanning, secret scanning, dependency review, and Dependabot alerts at enterprise scale.","primaryDomain":"source-code-security","domainTags":["sast","devsecops","code-scanning","supply-chain-security"],"capabilityTags":["code-scanning-setup","secret-scanning-configuration","dependency-review-enforcement","dependabot-alerting","custom-codeql-query-packs"],"capabilityDetails":["Enables CodeQL code scanning via default or advanced GitHub Actions workflow, automating SAST across push, pull request, and scheduled events.","Activates secret scanning and push protection to block secrets entering repositories.","Configures dependency review and Dependabot alerts/security updates to manage supply-chain risk.","Integrates custom organization-specific CodeQL query packs for specialized detection rules."],"techniqueTags":["codeql-semantic-analysis","sast-ci-integration","sarif-upload","branch-protection-gating"],"techniqueDetails":["Uses CodeQL to treat code as data and perform semantic analysis with query suites mapped to CWE and OWASP Top 10.","Runs SAST scans directly in pull requests and pushes via GitHub Actions workflow.","Accepts SARIF outputs from third-party tools for consolidated code scanning.","Enforces security gates via branch protection rules requiring code scanning results."],"tools":["github-advanced-security","codeql","github-actions","dependabot"],"targetTypes":["source-code"],"role":"tool-guide","workflowFocus":["detection","knowledge-reference"],"distinctiveFeatures":["Focuses on GitHub's native CodeQL-powered security scanning platform rather than generic SAST tools.","Covers both default one-click setup and advanced custom workflow with query packs and SARIF integration.","Includes enterprise-scale rollout, branch protection enforcement, and monitoring via security overview."],"familyIds":["ci-cd-security-scanning-integration"]},{"id":"implementing-google-workspace-admin-security","summary":"A specialist playbook for hardening Google Workspace tenants via Admin Console and GAM CLI, covering super admin protection, phishing-resistant MFA, email authentication (SPF/DKIM/DMARC), DLP policies, OAuth app control, and external sharing restrictions.","primaryDomain":"cloud-security","domainTags":["identity-access-management","email-security","data-loss-prevention","oauth-control"],"capabilityTags":["google-workspace-hardening","mfa-enforcement","email-authentication-configuration","dlp-policy-deployment","oauth-app-allowlisting","external-sharing-restriction"],"capabilityDetails":["Provides a step-by-step hardening playbook for Google Workspace tenants, covering super admin protection, phishing-resistant MFA, email authentication (SPF/DKIM/DMARC), DLP policies, OAuth app control, and external sharing restrictions.","Uses GAM CLI and Admin Console to implement security controls, including Advanced Protection Program, context-aware access, and allowlisting third-party apps."],"techniqueTags":["advanced-protection-program","context-aware-access","spf-dkim-dmarc","dlp-content-matchers","gam-commands","oauth-scope-restriction"],"techniqueDetails":["Advanced Protection Program (APP): Requires FIDO2 security keys for super admins and blocks third-party app access to sensitive data.","Context-Aware Access: Evaluates device posture, location, and user identity to conditionally grant access to Workspace apps.","SPF/DKIM/DMARC configuration: Uses DNS TXT records and GAM to authenticate email and prevent spoofing, with a phased monitoring-to-enforcement approach.","DLP content matchers: Defines data loss prevention rules using infoType detectors (e.g., SSN, credit card) and custom regexes to block/quarantine sensitive data.","GAM commands: Leverages the Google Apps Manager CLI to automate user/org hardening, list audits, and manage admin settings.","OAuth scope restriction: Limits which API scopes third-party apps can request and blocks unapproved app tokens."],"tools":["GAM","Google Admin Console","Google Workspace Alert Center","Google Workspace DLP API"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["analysis","detection","remediation"],"distinctiveFeatures":["Provides a comprehensive Google Workspace-specific hardening sequence with concrete GAM commands, DLP rule templates, and OAuth app allowlisting policies, distinguishing it from generic cloud security or Microsoft 365 hardening Skills.","Includes a post-hardening assessment report template to audit tenant security posture."],"familyIds":["cloud-identity-and-access-security"]},{"id":"implementing-google-workspace-phishing-protection","summary":"A configuration playbook for hardening Gmail in Google Workspace against phishing, spoofing, and malware by enabling advanced pre-delivery scanning, attachment protection, spoofing/impersonation detection, Enhanced Safe Browsing, Advanced Protection Program, and SPF/DKIM/DMARC email authentication.","primaryDomain":"cloud-security","domainTags":["email-security","phishing-defense","google-workspace","anti-spoofing","malware-protection"],"capabilityTags":["phishing-protection-configuration","email-hardening","spoofing-detection","malware-scanning","safe-browsing-enforcement","advanced-protection-program","email-authentication-configuration"],"capabilityDetails":["Provides a step-by-step workflow for configuring Google Workspace phishing and malware protection settings in the Admin Console.","Enables pre-delivery message scanning, attachment protection, and spoofing/impersonation detection.","Covers Enhanced Safe Browsing and Advanced Protection Program for high-risk users.","Includes SPF, DKIM, and DMARC configuration to prevent outbound email spoofing."],"techniqueTags":["pre-delivery-scanning","domain-spoofing-protection","employee-name-impersonation-protection","encrypted-attachment-protection","enhanced-safe-browsing","advanced-protection-program","spf-dkim-dmarc-configuration"],"techniqueDetails":["Uses enhanced pre-delivery scanning to detect weaponized emails before they reach the inbox.","Detects lookalike domains and employee name impersonation to mitigate spoofing attacks.","Protects against encrypted attachments from untrusted senders and anomalous attachment types.","Employs Enhanced Safe Browsing for real-time protection against phishing URLs in emails.","Uses Advanced Protection Program with FIDO2 security keys for high-privilege accounts.","Configures SPF, DKIM, and DMARC to authenticate outbound email and reduce spoofing."],"tools":["Google Admin Console","Google Workspace Security Investigation Tool","Google Security Center","Gmail Security Sandbox","Google Advanced Protection Program"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Covers Google Workspace-specific phishing defenses, including enhanced pre-delivery scanning, employee name spoofing protection, and Gmail Security Sandbox.","Combines inbound scanning controls with outbound email authentication (SPF/DKIM/DMARC) in a single administrative workflow.","Includes Advanced Protection Program enrollment steps with FIDO2 security keys for high-risk users."],"familyIds":["email-security-and-phishing-protection"]},{"id":"implementing-google-workspace-sso-configuration","summary":"Configuration playbook for enabling Google Workspace SAML 2.0 SSO against external identity providers (Okta, Azure AD, ADFS), including IdP setup, Google Admin Console configuration, profile assignment, testing, and validation checklist.","primaryDomain":"authentication","domainTags":["saml","sso","identity-provider","federation","google-workspace"],"capabilityTags":["saml-sso-configuration","identity-provider-integration","federation-setup"],"capabilityDetails":["Provides step-by-step workflow to configure Google Workspace as SAML service provider against Okta, Azure AD/Entra ID, or ADFS.","Includes assigning SSO profiles to organizational units/groups and configuring network masks.","Provides validation checklist and troubleshooting considerations for SAML assertions, certificates, and sign-out flows."],"techniqueTags":["saml-2.0","service-provider-configuration","idp-metadata","certificate-validation"],"techniqueDetails":["SAML AuthnRequest sent via HTTP-Redirect binding; SAML Response POSTed to Google ACS URL.","Google validates SAML signature against uploaded IdP X.509 signing certificate.","NameID format uses emailAddress for user identification.","SSO enforcement can be scoped by organizational unit or network mask."],"tools":["Google Admin Console","Okta","Azure AD","ADFS"],"targetTypes":["cloud"],"role":"workflow","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Specific to Google Workspace as SAML service provider, not generic SSO guidance.","Covers multiple IdPs (Okta, Azure AD, ADFS) with provider-specific setup steps.","Includes validation checklist and network mask enforcement details."],"familyIds":["identity-federation-sso-security"]},{"id":"implementing-hardware-security-key-authentication","summary":"Implementation playbook for building a FIDO2/WebAuthn relying party server with python-fido2, covering registration and authentication ceremonies, YubiKey enrollment, passkey migration, and user verification policies to deploy phishing-resistant MFA.","primaryDomain":"authentication","domainTags":["fido2","webauthn","hardware-security-key","yubikey","passkeys"],"capabilityTags":["webauthn-relying-party","credential-registration","credential-authentication","yubikey-enrollment","passkey-migration"],"capabilityDetails":["Provides a step-by-step workflow for implementing a FIDO2/WebAuthn relying party server using python-fido2.","Covers registration and authentication ceremonies, including attestation verification, sign counter validation, and discoverable credential flows.","Includes YubiKey enrollment and lifecycle management procedures.","Offers migration guidance from passwords to passkeys with recovery and monitoring."],"techniqueTags":["webauthn-registration-ceremony","webauthn-authentication-ceremony","ctap2","attestation-verification","sign-counter-validation","discoverable-credentials"],"techniqueDetails":["Uses the WebAuthn API for client-side credential creation and assertion.","Leverages CTAP2 for communication with external authenticators.","Verifies attestation and sign counter values for authenticator and clone detection.","Supports resident keys/discoverable credentials for passwordless authentication."],"tools":["python-fido2","py_webauthn","YubiKey","Yubico Authenticator","WebAuthn.io"],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["remediation"],"distinctiveFeatures":["Focuses specifically on server-side implementation of FIDO2/WebAuthn relying party, not on client-side or network-level analysis.","Details both registration and authentication ceremonies with python-fido2 library code-level configuration.","Includes YubiKey-specific enrollment, AAGUID attestation, and backup key management.","Provides passkey migration strategy from password-based authentication with monitoring metrics."],"familyIds":["multi-factor-and-passwordless-authentication-implementation"]},{"id":"implementing-hashicorp-vault-dynamic-secrets","summary":"Configuration playbook for implementing HashiCorp Vault dynamic secrets engines to generate short-lived database, AWS IAM, and PKI credentials with lease management and application integration.","primaryDomain":"cloud-security","domainTags":["secrets-management","identity-access-management","dynamic-secrets","database-credentials","aws-iam"],"capabilityTags":["dynamic-secrets-configuration","database-credential-rotation","aws-credential-generation","pki-certificate-issuance","lease-lifecycle-management"],"capabilityDetails":["Provides a workflow to enable and configure HashiCorp Vault secrets engines for dynamic database credentials, AWS IAM keys, and PKI certificates, including role creation, lease management, root credential rotation, and application integration."],"techniqueTags":["vault-configuration","lease-management","root-credential-rotation","approle-authentication","secret-revocation"],"techniqueDetails":["Uses Vault CLI commands and hvac library to configure secrets engines, set TTLs and max TTLs, rotate root credentials, issue certificates, and automatically renew or revoke leases."],"tools":["vault","hvac","vault-agent","vault-secrets-operator","jq"],"targetTypes":["database","cloud","kubernetes","other"],"role":"specialist-playbook","workflowFocus":["remediation","knowledge-reference"],"distinctiveFeatures":["Focuses exclusively on dynamic secrets engines (database, AWS, PKI) with ephemeral credentials, not static KV secret storage.","Includes application integration code with automatic lease renewal and revocation in Python.","Covers root credential rotation and lease lifecycle monitoring with audit log analysis."],"familyIds":["cloud-data-protection-and-classification"]},{"id":"implementing-hipaa-security-rule-safeguards","summary":"Provides a structured workflow for implementing HIPAA Security Rule safeguards, including required risk analysis, administrative/physical/technical safeguards, required vs addressable determination, BAA execution, breach notification readiness, documentation, and a gap assessment generator.","primaryDomain":"security-knowledge","domainTags":["compliance","healthcare","regulated-data","risk-management"],"capabilityTags":["hipaa-security-rule-implementation","risk-analysis","safeguard-mapping","baa-management","breach-notification-readiness","gap-assessment"],"capabilityDetails":["Provides a step-by-step workflow to implement the HIPAA Security Rule, including the mandatory risk analysis, administrative/physical/technical safeguards, required vs addressable specification handling, business associate agreements, breach notification readiness, and documentation/retention obligations."],"techniqueTags":["required-vs-addressable","four-factor-risk-assessment","safeguard-gap-analysis","nist-800-66-mapping","safe-harbor-encryption"],"techniqueDetails":["Uses the required vs addressable distinction to determine implementation obligations.","Uses the four-factor risk assessment to evaluate breaches of unsecured PHI.","Uses NIST SP 800-66 Rev 2 to map security controls to HIPAA safeguards.","Uses encryption as a safe harbor to avoid breach notification obligations."],"tools":["hhs-sra-tool","nist-sp-800-66","nist-sp-800-30","grc-platform","scripts/process.py"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","remediation","reporting","knowledge-reference"],"distinctiveFeatures":["Focuses specifically on HIPAA Security Rule compliance rather than generic security compliance or offensive pentesting.","Distinguishes required vs addressable implementation specifications and provides a scoring script to prioritize gaps.","Tracks the 2025 NPRM proposed changes and separates them from current compliance obligations."],"familyIds":["compliance-governance"]},{"id":"implementing-honeypot-for-ransomware-detection","summary":"Deploys canary files, honeypot shares, and Thinkst Canary tokens on Windows file servers to detect ransomware at the earliest stage, with SIEM alerting and automated host containment.","primaryDomain":"windows-security","domainTags":["ransomware-defense","deception-technology","file-integrity-monitoring"],"capabilityTags":["canary-file-deployment","honeypot-share-configuration","canary-token-creation","siem-alert-integration","file-system-monitoring"],"capabilityDetails":["Provides step-by-step workflows for deploying canary files on file shares, configuring FSRM file screens and FileSystemWatcher, creating honeypot shares with audit logging, generating Thinkst canary tokens, and integrating alerts with SIEM and automated containment."],"techniqueTags":["canary-tokens","file-system-watcher","fsrm-file-screening","honeypot-shares","behavioral-monitoring"],"techniqueDetails":["Uses strategically placed decoy files and network shares that trigger alerts on access or modification, and monitors file changes and audit events to detect ransomware activity early."],"tools":["thinkst-canary","fsrm","powershell","opencanary","canarytokens"],"targetTypes":["windows-host","network"],"role":"specialist-playbook","workflowFocus":["detection","validation","reporting"],"distinctiveFeatures":["Provides a complete deception-based detection stack specifically for ransomware, using canary files, honeypot shares, and canary tokens rather than relying on signatures or EDR alone.","Includes automated SIEM and NAC/EDR containment integration upon canary trigger."],"familyIds":["ransomware-defense"]},{"id":"implementing-honeytokens-for-breach-detection","summary":"Provides a workflow for deploying honeytokens and canary tokens across cloud credentials, DNS, documents, and databases, with alerting via webhooks for breach detection.","primaryDomain":"security-knowledge","domainTags":["deception-technology","security-operations"],"capabilityTags":["honeytoken-deployment","breach-detection","canary-token-creation","webhook-alerting"],"capabilityDetails":["Provides a workflow for deploying honeytokens and canary tokens across various targets to detect unauthorized access and trigger alerts via webhooks."],"techniqueTags":["dns-canary","aws-credential-token","document-beacon","database-honeytoken","web-bug"],"techniqueDetails":["Uses Canarytokens API to generate token types; embeds them in credentials, configs, documents, and database records; alerts via webhook when accessed."],"tools":["canarytokens","python-requests"],"targetTypes":["cloud","database","network","other"],"role":"specialist-playbook","workflowFocus":["detection"],"distinctiveFeatures":["Focuses specifically on deception-based breach detection using honeytokens, rather than general threat detection or SIEM correlation."],"familyIds":["deception-based-breach-detection"]},{"id":"implementing-ics-firewall-with-tofino","summary":"Deploys Belden/Hirschmann Tofino industrial firewalls in inline bridge mode with deep packet inspection to enforce zone-based access control for Modbus, S7comm, and EtherNet/IP in SCADA/ICS environments.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","scada-security","industrial-firewall"],"capabilityTags":["ics-firewall-deployment","deep-packet-inspection","zone-segmentation","protocol-allow-listing"],"capabilityDetails":["Provides a workflow for deploying Tofino industrial firewalls with protocol-level deep packet inspection to protect SCADA/PLC assets."],"techniqueTags":["inline-bridge-mode","fail-open-configuration","default-deny","protocol-specific-dpi"],"techniqueDetails":["Uses inline bridge deployment and fail-open safety mode, filtering based on allowed Modbus function codes, S7comm operations, and CIP services."],"tools":["tofino-xenon","tofino-central-management-platform","python"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["remediation","analysis"],"distinctiveFeatures":["Specialized in Tofino industrial firewall deployment rather than general network firewalling","Supports DPI for OT protocols (Modbus, S7comm, EtherNet/IP) not typically covered by IT firewall guides"],"familyIds":["ot-ics-network-security-architecture-and-compliance"]},{"id":"implementing-identity-governance-with-sailpoint","summary":"Implementation guide for deploying SailPoint IdentityNow/IdentityIQ to manage identity lifecycle, access certifications, role mining, and separation-of-duties policies, aligned with NIST 800-53.","primaryDomain":"security-knowledge","domainTags":["identity-access-management","iam","governance","access-control"],"capabilityTags":["identity-lifecycle-management","access-request-workflows","certification-campaigns","role-mining","separation-of-duties","compliance-reporting"],"capabilityDetails":["Provides a high-level implementation guide for deploying SailPoint IdentityNow/IdentityIQ, covering identity lifecycle management, access request workflows, certification campaigns, role mining, SOD policy enforcement, and compliance reporting."],"techniqueTags":["identity-lifecycle-provisioning","access-certification-campaign","role-mining","sod-policy-framework"],"techniqueDetails":["Automates identity provisioning and deprovisioning via SailPoint","Conducts access certification campaigns for regular reviews","Applies role mining to identify and optimize roles","Enforces separation-of-duties policies to prevent conflicting access"],"tools":["SailPoint IdentityNow","SailPoint IdentityIQ"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","reporting","remediation"],"distinctiveFeatures":["Product-specific SailPoint IGA implementation guide","Consolidates certification campaigns, role mining, and SOD enforcement in one workflow","Maps implementation controls to NIST 800-53 access control families"],"familyIds":["identity-governance-and-access-certification"]},{"id":"implementing-identity-verification-for-zero-trust","summary":"Implementation playbook for zero trust identity verification, covering phishing-resistant MFA, risk-based conditional access, continuous evaluation, and identity governance.","primaryDomain":"authentication","domainTags":["zero-trust","identity-verification","mfa","conditional-access"],"capabilityTags":["zero-trust-implementation","phishing-resistant-mfa","risk-based-access-control","identity-governance"],"capabilityDetails":["Provides a structured workflow for implementing continuous identity verification, phishing-resistant MFA, and risk-based conditional access aligned with zero trust principles."],"techniqueTags":["fido2-webauthn","risk-scoring","conditional-access-policies","continuous-access-evaluation","identity-lifecycle-management"],"techniqueDetails":["Uses risk signals such as device posture, behavior, and location to dynamically adjust authentication requirements and access grants."],"tools":["Azure AD","Okta","Ping Identity","YubiKey","Microsoft Entra ID Protection","Okta ThreatInsight","CyberArk","BeyondTrust"],"targetTypes":["cloud","other"],"role":"specialist-playbook","workflowFocus":["analysis","validation","remediation"],"distinctiveFeatures":["Focuses on continuous, risk-adaptive identity verification and phishing-resistant MFA rather than authentication bypass testing or credential attacks."],"familyIds":["zero-trust-access-control"]},{"id":"implementing-iec-62443-security-zones","summary":"Practical playbook for designing and implementing IEC 62443-3-2 security zones and conduits across OT/ICS networks, including zone partitioning by risk and Purdue level, SL-T assignment, industrial firewall and VLAN configuration, data diode deployment, and validation of unidirectional data flows and protocol filtering.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","network-segmentation","iec-62443","purdue-reference-model"],"capabilityTags":["security-zone-design","zone-partitioning","conduit-configuration","firewall-microsegmentation","data-diode-deployment","ot-protocol-allowlisting"],"capabilityDetails":["Provides a workflow for partitioning IACS assets into IEC 62443-3-2 security zones based on risk, criticality, and Purdue Reference Model levels, with Security Level Target (SL-T) assignment per zone.","Guides implementation of inter-zone conduits with protocol allowlists, industrial firewall rules, VLAN enforcement at Layer 2, and data diode deployment for unidirectional OT-to-IT data flow.","Includes validation procedures to verify that only authorized conduit traffic is allowed and that prohibited cross-zone paths are blocked, including function code filtering and reverse-flow testing."],"techniqueTags":["risk-based-zone-partitioning","security-level-target-assignment","purdue-level-alignment","modbus-function-code-filtering","opc-ua-allowlisting","vlan-segmentation","data-diode-validation"],"techniqueDetails":["Uses IEC 62443-3-2 zone/conduit modeling with SL-T targets and assigns assets to zones based on shared security requirements and Purdue levels (Level 1 through Level 4).","Employs deep packet inspection and function code filtering for industrial protocols such as Modbus, blocking write operations and allowing only read function codes.","Deploys hardware data diodes and validates unidirectional enforcement by testing forward flow, reverse flow blocking, and replication latency.","Implements VLAN segmentation aligned to zones, with port security, BPDU guard, and disabled unused ports to enforce layer boundaries."],"tools":["cisco-isa-3000","fortinet-fortigate-rugged","palo-alto-ot-security","waterfall-security-solutions","tofino-xenon","nmap","pymodbus"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["analysis","validation","remediation"],"distinctiveFeatures":["Specializes in OT/ICS network segmentation aligned to IEC 62443-3-2 and the Purdue Reference Model, covering zone/conduit design, SL-T assignment, and industrial firewall/VLAN implementation.","Distinct from generic IT microsegmentation or cloud-native workload segmentation by focusing on industrial protocols, data diodes, and safety-critical system isolation.","Includes unique validation steps for Modbus function code filtering and data diode reverse-flow prevention."],"familyIds":["ot-ics-network-security-architecture-and-compliance"]},{"id":"implementing-image-provenance-verification-with-cosign","summary":"Provides a practical implementation guide for signing and verifying container image provenance with Cosign, including key-based and keyless OIDC workflows, attaching SLSA/SBOM attestations, and enforcing image signature policies in Kubernetes.","primaryDomain":"cloud-security","domainTags":["container-security","supply-chain-security","kubernetes-security"],"capabilityTags":["image-signing","signature-verification","keyless-oidc-signing","slsa-attestation","admission-control-enforcement"],"capabilityDetails":["Provides a workflow for signing container images with Cosign using key-based and keyless OIDC methods.","Covers verification of signatures and attestations, including SBOM, vulnerability scan, and SLSA provenance.","Includes Kubernetes admission control enforcement using Sigstore policy-controller and Kyverno."],"techniqueTags":["key-based-signing","keyless-signing","oidc-identity","transparency-log-integration","kubernetes-admission-policy"],"techniqueDetails":["Key-based signing uses a Cosign-generated key pair; keyless signing uses OIDC identities to obtain certificates from Fulcio and records in Rekor.","Attestations are attached using the cosign attest command and verified with cosign verify-attestation.","Kubernetes admission policies validate signatures before image deployment, using either Sigstore policy-controller or Kyverno."],"tools":["cosign","syft","grype","rekor-cli","sigstore-policy-controller","kyverno","helm"],"targetTypes":["container","kubernetes"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Comprehensive coverage of the complete container image provenance lifecycle, from signing to admission enforcement.","Dual coverage of key-based and keyless OIDC signing, with CI/CD integration examples for GitHub Actions.","Includes both Sigstore policy-controller and Kyverno examples for Kubernetes enforcement."],"familyIds":["container-image-hardening-and-provenance"]},{"id":"implementing-immutable-backup-with-restic","summary":"A practical guide to deploying immutable, ransomware-resistant backups with restic and S3-compatible Object Lock, covering repository initialization, retention configuration, automated integrity verification, and restore testing.","primaryDomain":"security-knowledge","domainTags":["ransomware-defense","backup","immutable-storage","data-protection"],"capabilityTags":["immutable-backup-implementation","backup-integrity-verification","restore-testing"],"capabilityDetails":["Provides a workflow for setting up restic-based immutable backups on S3-compatible storage with Object Lock, automating backup creation, integrity checks, and restore validation."],"techniqueTags":["object-lock-compliance-mode","restic-repository-encryption","read-data-integrity-check","retention-policy"],"techniqueDetails":["Uses S3 Object Lock in Compliance mode to prevent modification or deletion during retention.","Encrypts backup data with AES-256-CTR and authenticates with Poly1305-AES.","Verifies all data blobs by downloading them with restic check --read-data."],"tools":["restic","resticpy","aws-s3","minio","backblaze-b2","aws-cli","mc"],"targetTypes":["cloud","other"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Focuses specifically on ransomware-resistant immutable backups using restic with S3 Object Lock, including automated integrity verification and restore testing, rather than generic backup strategies."],"familyIds":["ransomware-resistant-backup-implementation"]},{"id":"implementing-infrastructure-as-code-security-scanning","summary":"Actionable workflow to integrate Checkov, tfsec, and KICS into CI/CD for detecting and blocking cloud infrastructure misconfigurations in IaC, plus custom policy authoring.","primaryDomain":"cloud-security","domainTags":["iac-security","devsecops","terraform","kubernetes"],"capabilityTags":["infrastructure-as-code-scanning","policy-as-code","ci-cd-integration","custom-policy-authoring","misconfiguration-detection"],"capabilityDetails":["Provides automated scanning of Terraform, CloudFormation, Kubernetes manifests, and Helm charts with Checkov, tfsec, and KICS to detect cloud misconfigurations and enforce policy in CI/CD pipelines."],"techniqueTags":["static-analysis","terraform-plan-scanning","graph-based-scanning","custom-policy-writing","sarif-reporting"],"techniqueDetails":["Uses static analysis of IaC templates, Terraform plan JSON for dynamic values, graph-based resource relationship checks, and custom Python policies for organization-specific rules."],"tools":["checkov","tfsec","kics","terrascan","snyk-iac","github-actions"],"targetTypes":["cloud","kubernetes"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Combines multiple IaC scanners (Checkov, tfsec, KICS) with CI/CD guardrails, custom Checkov policies, baselines/suppressions, and Terraform plan scanning for higher accuracy."],"familyIds":["cloud-security-posture-management"]},{"id":"implementing-iso-27001-information-security-management","summary":"Structured, phase-based guide for implementing an ISO/IEC 27001:2022 ISMS from scoping to certification, including risk assessment, Annex A control selection, SoA creation, and continuous improvement, valuable for compliance and governance programs.","primaryDomain":"security-knowledge","domainTags":["iso-27001","isms","compliance","risk-management","governance","annex-a"],"capabilityTags":["isms-implementation","gap-analysis","risk-assessment","control-selection","soa-creation","certification-preparation"],"capabilityDetails":["Provides an end-to-end workflow for implementing an ISO/IEC 27001:2022 Information Security Management System (ISMS), including scoping, gap analysis, risk assessment, Annex A control selection, Statement of Applicability creation, and certification audit preparation."],"techniqueTags":["phase-based-methodology","risk-assessment-methodology","annex-a-mapping","internal-audit","continual-improvement"],"techniqueDetails":["Employs a structured phase-based methodology for ISMS implementation, from scoping and gap analysis through control selection, certification audit, and continual improvement."],"tools":[],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","remediation","reporting","knowledge-reference"],"distinctiveFeatures":["Covers the entire ISO/IEC 27001:2022 ISMS lifecycle, distinguishing it from generic compliance checklists or narrower audit-focused skills.","Includes the 2022 Annex A control updates and integrates with related standards like ISO 27002, 27005, NIST CSF, and SOC 2."],"familyIds":["compliance-governance"]},{"id":"implementing-just-in-time-access-provisioning","summary":"Provides a pragmatic implementation playbook for just-in-time access provisioning, covering approval workflows, time-bound access with automatic expiration, PAM/IGA integration, and audit controls to reduce standing privileges.","primaryDomain":"authentication","domainTags":["identity-access-management","access-control","zero-trust","privileged-access-management"],"capabilityTags":["jit-access-provisioning","access-approval-workflow","automatic-access-expiration","pam-iga-integration"],"capabilityDetails":["Provides a step-by-step implementation playbook for just-in-time access provisioning, including request/approval workflows, time-bound grants, automatic revocation, and integration with PAM and IGA platforms."],"techniqueTags":["time-bound-grants","risk-based-approval","emergency-access-bypass","audit-logging"],"techniqueDetails":["Uses risk-based approval routing (auto-approve low-risk, multi-approve high-risk), automatic expiration/revocation, and full audit logging to enforce zero-standing privilege."],"tools":[],"targetTypes":["other"],"role":"workflow","workflowFocus":["remediation","knowledge-reference"],"distinctiveFeatures":["Focuses on the defensive implementation of just-in-time access to eliminate standing privileges, rather than on attacking or enumerating IAM systems."],"familyIds":["privileged-access-and-identity-lifecycle-operations"]},{"id":"implementing-jwt-signing-and-verification","summary":"Provides implementation guidance for secure JWT signing and verification using HS256, RS256, ES256, and EdDSA, including claims validation, expiration, and defenses against algorithm confusion and none-algorithm attacks.","primaryDomain":"authentication","domainTags":["jwt","token-security","cryptography","digital-signatures"],"capabilityTags":["jwt-signing","jwt-verification","claims-validation","algorithm-confusion-defense","jwk-key-rotation"],"capabilityDetails":["Provides implementation guidance for generating and validating JWTs using multiple algorithms, with claims validation, expiration, and defenses against algorithm confusion, none-algorithm, and key-injection attacks."],"techniqueTags":["hmac-sha256","rsa-pss","es256","eddsa","jwk-set"],"techniqueDetails":["Covers symmetric and asymmetric JWT algorithms, including HS256, RS256, ES256, and EdDSA, along with JWK-based key rotation."],"tools":[],"targetTypes":["web-application","api"],"role":"workflow","workflowFocus":["validation","remediation"],"distinctiveFeatures":["Focuses on secure implementation and hardening of JWT signing/verification rather than attacking/exploiting JWT.","Provides multi-algorithm coverage and explicit defenses against algorithm confusion, none-algorithm, and key-injection attacks."],"familyIds":["token-authentication-security"]},{"id":"implementing-kubernetes-network-policy-with-calico","summary":"An advanced playbook for implementing Kubernetes network segmentation with Calico, covering CNI installation, default-deny policies, Calico-specific GlobalNetworkPolicy, policy ordering, service-account selectors, host endpoints, and validation commands.","primaryDomain":"network-security","domainTags":["container-security","kubernetes-security","network-segmentation","zero-trust","cni"],"capabilityTags":["network-policy-configuration","default-deny-implementation","policy-ordering","service-account-based-policies","host-endpoint-protection","policy-verification"],"capabilityDetails":["Provides step-by-step instructions for installing Calico CNI on Kubernetes using the Tigera operator.","Demonstrates writing default-deny NetworkPolicies for namespace isolation and least privilege.","Shows how to create Calico GlobalNetworkPolicy and NetworkPolicy with deny rules, ordering, and tiers.","Includes service-account-based selectors for zero-trust pod-to-pod communication.","Covers host endpoint protection and policy verification commands."],"techniqueTags":["network-policy","network-segmentation","zero-trust-enforcement","policy-ordering","namespace-isolation"],"techniqueDetails":["Uses Kubernetes NetworkPolicy and Calico GlobalNetworkPolicy to define ingress and egress rules.","Applies default-deny then selective allow to enforce least privilege between pods.","Leverages Calico policy tiers and ordering for deterministic evaluation.","Uses service account selectors to restrict communication based on identity."],"tools":["calicoctl","kubectl","tigera-operator"],"targetTypes":["kubernetes","container","network"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Focuses specifically on Calico's extended policy resources (GlobalNetworkPolicy, tiers, service-account selectors, host endpoints) rather than generic Kubernetes NetworkPolicy only.","Provides a complete installation and verification workflow for Calico CNI as part of security policy implementation."],"familyIds":["network-microsegmentation-and-workload-isolation"]},{"id":"implementing-kubernetes-pod-security-standards","summary":"Practical guide to enforcing Kubernetes Pod Security Standards at namespace level using Pod Security Admission, covering Restricted/Baseline/Privileged profiles, enforce/audit/warn modes, namespace labeling, migration from PodSecurityPolicy, compliant pod security contexts, and dry-run validation.","primaryDomain":"cloud-security","domainTags":["kubernetes-security","container-security","pod-security"],"capabilityTags":["pod-security-standards-configuration","pod-security-admission-implementation","namespace-labeling"],"capabilityDetails":["Provides a workflow for configuring Kubernetes Pod Security Standards (Privileged, Baseline, Restricted) using the built-in Pod Security Admission controller.","Includes namespace label management, enforce/audit/warn modes, and migration from PodSecurityPolicy."],"techniqueTags":["namespace-labeling","enforce-audit-warn-modes","security-context-hardening","dry-run-testing"],"techniqueDetails":["Uses pod-security.kubernetes.io labels to set enforce/audit/warn policies at namespace level.","Demonstrates gradual migration by starting with audit/warn before enforce.","Includes dry-run server-side testing to preview violations."],"tools":["kubectl","kubescape"],"targetTypes":["kubernetes","container"],"role":"specialist-playbook","workflowFocus":["remediation","detection","validation"],"distinctiveFeatures":["Specializes in implementing Kubernetes Pod Security Standards via the PSA controller, not a general Kubernetes security scan.","Covers all three profiles and three enforcement modes with practical label syntax and migration phases.","Includes dry-run validation and audit log inspection to detect violations before enforcing."],"familyIds":["kubernetes-policy-and-access-control"]},{"id":"implementing-llm-guardrails-for-security","summary":"Implements input/output validation guardrails for LLM applications using NeMo Guardrails, Guardrails AI, and Presidio, blocking prompt injection, PII leakage, and off-topic content, with configurable policies and middleware integration.","primaryDomain":"api-security","domainTags":["llm-security","ai-safety","prompt-injection-defense"],"capabilityTags":["llm-guardrails","input-validation","output-validation","pii-redaction","content-policy"],"capabilityDetails":["Provides a configurable guardrail pipeline that validates user inputs and model outputs for security and safety."],"techniqueTags":["colang-flows","self-check-rails","presidio-anonymization","json-schema-validation"],"techniqueDetails":["Uses NeMo Guardrails Colang flows and self-check rails to intercept and validate conversations."],"tools":["nemoguardrails","guardrails-ai","presidio","colang","openai-guardrails"],"targetTypes":["api","other"],"role":"workflow","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Focuses on defensive LLM security controls rather than offensive LLM exploitation","Covers both input and output guardrails with multiple frameworks","Provides concrete Colang and Python middleware examples"],"familyIds":["ai-llm-api-security"]},{"id":"implementing-log-forwarding-with-fluentd","summary":"Configures Fluent Bit endpoint forwarders and a Fluentd central aggregator to collect, filter, enrich, and route logs to Elasticsearch, S3, or Splunk, with syntax validation and test event delivery for a production-ready log pipeline.","primaryDomain":"security-knowledge","domainTags":["log-aggregation","centralized-logging","observability","siem"],"capabilityTags":["log-forwarding-configuration","centralized-log-collection","log-filtering-enrichment","multi-output-routing","configuration-generation"],"capabilityDetails":["Provides a workflow for generating and validating Fluentd/Fluent Bit configurations for centralized log collection, filtering, enrichment, and routing to multiple destinations."],"techniqueTags":["forward-protocol","file-tailing","syslog-input","record-transformer-filter","grep-filter","output-routing"],"techniqueDetails":["Uses Fluent Bit as endpoint log forwarder with tail/syslog inputs, Fluentd as central aggregator using forward protocol, and record_transformer/grep filters for enrichment and reduction before routing to Elasticsearch, S3, and Splunk."],"tools":["fluentd","fluent-bit","fluent-logger","elasticsearch","splunk"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["validation","reporting"],"distinctiveFeatures":["Covers both Fluent Bit and Fluentd as complementary forwarder/aggregator layers","Includes configuration generation, validation, and test event forwarding to multiple log destinations"],"familyIds":["centralized-log-pipeline-implementation"]},{"id":"implementing-log-integrity-with-blockchain","summary":"Builds a tamper-evident append-only log chain using SHA-256 hash chaining; verifies integrity and pinpoints altered entries, with optional external timestamp anchoring for compliance and forensic use.","primaryDomain":"forensics","domainTags":["log-integrity","tamper-detection","audit-logging"],"capabilityTags":["log-chain-construction","integrity-verification","tamper-localization","checkpoint-anchoring"],"capabilityDetails":["Provides a workflow for constructing an append-only hash-chained log ledger.","Includes verification routines that recompute hashes to validate chain integrity.","Can pinpoint the exact entry where tampering occurred by detecting hash mismatch."],"techniqueTags":["sha-256-hash-chaining","checkpoint-timestamping"],"techniqueDetails":["Each log entry incorporates the previous entry's hash, creating a chain where any modification breaks all subsequent hashes.","Checkpoint hashes can be anchored to external timestamping services to provide independent proof of existence."],"tools":["python","requests"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","validation"],"distinctiveFeatures":["Implements a blockchain-style hash chain for log files, unlike conventional log monitoring or SIEM correlation.","Enables pinpoint tamper detection and optional external timestamp anchoring for forensic admissibility."],"familyIds":["log-integrity-and-tamper-detection"]},{"id":"implementing-memory-protection-with-dep-aslr","summary":"Practical workflow for hardening Windows endpoints against memory corruption by configuring DEP, ASLR, CFG, and SEHOP, with system-wide and per-application settings and enterprise deployment via Intune or GPO.","primaryDomain":"windows-security","domainTags":["memory-protection","exploit-mitigation","endpoint-hardening"],"capabilityTags":["dep-configuration","aslr-configuration","cfg-configuration","exploit-protection-deployment"],"capabilityDetails":["Provides a workflow to enable and deploy Windows memory protections (DEP, ASLR, CFG, SEHOP) at system and per-application level."],"techniqueTags":["data-execution-prevention","address-space-layout-randomization","control-flow-guard","seh-overwrite-protection"],"techniqueDetails":["Uses bcdedit and PowerShell process mitigation cmdlets to enforce non-executable memory and address randomization."],"tools":["powershell","bcdedit","windows-exploit-protection","intune","group-policy"],"targetTypes":["windows-host"],"role":"workflow","workflowFocus":["remediation"],"distinctiveFeatures":["Focuses on enabling Windows exploit mitigations rather than discovering or exploiting memory corruption; includes enterprise deployment via Intune/GPO."],"familyIds":["windows-endpoint-hardening"]},{"id":"implementing-microsegmentation-with-guardicore","summary":"Provides a step-by-step workflow for implementing microsegmentation with Akamai Guardicore Segmentation, covering agent deployment, application dependency mapping, policy creation, reveal-mode testing, enforcement, and monitoring to block lateral movement and support compliance.","primaryDomain":"network-security","domainTags":["microsegmentation","network-segmentation","zero-trust","lateral-movement"],"capabilityTags":["microsegmentation-implementation","application-dependency-mapping","network-policy-management","lateral-movement-prevention"],"capabilityDetails":["Provides a workflow for deploying Guardicore agents, mapping application dependencies, creating segmented network policies, testing in reveal mode, and enforcing microsegmentation to block lateral movement."],"techniqueTags":["agent-based-telemetry","api-policy-management","reveal-mode-simulation","ring-fencing"],"techniqueDetails":["Uses Guardicore agents for process-level network visibility and Guardicore API for policy creation; policies are tested in reveal mode before enforcement."],"tools":["guardicore-centra","guardicore-reveal","guardicore-agents","guardicore-insight","guardicore-api"],"targetTypes":["network","windows-host","linux-host","container","kubernetes","cloud"],"role":"specialist-playbook","workflowFocus":["analysis","validation","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on implementing microsegmentation with Akamai Guardicore Segmentation, including agent deployment, dependency mapping, policy creation, and compliance reporting for zero-trust east-west traffic control."],"familyIds":["network-microsegmentation-and-workload-isolation"]},{"id":"implementing-mimecast-targeted-attack-protection","summary":"Step-by-step deployment guidance for Mimecast Targeted Threat Protection modules to defend Office 365/Google Workspace against phishing, spearphishing, and BEC, including policy configuration, pilot validation, and tuning.","primaryDomain":"cloud-security","domainTags":["email-security","phishing-defense","mimecast","targeted-threat-protection"],"capabilityTags":["email-threat-protection","security-policy-configuration","phishing-defense","malware-sandboxing","bec-detection"],"capabilityDetails":["Deploys Mimecast Targeted Threat Protection (TTP) modules for phishing and BEC defense.","Configures URL Protect for click-time URL rewriting and pre-delivery hold.","Configures Attachment Protect for sandbox detonation of suspicious attachments.","Configures Impersonation Protect to detect BEC/whaling using VIP lists and header analysis.","Enables Internal Email Protect to scan internal/outbound email for lateral phishing."],"techniqueTags":["url-rewriting","attachment-detonation","impersonation-detection","email-journaling","policy-tuning"],"techniqueDetails":["URL rewriting routes links through Mimecast proxy for click-time analysis.","Pre-delivery hold delays suspicious URLs before inbox delivery.","Sandbox detonation analyzes file behavior in an isolated environment.","Impersonation detection uses display name/domain similarity and reply-to mismatch.","Email journaling from M365/Google Workspace enables internal email scanning."],"tools":["mimecast-admin-console","mimecast-threat-dashboard","mimecast-api"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","validation"],"distinctiveFeatures":["Covers all four Mimecast TTP modules with step-by-step policy configuration.","Provides pilot-to-production workflow with validation using EICAR and test URLs.","Integrates email security controls with Microsoft 365/Google Workspace.","Includes tuning and false positive management guidance."],"familyIds":["email-security-and-phishing-protection"]},{"id":"implementing-mitre-attack-coverage-mapping","summary":"Provides a structured workflow for implementing MITRE ATT&CK coverage mapping in a SOC, including quantitative scoring, gap prioritization, and roadmap generation.","primaryDomain":"security-knowledge","domainTags":["mitre-attack","detection-engineering","soc-operations"],"capabilityTags":["coverage-mapping","gap-prioritization","detection-scoring"],"capabilityDetails":["Provides a structured workflow for mapping MITRE ATT&CK coverage, scoring detection maturity, and prioritizing rule development."],"techniqueTags":["coverage-mapping","scoring-model","gap-prioritization"],"techniqueDetails":["Uses ATT&CK Navigator layers to visualize coverage and a 0-100 scoring model for detection rules."],"tools":["mitre-attack-navigator","splunk","microsoft-sentinel","atomic-red-team"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","detection","validation","reporting","remediation"],"distinctiveFeatures":["Provides a quantitative scoring model (0-100) for detection coverage based on data source, rule quality, validation, and enrichment","Includes Splunk and Microsoft Sentinel queries for exporting and visualizing coverage","Offers a gap prioritization framework using prevalence, impact, and feasibility"],"familyIds":["siem-detection-engineering"]},{"id":"implementing-mobile-application-management","summary":"Provides a practical workflow for implementing Mobile Application Management (MAM) policies in Microsoft Intune, including app protection policy templates, BYOD data separation, conditional access integration, and validation testing.","primaryDomain":"mobile-security","domainTags":["mobile-security","enterprise-security","byod"],"capabilityTags":["mobile-application-management","app-protection-policy","selective-wipe","data-loss-prevention"],"capabilityDetails":["Provides a step-by-step workflow for defining, deploying, and validating Intune App Protection Policies on managed mobile apps without requiring full device enrollment."],"techniqueTags":["app-wrapping","conditional-access","containerization","app-configuration-policy"],"techniqueDetails":["Uses Intune App SDK or App Wrapping Tool to apply app-level controls, Azure AD Conditional Access to enforce policy compliance, and selective wipe to remove corporate data while preserving personal data."],"tools":["Microsoft Intune","Intune App SDK","Intune App Wrapping Tool","VMware Workspace ONE","Azure AD Conditional Access"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["analysis","validation","remediation"],"distinctiveFeatures":["Focuses exclusively on app-level MAM controls rather than full device management, with concrete Intune policy JSON templates and BYOD data separation workflows."],"familyIds":["mobile-application-management"]},{"id":"implementing-mtls-for-zero-trust-services","summary":"Provides a Python-based implementation workflow to generate an internal certificate authority, issue service certificates, and configure mutual TLS authentication to enforce zero-trust service-to-service communication.","primaryDomain":"authentication","domainTags":["mtls","zero-trust","certificate-management","microservices-security"],"capabilityTags":["mtls-configuration","certificate-generation","tls-verification","deployment-audit"],"capabilityDetails":["Generates internal CA and service certificates using Python cryptography library.","Configures mutual TLS verification using ssl module.","Validates certificate chains and checks expiration dates."],"techniqueTags":["x509","rsa","pki","mutual-tls"],"techniqueDetails":["Uses RSA 4096-bit key generation for CA and certificates.","Implements X.509 certificate builder with basic constraints.","Enforces TLS client and server certificate verification via ssl context."],"tools":["python","cryptography","ssl"],"targetTypes":["api","network"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Focuses specifically on implementing mTLS for zero-trust architecture rather than general TLS configuration.","Provides complete Python code for CA and service certificate generation, not just conceptual guidance.","Covers lifecycle aspects including chain validation and expiration auditing."],"familyIds":["cryptographic-authentication-implementation"]},{"id":"implementing-nerc-cip-compliance-controls","summary":"Provides a step-by-step NERC CIP compliance implementation playbook for BES cyber systems, covering asset categorization, electronic security perimeters, security hardening, monitoring, and compliance reporting.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","power-grid","compliance"],"capabilityTags":["asset-categorization","security-perimeter-implementation","security-hardening","compliance-reporting"],"capabilityDetails":["Provides a workflow for categorizing BES cyber systems and implementing NERC CIP security controls."],"techniqueTags":["impact-rating","perimeter-firewalling","remote-access-mfa","application-allowlisting","security-event-monitoring"],"techniqueDetails":["Uses CIP-002 impact ratings to classify systems, firewall rules to enforce ESP, MFA for remote access, and allowlisting for application control."],"tools":["tripwire-enterprise","splunk","carbon-black-app-control","trellix-epo","palo-alto"],"targetTypes":["network","windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["remediation","reporting","analysis"],"distinctiveFeatures":["Focuses specifically on NERC CIP compliance for Bulk Electric System cyber assets, distinct from general IT or OT security frameworks.","Includes executable Python categorization tool and concrete firewall/security configuration examples.","Covers 2025 CIP standards updates including MFA requirements."],"familyIds":["ot-ics-network-security-architecture-and-compliance"]},{"id":"implementing-network-access-control","summary":"Provides a complete implementation workflow for 802.1X port-based network access control using FreeRADIUS, Cisco switch configuration, and PacketFence posture assessment, including dynamic VLAN assignment, MAB fallback, critical VLAN failover, and validation testing.","primaryDomain":"network-security","domainTags":["802-1x","radius","nac","vlan-assignment","posture-assessment"],"capabilityTags":["network-access-control-implementation","radius-server-configuration","vlan-policy-enforcement","posture-compliance-checking","supplicant-deployment"],"capabilityDetails":["Provides a step-by-step guide for deploying 802.1X-based NAC, from FreeRADIUS setup to switch configuration and PacketFence posture assessment."],"techniqueTags":["802-1x","eap-peap","radius","mac-authentication-bypass","dynamic-vlan-assignment","critical-vlan-failover"],"techniqueDetails":["Uses RADIUS attributes to dynamically assign VLANs based on Active Directory group membership; leverages MAB for devices without 802.1X support; provides failover via critical VLAN when RADIUS is unreachable."],"tools":["freeradius","packetfence","cisco-ise","microsoft-nps","wpa-supplicant","cisco-ios"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["validation","remediation"],"distinctiveFeatures":["Covers full lifecycle of NAC enforcement from RADIUS server configuration to endpoint supplicant deployment and validation testing, including posture assessment with PacketFence and critical VLAN failover."],"familyIds":["network-access-control-implementation"]},{"id":"implementing-network-access-control-with-cisco-ise","summary":"Hands-on deployment guide for Cisco ISE as RADIUS server for 802.1X and MAB with posture enforcement and TrustSec segmentation, including switch CLI and ISE policy configuration.","primaryDomain":"network-security","domainTags":["network-access-control","8021x","radius","cisco-ise","trustsec","posture-assessment"],"capabilityTags":["nac-deployment","radius-policy-configuration","posture-enforcement","trustsec-segmentation","mac-authentication-bypass"],"capabilityDetails":["Provides a step-by-step workflow to deploy Cisco ISE as a RADIUS policy server for 802.1X wired and wireless authentication, including Active Directory integration, MAB fallback, posture compliance, dynamic VLAN assignment, downloadable ACLs, and TrustSec Security Group Tags."],"techniqueTags":["eap-tls","peap-mschapv2","eap-fast","mac-authentication-bypass","dynamic-vlan","downloadable-acl","security-group-tags","radius-coa"],"techniqueDetails":["Uses RADIUS Access-Accept responses carrying VLAN, dACL, and SGT attributes; leverages EAP-TLS/PEAP/EAP-FAST for 802.1X and MAB for non-802.1X devices."],"tools":["cisco-ise","cisco-ios"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["remediation"],"distinctiveFeatures":["Unlike generic 802.1X guidance, this skill provides Cisco ISE-specific configuration including TrustSec SGTs, posture assessment, MAB fallback, and detailed IOS switch CLI examples."],"familyIds":["network-access-control-implementation"]},{"id":"implementing-network-deception-with-honeypots","summary":"Practical guide for deploying network honeypots (OpenCanary, Cowrie, T-Pot) to detect unauthorized access, lateral movement, and attacker reconnaissance, including configuration of emulated services, canary tokens, and SIEM alert integration.","primaryDomain":"network-security","domainTags":["deception-technology","honeypots","lateral-movement-detection"],"capabilityTags":["honeypot-deployment","canary-token-deployment","attacker-monitoring","alert-forwarding"],"capabilityDetails":["Provides a step-by-step workflow for deploying and managing honeypots (OpenCanary, Cowrie, T-Pot) to detect unauthorized access, lateral movement, and attacker reconnaissance, including configuration of emulated services, canary tokens, and SIEM alerting."],"techniqueTags":["low-interaction-honeypot","medium-interaction-honeypot","service-emulation","canary-token-tripwire"],"techniqueDetails":["Uses low- and medium-interaction honeypots to emulate services such as SSH, HTTP, SMB, FTP, RDP, and deploys canary tokens as tripwires to alert on unauthorized access."],"tools":["OpenCanary","Cowrie","T-Pot","Dionaea","Splunk","Elastic"],"targetTypes":["network","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses specifically on deploying honeypot platforms (OpenCanary, Cowrie, T-Pot) with canary tokens and SIEM integration to detect lateral movement, distinguishing it from general network monitoring or intrusion detection playbooks."],"familyIds":["deception-based-threat-detection"]},{"id":"implementing-network-intrusion-prevention-with-suricata","summary":"Deploys Suricata as an inline network IPS using NFQUEUE or AF_PACKET, manages Emerging Threats rulesets, writes custom detection rules, tunes performance, and integrates EVE logging for production network defense.","primaryDomain":"network-security","domainTags":["intrusion-prevention","intrusion-detection","network-defense","signature-rules","traffic-inspection"],"capabilityTags":["inline-ips-deployment","custom-rule-writing","ruleset-management","performance-tuning","logging-integration"],"capabilityDetails":["Provides step-by-step configuration of Suricata for inline IPS operation using NFQUEUE and AF_PACKET modes.","Demonstrates writing custom Suricata rules for detecting reverse shells, malicious user agents, DGA queries, ICMP tunneling, and lateral movement.","Covers managing Emerging Threats Open and ET Pro rulesets with suricata-update, including enabling sources, disabling noisy rules, and modifying rule actions.","Explains CPU affinity, threading, memcap settings, and kernel drop monitoring for production tuning.","Includes EVE JSON log configuration and integration with logging infrastructure for alerts and metadata."],"techniqueTags":["nfqueue-inline-mode","af-packet-inline-mode","signature-based-detection","deep-packet-inspection","rule-thresholding"],"techniqueDetails":["Uses NFQUEUE to redirect packets through Suricata via iptables for inline blocking.","Uses AF_PACKET inline mode with copy-mode to bridge two interfaces and inspect traffic in both directions.","Applies Suricata rule syntax with actions like alert, drop, reject, and pass for signature-based detection.","Leverages protocol parsers for HTTP, DNS, TLS, SMB, and ICMP to inspect application-layer content.","Uses threshold and suppress directives to reduce false positives and rate-limit alerts."],"tools":["suricata","suricata-update","suricatasc","iptables"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses specifically on inline IPS deployment rather than passive IDS monitoring, covering NFQUEUE and AF_PACKET inline modes.","Includes custom rule examples for detecting reverse shells, Cobalt Strike user agents, DGA domains, DNS tunneling, and ICMP tunneling.","Provides detailed ruleset management workflows with suricata-update, including enabling ET Pro, disabling noisy rules, and modifying rule actions.","Emphasizes production readiness with fail-open behavior, CPU affinity, kernel drop monitoring, and alert suppression/thresholding."],"familyIds":["signature-based-network-ids-ips-deployment"]},{"id":"implementing-network-policies-for-kubernetes","summary":"Step-by-step implementation of Kubernetes NetworkPolicies for zero-trust microsegmentation, covering default-deny, DNS egress, pod/namespace selectors, egress restrictions, and cloud metadata blocking, with validation commands.","primaryDomain":"network-security","domainTags":["kubernetes-security","network-policies","microsegmentation","container-security"],"capabilityTags":["network-policy-authoring","default-deny-configuration","dns-egress-configuration","selector-rule-configuration"],"capabilityDetails":["Provides step-by-step YAML examples for implementing default-deny-all, allow-DNS, application-specific, cross-namespace, and egress-restriction NetworkPolicies in Kubernetes."],"techniqueTags":["networkpolicy-yaml","pod-selector-rules","namespace-selector-rules","ipblock-egress-rules"],"techniqueDetails":["Uses Kubernetes NetworkPolicy resources with podSelector, namespaceSelector, and ipBlock to control ingress/egress traffic."],"tools":["kubectl","calico","cilium"],"targetTypes":["kubernetes","network"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Provides ready-to-use YAML for a complete Kubernetes microsegmentation baseline (default-deny, DNS, pod/namespace selectors, egress restrictions, cloud metadata blocking) rather than generic firewall configuration."],"familyIds":["network-microsegmentation-and-workload-isolation"]},{"id":"implementing-network-segmentation-for-ot","summary":"Implements OT network segmentation per IEC 62443 using VLANs, OT-aware firewalls, data diodes, and a baseline-driven design tool to plan, deploy, and validate Purdue-level isolation.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","network-segmentation","iec62443","industrial-control"],"capabilityTags":["ot-segmentation-design","vlan-zone-implementation","firewall-rule-generation","segmentation-validation","sis-isolation"],"capabilityDetails":["Provides a traffic-baseline-driven workflow to design VLANs and firewall rules aligned to Purdue levels and IEC 62443 zones.","Generates a phased migration plan including DMZ deployment, L3/L2 separation, field device isolation, and SIS isolation.","Includes Python tooling to automatically generate segmentation designs from baseline JSON and validate connectivity after implementation."],"techniqueTags":["vlan-segmentation","zone-conduit-architecture","default-deny-firewall","data-diode","port-security","protocol-dpi"],"techniqueDetails":["Uses a 2-4 week passive traffic baseline to map cross-zone flows and create allow rules.","Applies IEC 62443 zone/conduit design with dedicated VLANs per Purdue level and default-deny zone boundaries.","Uses hardware data diodes for unidirectional IT/OT data flow, and OT-aware firewall DPI profiles for protocols like Modbus, DNP3, OPC UA."],"tools":["python3","cisco-industrial-ethernet-switch","cisco-isa-3000","fortinet-fortigate-rugged","waterfall-unidirectional-gateway"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["analysis","validation","remediation"],"distinctiveFeatures":["Focused on OT/ICS environments rather than general IT microsegmentation, integrating IEC 62443 Purdue levels and safety instrumented system isolation.","Automates segmentation design from traffic baseline data with a Python tool that outputs VLAN, firewall rule, and migration plan JSON.","Operationally grounded with concrete switch configuration commands, firewall DPI profiles for OT protocols, and automated validation tests."],"familyIds":["ot-network-segmentation"]},{"id":"implementing-network-segmentation-with-firewall-zones","summary":"A practical, advanced playbook for implementing network segmentation using firewall zones, VLANs, inter-zone ACLs, and microsegmentation to restrict lateral movement and enforce least privilege, with vendor-specific configurations and automated validation.","primaryDomain":"network-security","domainTags":["network-segmentation","firewall-zones","vlan","microsegmentation","zero-trust"],"capabilityTags":["segmentation-design","firewall-policy-configuration","vlan-implementation","segmentation-validation","microsegmentation-deployment"],"capabilityDetails":["Provides a step-by-step workflow for designing and implementing network segmentation using firewall zones, VLANs, and inter-zone ACLs.","Includes concrete configuration examples for Palo Alto firewalls and Cisco switches.","Provides a Python validation script to test connectivity between zones and verify segmentation controls."],"techniqueTags":["zone-based-firewalling","inter-zone-acls","default-deny","lateral-movement-prevention","east-west-traffic-control"],"techniqueDetails":["Uses zone-based firewall policies with explicit allow rules and default deny.","Implements VLAN segmentation for Layer 2 isolation and inter-VLAN ACLs on routers/L3 switches.","Introduces microsegmentation for workload-level control in dynamic environments.","Emphasizes intra-zone deny rules to block lateral movement within security zones."],"tools":["nfdump","palo-alto-firewall","cisco-ios","netcat","python3"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["analysis","validation","remediation"],"distinctiveFeatures":["Covers both traditional VLAN/firewall-zone segmentation and modern workload-level microsegmentation.","Includes vendor-specific configuration examples for Palo Alto and Cisco, plus a reusable Python segmentation validation script.","Explicitly ties segmentation to compliance frameworks such as PCI DSS, HIPAA, NIST 800-53, and zero-trust architecture.","Addresses east-west lateral movement with intra-zone deny rules, not just inter-zone boundaries."],"familyIds":["network-microsegmentation-and-workload-isolation"]},{"id":"implementing-network-traffic-analysis-with-arkime","summary":"A practical guide to using Arkime API to search full packet capture sessions, download PCAPs, and perform network forensics including C2 beaconing detection, DNS tunneling identification, and TLS issuer checks.","primaryDomain":"network-security","domainTags":["network-security","full-packet-capture","pcap-analysis","network-forensics","network-traffic-analysis"],"capabilityTags":["full-packet-capture-querying","c2-beaconing-detection","dns-tunneling-detection","tls-certificate-investigation","pcap-download"],"capabilityDetails":["Provides workflow to query Arkime API for network session metadata and full packet capture.","Detects C2 beaconing by analyzing connection intervals and jitter.","Identifies DNS tunneling via query length statistics.","Flags connections with known-bad TLS certificate issuers.","Allows downloading PCAPs for further forensics."],"techniqueTags":["connection-interval-analysis","jitter-analysis","dns-query-length-analysis","tls-issuer-check","api-querying"],"techniqueDetails":["Computes average session interval and jitter (<5% indicates high confidence beacon).","Assesses DNS query lengths to spot tunneling anomalies.","Compares TLS certificate issuer against known-bad lists.","Uses Arkime viewer API for session search and PCAP retrieval."],"tools":["Arkime","scripts/agent.py","Python requests"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Specifically targets Arkime full packet capture via its API, not generic NTA.","Bundles automated heuristics for C2 beaconing and DNS tunneling.","Includes PCAP download capability for deeper investigation."],"familyIds":["network-traffic-analysis-and-detection"]},{"id":"implementing-network-traffic-baselining","summary":"Builds statistical baselines of normal network traffic from NetFlow/IPFIX flow data using pandas, computing volume distributions, per-host stats, and top talkers, then flags anomalies via z-score and IQR outlier detection to identify potential exfiltration, beaconing, or unusual port usage.","primaryDomain":"network-security","domainTags":["netflow","ipfix","traffic-analysis","baselining","anomaly-detection"],"capabilityTags":["traffic-baselining","anomaly-detection","statistical-profiling","top-talker-analysis"],"capabilityDetails":["Provides a workflow for building statistical baselines of normal network traffic from historical NetFlow/IPFIX flow data using Python pandas.","Computes hourly and daily volume distributions, per-host byte/packet statistics, protocol and port distributions, and top talker profiles."],"techniqueTags":["z-score-outlier-detection","iqr-outlier-detection","time-series-aggregation","statistical-baselining"],"techniqueDetails":["Uses z-score thresholds to identify statistical outliers in traffic volume metrics.","Applies IQR-based thresholding to flag flows deviating from baseline interquartile ranges."],"tools":["pandas","numpy"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses specifically on network traffic baselining from flow records (NetFlow/IPFIX) rather than raw packet capture or general network monitoring.","Employs statistical outlier detection (z-score, IQR) on aggregated historical data to surface anomalies such as data exfiltration spikes, beaconing, and unusual port usage."],"familyIds":["network-traffic-analysis-and-detection"]},{"id":"implementing-next-generation-firewall-with-palo-alto","summary":"Provides a comprehensive, vendor-specific playbook for implementing Palo Alto Networks NGFW with application- and identity-aware security policies, SSL decryption, threat prevention, and validation steps, ideal for enterprises transitioning from legacy port-based firewalls.","primaryDomain":"network-security","domainTags":["firewall","ngfw","network-security"],"capabilityTags":["ngfw-deployment","app-id-policy","user-id-enforcement","ssl-decryption","threat-prevention-profiles"],"capabilityDetails":["Provides an end-to-end workflow for configuring and deploying Palo Alto Networks NGFW, including initial system setup, zone-based architecture, App-ID application-aware policies, User-ID identity-based enforcement, SSL decryption, threat prevention profiles, logging, and validation."],"techniqueTags":["app-id","user-id","zone-based-policy","ssl-forward-proxy","content-id"],"techniqueDetails":["Uses App-ID to classify traffic by application regardless of port or protocol, User-ID to map IP addresses to user identities, zone-based rules for segmentation, SSL Forward Proxy to decrypt and inspect encrypted traffic, and Content-ID for threat prevention."],"tools":["palo-alto-panos","policy-optimizer"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Covers full Palo Alto NGFW deployment from device configuration to advanced threat prevention, with emphasis on migrating from port-based to App-ID application-aware and User-ID identity-based policies, including SSL decryption setup and zone protection profiles."],"familyIds":["next-generation-firewall-deployment"]},{"id":"implementing-opa-gatekeeper-for-policy-enforcement","summary":"Practical guide for deploying OPA Gatekeeper on Kubernetes via Helm and authoring Rego-based ConstraintTemplates and Constraints to enforce admission policies such as required labels, privileged container blocking, image registry allowlists, resource limits, latest-tag blocking, and read-only root filesystems, with dryrun/deny modes and namespace exemptions.","primaryDomain":"cloud-security","domainTags":["container-security","kubernetes-security","policy-as-code"],"capabilityTags":["opa-gatekeeper","admission-control","rego-policy-authoring"],"capabilityDetails":["Deploys OPA Gatekeeper via Helm and authors ConstraintTemplates with Rego plus Constraints to validate, mutate, or deny Kubernetes resource requests at admission time."],"techniqueTags":["helm-installation","constraint-template","rego","dryrun-audit"],"techniqueDetails":["Uses ConstraintTemplate/Constraint model with Rego rules; supports enforcementAction dryrun/deny/warn; leverages kubectl for managing policies and inspecting audit violations."],"tools":["helm","kubectl","opa"],"targetTypes":["kubernetes","container"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Focuses on OPA Gatekeeper as a Kubernetes admission controller, providing concrete ConstraintTemplate and Constraint examples for six common policies (required labels, privileged containers, allowed registries, resource limits, latest-tag, read-only root) plus dryrun/deny modes and namespace exemptions."],"familyIds":["kubernetes-policy-and-access-control"]},{"id":"implementing-ot-incident-response-playbook","summary":"Provides an OT-specific incident response playbook engine that implements the SANS PICERL lifecycle, classifies OT incident severity (safety/process/access/recon), and coordinates IT SOC, OT engineering, and plant operations. Includes dedicated playbooks for OT ransomware and safety system compromise, with alignment to IEC 62443 and NIST SP 800-82.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","scada-security"],"capabilityTags":["ot-incident-response","incident-severity-classification","picerl-workflow","playbook-generation","ics-ransomware-response","sis-compromise-response"],"capabilityDetails":["Develops OT-specific incident response playbooks using a Python engine implementing the SANS PICERL lifecycle, with severity classification and coordination across IT SOC, OT engineering, and plant operations.","Provides dedicated playbooks for OT ransomware and safety system compromise, aligned with IEC 62443 and NIST SP 800-82."],"techniqueTags":["picerl-lifecycle","severity-classification","safety-system-preservation","network-isolation","known-good-backup-restoration"],"techniqueDetails":["Uses PICERL phase checklists with OT-specific actions for preparation, identification, containment, eradication, recovery, and lessons learned.","Classifies incidents by OT-specific severity (safety, process, access, recon, IT spillover) and category (ransomware, SIS compromise, etc.).","Employs safety-first actions such as never shutting down OT systems without plant operations approval and preserving safety system operation."],"tools":["python"],"targetTypes":["network","windows-host","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Focuses exclusively on OT/ICS incident response rather than general IT IR","Includes a customizable Python playbook engine (OTPlaybookEngine)","OT-specific severity classification with safety, process, access, and recon categories","Provides dedicated playbooks for OT ransomware and SIS compromise","Safety-first guidance to avoid disrupting physical processes"],"familyIds":["ot-incident-response"]},{"id":"implementing-ot-network-traffic-analysis-with-nozomi","summary":"Provides a workflow to deploy Nozomi Guardian sensors for passive OT network monitoring, including asset discovery, behavioral anomaly detection, vulnerability assessment, and communication analysis via a Python API client.","primaryDomain":"network-security","domainTags":["ot-security","ics","network-monitoring"],"capabilityTags":["asset-visibility","anomaly-detection","vulnerability-assessment","communication-analysis","deployment-validation"],"capabilityDetails":["Enables passive OT network monitoring to discover assets, detect behavioral anomalies, assess vulnerabilities, and analyze cross-zone communications."],"techniqueTags":["passive-traffic-monitoring","protocol-aware-monitoring","behavioral-anomaly-detection","cross-zone-analysis"],"techniqueDetails":["Uses Nozomi Guardian passive sensors deployed on SPAN/TAP ports to monitor OT protocols without active scanning; employs Behavioral Anomaly Detection and API-based data extraction for analysis."],"tools":["nozomi-guardian","nozomi-vantage","python"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Dedicated to Nozomi Guardian sensor deployment for OT networks","Includes a Python API client for automated deployment validation and communication analysis","Focuses on passive monitoring to avoid disrupting ICS operations"],"familyIds":["network-traffic-analysis-and-detection"]},{"id":"implementing-pam-for-database-access","summary":"Knowledge base for implementing privileged access management for databases (Oracle, SQL Server, PostgreSQL, MySQL), covering session proxy, credential vaulting, query auditing, dynamic credentials, and least-privilege roles, with alignment to compliance frameworks.","primaryDomain":"security-knowledge","domainTags":["database-security","identity-access-management","privileged-access-management"],"capabilityTags":["pam-implementation","credential-vaulting","session-proxy","query-auditing","dynamic-credential-generation","least-privilege-database-roles"],"capabilityDetails":["Provides a knowledge base for deploying privileged access management to secure database access across Oracle, SQL Server, PostgreSQL, and MySQL, including credential vaulting, session proxy, and audit logging."],"techniqueTags":["session-proxy","credential-vaulting","query-auditing","dynamic-credential-generation","least-privilege-role-design"],"techniqueDetails":["Describes mechanisms for proxying database sessions, vaulting and rotating credentials, auditing SQL queries, generating temporary credentials, and enforcing least-privilege database roles."],"tools":[],"targetTypes":["database"],"role":"knowledge-base","workflowFocus":["knowledge-reference","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on implementing PAM for database platforms rather than general IAM or network PAM","Maps controls to NIST 800-53 and MITRE ATT&CK for compliance-ready guidance"],"familyIds":["pam-implementation-and-session-monitoring"]},{"id":"implementing-passwordless-auth-with-microsoft-entra","summary":"Implements a complete passwordless authentication strategy for Microsoft Entra ID, covering policy configuration, FIDO2 and Windows Hello deployment, legacy auth disablement, and adoption tracking with PowerShell and Intune.","primaryDomain":"authentication","domainTags":["identity-access-management","passwordless-authentication","microsoft-entra","phishing-resistant-mfa"],"capabilityTags":["passwordless-deployment","authentication-method-policies","conditional-access-configuration","fido2-registration-workflow","legacy-auth-phaseout"],"capabilityDetails":["Provides a step-by-step workflow to deploy passwordless authentication in Microsoft Entra, including enabling FIDO2, Windows Hello for Business, and Microsoft Authenticator passkeys, enforcing phishing-resistant Conditional Access, and monitoring adoption."],"techniqueTags":["fido2-authentication","windows-hello-for-business","temporary-access-pass","cloud-kerberos-trust","authentication-strength"],"techniqueDetails":["Uses Microsoft Graph PowerShell to configure authentication method policies and Conditional Access authentication strength; leverages Temporary Access Pass for secure FIDO2 key registration; utilizes Cloud Kerberos Trust for hybrid Windows Hello for Business deployments."],"tools":["Microsoft Graph PowerShell SDK","Microsoft Intune","Microsoft Entra Admin Center","FIDO2 security keys","Windows Hello for Business","Microsoft Authenticator"],"targetTypes":["cloud","active-directory","windows-host","mobile"],"role":"specialist-playbook","workflowFocus":["remediation","reporting"],"distinctiveFeatures":["Provides concrete PowerShell automation for every step of Microsoft Entra passwordless deployment, including FIDO2 registration via Temporary Access Pass and Cloud Kerberos Trust for hybrid WHfB.","Includes a complete enterprise migration scenario and adoption metrics dashboard, distinguishing it from generic passwordless concept guides."],"familyIds":["multi-factor-and-passwordless-authentication-implementation"]},{"id":"implementing-passwordless-authentication-with-fido2","summary":"Provides a structured implementation playbook for deploying FIDO2/WebAuthn passwordless authentication, covering server configuration, API integration, passkey enrollment, and phishing-resistant authentication aligned with NIST AAL3.","primaryDomain":"authentication","domainTags":["fido2","webauthn","passwordless","identity-access-management"],"capabilityTags":["fido2-server-configuration","webauthn-api-integration","passkey-enrollment","biometric-authentication"],"capabilityDetails":["Provides a step-by-step workflow for deploying FIDO2/WebAuthn passwordless authentication, including WebAuthn API integration, FIDO2 server setup, passkey enrollment, and biometric authentication support."],"techniqueTags":["phishing-resistant-authentication","public-key-cryptography","multi-factor-authentication"],"techniqueDetails":["Uses FIDO2/WebAuthn public key cryptography to eliminate passwords and resist phishing."],"tools":[],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["remediation","knowledge-reference"],"distinctiveFeatures":["Specializes in phishing-resistant passwordless authentication using FIDO2/WebAuthn, including security keys and platform authenticators, with explicit alignment to NIST SP 800-63B AAL3 and migration from password-based systems."],"familyIds":["multi-factor-and-passwordless-authentication-implementation"]},{"id":"implementing-patch-management-for-ot-systems","summary":"Structured patch management program for OT/ICS environments integrating risk-based prioritization, vendor compatibility testing, staged deployment, compliance tracking, and compensating control documentation.","primaryDomain":"network-security","domainTags":["ot-ics-security","industrial-control","scada","patch-management","vulnerability-management"],"capabilityTags":["patch-lifecycle-management","risk-based-prioritization","vendor-compatibility-testing","compensating-controls","maintenance-window-planning"],"capabilityDetails":["Provides an executable workflow for managing the OT patch lifecycle, from identification through deployment, with risk-based prioritization and documentation of compensating controls."],"techniqueTags":["risk-scoring","staged-testing","rollback-procedures","compliance-mapping","python-automation"],"techniqueDetails":["Uses OT-specific risk scoring based on CVSS, CISA KEV, network exposure, and Purdue levels.","Requires staged testing in a mirrored environment and documentation of rollback procedures."],"tools":["python","wsus/sccm","claroty-xdome","tripwire-enterprise"],"targetTypes":["other","windows-host","network"],"role":"specialist-playbook","workflowFocus":["remediation","analysis","validation","reporting"],"distinctiveFeatures":["Dedicated to OT/ICS patch management with safety-aware prioritization, vendor compatibility gates, and compensating controls, unlike generic IT patch management skills."],"familyIds":["ot-patch-management"]},{"id":"implementing-patch-management-workflow","summary":"Provides a structured workflow for implementing enterprise patch management, covering patch discovery, risk-based prioritization, lab testing, phased production rollouts using deployment rings, and post-patch verification.","primaryDomain":"security-knowledge","domainTags":["vulnerability-management","patch-management","configuration-management","compliance"],"capabilityTags":["patch-lifecycle-management","phased-rollout","automated-patching","patch-verification","risk-prioritization"],"capabilityDetails":["Provides a complete patch management workflow including discovery, assessment, testing, approval, phased deployment, verification, and reporting."],"techniqueTags":["deployment-rings","snapshot-rollback","post-patch-scanning","change-management"],"techniqueDetails":["Uses deployment rings with soak times to stage rollouts.","Uses VM snapshots to enable rollback during patch testing.","Correlates vulnerability scans with available patches to prioritize."],"tools":["WSUS","Ansible","PowerShell","Nessus","apt","dnf"],"targetTypes":["windows-host","linux-host"],"role":"workflow","workflowFocus":["detection","validation","remediation","reporting"],"distinctiveFeatures":["Covers the entire patch lifecycle with concrete automation examples for WSUS, Ansible, and Nessus.","Defines deployment rings with sample rollout percentages, soak times, and SLA tables by CVSS severity."],"familyIds":["patch-management-implementation"]},{"id":"implementing-pci-dss-compliance-controls","summary":"Provides a phased implementation workflow for PCI DSS 4.0.1 compliance across all 12 requirements, covering scoping, network and data protection, access control, monitoring, and governance, with emphasis on the new mandatory controls effective March 2025.","primaryDomain":"security-knowledge","domainTags":["compliance","governance","pci-dss","payment-security","cardholder-data"],"capabilityTags":["pci-dss-4-0-1-implementation","compliance-control-mapping","cardholder-data-environment-scoping","gap-assessment"],"capabilityDetails":["Provides a structured workflow for implementing PCI DSS 4.0.1 compliance controls across 12 requirements, including scoping the cardholder data environment, deploying network security, data encryption, access control, monitoring, and governance controls."],"techniqueTags":["network-segmentation","encryption","tokenization","mfa","file-integrity-monitoring","vulnerability-scanning","penetration-testing"],"techniqueDetails":["Describes implementing controls using the customized approach and targeted risk analysis where allowed by PCI DSS 4.0.1."],"tools":[],"targetTypes":["network","database","web-application","cloud","container"],"role":"mixed","workflowFocus":["analysis","remediation","validation","knowledge-reference"],"distinctiveFeatures":["Complete PCI DSS 4.0.1 implementation roadmap covering all 12 requirements, including the 51 new mandatory controls effective March 2025; unlike generic compliance references, it provides a week-based phased deployment plan with specific artifacts and pitfalls."],"familyIds":["compliance-governance"]},{"id":"implementing-pod-security-admission-controller","summary":"Implementation guide for Kubernetes Pod Security Admission (PSA), covering namespace-level enforcement of Privileged/Baseline/Restricted standards via labels, dry-run testing, cluster-wide defaults, compliant pod examples, and migration from PodSecurityPolicy.","primaryDomain":"cloud-security","domainTags":["kubernetes-security","container-security","pod-security-standards"],"capabilityTags":["pod-security-admission-implementation","namespace-hardening","pod-security-policy-migration","security-baseline-enforcement"],"capabilityDetails":["Provides a step-by-step workflow for implementing Kubernetes Pod Security Admission (PSA) at the namespace and cluster level, including label-based enforcement of Privileged, Baseline, and Restricted profiles, dry-run testing, and migration from deprecated PodSecurityPolicy."],"techniqueTags":["admission-controller-configuration","kubernetes-labeling","dry-run-testing","audit-warn-enforce-modes"],"techniqueDetails":["Uses kubectl label commands to set pod-security.kubernetes.io enforcement modes and versions on namespaces.","Uses server-side dry-run to assess policy impact before enforcement.","Configures cluster-wide defaults via AdmissionConfiguration YAML with exemptions."],"tools":["kubectl","jq"],"targetTypes":["kubernetes","container"],"role":"specialist-playbook","workflowFocus":["remediation","validation","detection"],"distinctiveFeatures":["Focuses on the built-in Kubernetes Pod Security Admission controller, specifically its label-based enforcement profiles and modes, and the migration path from PodSecurityPolicy."],"familyIds":["kubernetes-policy-and-access-control"]},{"id":"implementing-policy-as-code-with-open-policy-agent","summary":"Provides a practical workflow to implement and enforce policy-as-code using OPA Gatekeeper and conftest across Kubernetes and CI/CD pipelines, covering Rego policy authoring, admission controller deployment, local testing, and CI integration.","primaryDomain":"cloud-security","domainTags":["kubernetes-security","policy-as-code","devsecops","cicd"],"capabilityTags":["policy-as-code-implementation","rego-policy-authoring","gatekeeper-deployment","admission-control","policy-testing"],"capabilityDetails":["Provides a step-by-step workflow for implementing policy-as-code enforcement using OPA and Gatekeeper in Kubernetes, from writing Rego policies and deploying admission controllers to testing with conftest and integrating into CI/CD."],"techniqueTags":["rego-policy-writing","constraint-templates","admission-controller-policies","conftest-testing","ci-cd-gating"],"techniqueDetails":["Uses Rego to write policy rules in ConstraintTemplates, enforced as Kubernetes admission controllers, and tested with conftest against configuration files."],"tools":["opa","gatekeeper","conftest","helm"],"targetTypes":["kubernetes","container","cloud"],"role":"specialist-playbook","workflowFocus":["validation","remediation"],"distinctiveFeatures":["Focuses on policy-as-code enforcement with OPA/Gatekeeper rather than vulnerability scanning or runtime threat detection.","Covers both Kubernetes admission control and CI/CD pipeline policy gating."],"familyIds":["kubernetes-policy-and-access-control"]},{"id":"implementing-privileged-access-management-with-cyberark","summary":"A comprehensive deployment playbook for CyberArk Privileged Access Management, covering vault architecture, credential discovery/rotation, session isolation, compliance mapping, and monitoring integration.","primaryDomain":"authentication","domainTags":["identity-access-management","privileged-access-management","cyberark","access-control"],"capabilityTags":["pam-deployment","credential-vaulting","credential-rotation","session-isolation","privileged-session-monitoring","security-control-implementation"],"capabilityDetails":["Provides a step-by-step workflow for deploying CyberArk PAM, including vault architecture design, safe/policy configuration, platform-based credential rotation, privileged session management, and SIEM integration."],"techniqueTags":["vault-architecture-design","credential-discovery","rotation-policy-configuration","session-recording","just-in-time-access","high-availability-configuration"],"techniqueDetails":["Uses CyberArk-specific component roles (Vault, CPM, PSM, PVWA, PTA, Conjur) and details platform-specific rotation schedules, dual control, and break-glass procedures."],"tools":["cyberark","conjur","siem"],"targetTypes":["active-directory","windows-host","linux-host","database","network","cloud"],"role":"specialist-playbook","workflowFocus":["analysis","detection","remediation"],"distinctiveFeatures":["Focuses specifically on CyberArk PAM implementation, not generic IAM; includes concrete platform rotation schedules, PSM session isolation, NIST 800-53 mapping, and break-glass/DR procedures."],"familyIds":["privileged-access-and-identity-lifecycle-operations"]},{"id":"implementing-privileged-access-workstation","summary":"Step-by-step guidance to design and implement Privileged Access Workstations (PAWs) using a tiered administration model, with device hardening, Intune/GPO compliance enforcement, just-in-time access, and PAM integration with CyberArk or BeyondTrust, producing a JSON compliance and risk report.","primaryDomain":"windows-security","domainTags":["privileged-access","device-hardening","tiered-administration","just-in-time-access","pam"],"capabilityTags":["paw-implementation","hardening-configuration","compliance-enforcement","jit-access-provisioning","pam-integration"],"capabilityDetails":["Provides a step-by-step workflow to design, implement, and validate Privileged Access Workstations (PAWs) using a tiered administration model, including device hardening, compliance enforcement, JIT access, and PAM integration."],"techniqueTags":["applocker-policy","credential-guard","device-guard","intune-compliance-policy","group-policy","time-limited-admin-group-membership","cyberark-integration","beyondtrust-integration","cis-benchmark-validation"],"techniqueDetails":["Uses AppLocker, Credential Guard, and Device Guard for device hardening.","Enforces compliance via Microsoft Intune or Group Policy objects.","Implements JIT access with time-limited admin group membership.","Integrates with CyberArk or BeyondTrust for credential vaulting.","Validates configuration against CIS and Microsoft PAW guidance."],"tools":["microsoft-intune","group-policy","cyberark","beyondtrust","python","applocker","credential-guard"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","validation","remediation"],"distinctiveFeatures":["Focuses specifically on the design and implementation of Privileged Access Workstations, not general endpoint hardening.","Integrates both native Microsoft controls (Intune/GPO) and third-party PAM platforms (CyberArk/BeyondTrust).","Includes just-in-time access provisioning as a core component, rather than just static hardening."],"familyIds":["privileged-access-workstation-design"]},{"id":"implementing-privileged-session-monitoring","summary":"Detailed implementation guide for deploying privileged session monitoring and recording using CyberArk PSM and open-source Teleport, enabling keystroke logging, real-time high-risk command alerts, session review, and compliance audit trail generation.","primaryDomain":"security-knowledge","domainTags":["identity-access-management","pam","session-monitoring","compliance"],"capabilityTags":["session-recording-configuration","keystroke-logging","real-time-monitoring","compliance-audit-trail"],"capabilityDetails":["This skill provides a practical implementation workflow for configuring privileged session recording and monitoring using CyberArk PSM and Teleport, including keystroke logging, real-time high-risk command detection, session review, and SIEM forwarding."],"techniqueTags":["session-proxy","session-recording","keystroke-capture","risk-based-alerting","syslog-forwarding"],"techniqueDetails":["Uses a proxy architecture to route all privileged access through a jump server, records sessions in video and text formats, captures keystrokes for searchable transcripts, applies behavioral analytics for high-risk command detection, and forwards session metadata to SIEM."],"tools":["CyberArk PSM","CyberArk PVWA","CyberArk Privileged Threat Analytics","Teleport","tsh"],"targetTypes":["windows-host","linux-host","database"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting","validation"],"distinctiveFeatures":["Provides a complete implementation guide for privileged session monitoring, not just a configuration snippet","Covers both commercial CyberArk PSM and open-source Teleport alternatives","Integrates compliance requirements (PCI-DSS, SOX, HIPAA) into session retention and review policies"],"familyIds":["pam-implementation-and-session-monitoring"]},{"id":"implementing-proofpoint-email-security-gateway","summary":"Provides a step-by-step playbook for deploying and configuring Proofpoint Email Protection as a secure email gateway, including mail flow planning, policy configuration, SPF/DKIM/DMARC enforcement, advanced threat protection (URL Defense, Attachment Defense, TRAP), and MX migration.","primaryDomain":"network-security","domainTags":["email-security","secure-email-gateway","phishing-defense","malware-protection"],"capabilityTags":["email-gateway-deployment","phishing-blocking","malware-sandboxing","bec-detection","email-authentication-configuration"],"capabilityDetails":["Provides a step-by-step workflow for deploying and configuring Proofpoint Email Protection as a secure email gateway, covering mail flow planning, policy configuration, SPF/DKIM/DMARC enforcement, advanced threat protection (URL Defense, Attachment Defense, TRAP), and MX record migration."],"techniqueTags":["mx-record-redirection","spf-dkim-dmarc-configuration","url-defense","attachment-defense","post-delivery-remediation"],"techniqueDetails":["Uses MX-based, API-based, or hybrid deployment models to route email through Proofpoint. Employs SPF/DKIM/DMARC for authentication, URL rewriting with time-of-click sandboxing, and attachment detonation in sandboxes."],"tools":["Proofpoint TAP","Proofpoint TRAP","Proofpoint SER","Proofpoint CLEAR","MX Toolbox"],"targetTypes":["network","cloud"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Focuses specifically on Proofpoint Email Protection product integration, including deployment models (MX-based, API, hybrid) and advanced features like URL Defense, TRAP auto-retraction, and Supplier Threat Detection for BEC."],"familyIds":["email-security-gateway-implementation"]},{"id":"implementing-purdue-model-network-segmentation","summary":"Provides a structured workflow and Python planner for implementing Purdue Model network segmentation in ICS/OT environments, including asset classification, VLAN planning, firewall rule generation, and IT/OT DMZ design.","primaryDomain":"network-security","domainTags":["ot-security","ics","network-segmentation","purdue-model","iec-62443","dmz"],"capabilityTags":["asset-classification","vlan-planning","firewall-rule-generation","dmz-design","zone-segmentation"],"capabilityDetails":["Provides a structured workflow for classifying OT assets to Purdue levels and generating inter-zone firewall rules and VLAN assignments for ICS network segmentation."],"techniqueTags":["purdue-model","defense-in-depth","zone-and-conduit","dmz"],"techniqueDetails":["Uses Purdue Model hierarchy to segment OT networks into trust levels and enforces strict traffic control through an IT/OT DMZ aligned with IEC 62443."],"tools":["custom-python-planner"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["analysis","remediation"],"distinctiveFeatures":["Focuses on OT/ICS network segmentation using Purdue Model levels and IEC 62443 zones","Automates asset classification and firewall rule generation with a Python script","Provides detailed IT/OT DMZ configuration with dual-firewall architecture"],"familyIds":["ot-network-segmentation"]},{"id":"implementing-ransomware-backup-strategy","summary":"Provides an actionable playbook for designing and implementing ransomware-resilient backup architecture using the 3-2-1-1-0 rule, including asset classification, immutable/air-gapped storage configuration, backup credential isolation, and automated restore testing with defined RPO/RTO targets.","primaryDomain":"security-knowledge","domainTags":["ransomware-defense","backup-strategy","data-protection"],"capabilityTags":["backup-strategy-design","immutable-storage-config","restore-testing","backup-credential-isolation"],"capabilityDetails":["Designs a ransomware-resilient backup strategy using the 3-2-1-1-0 methodology, including asset classification, RPO/RTO alignment, isolated backup credentials, immutable/air-gapped storage, and automated restore testing."],"techniqueTags":["3-2-1-1-0-methodology","rpo-rto-setting","immutable-backup","air-gapped-backup","automated-restore-testing"],"techniqueDetails":["Uses the 3-2-1-1-0 rule (3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, 0 restore errors) to ensure backup resilience.","Configures immutable storage via Veeam Hardened Linux Repository, AWS S3 Object Lock in Compliance mode, or Azure immutable blob storage.","Isolates backup admin credentials from the production Active Directory domain and disables RDP to reduce attack surface.","Automates restore testing using Veeam SureBackup or equivalent to verify boot, network connectivity, and application health."],"tools":["Veeam Backup & Replication","Rubrik Security Cloud","Commvault","AWS S3 Object Lock","Cohesity DataProtect","Azure Immutable Blob Storage"],"targetTypes":["windows-host","linux-host","cloud","database"],"role":"specialist-playbook","workflowFocus":["analysis","validation","remediation"],"distinctiveFeatures":["Provides a comprehensive 3-2-1-1-0 backup methodology with concrete configuration examples for Veeam Hardened Repository, AWS S3 Object Lock, and Azure immutable blob storage.","Emphasizes isolation of backup credentials from production AD and includes automated restore testing with SureBackup verification jobs.","Includes a financial services scenario and a structured gap analysis / output format for assessing current backup maturity."],"familyIds":["ransomware-resistant-backup-implementation"]},{"id":"implementing-ransomware-kill-switch-detection","summary":"Provides a practical workflow for identifying ransomware kill switch mechanisms (mutex, domain, registry, file, language) and deploying mutex vaccination, Sysmon-based monitoring, and DNS monitoring to prevent ransomware execution.","primaryDomain":"windows-security","domainTags":["ransomware","kill-switch","mutex","malware-analysis","windows-internals"],"capabilityTags":["mutex-vaccination","kill-switch-detection","dns-monitoring","sysmon-detection","incident-response"],"capabilityDetails":["Provides a workflow for identifying ransomware kill switch mechanisms including mutex, domain, registry, file, and language-based checks.","Implements proactive mutex vaccination on Windows endpoints to prevent known ransomware families from executing.","Deploys Sysmon-based monitoring for mutex creation events and DNS monitoring for kill switch domain resolution attempts."],"techniqueTags":["mutex-creation","domain-sinkhole","sysmon-event-monitoring","registry-check","file-marker"],"techniqueDetails":["Uses Windows named mutexes as execution guards and pre-creates them to block ransomware.","Monitors DNS queries for high-entropy or known kill switch domains.","Leverages Sysmon Event IDs 1, 17, and 18 for process and mutex creation detection.","Enumerates active mutexes using Velociraptor and Sysinternals Handle for incident response."],"tools":["Sysmon","Velociraptor","Sysinternals Handle","Python ctypes","ANY.RUN","PassiveDNS","malware-mutex GitHub"],"targetTypes":["windows-host","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on ransomware kill switch mechanisms rather than general ransomware defense.","Combines static/dynamic analysis of kill switch types with deployable defensive controls like mutex vaccination and domain monitoring.","Includes concrete examples from WannaCry, Conti, Ryuk, and REvil and provides reusable Python, PowerShell, and Sysmon configurations."],"familyIds":["ransomware-defense"]},{"id":"implementing-rapid7-insightvm-for-scanning","summary":"Provides comprehensive guidance for deploying and operating Rapid7 InsightVM, including console installation, distributed scan engine setup, credentialed scanning for Windows/Linux/databases, and Insight Agent integration, enabling authenticated vulnerability discovery and remediation workflows across enterprise environments.","primaryDomain":"network-security","domainTags":["vulnerability-management","asset-discovery","insightvm","scan-engine"],"capabilityTags":["insightvm-deployment","scan-engine-configuration","credentialed-scanning","scan-template-configuration","insight-agent-integration","vulnerability-assessment"],"capabilityDetails":["Provides step-by-step installation and configuration of Rapid7 InsightVM Security Console and distributed Scan Engines.","Details creation of custom scan templates with service discovery and vulnerability check settings.","Covers credentialed scanning configuration for Windows (WMI), Linux (SSH), and database assets.","Includes Insight Agent deployment for continuous vulnerability assessment of remote endpoints.","Shows how to set up remediation projects and track vulnerability remediation workflows."],"techniqueTags":["credentialed-scanning","unauthenticated-scanning","agent-based-assessment","scheduled-scanning","api-automation","network-scanning"],"techniqueDetails":["Uses WMI and SMB credentials for authenticated Windows scanning.","Uses SSH private key or password authentication for Linux scanning.","Employs SQL Server and Oracle credentials for database vulnerability assessment.","Leverages Insight Agent for continuous assessment without network scans.","Uses InsightVM API v3 to programmatically trigger scans and retrieve vulnerabilities."],"tools":["rapid7-insightvm","rapid7-scan-engine","insight-agent","rapid7-insightvm-api"],"targetTypes":["network","windows-host","linux-host","database"],"role":"tool-guide","workflowFocus":["detection","reporting","remediation"],"distinctiveFeatures":["Enterprise-focused deployment of Rapid7 InsightVM with distributed Scan Engines and console.","Covers both engine-based and agent-based vulnerability assessment in one workflow.","Provides detailed multi-platform credentialed scan configuration (Windows, Linux, database).","Includes API automation examples for scan orchestration and remediation project creation."],"familyIds":["vulnerability-scanning-management"]},{"id":"implementing-rbac-hardening-for-kubernetes","summary":"Provides a specialized Kubernetes RBAC hardening playbook covering least-privilege Role/ClusterRole design, elimination of cluster-admin sprawl, service account separation, token auto-mount review, and OIDC integration, with practical kubectl/jq audit commands and supporting tooling.","primaryDomain":"cloud-security","domainTags":["kubernetes-security","rbac","access-control","container-security"],"capabilityTags":["rbac-hardening","least-privilege-roles","clusterrole-audit","service-account-hardening","oidc-integration"],"capabilityDetails":["Provides a step-by-step workflow for auditing Kubernetes RBAC configurations, identifying overprivileged bindings, and implementing least-privilege access controls.","Includes concrete kubectl/jq commands for enumerating role bindings and finding risky service account configurations."],"techniqueTags":["least-privilege-modeling","role-binding-audit","service-account-isolation","external-identity-integration"],"techniqueDetails":["Uses namespace-scoped Role/RoleBinding instead of ClusterRole/ClusterRoleBinding to limit blast radius.","Disables automatic service account token mounts and creates dedicated service accounts per workload.","Integrates OIDC for external user authentication and group-based access control."],"tools":["kubectl","jq","rbac-lookup","rakkess"],"targetTypes":["kubernetes"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","remediation"],"distinctiveFeatures":["Focuses exclusively on Kubernetes RBAC hardening rather than general Kubernetes security or container hardening.","Provides purpose-built audit commands for cluster-admin sprawl, default service account usage, and token auto-mount checks.","Includes OIDC integration for identity provider-based access control, setting it apart from RBAC-only guides."],"familyIds":["kubernetes-policy-and-access-control"]},{"id":"implementing-rsa-key-pair-management","summary":"Provides operational guidance for generating, serializing, protecting, rotating, and validating RSA key pairs in accordance with NIST SP 800-57, including key size recommendations and modern padding schemes.","primaryDomain":"security-knowledge","domainTags":["cryptography","key-management","pki","asymmetric-encryption"],"capabilityTags":["rsa-key-generation","key-serialization","key-rotation","key-strength-validation","rsa-sign-and-verify"],"capabilityDetails":["Provides a workflow for implementing RSA key pair management, including generation, serialization, passphrase protection, rotation, and validation."],"techniqueTags":["nist-sp-800-57","pkcs8","pem","der","rsa-pss","rsa-oaep","aes-256-cbc"],"techniqueDetails":["Uses NIST SP 800-57 guidelines to determine appropriate key sizes and rotation intervals.","Serializes keys in PEM, DER, and PKCS#8 formats.","Uses AES-256-CBC passphrase encryption for private key protection.","Uses RSA-PSS for signatures and RSA-OAEP for encryption, avoiding deprecated PKCS#1 v1.5.","Computes key fingerprints for identity verification."],"tools":["python"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["validation","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on RSA key lifecycle management rather than generic cryptography.","Adheres to NIST SP 800-57 guidelines, including minimum 3072-bit key sizes and annual rotation.","Covers multiple serialization formats (PEM, DER, PKCS#8) and passphrase protection in one skill."],"familyIds":["cryptographic-key-lifecycle-management"]},{"id":"implementing-runtime-application-self-protection","summary":"Provides a step-by-step workflow for deploying and configuring OpenRASP agents to detect and block web application attacks from within the application runtime, including policy tuning and SIEM integration.","primaryDomain":"web-security","domainTags":["application-security","runtime-protection","openrasp"],"capabilityTags":["rasp-deployment","policy-configuration","attack-detection","siem-integration"],"capabilityDetails":["Provides a workflow for deploying RASP agents into Java/Python web applications, configuring detection policies for OWASP Top 10 attacks, tuning alert thresholds, and integrating telemetry with SIEM."],"techniqueTags":["runtime-instrumentation","execution-context-analysis","attack-pattern-detection"],"techniqueDetails":["Explains how RASP instruments application code to intercept dangerous operations at runtime, achieving near-zero false positives compared to network-level WAFs."],"tools":["openrasp"],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["remediation"],"distinctiveFeatures":["Focuses on runtime application self-protection as an internal security control rather than external scanning or WAF rules.","Covers OpenRASP agent deployment for Java and Python web applications.","Includes SIEM telemetry integration for correlation with WAF/IDS events."],"familyIds":["web-application-defense-and-detection"]},{"id":"implementing-runtime-security-with-tetragon","summary":"Implementation guide for Cilium Tetragon to deploy kernel-level runtime security in Kubernetes, covering installation, TracingPolicy creation, monitoring, and enforcement.","primaryDomain":"cloud-security","domainTags":["kubernetes-security","container-security","runtime-security","ebpf-security"],"capabilityTags":["tetragon-deployment","tracing-policy-authoring","runtime-threat-detection","kernel-event-monitoring"],"capabilityDetails":["Provides a step-by-step workflow for installing Cilium Tetragon in a Kubernetes cluster, constructing TracingPolicy CRDs for kernel-level observability and enforcement, and integrating events with SIEM and Prometheus."],"techniqueTags":["ebpf-instrumentation","kprobe-tracing","kernel-enforcement","process-execution-tracking"],"techniqueDetails":["Attaches eBPF programs to kernel functions and syscalls via kprobes to intercept process execution, file access, and network operations."],"tools":["tetragon","tetra","helm","kubectl","kubernetes"],"targetTypes":["kubernetes","container","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","remediation","analysis"],"distinctiveFeatures":["Focuses on eBPF-based kernel-level security, differentiating it from user-space agents.","Provides concrete TracingPolicy examples for container escape, sensitive file access, and cryptomining detection."],"familyIds":["cloud-threat-detection-and-hunting"]},{"id":"implementing-saml-sso-with-okta","summary":"Provides step-by-step guidance for implementing SAML 2.0 SSO with Okta as Identity Provider, including SAML app configuration, attribute mapping, certificate installation, SHA-256 signature enforcement, Single Logout, and validation with SAML Tracer.","primaryDomain":"authentication","domainTags":["saml","sso","okta","identity-access-management","access-control"],"capabilityTags":["saml-sso-configuration","okta-idp-setup","attribute-mapping","saml-signature-hardening","certificate-rotation","single-logout-implementation"],"capabilityDetails":["Provides end-to-end workflow for configuring Okta as a SAML 2.0 Identity Provider, implementing SP-initiated and IdP-initiated SSO flows, mapping attributes, enforcing SHA-256 signatures, managing certificates, and implementing Single Logout."],"techniqueTags":["sp-initiated-sso","idp-initiated-sso","saml-assertion-validation","sha256-signature-enforcement","assertion-encryption","saml-tracer-testing"],"techniqueDetails":["Walks through SAML application creation in Okta, IdP metadata installation, SP-side assertion validation including InResponseTo and audience restriction, and validation of flows using a SAML Tracer browser extension."],"tools":["okta","saml-tracer"],"targetTypes":["web-application"],"role":"workflow","workflowFocus":["validation","remediation","knowledge-reference"],"distinctiveFeatures":["Focuses specifically on implementing and hardening SAML SSO with Okta as the IdP, covering both SP-initiated and IdP-initiated flows, certificate rotation, and SLO alongside configuration steps.","Provides an actionable Okta-centric deployment playbook with security hardening and SAML Tracer testing, distinct from generic SAML knowledge or attack-focused identity skills."],"familyIds":["identity-federation-sso-security"]},{"id":"implementing-scim-provisioning-with-okta","summary":"Step-by-step guide to building a SCIM 2.0-compliant provisioning API server and integrating it with Okta for automated user lifecycle management, including Flask implementation, attribute mapping, error handling, and Okta SCIM validator testing.","primaryDomain":"authentication","domainTags":["scim","okta","provisioning","identity-management","lifecycle-management","sso"],"capabilityTags":["scim-2-server-implementation","okta-provisioning-integration","user-lifecycle-automation","attribute-mapping","group-push-sync"],"capabilityDetails":["Provides a workflow for building a SCIM 2.0-compliant REST API server and integrating it with Okta for automated user provisioning, deprovisioning, attribute sync, and group management."],"techniqueTags":["scim-crud-operations","bearer-token-authentication","scim-filtering","pagination","patch-operations","soft-deactivation"],"techniqueDetails":["Uses SCIM 2.0 protocol operations (POST/GET/PUT/PATCH/DELETE) for user and group lifecycle management.","Uses bearer token validation to authenticate Okta requests.","Implements userName 'eq' filter and startIndex/count pagination for user listing.","Deactivates users by setting active=false rather than hard delete.","Supports PATCH add/replace/remove operations for partial updates."],"tools":["flask","fastapi","okta","runscope","blazemeter"],"targetTypes":["api","cloud"],"role":"specialist-playbook","workflowFocus":["validation","remediation"],"distinctiveFeatures":["Focuses specifically on implementing SCIM 2.0 provisioning with Okta as the identity provider, including building the SCIM server API, configuring Okta provisioning, and passing the Okta SCIM validator test suite - distinct from general SSO/OAuth integration or IdP configuration guidance."],"familyIds":["privileged-access-and-identity-lifecycle-operations"]},{"id":"implementing-secret-scanning-with-gitleaks","summary":"Practical workflow for deploying Gitleaks secret scanning across git repositories, covering pre-commit hooks, CI/CD integration, custom detection rules, baseline management for legacy repos, and remediation of exposed secrets via git history rewriting.","primaryDomain":"source-code-security","domainTags":["secret-scanning","devsecops","git-security"],"capabilityTags":["secret-detection","pre-commit-integration","ci-cd-integration","custom-rule-authoring","baseline-management","secret-remediation"],"capabilityDetails":["Provides a workflow for implementing Gitleaks to detect and prevent hardcoded secrets in git repositories, including pre-commit hooks, CI/CD pipeline integration, custom rule authoring, baseline management, and remediation."],"techniqueTags":["regex-pattern-matching","entropy-detection","git-history-scanning","baseline-comparison"],"techniqueDetails":["Uses regex patterns and entropy analysis to detect likely secrets; scans git history and compares against baselines to identify new findings."],"tools":["gitleaks","pre-commit","git-filter-repo"],"targetTypes":["source-code"],"role":"workflow","workflowFocus":["detection","remediation"],"distinctiveFeatures":["Focuses specifically on implementing Gitleaks across the secure SDLC, including pre-commit hooks, CI/CD, custom rules, baselines, and history remediation; distinct from generic secret-scanning methodology."],"familyIds":["secret-scanning-and-remediation"]},{"id":"implementing-secrets-management-with-vault","summary":"Provides a comprehensive playbook for deploying HashiCorp Vault to centralize secrets management, including HA setup, dynamic database and cloud credentials, Kubernetes integration, Transit encryption, PKI, and audit logging.","primaryDomain":"cloud-security","domainTags":["secrets-management","hashicorp-vault","cloud-security","kubernetes-security"],"capabilityTags":["vault-deployment","dynamic-secrets","transit-encryption","pki-management","kubernetes-integration"],"capabilityDetails":["Provides a step-by-step workflow to deploy HashiCorp Vault in HA mode, configure dynamic secret engines for databases and cloud providers, integrate with Kubernetes workloads via Agent Injector, implement Transit encryption, manage PKI certificates, and establish policies and audit logging."],"techniqueTags":["dynamic-secret-generation","transit-encryption","pki-certificate-issuance","approle-authentication","kubernetes-auth","vault-agent-injection"],"techniqueDetails":["Uses Vault secret engines to generate short-lived credentials on demand for databases and AWS IAM, leverages Transit for encryption-as-a-service without exposing keys, issues and manages certificates via PKI, authenticates applications via AppRole and Kubernetes auth methods, and injects secrets into pods via sidecar or CSI."],"tools":["vault","vault-agent-injector","vault-csi-provider","consul-template","vault-radar"],"targetTypes":["cloud","kubernetes","database"],"role":"specialist-playbook","workflowFocus":["remediation"],"distinctiveFeatures":["Covers end-to-end HashiCorp Vault implementation from HA deployment to Kubernetes workload integration","Provides configuration examples for dynamic secrets across PostgreSQL and AWS IAM platforms","Includes an audit report output format for credential hygiene and lease management"],"familyIds":["identity-secrets-and-privileged-access-management"]},{"id":"implementing-secrets-scanning-in-ci-cd","summary":"A step-by-step implementation guide that integrates gitleaks and TruffleHog into CI/CD pipelines to automatically detect hardcoded secrets in source code, generate JSON reports, and enforce severity-based deployment gates.","primaryDomain":"source-code-security","domainTags":["secrets-scanning","devsecops","ci-cd"],"capabilityTags":["ci-cd-secrets-gating","gitleaks-integration","trufflehog-integration","pre-commit-secrets-check"],"capabilityDetails":["Provides a workflow for integrating gitleaks and TruffleHog into CI/CD pipelines to detect hardcoded secrets before deployment, with severity-based gating and pre-commit hooks."],"techniqueTags":["entropy-analysis","regex-pattern-matching","git-history-scanning","secret-verification","json-report-parsing"],"techniqueDetails":["Uses regex pattern matching and entropy analysis via gitleaks; TruffleHog scans filesystem and git history with optional live secret verification; findings are parsed into JSON and filtered by severity to enforce a CI gate."],"tools":["gitleaks","trufflehog"],"targetTypes":["source-code"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Combines two complementary secret scanners (gitleaks and TruffleHog) in a single CI/CD pipeline","Includes a severity-based CI gate that can block deployments based on finding severity","Covers pre-commit hooks for early detection before code is committed"],"familyIds":["secret-scanning-and-remediation"]},{"id":"implementing-security-chaos-engineering","summary":"Provides a workflow for implementing security chaos engineering experiments that deliberately disable or degrade security controls (e.g., opening security groups, disabling CloudTrail, creating admin IAM users) to verify SOC detection and response capabilities, with a safe rollback pattern.","primaryDomain":"cloud-security","domainTags":["security-chaos-engineering","detection-validation","resilience-testing","security-operations"],"capabilityTags":["chaos-experiment-design","detection-coverage-validation","control-degradation-testing","safe-rollback-execution"],"capabilityDetails":["Provides a workflow for designing and executing security chaos experiments that intentionally disable or degrade security controls to verify detection and response capabilities."],"techniqueTags":["security-group-ingress-modification","cloudtrail-disablement","iam-admin-creation","log-pipeline-disruption","malware-hash-testing"],"techniqueDetails":["Uses AWS-native controls like opening security groups, disabling CloudTrail, creating IAM admin users, simulating log pipeline failures, and deploying malware hashes to trigger and evaluate detection."],"tools":["boto3","subprocess"],"targetTypes":["cloud","network"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Deliberately disables or degrades security controls to test detection and response, rather than exploiting vulnerabilities","Provides a safe rollback pattern for chaos experiments","Uses AWS-native services (EC2, CloudTrail, IAM) as experiment targets"],"familyIds":["cloud-threat-detection-and-hunting"]},{"id":"implementing-security-information-sharing-with-stix2","summary":"A step-by-step guide to creating, validating, and sharing STIX 2.1 threat intelligence objects using the stix2 Python library, including relationship modeling, bundle serialization, and TAXII 2.1 publish/consume workflows.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","stix","taxii","intelligence-sharing"],"capabilityTags":["stix-object-creation","relationship-modeling","bundle-serialization","taxii-publishing","taxii-consumption","stix-validation"],"capabilityDetails":["Provides a workflow for creating STIX 2.1 domain objects, indicators, relationships, and bundles using the stix2 Python library.","Describes how to validate STIX objects against the 2.1 specification.","Demonstrates publishing and consuming STIX bundles over TAXII 2.1."],"techniqueTags":["stix-patterning","taxii2-rest-api","relationship-modeling"],"techniqueDetails":["Uses STIX Patterning Language to express detection indicators.","Employs TAXII 2.1 REST API for intelligence exchange.","Models relationships between SDOs using STIX Relationship objects."],"tools":["stix2","taxii2-client","stix2-validator","requests"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","validation"],"distinctiveFeatures":["Provides end-to-end STIX 2.1 object creation, relationship modeling, bundle serialization, and TAXII 2.1 publish/consume in one workflow.","Uses a realistic Emotet campaign to illustrate relationships between malware, threat actor, campaign, and indicators.","Includes both a custom Python validation function and reference to the stix2-validator CLI."],"familyIds":["threat-intelligence-sharing-and-processing"]},{"id":"implementing-security-monitoring-with-datadog","summary":"Provides a practical implementation playbook for deploying Datadog Cloud SIEM, CSM, and Workload Protection across cloud and hybrid infrastructure, including Agent setup, multi-cloud log ingestion, detection rule tuning, SOC dashboards, and automated notification workflows.","primaryDomain":"cloud-security","domainTags":["siem","security-monitoring","cloud-security","detection-rules","log-analysis"],"capabilityTags":["datadog-agent-configuration","cloud-siem-deployment","detection-rule-creation","workload-protection-setup","security-dashboard-creation","notification-workflow-configuration"],"capabilityDetails":["Provides a step-by-step implementation workflow for Datadog Cloud SIEM, Cloud Security Management, and Workload Protection, including Agent deployment, cloud log ingestion, custom detection rule creation, security dashboard building, and automated alert notifications."],"techniqueTags":["log-source-ingestion","detection-rule-configuration","runtime-threat-detection","compliance-benchmarking","notification-automation"],"techniqueDetails":["Uses Datadog Agent configuration for log and runtime security collection, content packs to ingest AWS/Azure/GCP audit logs, detection rules to generate security signals, and notification rules to trigger escalation workflows."],"tools":["datadog-agent","datadog-api-client","datadog-workflows"],"targetTypes":["cloud","linux-host","windows-host","container","network"],"role":"specialist-playbook","workflowFocus":["detection","validation","reporting"],"distinctiveFeatures":["Vendor-specific implementation for Datadog Cloud SIEM and CSM, covering the full lifecycle from Agent configuration to alert notification workflows","Combines cloud log ingestion (AWS CloudTrail, Azure Activity Logs, GCP Audit Logs) with runtime Workload Protection (eBPF-based agent rules) in a single operational guide"],"familyIds":["cloud-threat-detection-and-hunting"]},{"id":"implementing-semgrep-for-custom-sast-rules","summary":"Provides hands-on guidance for authoring custom Semgrep SAST rules in YAML, including taint analysis, rule testing, and CI/CD integration to detect application-specific vulnerabilities and enforce coding standards.","primaryDomain":"source-code-security","domainTags":["static-analysis","sast","devsecops","code-security"],"capabilityTags":["custom-rule-authoring","taint-analysis","rule-testing","ci-cd-integration"],"capabilityDetails":["Provides practical guidance for writing custom Semgrep rules in YAML to detect application-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines."],"techniqueTags":["pattern-matching","taint-tracking","metavariable-regex","rule-annotation-testing"],"techniqueDetails":["Explains pattern operators, taint sources/sinks/sanitizers, metavariable regex filtering, and testing with # ruleid / # ok annotations."],"tools":["semgrep"],"targetTypes":["source-code"],"role":"tool-guide","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Dedicated to authoring custom Semgrep rules rather than just running default rulesets","Covers taint analysis mode, rule testing, and CI/CD pipeline integration for custom rules"],"familyIds":["source-code-sast-vulnerability-analysis"]},{"id":"implementing-siem-correlation-rules-for-apt","summary":"Provides a playbook for building and deploying multi-event SIEM correlation rules in Splunk SPL and Sigma format to detect APT lateral movement chains, including RDP, Pass-the-Hash, and PsExec scenarios.","primaryDomain":"security-knowledge","domainTags":["siem","detection-engineering","apt-detection","lateral-movement","windows-event-log","sigma"],"capabilityTags":["correlation-rule-development","sigma-rule-authoring","splunk-spl","multi-event-chaining","coverage-gap-analysis"],"capabilityDetails":["Enables detection engineers to write multi-event correlation rules that chain Windows event log and Sysmon events across hosts to identify APT lateral movement sequences that single-event detections miss."],"techniqueTags":["pass-the-hash-detection","psexec-detection","rdp-lateral-movement-detection","sliding-time-window-correlation"],"techniqueDetails":["Uses sliding time windows to correlate sequential events such as RDP logon followed by service installation, Pass-the-Hash NTLM logons with administrative process creation, and PsExec named pipe creation with remote service creation."],"tools":["splunk","sigma","sigma-cli","python"],"targetTypes":["windows-host","network"],"role":"specialist-playbook","workflowFocus":["detection","validation"],"distinctiveFeatures":["Combines Sigma rule authoring with Splunk SPL generation for detecting APT lateral movement chains.","Provides concrete correlation scenarios for RDP, Pass-the-Hash, and PsExec lateral movement techniques.","Focuses on multi-event chaining within sliding time windows to catch APT sequences missed by single-event detections."],"familyIds":["siem-detection-engineering"]},{"id":"implementing-siem-use-case-tuning","summary":"Tune SIEM detection rules in Splunk and Elastic to reduce false positives by analyzing alert volumes, creating context-aware exclusion lists, adjusting thresholds against environmental baselines, and measuring precision/recall efficacy.","primaryDomain":"security-knowledge","domainTags":["siem","detection-engineering","false-positive-reduction","splunk","elastic"],"capabilityTags":["alert-tuning","threshold-baselining","whitelist-management","precision-recall-measurement","rule-optimization"],"capabilityDetails":["Provides a workflow to systematically tune SIEM detection rules to reduce alert fatigue.","Covers Splunk correlation searches and Elastic detection rules.","Includes statistical baselining and context-aware exclusion list creation."],"techniqueTags":["statistical-baselining","threshold-adjustment","exclusion-list-creation","alert-volume-analysis","false-positive-rate-calculation"],"techniqueDetails":["Uses historical alert data to calculate false positive rates per rule.","Adjusts thresholds using mean + N standard deviations of environmental baselines.","Creates whitelist entries for known-good entities such as service accounts and scanners."],"tools":["splunk","elastic","python"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Specifically focuses on tuning existing SIEM detection rules rather than writing new ones.","Cross-platform approach covering both Splunk and Elastic SIEM.","Emphasizes measurable efficacy improvement through precision/recall metrics and alert-to-incident conversion tracking."],"familyIds":["siem-detection-engineering"]},{"id":"implementing-siem-use-cases-for-detection","summary":"Provides a structured workflow for SOC detection engineers to design, implement, test, and maintain SIEM detection use cases across Splunk, Elastic, and Sentinel, mapped to MITRE ATT&CK.","primaryDomain":"security-knowledge","domainTags":["siem","detection-engineering","soc-operations","mitre-attack","use-case-management"],"capabilityTags":["siem-use-case-design","detection-rule-authoring","coverage-gap-analysis","detection-rule-testing","use-case-lifecycle-management"],"capabilityDetails":["Provides a structured workflow for assessing detection coverage gaps, designing use case specifications, implementing detection rules across Splunk/Elastic/Sentinel, validating with attack simulation, and managing the full use case lifecycle."],"techniqueTags":["lsass-memory-access","credential-dumping","scheduled-task-persistence","registry-run-key-persistence"],"techniqueDetails":["Detects unauthorized access to LSASS process memory for credential dumping.","Covers persistence mechanisms such as scheduled tasks and registry run keys mapped to MITRE ATT&CK."],"tools":["splunk-es","elastic-security","microsoft-sentinel","atomic-red-team","mitre-attack-navigator"],"targetTypes":["windows-host","active-directory","network"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","reporting"],"distinctiveFeatures":["Covers the full detection engineering lifecycle from coverage gap analysis to use case maintenance, not just query writing.","Provides equivalent detection implementations in Splunk SPL, Elastic EQL, and Sentinel KQL for the same use case.","Includes a standardized use case specification template and lifecycle state model."],"familyIds":["siem-detection-engineering"]},{"id":"implementing-sigstore-for-software-signing","summary":"Operational playbook for implementing Sigstore keyless signing and verification for container images and software artifacts using Cosign, Fulcio, and Rekor, with OIDC identity binding, transparency log auditing, and CI/CD and Kubernetes enforcement.","primaryDomain":"security-knowledge","domainTags":["supply-chain-security","software-signing","container-security","cryptographic-provenance"],"capabilityTags":["keyless-signing","signature-verification","transparency-log-verification","oidc-identity-binding","ci-cd-pipeline-integration","kubernetes-admission-policy"],"capabilityDetails":["Provides an operational workflow to sign container images and software artifacts using Sigstore keyless signing with Cosign.","Verifies signatures against OIDC-bound certificates and Rekor transparency log entries, ensuring identity and provenance.","Integrates signing and verification into CI/CD pipelines and Kubernetes admission controls for supply-chain security."],"techniqueTags":["keyless-signing","cosign-sign","cosign-verify","rekor-search","fulcio-certificate-issuance","oidc-token-exchange","in-toto-attestation"],"techniqueDetails":["Keyless signing uses short-lived Fulcio certificates bound to OIDC identities, avoiding long-term key management.","Cosign signs container images and blobs, generating ephemeral keys and recording signing events in Rekor.","Verification checks certificate identity, OIDC issuer, and Rekor inclusion proof using cosign verify / verify-blob.","Rekor can be queried via rekor-cli for entries by email or artifact hash, and inclusion proofs verify tamper-evidence.","OIDC tokens from CI providers (GitHub Actions, GCP workload identity) enable non-interactive signing.","In-toto attestations (SLSA, SBOM) can be attached with cosign attest and verified with the same keyless flow."],"tools":["cosign","rekor-cli","fulcio","rekor","sigstore-policy-controller","kyverno"],"targetTypes":["container","binary","other"],"role":"specialist-playbook","workflowFocus":["validation","analysis","detection","reporting"],"distinctiveFeatures":["Focused specifically on Sigstore keyless signing and Rekor transparency log verification, not general code signing or PGP workflows.","Emphasizes OIDC identity binding and non-interactive CI/CD signing with short-lived certificates.","Includes Kubernetes admission enforcement via Sigstore Policy Controller and Kyverno, moving beyond developer-facing signing to automated policy."],"familyIds":["software-artifact-signing-and-provenance"]},{"id":"implementing-soar-automation-with-phantom","summary":"Provides step-by-step guidance and Python code for building SOAR automation with Splunk Phantom, covering asset integration, triage playbooks, enrichment, approval-based containment, and performance monitoring.","primaryDomain":"security-knowledge","domainTags":["soc-operations","incident-response","automation"],"capabilityTags":["alert-triage","ioc-enrichment","containment-automation","playbook-development"],"capabilityDetails":["Automates alert triage, enriches IOCs from multiple tools, executes containment actions with approval gates, and standardizes incident response playbooks."],"techniqueTags":["soar-playbook-design","python-playbook-automation","human-in-the-loop-decisions","multi-tool-orchestration"],"techniqueDetails":["Uses Python playbooks to orchestrate connected security tools, with conditional logic for automatic blocking and analyst prompts for high-impact actions."],"tools":["splunk-soar","phantom","virustotal","crowdstrike-falcon","servicenow","palo-alto-ngfw","splunk-es","active-directory"],"targetTypes":["other"],"role":"workflow","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on building SOAR playbooks in Splunk Phantom, not just general SOAR concepts.","Includes Python code examples for triage, enrichment, and containment playbooks.","Emphasizes human-in-the-loop approval gates for high-impact actions."],"familyIds":["soar-playbook-development"]},{"id":"implementing-soar-playbook-for-phishing","summary":"Automates phishing incident response by creating Splunk SOAR containers, attaching email-derived artifacts, triggering investigation playbooks, and polling results.","primaryDomain":"security-knowledge","domainTags":["phishing","soar","incident-response","security-automation"],"capabilityTags":["soar-automation","phishing-triage","incident-response-workflow","email-parsing"],"capabilityDetails":["Provides a concrete workflow to automate phishing incident response via the Splunk SOAR REST API, including parsing email headers, creating containers, attaching artifacts, triggering playbooks, and compiling verdicts."],"techniqueTags":["rest-api-integration","email-header-analysis","cef-artifacts","playbook-orchestration"],"techniqueDetails":["Uses Splunk SOAR REST API endpoints to create and manage incident containers and artifacts."],"tools":["splunk-soar","python-requests","python-email"],"targetTypes":["api","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on automated Splunk SOAR integration for phishing incident response, not on generic phishing detection; includes concrete REST API endpoints and artifact schemas."],"familyIds":["soar-playbook-development"]},{"id":"implementing-soar-playbook-with-palo-alto-xsoar","summary":"Practical guide and templates for building automated incident response playbooks in Palo Alto Cortex XSOAR, covering phishing, malware, account compromise, and DDoS orchestration with integration commands and custom Python automation.","primaryDomain":"security-knowledge","domainTags":["soar","soc-operations","incident-response","security-orchestration","automation"],"capabilityTags":["xsoar-playbook-authoring","incident-response-automation","soc-playbook-orchestration","integration-command-wiring"],"capabilityDetails":["Provides a step-by-step workflow for authoring automated incident response playbooks in Cortex XSOAR using YAML playbook structure, tasks, and integrations.","Demonstrates phishing, malware, account compromise, and DDoS response playbook templates with enrichment, conditional verdicts, and containment actions.","Includes a custom Python automation script example for calculating risk scores within XSOAR."],"techniqueTags":["yaml-playbook-definition","conditional-branching","integration-command-invocation","sub-playbook-composition"],"techniqueDetails":["Uses XSOAR task types (regular, condition, playbook, manual, timer) to structure response workflows.","Leverages integration commands such as !o365-mail-block-sender and !pan-os-block-ip for containment.","Uses conditional tasks to branch on verdicts from DBotScore enrichment."],"tools":["Cortex XSOAR","Microsoft 365","PAN-OS","Cortex XDR","Jira","ServiceNow"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","detection","remediation","reporting"],"distinctiveFeatures":["Provides concrete XSOAR playbook YAML and templates for phishing, malware, account compromise, and DDoS response, not just generic SOAR concepts.","Combines playbook authoring guidance with integration command examples and a custom Python automation script, making it implementation-ready."],"familyIds":["soar-playbook-development"]},{"id":"implementing-stix-taxii-feed-integration","summary":"Provides a Python implementation workflow for consuming and producing STIX 2.1/TAXII 2.1 threat intelligence, including TAXII server discovery, collection polling, STIX bundle parsing, indicator extraction, and running a local TAXII server with Medallion.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","cti","ioc","stix","taxii","feed-integration","mitre-attack"],"capabilityTags":["stix-taxii-feed-integration","threat-intelligence-feed-consumer","threat-intelligence-feed-producer","stix-object-parsing","taxii-server-setup","indicator-extraction"],"capabilityDetails":["Provides a Python workflow for discovering TAXII servers, polling STIX 2.1 collections, parsing STIX bundles, extracting indicators and observables, and running a local TAXII server with Medallion."],"techniqueTags":["stix-2-1","taxii-2-1","taxii-discovery","collection-polling","stix-bundle-parsing","incremental-polling","medallion"],"techniqueDetails":["Uses taxii2client's Server and Collection classes for discovery and paginated polling.","Uses stix2 library MemoryStore and Filter queries for parsing and correlation of STIX objects.","Implements incremental polling with added_after timestamps and a custom TAXIIConsumer class.","Demonstrates pushing STIX bundles to a local Medallion TAXII collection."],"tools":["taxii2-client","stix2","medallion","requests"],"targetTypes":["api","other"],"role":"workflow","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses specifically on implementing STIX/TAXII 2.1 feed consumers and producers in Python, rather than general threat-intelligence analysis.","Covers both consuming public TAXII feeds (e.g., MITRE ATT&CK) and standing up a local TAXII server with Medallion.","Includes a custom consumer class with incremental polling and indicator extraction for SIEM/TIP integration."],"familyIds":["threat-intelligence-sharing-and-processing"]},{"id":"implementing-supply-chain-security-with-in-toto","summary":"Guides implementation of in-toto supply chain integrity for container builds, from key generation and layout definition to signed step attestation, pre-deployment verification, and Kubernetes admission control with SLSA alignment.","primaryDomain":"cloud-security","domainTags":["supply-chain-security","container-security","attestation","slsa","kubernetes"],"capabilityTags":["attestation-generation","supply-chain-verification","kubernetes-admission-control","slsa-compliance"],"capabilityDetails":["Delivers an end-to-end workflow to generate and verify in-toto attestations for container builds, including signing keys, layout policy, artifact linking, and admission-time enforcement."],"techniqueTags":["in-toto-layout","link-metadata","ed25519-signing","validating-webhook","slsa-levels"],"techniqueDetails":["Defines a signed layout of pipeline steps and functionaries, records each step as signed link metadata, and verifies artifact hashes chain across steps before deployment."],"tools":["in-toto","in-toto-run","in-toto-verify","in-toto-keygen","trivy","syft","docker","kubectl"],"targetTypes":["container","kubernetes","cloud"],"role":"specialist-playbook","workflowFocus":["validation"],"distinctiveFeatures":["Complete in-toto implementation for container builds with admission control","Maps attestations to SLSA levels","Uses in-toto CLI and Python API for layout and verification"],"familyIds":["kubernetes-policy-and-access-control"]},{"id":"implementing-syslog-centralization-with-rsyslog","summary":"Provides a concrete workflow to deploy centralized, TLS-encrypted syslog collection via rsyslog, including configuration generation, x509 authentication, per-host log segregation, and reliable queueing, with validation steps.","primaryDomain":"linux-security","domainTags":["security-operations","log-management","syslog","tls-encryption"],"capabilityTags":["syslog-configuration","tls-log-forwarding","centralized-log-collection","per-host-log-segregation"],"capabilityDetails":["Provides a workflow to generate and deploy rsyslog server and client configurations for centralized, TLS-encrypted syslog collection with per-host log segregation and reliable queueing."],"techniqueTags":["tls-encryption","x509-certificate-authentication","custom-templates","disk-assisted-queues"],"techniqueDetails":["Uses GnuTLS stream drivers with x509/name auth mode for encrypted syslog transport and client authentication; custom templates route logs to per-host directories; disk-assisted queues ensure reliable message delivery."],"tools":["rsyslog","openssl","paramiko"],"targetTypes":["linux-host","network"],"role":"specialist-playbook","workflowFocus":["validation","knowledge-reference"],"distinctiveFeatures":["Specialized for rsyslog-based log centralization with TLS encryption and x509 cert auth, per-host log segregation, and reliable queueing, unlike general log analysis or SIEM integration skills."],"familyIds":["linux-syslog-centralization"]},{"id":"implementing-taxii-server-with-opentaxii","summary":"Deploy and manage a TAXII 2.1 threat intelligence sharing server using Medallion and Docker, publish and consume STIX 2.1 bundles, and integrate indicators with SIEM/SOAR platforms.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","stix","taxii","cti","indicator-exchange"],"capabilityTags":["taxii-server-deployment","stix-bundle-management","collection-configuration","siem-integration","indicator-exchange"],"capabilityDetails":["Provides an end-to-end workflow for deploying a TAXII 2.1 threat intelligence sharing server using Medallion and Docker, configuring collections, publishing and consuming STIX 2.1 bundles, and pushing extracted indicators to SIEM/SOAR platforms."],"techniqueTags":["taxii-2.1-api","stix-2.1-modeling","docker-compose-deployment","python-client-automation"],"techniqueDetails":["Uses Medallion's JSON configuration for API roots and collections, taxii2client for authenticated REST API access, and Docker Compose for containerized server deployment."],"tools":["medallion","stix2","taxii2-client","docker","docker-compose","requests"],"targetTypes":["api","other"],"role":"specialist-playbook","workflowFocus":["knowledge-reference"],"distinctiveFeatures":["Focuses on establishing a TAXII 2.1 server and STIX 2.1 content exchange rather than offensive security operations.","Includes both server-side (Medallion/Docker) and client-side (taxii2client) Python implementations.","Demonstrates SIEM/SOAR integration by pushing extracted indicators to Splunk HEC and Elasticsearch."],"familyIds":["threat-intelligence-sharing-and-processing"]},{"id":"implementing-threat-intelligence-lifecycle-management","summary":"Provides a structured framework and Python-based implementation for standing up or maturing a threat intelligence program, covering requirement definition, multi-source collection, normalization/deduplication, analysis, dissemination, and feedback tracking.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","intelligence-lifecycle","cti-program"],"capabilityTags":["threat-intelligence-program-development","intelligence-requirements-management","collection-pipeline-design","data-normalization","intelligence-analysis","dissemination-feedback-tracking"],"capabilityDetails":["Provides a complete workflow for building a threat intelligence lifecycle, including defining intelligence requirements, building collection pipelines, normalizing and deduplicating data, producing analysis, and tracking dissemination feedback."],"techniqueTags":["six-phase-intelligence-cycle","priority-intelligence-requirements","collection-management","data-normalization","deduplication","stakeholder-feedback"],"techniqueDetails":["Uses the six-phase intelligence lifecycle (direction, collection, processing, analysis, dissemination, feedback) to structure CTI program operations.","Defines Priority Intelligence Requirements (PIRs) to drive collection planning and relevant intelligence production.","Employs data normalization and deduplication to standardize intelligence from multiple sources.","Captures stakeholder feedback to measure and refine CTI program effectiveness."],"tools":["misp","opencti","jira","servicenow","splunk","elastic","pymisp","stix2","pandas","requests"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis","reporting"],"distinctiveFeatures":["Provides a full six-phase CTI lifecycle implementation with working Python templates, rather than focusing on a single phase or tool.","Connects intelligence requirements directly to collection, analysis, and dissemination outputs, including practical PIR examples.","Includes concrete integrations with real-world data sources such as CISA KEV, AlienVault OTX, and MalwareBazaar.","Covers program performance metrics and feedback loops for continuous improvement."],"familyIds":["threat-intelligence-lifecycle-management"]},{"id":"implementing-threat-modeling-with-mitre-attack","summary":"Provides SOC teams with a step-by-step methodology to model relevant threat actors using MITRE ATT&CK, map current detection coverage, identify gaps, prioritize remediation, and validate via adversary emulation.","primaryDomain":"security-knowledge","domainTags":["soc-operations","detection-engineering","mitre-attack","threat-modeling"],"capabilityTags":["threat-modeling","detection-gap-analysis","ttp-mapping","coverage-assessment"],"capabilityDetails":["Provides a systematic workflow to map adversary TTPs using MITRE ATT&CK, compare against current detection coverage, identify gaps, and prioritize defensive investments. Includes scripts for building ATT&CK Navigator layers, performing gap analysis, and generating a structured threat model assessment report."],"techniqueTags":["mitre-attack","adversary-emulation"],"techniqueDetails":["Uses MITRE ATT&CK framework to map adversary TTPs and assess detection coverage. Employs adversary emulation via Atomic Red Team and MITRE Caldera to validate detection coverage."],"tools":["MITRE ATT&CK Navigator","Atomic Red Team","MITRE Caldera","Python","Splunk"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","reporting","remediation"],"distinctiveFeatures":["Focuses on detection coverage alignment with threat actor TTPs rather than vulnerability exploitation.","Provides executable Python and Splunk examples for creating ATT&CK Navigator layers and performing quantitative gap analysis.","Includes an adversary emulation validation step using Atomic Red Team.","Delivers a structured output report with coverage percentages and prioritized investment recommendations."],"familyIds":["mitre-attack-coverage-analysis"]},{"id":"implementing-ticketing-system-for-incidents","summary":"Provides a structured workflow for integrating SIEM alerts with incident ticketing platforms (ServiceNow, TheHive, Jira) including taxonomy definition, automated ticket creation, SLA tracking, escalation, and compliance reporting.","primaryDomain":"security-knowledge","domainTags":["incident-management","ticketing","soc-operations","sla-management"],"capabilityTags":["ticket-automation","sla-tracking","escalation-management","incident-metrics"],"capabilityDetails":["Automates creation of incident tickets from SIEM alerts into ServiceNow, TheHive, or Jira using REST APIs and Python code.","Implements SLA tracking and breach detection with severity-based response and resolution targets.","Provides auto-escalation logic for SLA breaches and multi-tier assignment routing.","Generates compliance-oriented incident metrics and SLA compliance reports using Splunk SPL queries."],"techniqueTags":["rest-api-integration","splunk-spl","incident-classification","sla-policy"],"techniqueDetails":["Uses ServiceNow REST API and TheHive API for incident creation, updates, and escalation.","Leverages Splunk SPL to compute SLA remaining time and monthly metrics.","Defines incident taxonomy with severity levels and corresponding SLA targets in YAML.","Includes Python classes for ticket management, SLA checking, and escalation."],"tools":["servicenow","thehive","jira","splunk","pagerduty"],"targetTypes":["other"],"role":"workflow","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Focuses on operational incident ticketing and SLA management rather than offensive security testing.","Provides concrete multi-platform integration code (ServiceNow, TheHive) with severity-based workflows.","Includes both automated ticket creation and periodic SLA breach monitoring logic.","Covers compliance documentation and metrics generation from ticketing data."],"familyIds":["soc-operations-playbook-design"]},{"id":"implementing-usb-device-control-policy","summary":"Implements USB device control on Windows endpoints by restricting removable media access via Group Policy, Intune, or EDR platforms, including VID/PID whitelisting and event-based auditing.","primaryDomain":"windows-security","domainTags":["endpoint-security","usb-control","device-control","removable-media","data-loss-prevention"],"capabilityTags":["usb-device-policy-implementation","removable-media-restriction","device-whitelisting","gpo-configuration","edr-device-control"],"capabilityDetails":["Provides step-by-step workflow for implementing USB device control policies on Windows endpoints using Group Policy, Intune, or EDR platforms, including inventory, configuration, and auditing."],"techniqueTags":["group-policy","intune","edr-device-control","vid-pid-whitelisting","windows-event-auditing"],"techniqueDetails":["Uses Group Policy Removable Storage Access and Device Installation Restrictions, MDE Device Control XML policies, and VID/PID matching to whitelist approved devices and block unapproved removable media. Monitors via Windows Event IDs 6416 and 4663."],"tools":["Group Policy","Microsoft Intune","Microsoft Defender for Endpoint","CrowdStrike Falcon","PowerShell","Endpoint Protector"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","remediation"],"distinctiveFeatures":["Covers GPO, Intune, and EDR deployment methods in a single workflow","Unique focus on VID/PID-based whitelisting for approved USB devices","Includes specific Windows Event ID guidance for USB monitoring"],"familyIds":["windows-endpoint-hardening"]},{"id":"implementing-velociraptor-for-ir-collection","summary":"Provides actionable guidance to deploy Velociraptor server and clients, collect forensic artifacts via VQL across Windows/Linux/macOS, run hunts, monitor endpoints, and integrate with SIEM, including concrete deployment commands and artifact queries.","primaryDomain":"forensics","domainTags":["dfir","incident-response","endpoint-collection","vql","forensic-artifacts"],"capabilityTags":["endpoint-artifact-collection","vql-querying","hunt-management","real-time-monitoring","siem-integration"],"capabilityDetails":["Provides a workflow for deploying Velociraptor and using VQL artifacts to collect forensic evidence from Windows, Linux, and macOS endpoints during incident response."],"techniqueTags":["vql","yara-scanning","sigma-rule-matching","etw-monitoring","process-monitoring","file-system-monitoring"],"techniqueDetails":["Uses VQL queries and pre-built artifacts to collect endpoint forensic data, including event logs, prefetch, registry, processes, network connections, and file system metadata."],"tools":["velociraptor"],"targetTypes":["windows-host","linux-host","other"],"role":"tool-guide","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Covers end-to-end Velociraptor deployment, client management, VQL artifact collection, hunt operations, real-time monitoring, and SIEM integration in a single tool-specific implementation guide."],"familyIds":["velociraptor-endpoint-collection-and-hunting"]},{"id":"implementing-vulnerability-management-with-greenbone","summary":"Automates Greenbone/OpenVAS vulnerability management using python-gvm and GMP, covering target and task creation, scan execution, and conversion of XML reports into structured JSON findings.","primaryDomain":"network-security","domainTags":["vulnerability-scanning","vulnerability-management","openvas","greenbone","gmp","python-gvm"],"capabilityTags":["vulnerability-scan-automation","xml-report-parsing","scan-target-creation","scan-task-management"],"capabilityDetails":["Automates creation and management of OpenVAS/GVM scan targets, tasks, and configs via the python-gvm library over the GMP protocol.","Retrieves and parses XML scan reports into actionable JSON summaries with severity distributions and per-host findings."],"techniqueTags":["gmp-protocol-usage","python-gvm-api","xml-report-processing"],"techniqueDetails":["Uses UnixSocketConnection or TLSConnection for GMP connectivity.","Parses XML reports to extract CVSS scores, CVE references, and affected hosts."],"tools":["python-gvm","greenbone","openvas"],"targetTypes":["network"],"role":"workflow","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Provides a complete programmatic workflow for Greenbone/OpenVAS using python-gvm, including connection setup, scan lifecycle management, and XML report conversion to JSON.","Focuses on operational vulnerability management automation rather than individual vulnerability exploitation or manual scanning."],"familyIds":["vulnerability-scanning-management"]},{"id":"implementing-vulnerability-remediation-sla","summary":"A practical guide to designing a vulnerability remediation SLA program, covering asset tiering, severity-based deadlines, exception handling, escalation chains, and KPI reporting.","primaryDomain":"security-knowledge","domainTags":["vulnerability-management","remediation","patch-management","security-governance"],"capabilityTags":["sla-policy-design","asset-tiering","exception-management","escalation-management","kpi-tracking"],"capabilityDetails":["Provides a structured workflow to design vulnerability remediation SLAs, including asset tiering, severity-based response timeframes, exception and escalation processes, and KPI tracking."],"techniqueTags":["severity-classification","asset-tiering","sla-matrix","exception-process","kpi-definition"],"techniqueDetails":["Uses CVSS scores combined with threat context (EPSS, CISA KEV) to determine remediation timeframes, and defines asset tiers to differentiate response SLAs."],"tools":["jira","servicenow"],"targetTypes":["other"],"role":"workflow","workflowFocus":["remediation","reporting"],"distinctiveFeatures":["Focuses on the organizational governance of vulnerability remediation rather than technical exploitation, providing a complete SLA framework with matrix, escalations, exceptions, and metrics."],"familyIds":["soc-operations-playbook-design"]},{"id":"implementing-vulnerability-sla-breach-alerting","summary":"A workflow-driven guide for implementing an automated vulnerability SLA breach alerting system, including database schema, breach detection, multi-channel notification dispatch, scheduled checks, and compliance metrics.","primaryDomain":"security-knowledge","domainTags":["vulnerability-management","sla-tracking","alerting","compliance","remediation-tracking"],"capabilityTags":["sla-breach-detection","notification-dispatch","compliance-metrics","scheduled-checks","escalation-automation"],"capabilityDetails":["Provides a complete implementation workflow for building an automated SLA breach alerting system for vulnerability remediation, including database schema, breach detection logic, multi-channel notifications, scheduled checks, and compliance metrics."],"techniqueTags":["sla-policy-calculation","breach-status-detection","multi-channel-notification","cron-scheduling","kpi-calculation"],"techniqueDetails":["Uses severity-based SLA tiers with CVSS thresholds to compute deadlines and detect approaching or breached statuses.","Implements email, Slack, and PagerDuty notifications triggered by SLA status transitions.","Leverages cron for periodic automated checks and Python for metrics aggregation."],"tools":["python","sql","cron","slack","pagerduty","smtp"],"targetTypes":["other"],"role":"workflow","workflowFocus":["detection","analysis","reporting","remediation"],"distinctiveFeatures":["Focuses specifically on implementing an automated SLA breach alerting system rather than general vulnerability management or manual compliance reporting.","Provides copy-paste-ready Python code, SQL schema, and YAML configuration for immediate deployment.","Covers multi-channel escalation (email, Slack, PagerDuty) and compliance metric calculations in a single workflow."],"familyIds":["soc-operations-playbook-design"]},{"id":"implementing-web-application-logging-with-modsecurity","summary":"Operational playbook for configuring ModSecurity WAF with OWASP CRS to enable audit logging, tune false positives through paranoia levels and rule exclusions, and forward logs to a SIEM.","primaryDomain":"web-security","domainTags":["modsecurity","waf","crs","owasp","audit-logging"],"capabilityTags":["modsecurity-configuration","waf-audit-logging","crs-tuning","false-positive-reduction","custom-secrules"],"capabilityDetails":["Provides a step-by-step workflow for deploying and tuning ModSecurity with OWASP CRS for audit logging, including configuring SecRuleEngine, SecAuditEngine, CRS paranoia levels, and writing custom SecRules."],"techniqueTags":["detectiononly-mode","paranoia-levels","rule-exclusions","audit-engine-configuration"],"techniqueDetails":["Uses DetectionOnly mode to observe attacks without blocking, adjusts paranoia levels to balance protection and false positives, and applies SecRuleRemoveById for targeted exclusions."],"tools":["modsecurity","owasp-crs","apache","nginx"],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on WAF logging and rule tuning rather than direct vulnerability exploitation, with detailed attention to false-positive reduction and SIEM log forwarding."],"familyIds":["web-application-defense-and-detection"]},{"id":"implementing-zero-knowledge-proof-for-authentication","summary":"Implements Schnorr identification protocol and a simplified Zero-Knowledge Password Proof for authentication, enabling a server to verify a user's secret without ever learning or storing it. Includes non-interactive Fiat-Shamir variant and validation criteria for completeness, soundness, and zero-knowledge.","primaryDomain":"authentication","domainTags":["zero-knowledge-proof","cryptography","schnorr-protocol","discrete-logarithm"],"capabilityTags":["zero-knowledge-proof-implementation","schnorr-identification-protocol","zkpp-implementation","fiat-shamir-non-interactive-proof"],"capabilityDetails":["Implements Schnorr identification protocol for zero-knowledge authentication.","Builds non-interactive ZKP using Fiat-Shamir heuristic.","Implements a simplified Zero-Knowledge Password Proof (ZKPP) over discrete logarithm.","Demonstrates completeness, soundness, and zero-knowledge properties."],"techniqueTags":["schnorr-identification","fiat-shamir-heuristic","zero-knowledge-password-proof","discrete-logarithm-protocol"],"techniqueDetails":["Uses commitment-challenge-response to prove knowledge of secret without revealing it.","Applies Fiat-Shamir to make the protocol non-interactive.","Uses DLP for ZKPP where server verifies without storing secret."],"tools":["python3"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","validation"],"distinctiveFeatures":["Provides executable Python implementations of Schnorr identification and ZKPP, not just theory.","Focuses on password-less / secret-free authentication where server never learns the secret.","Includes non-interactive Fiat-Shamir variant for offline verification."],"familyIds":["cryptographic-authentication-implementation"]},{"id":"implementing-zero-standing-privilege-with-cyberark","summary":"Practical guide for eliminating standing cloud privileges by deploying CyberArk Secure Cloud Access, covering multi-cloud integration, TEA policy configuration, approval workflows, and a phased migration strategy.","primaryDomain":"cloud-security","domainTags":["zero-standing-privilege","jit-access","pam","cloud-iam"],"capabilityTags":["zero-standing-privilege-implementation","cyberark-sca-configuration","jit-access-policy-design","cloud-role-ephemeral-provisioning"],"capabilityDetails":["Provides a step-by-step implementation workflow for eliminating standing privileges using CyberArk SCA, including cloud provider integration, TEA policy definition, approval workflows, session monitoring, and phased migration."],"techniqueTags":["tea-framework","ephemeral-role-provisioning","approval-workflow","session-monitoring"],"techniqueDetails":["Uses the TEA framework (Time, Entitlements, Approvals) to govern just-in-time privileged access.","Creates ephemeral cloud roles that are destroyed after session expiry.","Integrates with ITSM tools for approval workflows.","Enables session recording and real-time monitoring."],"tools":["cyberark-sca","cyberark-privilege-cloud","aws-iam","azure-entra-id","gcp-iam","service-now","jira"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Focuses specifically on implementing zero standing privilege with CyberArk SCA and the TEA framework across AWS, Azure, and GCP, including detailed policy examples and a phased migration plan."],"familyIds":["identity-secrets-and-privileged-access-management"]},{"id":"implementing-zero-trust-dns-with-nextdns","summary":"Provides a practical workflow to deploy NextDNS as an encrypted zero trust DNS resolver, including threat blocking, privacy controls, endpoint/router configuration, and integration with Windows 11 Zero Trust DNS.","primaryDomain":"network-security","domainTags":["dns-security","zero-trust","encrypted-dns"],"capabilityTags":["dns-threat-blocking","dns-policy-enforcement","zero-trust-dns-deployment"],"capabilityDetails":["Provides step-by-step configuration of NextDNS as an encrypted DNS resolver to block malicious domains and enforce acceptable use policies."],"techniqueTags":["dns-over-https","dns-over-tls","dns-rebinding-protection","cname-cloaking-detection"],"techniqueDetails":["Configures DoH/DoT for encrypted DNS resolution.","Implements DNS rebinding and CNAME cloaking protections."],"tools":["NextDNS","NextDNS CLI","systemd-resolved","curl"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["remediation","analysis"],"distinctiveFeatures":["Focuses specifically on NextDNS and Microsoft Zero Trust DNS integration rather than generic DNS filtering.","Covers endpoint, router, and mobile deployment configurations for DoH/DoT.","Provides a tiered Zero Trust DNS policy framework for security, privacy, and compliance."],"familyIds":["zero-trust-dns"]},{"id":"implementing-zero-trust-for-saas-applications","summary":"Provides a step-by-step workflow to implement zero trust security controls for SaaS applications by federating SSO through an IdP, enforcing conditional access with MFA and device compliance, deploying CASB for shadow IT discovery and DLP session controls, governing OAuth consent grants, and auditing SaaS security posture via SSPM.","primaryDomain":"cloud-security","domainTags":["zero-trust","saas-security","casb","sspm","conditional-access","oauth-governance","session-controls"],"capabilityTags":["zero-trust-implementation","saas-security-hardening","shadow-it-discovery","oauth-consent-governance","saas-posture-management"],"capabilityDetails":["Provides an operational workflow to secure SaaS applications through identity federation, conditional access, CASB, OAuth governance, and SSPM."],"techniqueTags":["saml-sso-federation","conditional-access-policies","casb-api-integration","oauth-permission-review","sspm-auditing"],"techniqueDetails":["Uses Entra ID conditional access policies, Defender for Cloud Apps discovery/session policies, OAuth consent grant review, and SaaS security posture checks."],"tools":["Microsoft Defender for Cloud Apps","Microsoft Entra ID","Netskope CASB","Okta Identity Governance","AppOmni","Adaptive Shield","Valence Security"],"targetTypes":["cloud","web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on zero trust security for SaaS applications, integrating CASB, conditional access, OAuth governance, and SSPM rather than general cloud security or IAM hardening."],"familyIds":["zero-trust-implementation"]},{"id":"implementing-zero-trust-in-cloud","summary":"Guides implementation of zero trust architecture across AWS, Azure, and GCP with identity-aware proxy deployment, micro-segmentation, device trust, and continuous verification, providing concrete configuration examples and an assessment report template.","primaryDomain":"cloud-security","domainTags":["zero-trust","identity-aware-proxy","micro-segmentation","continuous-verification"],"capabilityTags":["zero-trust-architecture-design","iap-deployment","micro-segmentation-enforcement","device-trust-assessment","continuous-verification-implementation"],"capabilityDetails":["Provides a step-by-step workflow for implementing zero trust architecture across AWS, Azure, and GCP, including identity-aware proxy deployment, micro-segmentation, device trust assessment, and continuous verification."],"techniqueTags":["nist-sp-800-207","beyondcorp","identity-centric-access","device-posture-assessment"],"techniqueDetails":["Uses NIST SP 800-207 principles and Google BeyondCorp model to replace perimeter-based security with identity-centric access decisions, enforcing continuous verification and micro-segmentation."],"tools":["gcloud","aws-cli","azure-conditional-access","beyondcorp-enterprise","aws-verified-access"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["analysis","remediation","knowledge-reference"],"distinctiveFeatures":["Focuses specifically on multi-cloud zero trust implementation with concrete configuration commands for GCP IAP, AWS Verified Access, and Azure Conditional Access, including a maturity assessment report template."],"familyIds":["zero-trust-implementation"]},{"id":"implementing-zero-trust-network-access","summary":"Practical multi-cloud playbook for replacing VPN-based remote access with Zero Trust Network Access: configures GCP IAP, AWS Verified Access, and Azure Conditional Access/Private Link, plus micro-segmentation and continuous verification, with phased migration and reporting template.","primaryDomain":"cloud-security","domainTags":["cloud-security","zero-trust","ztna","beyondcorp","identity-aware-proxy","micro-segmentation"],"capabilityTags":["zero-trust-network-access-implementation","vpn-replacement","identity-aware-proxy-configuration","conditional-access-policy-configuration","micro-segmentation-configuration","continuous-verification-setup"],"capabilityDetails":["Provides step-by-step workflows for implementing ZTNA in GCP, AWS, and Azure, including identity-aware proxy deployment, conditional access policies, micro-segmentation, and continuous verification."],"techniqueTags":["identity-aware-proxy","micro-segmentation","conditional-access","private-link","network-policy","continuous-verification"],"techniqueDetails":["Uses identity-aware proxies (GCP IAP, AWS Verified Access) to enforce identity-based access before reaching applications.","Implements micro-segmentation via cloud security groups and Kubernetes NetworkPolicies to limit lateral movement.","Enforces conditional access with MFA, device compliance, and sign-in frequency controls.","Leverages private DNS and Private Link endpoints to keep cloud workloads off the public internet."],"tools":["gcloud","aws","az","kubectl","Microsoft Graph PowerShell","Microsoft Entra ID","Microsoft Intune","Cloudflare Access","Zscaler ZPA"],"targetTypes":["cloud","network","web-application","api"],"role":"specialist-playbook","workflowFocus":["remediation","reporting"],"distinctiveFeatures":["Multi-cloud coverage across AWS, Azure, and GCP in a single playbook","Includes micro-segmentation implementation alongside identity-aware proxy configuration","Provides continuous verification setup with session sign-in frequency controls","Includes a phased migration plan from VPN to ZTNA with a structured implementation report template"],"familyIds":["zero-trust-implementation"]},{"id":"implementing-zero-trust-network-access-with-zscaler","summary":"Configures Zero Trust Network Access using Zscaler Private Access (ZPA), covering IdP integration, App Connector deployment, application segmentation, policy configuration, and client deployment to replace legacy VPN.","primaryDomain":"network-security","domainTags":["zero-trust-network-access","vpn-replacement","network-access-control"],"capabilityTags":["zpa-deployment","identity-provider-integration","application-segmentation","access-policy-configuration","client-connector-deployment"],"capabilityDetails":["Provides a step-by-step workflow for configuring Zscaler Private Access (ZPA) to implement Zero Trust Network Access, including IdP integration, App Connector deployment, application segmentation, policy enforcement, and client deployment."],"techniqueTags":["identity-based-access","context-aware-policy","device-posture-check","outbound-only-tunnel"],"techniqueDetails":["Uses outbound-only TLS tunnels between Client Connector and App Connector via the Zscaler Zero Trust Exchange, with policy evaluation based on user identity, device posture, and contextual signals."],"tools":["zscaler-private-access","zpa-admin-portal","zpa-app-connector","zpa-client-connector"],"targetTypes":["network","cloud","web-application","api"],"role":"specialist-playbook","workflowFocus":["analysis","validation","remediation"],"distinctiveFeatures":["Vendor-specific ZTNA deployment guide for Zscaler Private Access, not generic zero-trust methodology","Emphasizes outbound-only TLS tunnels to eliminate traditional VPN attack surface","Covers full lifecycle from IdP integration and App Connector deployment to policy configuration and client deployment","Includes validation checklist and monitoring integration with SIEM for iterative refinement"],"familyIds":["zero-trust-network-access-deployment"]},{"id":"implementing-zero-trust-with-beyondcorp","summary":"Provides a structured workflow for deploying Google BeyondCorp Enterprise Zero Trust by configuring Identity-Aware Proxy (IAP), Access Context Manager access levels, and policy binding, plus auditing compliance and generating coverage reports for GCP web applications.","primaryDomain":"cloud-security","domainTags":["zero-trust","google-cloud","identity-aware-proxy","access-context-manager"],"capabilityTags":["zero-trust-implementation","iap-configuration","access-policy-management","policy-auditing"],"capabilityDetails":["Provides a structured workflow for configuring Google BeyondCorp Identity-Aware Proxy (IAP), defining Access Context Manager access levels, binding them to resources, and auditing policy compliance."],"techniqueTags":["identity-based-access","context-aware-access","device-posture-assessment"],"techniqueDetails":["Uses user identity and device posture as primary access decisions instead of network location; defines access levels based on device OS, encryption, IP ranges, and geography."],"tools":["google-cloud-iap","access-context-manager","endpoint-verification"],"targetTypes":["web-application","api","cloud"],"role":"specialist-playbook","workflowFocus":["validation","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on Google Cloud BeyondCorp Enterprise and IAP configuration, not general zero-trust methodology.","Includes compliance auditing and JSON reporting of access policy coverage."],"familyIds":["zero-trust-implementation"]},{"id":"implementing-zero-trust-with-hashicorp-boundary","summary":"Provides a step-by-step guide to deploying HashiCorp Boundary as an identity-aware proxy for zero-trust infrastructure access, covering controller/worker setup, Vault credential brokering, OIDC authentication, RBAC, session recording, and Terraform-managed configuration.","primaryDomain":"network-security","domainTags":["zero-trust","identity-aware-proxy","vault-integration","session-recording","privileged-access-management"],"capabilityTags":["boundary-deployment","controller-worker-configuration","vault-credential-brokering","oidc-authentication","role-based-access-control","session-recording-setup"],"capabilityDetails":["Provides a complete workflow for deploying HashiCorp Boundary as a default-deny, identity-aware proxy, including controller/worker installation, Terraform-based infrastructure configuration, Vault credential brokering, OIDC/LDAP authentication integration, RBAC policy definition, and session recording for audit compliance."],"techniqueTags":["default-deny-access","just-in-time-access","credential-injection","dynamic-credential-brokering","identity-aware-proxy"],"techniqueDetails":["Implements zero trust by enforcing default-deny access to resources, brokering credentials via Vault so users never see secrets, and using identity-aware proxying with session time limits and recording."],"tools":["boundary","vault","terraform","postgresql","asciinema"],"targetTypes":["network","linux-host","windows-host","database","web-application","api","kubernetes","cloud"],"role":"tool-guide","workflowFocus":["remediation","knowledge-reference"],"distinctiveFeatures":["Specialized as a concrete implementation guide for HashiCorp Boundary, distinct from general zero-trust methodology; includes production-grade Terraform configs, Vault credential brokering, session recording, and multi-hop worker deployment."],"familyIds":["zero-trust-network-access-deployment"]},{"id":"injection-checking","summary":"Router skill for injection testing that classifies injection type by input sink and directs users to the appropriate interpreter-specific playbook (XSS, SQLi, SSRF, XXE, SSTI, CMDi, NoSQL, etc.).","primaryDomain":"injection","domainTags":["injection","input-validation"],"capabilityTags":["injection-routing","vulnerability-classification","sink-identification"],"capabilityDetails":["Routes injection-class findings to the appropriate interpreter-specific skill based on the final input sink."],"techniqueTags":["input-sink-mapping","interpreter-identification"],"techniqueDetails":["Classifies injection type by determining which dangerous interpreter or execution environment consumes attacker-controlled input."],"tools":[],"targetTypes":["web-application","api","database"],"role":"router","workflowFocus":["navigation","knowledge-reference"],"distinctiveFeatures":["Functions as a pure routing skill that maps attacker-controlled input sinks to dedicated injection playbooks, rather than performing actual injection testing itself."],"familyIds":["injection-triage-router"]},{"id":"insecure-source-code-management","summary":"Provides targeted detection and recovery techniques for exposed version-control metadata (.git, .svn, .hg, .bzr), backup files, and config artifacts, including tooling to reconstruct source from partial VCS dumps.","primaryDomain":"source-code-security","domainTags":["source-code-exposure","vcs-metadata-leak","backup-artifact-exposure","web-misconfiguration"],"capabilityTags":["vcs-exposure-detection","source-code-recovery","backup-leak-detection","git-metadata-dump","svn-recovery"],"capabilityDetails":["Provides a workflow for detecting exposed version-control metadata (.git, .svn, .hg, .bzr), backup archives, and config artifacts, and recovering source code from partial VCS dumps using specialized open-source tools."],"techniqueTags":["http-probing","status-code-analysis","git-object-reconstruction","svn-sqlite-analysis","ds-store-parsing"],"techniqueDetails":["Uses direct HTTP GET/HEAD probes of sensitive paths, interprets 403 vs 404 responses to infer hidden directory existence, reconstructs Git objects from partial metadata dumps, parses SVN working-copy databases (wc.db), and parses .DS_Store files for directory listings."],"tools":["git-dumper","GitTools","GitHacker","svn-extractor","mercurial_source_code_dumper","ds-store","ds_store_exp","sqlite3"],"targetTypes":["web-application","source-code"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Dedicated to VCS and backup artifact exposure rather than general web vulnerability scanning","Provides a decision tree that distinguishes 403 from 404 to infer hidden route existence and triggers file-by-file recovery","Covers multiple VCS systems (Git, SVN, Mercurial, Bazaar) with specific recovery tooling for each"],"familyIds":["version-control-exposure-recovery"]},{"id":"integrating-dast-with-owasp-zap-in-pipeline","summary":"Provides ready-to-use OWASP ZAP DAST integration for GitHub Actions and local Docker Compose, enabling automated baseline, full, and OpenAPI-driven API scans in CI/CD, with scan rule tuning and quality gates.","primaryDomain":"web-security","domainTags":["dast","ci-cd","web-application-security"],"capabilityTags":["dast-scanning","zap-baseline-scan","zap-full-scan","zap-api-scan","scan-rule-configuration"],"capabilityDetails":["Provides step-by-step configuration for integrating OWASP ZAP dynamic application security testing (DAST) into GitHub Actions and Docker Compose environments, including baseline, full, and API scans, with custom rule tuning and quality gate enforcement."],"techniqueTags":["passive-scanning","active-scanning","spidering","openapi-based-api-scanning"],"techniqueDetails":["Uses passive scanning for quick baseline checks, active scanning with attack payloads for comprehensive coverage, and OpenAPI specification-driven scanning for API endpoint testing."],"tools":["owasp-zap","zaproxy/action-baseline","zaproxy/action-full-scan","zaproxy/action-api-scan","docker-compose"],"targetTypes":["web-application","api"],"role":"workflow","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Provides reusable GitHub Actions workflow jobs for ZAP baseline, full, and API scans","Includes a .zap/rules.tsv policy file that maps ZAP rule IDs to FAIL/WARN/IGNORE actions for quality gates","Covers both CI/CD pipeline integration and local Docker Compose ZAP execution","Addresses staging pipeline integration and common pitfalls such as scan duration and WAF blocking"],"familyIds":["automated-web-vulnerability-scanning"]},{"id":"integrating-sast-into-github-actions-pipeline","summary":"Provides a GitHub Actions-based workflow to integrate CodeQL and Semgrep SAST scanning, with SARIF upload, false-positive tuning, and branch protection quality gates for compliance and secure SDLC.","primaryDomain":"source-code-security","domainTags":["sast","code-scanning","github-actions","ci-cd"],"capabilityTags":["sast-pipeline-integration","codeql-configuration","semgrep-configuration","false-positive-tuning","quality-gate-enforcement","sarif-reporting"],"capabilityDetails":["Integrates CodeQL and Semgrep into GitHub Actions for automated source code vulnerability scanning.","Covers configuring scan triggers, uploading SARIF results to GitHub Advanced Security.","Provides methods for suppressing false positives and blocking PR merges on high-severity findings."],"techniqueTags":["codeql-semantic-analysis","semgrep-pattern-matching","sarif-upload","branch-protection-api","ignore-annotations","security-dashboard"],"techniqueDetails":["Uses CodeQL's query-based engine to treat code as data.","Uses Semgrep's lightweight pattern matching with custom rules.","Exports SARIF JSON output for unified GitHub Security tab.","Configures branch protection via GitHub CLI to require scan checks pass.","Suppresses false positives with CodeQL excludes and nosemgrep comments."],"tools":["codeql","semgrep","github-actions","github-cli","github-advanced-security","sarif"],"targetTypes":["source-code"],"role":"workflow","workflowFocus":["detection","analysis","reporting","remediation"],"distinctiveFeatures":["Dual-tool SAST integration (CodeQL+Semgrep) rather than a single scanner methodology.","Includes compliance-driven rationale (SOC 2/PCI DSS/NIST SSDF evidence) for automated scanning.","Specific workflow steps for custom Semgrep rule development and false-positive triage processes.","Uses GitHub branch protection and SARIF upload to enforce quality gates directly in the PR flow."],"familyIds":["ci-cd-security-scanning-integration"]},{"id":"intercepting-mobile-traffic-with-burpsuite","summary":"A practical playbook for intercepting and analyzing mobile app HTTP/HTTPS traffic using Burp Suite, covering Android/iOS proxy setup, CA certificate installation including Android 7+ constraints, traffic analysis for API security issues, and certificate pinning bypass with Frida/Objection.","primaryDomain":"mobile-security","domainTags":["mobile-security","api-security","traffic-analysis"],"capabilityTags":["mobile-traffic-interception","burp-suite-proxy","certificate-pinning-bypass","api-security-testing"],"capabilityDetails":["Provides a step-by-step workflow to configure Burp Suite as a proxy for Android/iOS devices, install Burp CA certificates including Android 7+ trust changes, intercept HTTP/HTTPS traffic from mobile apps, and analyze API communications for vulnerabilities."],"techniqueTags":["man-in-the-middle-proxy","tls-interception","certificate-pinning-bypass","frida-instrumentation","proxy-configuration"],"techniqueDetails":["Uses Burp Suite proxy listeners and device proxy settings to capture mobile traffic.","Includes techniques for installing CA certificates on modern Android using system CA installation, network security config, or Magisk.","Uses Frida and Objection to bypass SSL certificate pinning."],"tools":["burp-suite","frida","objection","mitmproxy","charles-proxy"],"targetTypes":["mobile","api","web-application"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation"],"distinctiveFeatures":["Focuses specifically on mobile app traffic interception and analysis with Burp Suite, including platform-specific Android/iOS proxy and certificate trust setup and certificate pinning bypass methods, rather than general web application scanning."],"familyIds":["mobile-network-traffic-interception-and-pinning-bypass"]},{"id":"investigating-insider-threat-indicators","summary":"Structured insider threat investigation playbook that correlates SIEM, DLP, UEBA, physical access, and HR data to detect data exfiltration, unauthorized access, and pre-departure risk, with evidence preservation and reporting.","primaryDomain":"forensics","domainTags":["insider-threat","data-exfiltration","dlp","ueba","hr-correlation"],"capabilityTags":["insider-threat-investigation","data-exfiltration-analysis","access-pattern-analysis","evidence-preservation"],"capabilityDetails":["Provides a multi-step workflow to investigate insider threat indicators from HR referrals and security alerts.","Includes Splunk SPL queries to analyze bulk downloads, USB usage, email exfiltration, and cloud uploads.","Correlates SIEM activity with HR timelines and physical access data.","Describes evidence preservation with chain of custody documentation and SHA-256 hashing."],"techniqueTags":["splunk-spl","ueba-anomaly-detection","timeline-analysis","hr-correlation","evidence-hashing"],"techniqueDetails":["Uses Splunk SPL queries to search DLP, endpoint, proxy, email, and cloud logs.","Applies UEBA-style normal/off-hours/peer baseline comparisons to flag anomalies.","Builds activity timelines and phases (normal, notice period, transition).","Correlates employee HR records with system access and physical badge events.","Hashes evidence artifacts and logs chain of custody in a JSON manifest."],"tools":["Splunk","Microsoft Purview","Forcepoint Insider Threat","DTEX InTERCEPT","Code42 Incydr"],"targetTypes":["windows-host","cloud","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Integrates legal authorization and HR data correlation into a technical investigation workflow, unlike general SIEM hunting playbooks.","Provides concrete SPL queries for every indicator category (downloads, USB, email, cloud, after-hours) and includes evidence chain-of-custody preservation."],"familyIds":["threat-specific-forensic-investigations"]},{"id":"investigating-phishing-email-incident","summary":"Provides a complete operational playbook for investigating and containing phishing email incidents, covering header analysis, payload detonation, campaign scoping, impacted user identification, and remediation using SOC tools.","primaryDomain":"forensics","domainTags":["phishing","email-security","incident-response","soc-operations"],"capabilityTags":["email-header-analysis","url-reputation-analysis","attachment-sandboxing","campaign-scope-identification","impacted-user-identification","email-containment"],"capabilityDetails":["Provides an end-to-end phishing email investigation workflow from user report to containment.","Includes techniques for analyzing email headers to verify SPF, DKIM, and DMARC.","Uses URL scanning and sandbox detonation to validate malicious links and attachments.","Leverages SIEM and Microsoft Graph queries to determine campaign recipients and impacted users.","Provides containment actions including email purge, indicator blocking, and password resets."],"techniqueTags":["spf-dkim-dmarc-analysis","url-scanning","attachment-detonation","proxy-log-analysis","threat-intelligence-lookup"],"techniqueDetails":["Uses the Authentication-Results header to evaluate SPF, DKIM, and DMARC alignment.","Queries URLScan.io and VirusTotal to assess URL reputation.","Submits attachments to Any.Run or Joe Sandbox for dynamic behavior analysis.","Uses Splunk SPL to search email trace and proxy logs for campaign scope and impact.","Calculates MD5 and SHA256 hashes for attachment IOCs and queries MalwareBazaar."],"tools":["Splunk","Microsoft Defender for Office 365","URLScan.io","Any.Run","VirusTotal","MalwareBazaar","Microsoft Graph API","PhishTool","Proofpoint TAP"],"targetTypes":["cloud","web-application","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","remediation","reporting"],"distinctiveFeatures":["End-to-end phishing incident investigation from initial report to containment, not just URL analysis","Combines email header authentication analysis with SIEM log correlation for campaign scoping","Provides concrete containment actions including email purge and Azure AD credential revocation","Covers multiple phishing scenarios (credential harvesting, macro payloads, quishing, thread hijacking)"],"familyIds":["threat-specific-forensic-investigations"]},{"id":"investigating-ransomware-attack-artifacts","summary":"A forensic incident-response playbook for ransomware events, guiding evidence preservation, variant identification, attack timeline reconstruction, initial access tracing, encryption scope and recovery assessment, and report generation.","primaryDomain":"forensics","domainTags":["digital-forensics","incident-response","ransomware-analysis"],"capabilityTags":["ransomware-variant-identification","evidence-preservation","attack-timeline-reconstruction","initial-access-tracing","encryption-scope-assessment","recovery-option-assessment"],"capabilityDetails":["Provides a structured workflow for preserving memory and disk evidence, identifying ransomware families from encrypted file extensions/ransom notes/samples, reconstructing attack timelines from event logs and Prefetch, tracing initial access vectors, assessing encryption scope and recovery options, and generating detailed investigation reports."],"techniqueTags":["memory-forensics","event-log-analysis","prefetch-analysis","ransom-note-parsing","timeline-analysis","yara-scanning"],"techniqueDetails":["Uses Volatility yarascan to search for AES/RSA key material in memory dumps.","Parses Security.evtx for authentication and process events (4624, 4625, 4648, 4688) to detect RDP brute force and lateral movement.","Inspects Prefetch for ransomware executables and vssadmin/wmic artifacts.","Extracts Bitcoin addresses, Tor URLs, and contact emails from ransom notes.","Uses file extension mapping (e.g., .lockbit, .blackcat) to identify known ransomware families."],"tools":["ID Ransomware","No More Ransom","Volatility","Chainsaw","Hayabusa","PECmd","YARA","Any.Run","Joe Sandbox","Capa"],"targetTypes":["windows-host","linux-host","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting","remediation"],"distinctiveFeatures":["Combines ransomware variant identification, memory key recovery, and recovery option assessment into a single forensic IR playbook; focuses on ransomware-specific artifacts (ransom notes, encrypted file samples, volume shadow copy deletion) and integrates ID Ransomware, Volatility, and Chainsaw/Hayabusa into a prescriptive workflow."],"familyIds":["threat-specific-forensic-investigations"]},{"id":"ios-pentesting-tricks","summary":"Practical iOS pentesting playbook covering keychain extraction, URL scheme and Universal Links hijacking, Frida/Objection runtime manipulation, binary protection checks, data storage inspection, and ATS bypass, with a decision tree for jailbroken and non-jailbroken devices.","primaryDomain":"mobile-security","domainTags":["ios","keychain-security","url-handling","runtime-analysis","data-security","transport-security","binary-protections"],"capabilityTags":["keychain-extraction","url-scheme-hijacking","universal-links-exploitation","runtime-manipulation","binary-protection-analysis","data-storage-analysis","transport-security-bypass","jailbreak-detection-bypass"],"capabilityDetails":["Extracts and assesses keychain items with awareness of iOS keychain protection classes and their risk levels.","Identifies and exploits custom URL scheme hijacking, including OAuth callback and deep link interception.","Validates Universal Links AASA file misconfigurations and forces fallback to hijackable URL schemes.","Performs runtime manipulation via Frida, Objection, and Cycript to bypass authentication, jailbreak detection, and SSL pinning.","Analyzes iOS binary protections such as PIE, ARC, stack canaries, and encryption, and decrypts IPAs for static analysis.","Inspects sensitive data storage locations including NSUserDefaults, SQLite, cookies, cache, screenshots, keyboard cache, and pasteboard.","Assesses App Transport Security (ATS) exceptions for insecure HTTP loads and weak TLS configurations."],"techniqueTags":["frida-hooking","objection-commands","cycript-hooking","class-dump-analysis","keychain-dumper","ipa-decryption","aasa-analysis","info-plist-inspection","backup-extraction","otool-analysis"],"techniqueDetails":["Uses Frida Interceptor to hook Objective-C methods and modify return values at runtime.","Uses Objection commands for keychain dump, cookie extraction, jailbreak detection bypass, SSL pinning bypass, and method hooking.","Uses Cycript for UI hierarchy exploration, view controller discovery, and direct method invocation.","Uses class-dump to recover Objective-C class headers and grep for sensitive strings.","Uses otool to inspect binary protection flags: PIE, ARC, stack canaries, and encryption cryptid.","Checks Apple-App-Site-Association files for wildcard paths, incorrect content type, and other misconfigurations.","Employs keychain-dumper, frida-ios-dump, and bagbak for keychain access and IPA decryption."],"tools":["frida","objection","cycript","class-dump","keychain-dumper","frida-ios-dump","bagbak","otool","ideviceinstaller","ios-deploy","plutil","sqlite3","curl","jq"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection","exploitation"],"distinctiveFeatures":["Provides a decision tree that orients testers based on jailbroken vs non-jailbroken device, then branches into keychain, URL schemes, Universal Links, runtime, binary, storage, and ATS checks.","Bundles concrete Frida/Objection/Cycript snippets with binary hardening checks and AASA misconfiguration identification, covering both dynamic and static iOS testing in a single playbook."],"familyIds":["mobile-app-penetration-testing"]},{"id":"java-audit-skill","summary":"AI驱动的Java/前端代码安全审计技能，实现系统化、高覆盖率的漏洞挖掘。使用场景： (1) 审计Java/Kotlin项目寻找安全漏洞（0day挖掘、代码审计、安全评估） (2) 审计前端项目（JavaScript/TypeScript/React/Vue）寻找安全漏洞 (3) 企业级代码库的安全审计（支持大型项目） (4) 需要高质量、低幻觉率的安全审计报告 (5) CI/CD集成的前期漏洞发现 触发关键词：Java审计、代码审计、安全审计、漏洞挖掘、0day、安全评估、前端审计、React审计、Vue审计、Java security audit、code review for security","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"jndi-injection","summary":"Expert playbook for detecting and exploiting JNDI injection in Java applications, including Log4Shell, with complete coverage of RMI/LDAP/DNS vectors, JDK version constraints, post-8u191 bypasses via serialized gadgets and BeanFactory EL, WAF obfuscation, and tooling such as marshalsec and ysoserial.","primaryDomain":"injection","domainTags":["jndi-injection","log4shell","java-security"],"capabilityTags":["jndi-injection-testing","log4shell-assessment","waf-bypass","out-of-band-callback-detection","rmi-ldap-exploitation"],"capabilityDetails":["Provides an expert workflow for detecting and exploiting JNDI injection vulnerabilities in Java applications, including Log4Shell (CVE-2021-44228).","Covers validation via DNS/LDAP out-of-band callbacks and exploitation via RMI/LDAP reference servers, with JDK-version-aware bypass techniques.","Includes WAF bypass variants and split-log attack techniques for Log4j2 lookups."],"techniqueTags":["jndi-lookup-injection","ldap-codebase-loading","rmi-reference-loading","dns-callback-confirmation","serialized-gadget-chain","beanfactory-el-injection","log4j-lookup-evaluation"],"techniqueDetails":["Uses attacker-controlled JNDI names reaching InitialContext.lookup() to load remote classes or deserialize malicious objects.","Exploits Log4j2 ${jndi:...} lookup syntax with nested expressions and lookups for obfuscation.","Applies JDK version constraints: direct RMI/LDAP class loading before 8u121/8u191, and post-8u191 bypass via LDAP serialized objects or BeanFactory + EL injection.","Employs tools like marshalsec, JNDI-Injection-Exploit, RogueJndi, and ysoserial for server setup and payload delivery."],"tools":["marshalsec","JNDI-Injection-Exploit","RogueJndi","ysoserial"],"targetTypes":["web-application","database","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on JNDI injection as a distinct attack surface, not general deserialization.","Provides a detailed JDK version constraint matrix (RMI vs LDAP vs serialized gadgets) and post-8u191 bypass techniques.","Includes Log4Shell-specific WAF bypass variants, split-log attacks, and a broad list of JNDI sinks beyond Log4j (Spring, Solr, Druid, vCenter, H2, Fastjson)."],"familyIds":["jndi-injection"]},{"id":"jwt-oauth-token-attacks","summary":"Advanced playbook for attacking JWT and OAuth 2.0 tokens, covering signature algorithm bypasses, key confusion, secret cracking, header injection, OAuth CSRF and redirect URI bypass, implicit flow token theft, and token leakage detection.","primaryDomain":"authentication","domainTags":["web-security","api-security","token-security"],"capabilityTags":["jwt-attack","oauth-attack","token-forgery","signature-bypass","token-theft","scope-escalation"],"capabilityDetails":["Provides a comprehensive playbook for attacking JWT and OAuth 2.0 tokens, including cryptographic signature bypasses, algorithm confusion, secret cracking, header injection, OAuth flow abuse, and token leakage discovery."],"techniqueTags":["alg-none-injection","rs256-hs256-confusion","jwt-secret-cracking","kid-injection","jku-injection","oauth-csrf","redirect-uri-bypass","implicit-flow-attack","scope-escalation","token-leakage"],"techniqueDetails":["Covers JWT header manipulation (alg:none, kid, jku), RS256 to HS256 key confusion using public keys, brute-forcing weak HMAC secrets, OAuth CSRF via missing state, redirect_uri validation bypasses, implicit flow token theft via fragments, scope escalation, and token leakage through Referer headers and server logs."],"tools":["jwt_tool","hashcat","john","openssl"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Merges JWT cryptographic attacks with OAuth 2.0 flow-level abuse and token leakage vectors in one token-centric playbook; includes both automated tooling commands (jwt_tool, hashcat) and manual bypass examples, plus dedicated JWT and OAuth testing checklists."],"familyIds":["token-authentication-security"]},{"id":"kernel-exploitation","summary":"Provides expert guidance for exploiting Linux kernel vulnerabilities to elevate privileges through commit_creds, modprobe_path overwrite, or kernel ROP chains, including bypassing KASLR/SMEP/SMAP/KPTI and using QEMU/GDB for debugging.","primaryDomain":"binary-exploitation","domainTags":["kernel-exploitation","linux-kernel","privilege-escalation"],"capabilityTags":["kernel-exploitation","privilege-escalation","kernel-rop","mitigation-bypass","kernel-debugging"],"capabilityDetails":["Provides an expert playbook for exploiting Linux kernel vulnerabilities (UAF, OOB, race, type confusion) to achieve privilege escalation via commit_creds, modprobe_path overwrite, or kernel ROP chains, including mitigation bypass and QEMU debugging setup."],"techniqueTags":["kernel-rop","stack-pivoting","ret2usr","commit-creds","modprobe-path-overwrite","kpti-trampoline","seq-operations-hijack"],"techniqueDetails":["Covers kernel ROP with controlled RIP sources like corrupted function pointers or ops structures, stack pivoting gadgets, ret2usr (pre-SMEP), and clean return to userspace via swapgs/iretq or KPTI trampoline. Includes vulnerability classes and exploitation primitives."],"tools":["qemu","gdb","cpio","pwndbg","gef"],"targetTypes":["linux-host","ctf","container"],"role":"specialist-playbook","workflowFocus":["exploitation","analysis","validation"],"distinctiveFeatures":["Specialist playbook for Linux kernel-mode exploitation, distinct from userspace binary exploitation; focuses on kernel-specific mitigation bypass (KASLR/SMEP/SMAP/KPTI) and kernel primitives such as modprobe_path overwrite and seq_operations hijack, plus QEMU/GDB debugging setup."],"familyIds":["kernel-exploitation"]},{"id":"kubernetes-pentesting","summary":"Provides an expert-level penetration testing playbook for Kubernetes clusters, covering API server access, RBAC escalation, service account token abuse, etcd secret dumping, Kubelet API exploitation, cloud metadata credential theft, admission webhook bypass, and network policy evasion.","primaryDomain":"cloud-security","domainTags":["kubernetes-security","container-security","cloud-security"],"capabilityTags":["kubernetes-api-abuse","rbac-enumeration","service-account-token-abuse","etcd-secrets-extraction","kubelet-api-exploitation","admission-webhook-bypass","cloud-metadata-abuse"],"capabilityDetails":["Delivers an operational Kubernetes pentesting playbook covering API server access, RBAC escalation, service account token misuse, etcd secret dumping, Kubelet API exploitation, cloud metadata credential theft, admission webhook bypass, registry secret extraction, and network policy evasion."],"techniqueTags":["anonymous-api-checks","jwt-token-decoding","rbac-permission-abuse","privileged-pod-creation","etcd-direct-query","kubelet-api-access","imds-credential-theft","network-policy-bypass"],"techniqueDetails":["Checks API server for anonymous access and token/certificate authentication paths.","Enumerates RBAC roles, clusterroles, and self-subject rules to identify overprivileged permissions.","Decodes service account JWTs and abuses mounted tokens, including creating tokens if permitted.","Exploits misconfigurations to create privileged pods and use host namespaces / hostPath to escape.","Queries etcd directly using etcdctl or curl to dump secrets from the registry.","Calls Kubelet API endpoints (10250/10255) for pod listing, log reading, and remote exec.","Targets AWS/GCP/Azure metadata services to obtain temporary cloud credentials from pods.","Enumerates network policies and admission webhooks to find bypass paths."],"tools":["kubectl","kube-hunter","peirates","kubesploit","CDK","kubeletctl","kubeaudit"],"targetTypes":["kubernetes","container","cloud"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","exploitation","post-exploitation"],"distinctiveFeatures":["An end-to-end Kubernetes cluster attack playbook spanning API server, RBAC, service accounts, etcd, Kubelet, cloud metadata, admission webhooks, and network policies, with a decision tree for choosing attack paths; distinct from single-vector container escape or Linux privesc skills."],"familyIds":["cloud-offensive-security-and-emulation"]},{"id":"lattice-crypto-attacks","summary":"Expert playbook for lattice-based cryptanalysis in CTF settings, providing LLL/BKZ reduction, Coppersmith small roots, DSA/ECDSA nonce recovery via HNP, knapsack attacks, NTRU key recovery, and a decision tree for selecting and building attack lattices using SageMath and fpylll.","primaryDomain":"ctf","domainTags":["cryptanalysis","lattice-based-cryptography","public-key-cryptography"],"capabilityTags":["lattice-reduction","coppersmith-attack","hidden-number-problem","knapsack-attack","ntru-cryptanalysis","dsa-ecdsa-nonce-recovery"],"capabilityDetails":["Provides a complete workflow for constructing and solving lattice-based cryptographic attacks, including LLL/BKZ reduction, Coppersmith's method, Hidden Number Problem for DSA/ECDSA nonce recovery, knapsack/subset sum attacks, and NTRU key recovery.","Includes practical SageMath and fpylll code snippets for each attack, a decision tree to select the correct lattice construction, and a common pitfalls guide."],"techniqueTags":["lll","bkz","coppersmith-small-roots","boneh-durfee","cvp-embedding","cjloss","ntru-lattice"],"techniqueDetails":["Covers LLL and BKZ lattice reduction algorithms, univariate and multivariate Coppersmith for RSA small roots, the Hidden Number Problem (HNP) converted to CVP for DSA/ECDSA nonce bias attacks, low-density knapsack attacks via CJLOSS embedding, and NTRU lattice key recovery.","Explains how to express cryptographic problems as lattices, including dimension selection, scaling factors, and embedding CVP to SVP using Kannan's embedding."],"tools":["SageMath","fpylll"],"targetTypes":["ctf","other"],"role":"specialist-playbook","workflowFocus":["exploitation","analysis","knowledge-reference"],"distinctiveFeatures":["Covers a broad range of lattice attack families in one playbook, with a unified methodology for constructing attack lattices, rather than focusing on a single algorithm or specific vulnerability.","Includes a practical decision tree to route to the correct lattice construction, plus dimension/parameter selection guidance and common pitfall fixes."],"familyIds":["ctf-cryptanalysis"]},{"id":"linux-lateral-movement","summary":"Expert Linux lateral movement playbook for pivoting across hosts after initial access, covering SSH agent/key hijacking, credential harvesting, D-Bus abuse, internal tunneling, shared filesystem attacks, sudo token reuse, and systemd persistence.","primaryDomain":"linux-security","domainTags":["lateral-movement","ssh","post-exploitation"],"capabilityTags":["ssh-agent-hijacking","ssh-key-harvesting","credential-harvesting","network-pivoting","dbus-exploitation","sudo-token-reuse","shared-filesystem-abuse","systemd-manipulation"],"capabilityDetails":["Provides a comprehensive Linux lateral movement playbook covering SSH agent hijacking, key harvesting, credential discovery, D-Bus abuse, tunneling, shared filesystem exploitation, sudo token reuse, and systemd backdoors."],"techniqueTags":["ssh-agent-socket-hijacking","authorized-keys-injection","ssh-tunneling","credential-enumeration","dbus-method-call-abuse","nfs-suid-abuse","ptrace-sudo-token-injection","writable-systemd-unit-injection"],"techniqueDetails":["Uses SSH_AUTH_SOCK hijacking and ssh-add to reuse forwarded agent credentials.","Enumerates credential stores, process environments, and config files for password harvesting.","Exploits D-Bus system/session services and unsafely exposed polkit actions.","Leverages SSH tunnels, SOCKS proxies, and alternative tools like socat/ncat/chisel for pivoting.","Abuses NFS no_root_squash by planting SUID binaries on shared mounts.","Reuses active sudo timestamp tokens via ptrace injection into user processes.","Injects malicious ExecStartPre into writable systemd unit files for persistence."],"tools":["ssh","ssh-add","ssh-keygen","socat","ncat","chisel","smbclient","dbus-send","systemctl","sudo_inject"],"targetTypes":["linux-host"],"role":"specialist-playbook","workflowFocus":["post-exploitation","exploitation","reconnaissance"],"distinctiveFeatures":["Focuses specifically on Linux lateral movement with advanced SSH agent hijacking and ptrace-based sudo token reuse, distinguishing it from general post-exploitation or Windows-focused lateral movement skills."],"familyIds":["linux-lateral-movement"]},{"id":"linux-privilege-escalation","summary":"Actionable Linux privilege escalation playbook covering enumeration, SUID/SGID, capabilities, cron, NFS, passwd/shadow misconfigurations, LD_PRELOAD, Docker group, and library hijacking, with ready-to-use commands and a decision tree.","primaryDomain":"linux-security","domainTags":["privilege-escalation","linux-security"],"capabilityTags":["linux-enumeration","suid-exploitation","capability-abuse","cron-abuse","nfs-exploitation","credential-harvesting","library-hijacking","docker-group-exploitation"],"capabilityDetails":["Provides a comprehensive Linux privilege escalation playbook covering enumeration and exploitation of SUID/SGID binaries, Linux capabilities, cron jobs, NFS no_root_squash, writable passwd/shadow, LD_PRELOAD, Docker group membership, and library hijacking."],"techniqueTags":["suid-gtfobins","capability-abuse","cron-path-injection","nfs-no-root-squash","passwd-shadow-write","ld-preload-hijack","docker-group-mount","library-hijacking"],"techniqueDetails":["Includes specific commands for GTFOBins SUID abuse, capability misuse (cap_setuid, cap_dac_override, etc.), cron PATH/wildcard injection, NFS no_root_squash exploitation, writable /etc/passwd or shadow hash replacement, LD_PRELOAD with sudo, Docker group host mount, and Python/Perl/Ruby library hijacking."],"tools":["GTFOBins","linpeas","linux-exploit-suggester","pspy","LinEnum"],"targetTypes":["linux-host"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation"],"distinctiveFeatures":["Combines enumeration checklist with exploit commands for many Linux privesc vectors in one playbook","Includes decision tree for choosing escalation path","Supplements with specialized checklists for SUID/capability tricks and kernel exploits","Explicitly routes to related skills for container escape, security bypass, lateral movement, and Kubernetes pentesting"],"familyIds":["linux-privilege-escalation"]},{"id":"linux-security-bypass","summary":"Expert Linux post-exploitation playbook for bypassing restricted shells, noexec filesystems, AppArmor, SELinux, seccomp filters, and audit logging, including fileless execution techniques.","primaryDomain":"linux-security","domainTags":["linux-security","post-exploitation","security-bypass"],"capabilityTags":["restricted-shell-escape","noexec-filesystem-bypass","apparmor-evasion","selinux-evasion","seccomp-bypass","audit-log-evasion","fileless-execution"],"capabilityDetails":["Provides expert workflows to escape restricted shells, execute binaries on noexec filesystems, evade AppArmor/SELinux, bypass seccomp filters, and cover audit trails during post-exploitation."],"techniqueTags":["rbash-escape","ddexec","memfd-create","ldso-execution","architecture-confusion","timestomping","process-name-spoofing"],"techniqueDetails":["Covers rbash escapes via editors and interpreters, fileless execution through DDexec and memfd_create, ld.so direct binary execution, 32-bit syscall confusion for seccomp filters, and log/timestamp manipulation."],"tools":["amicontained"],"targetTypes":["linux-host","container"],"role":"specialist-playbook","workflowFocus":["detection","exploitation","post-exploitation"],"distinctiveFeatures":["Focuses specifically on evading Linux kernel security mechanisms rather than general privilege escalation; includes fileless execution and seccomp architecture confusion not typically covered in standard post-exploitation playbooks."],"familyIds":["linux-security-bypass"]},{"id":"llm-prompt-injection","summary":"Expert playbook for testing LLM applications for prompt injection, covering direct and indirect injection, tool-calling abuse, data exfiltration via Markdown, MCP security risks, and defense bypass techniques.","primaryDomain":"injection","domainTags":["prompt-injection","llm-security"],"capabilityTags":["direct-prompt-injection","indirect-prompt-injection","tool-call-abuse","data-exfiltration","defense-bypass","mcp-security"],"capabilityDetails":["Provides expert playbook for testing LLM applications for prompt injection.","Covers both direct injection via user input and indirect injection via RAG, web browsing, and email.","Addresses tool/function calling abuse, including argument injection and tool chaining for data exfiltration.","Includes MCP-specific security risks such as malicious tool descriptions and cross-MCP data leakage.","Provides defense bypass techniques including encoding, instruction splitting, few-shot manipulation, and context stuffing."],"techniqueTags":["instruction-override","rag-poisoning","tool-call-chaining","encoding-bypass","markdown-exfiltration","mcp-tool-description-injection"],"techniqueDetails":["Instruction override: Payloads that tell the model to ignore prior instructions and adopt new ones.","RAG poisoning: Injecting malicious instructions into documents that get retrieved and processed by the LLM.","Tool call chaining: Using a sequence of innocuous tool calls to exfiltrate sensitive data.","Encoding bypass: Using base64, ROT13, hex, or other encodings to hide malicious instructions from filters.","Markdown exfiltration: Tricking the LLM to include Markdown image or link URLs that leak data when rendered.","MCP tool description injection: Embedding hidden instructions in MCP server tool descriptions to manipulate LLM behavior."],"tools":[],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","exploitation","validation","reporting"],"distinctiveFeatures":["Covers both direct and indirect injection vectors specifically for LLM applications.","Includes MCP-specific security risks and tool description injection, which is often overlooked.","Provides a structured decision tree and payload progression for systematic testing.","Focuses on attack chains combining tool calling and data exfiltration rather than single-payload testing."],"familyIds":["llm-prompt-injection-red-teaming"]},{"id":"macos-process-injection","summary":"Provides an expert playbook for macOS process injection via DYLD_INSERT_LIBRARIES, dylib hijacking, XPC exploitation, Mach port manipulation, MIG abuse, and Electron injection, including target enumeration, decision support, and detection/forensics guidance.","primaryDomain":"injection","domainTags":["process-injection","dylib-hijacking","xpc-exploitation","mach-port"],"capabilityTags":["process-injection","dylib-hijacking","xpc-exploitation","mach-port-manipulation","electron-injection"],"capabilityDetails":["Injects code into macOS processes using DYLD_INSERT_LIBRARIES.","Performs dylib hijacking via weak dylibs, rpath search order, and dylib proxying.","Exploits XPC services through PID reuse and validation weaknesses.","Manipulates Mach ports and uses task_for_pid for memory access and thread injection.","Abuses Electron/Chromium runtime features for code execution in Electron apps.","Uses Apple Events (osascript/JXA) for application scripting."],"techniqueTags":["dyld-insert-libraries","weak-dylib-hijacking","xpc-pid-reuse","task-for-pid","electron-run-as-node"],"techniqueDetails":["Uses DYLD_INSERT_LIBRARIES environment variable to preload malicious dylibs.","Exploits weak dylib references and rpath search order to load attacker-controlled dylibs.","Performs PID reuse attacks against XPC services with PID-based validation.","Uses task_for_pid to obtain a task port for memory read/write and thread injection.","Abuses ELECTRON_RUN_AS_NODE and debug flags to execute code in Electron apps."],"tools":["gcc","otool","codesign","nm","osascript","dyldinfo"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["exploitation","enumeration","detection"],"distinctiveFeatures":["Comprehensive macOS-specific coverage of process injection vectors including DYLD, dylib hijacking, XPC, Mach ports, MIG, and Electron.","Explicitly handles macOS security constraints such as SIP, Hardened Runtime, and entitlements.","Provides a decision tree to select the appropriate injection technique based on target characteristics.","Includes detection and forensics guidance for red team operations."],"familyIds":["macos-process-injection"]},{"id":"macos-security-bypass","summary":"Actionable macOS security bypass playbook: strips quarantine, manipulates TCC, exploits SIP/sandbox/code-signing weaknesses, and establishes persistence for authorized red team/pentest use.","primaryDomain":"general-pentesting","domainTags":["macos-security","tcc","gatekeeper","sip","sandbox-escape","code-signing","entitlements"],"capabilityTags":["macos-security-bypass","tcc-bypass","gatekeeper-evasion","sip-bypass","sandbox-escape","entitlement-abuse","security-control-evasion"],"capabilityDetails":["Provides a structured decision-tree playbook for bypassing macOS security controls including TCC, Gatekeeper, SIP, sandbox, code signing, and entitlements, plus persistence methods."],"techniqueTags":["quarantine-attribute-removal","tcc-database-modification","fda-context-abuse","automation-abuse","historical-cve-exploitation","xpc-service-abuse","entitlement-abuse","library-validation-bypass"],"techniqueDetails":["Uses xattr -d to strip quarantine, queries or modifies TCC.db with sqlite3, abuses FDA-granted app contexts and Apple Events, exploits historical SIP CVEs, abuses XPC/Mach IPC, and leverages weak entitlements."],"tools":["sqlite3","xattr","csrutil","codesign","spctl","security","sandbox-exec","tccutil","osascript"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","post-exploitation"],"distinctiveFeatures":["Combines macOS-specific TCC, Gatekeeper, SIP, sandbox, code-signing, entitlement, and persistence bypass techniques into a single decision-tree playbook with version-specific CVEs and a reference matrix."],"familyIds":["specialized-platform-security-assessment"]},{"id":"managed-pentesting-with-strix","summary":"Provides an API-driven workflow to run managed pentests on web apps, APIs, source code, and internal infrastructure via Strix's cloud platform, covering asset registration, scan launch/polling, vulnerability triage, report export (SARIF/PDF/DOCX), PR reviews, and scheduled/continuous testing.","primaryDomain":"general-pentesting","domainTags":["web-application-pentesting","api-pentesting","source-code-analysis","continuous-pentesting"],"capabilityTags":["scan-orchestration","asset-registration","vulnerability-triage","report-export","schedule-configuration","pr-review-triggering"],"capabilityDetails":["Provides step-by-step API workflows for registering target assets, launching and polling pentest scans, reading and triaging vulnerabilities, exporting SARIF and PDF/DOCX reports, triggering PR reviews, and setting up schedules/webhooks on the Strix cloud platform."],"techniqueTags":[],"techniqueDetails":["Does not teach specific exploitation techniques; instead automates and manages pentests through the Strix cloud service, with user guidance limited to scan configuration, orchestration, and results interpretation."],"tools":["strix-cloud-api","curl","jq"],"targetTypes":["web-application","api","source-code","network"],"role":"tool-guide","workflowFocus":["reconnaissance","detection","validation","reporting"],"distinctiveFeatures":["Cloud-hosted managed pentesting API requiring no local infrastructure or own LLM key","Supports asset registration, authenticated scans, and SARIF/PDF/DOCX report export via REST API","Includes continuous testing through schedules and webhooks, plus PR review triggering","Integrates with team dashboard and offers enterprise compliance reports (SOC 2)"],"familyIds":["strix-security-testing-and-remediation-workflows"]},{"id":"managing-cloud-identity-with-okta","summary":"Comprehensive guide for implementing Okta as a centralized cloud identity provider, including multi-cloud SSO via SAML/OIDC, phishing-resistant MFA with FastPass/FIDO2, SCIM lifecycle automation, adaptive access policies, and ThreatInsight monitoring.","primaryDomain":"cloud-security","domainTags":["cloud-identity","single-sign-on","mfa","identity-lifecycle"],"capabilityTags":["sso-configuration","mfa-deployment","scim-provisioning","adaptive-access-control","identity-threat-monitoring"],"capabilityDetails":["Provides a step-by-step workflow for configuring Okta as a centralized identity provider for AWS, Azure, and GCP using SAML and OIDC federation.","Details deployment of Okta FastPass and FIDO2 WebAuthn for phishing-resistant MFA, including policy configuration and device trust requirements.","Explains SCIM-based automated user provisioning and deprovisioning across cloud platforms, covering group mapping and offboarding workflows.","Covers adaptive access policies that enforce risk-based conditional access using device posture, network context, and user risk signals.","Includes monitoring identity threats with Okta ThreatInsight and system log analysis to detect credential stuffing and account takeover attempts."],"techniqueTags":["saml-federation","oidc-federation","fido2-webauthn","scim-provisioning","device-trust","adaptive-mfa"],"techniqueDetails":["Uses SAML 2.0 to federate AWS console access with Okta as the identity provider.","Uses OIDC for Azure and GCP Workforce Identity Federation integration.","Deploys FIDO2 WebAuthn security keys and Okta FastPass for phishing-resistant authentication.","Automates user lifecycle management through SCIM provisioning to AWS IAM Identity Center, Azure AD, and GCP Workforce Identity.","Enforces context-aware access policies using device posture, network location, and risk signals from ThreatInsight."],"tools":["okta","aws-iam-identity-center","azure-ad-external-identities","gcp-workforce-identity-federation","okta-workflows","okta-threatinsight"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on Okta as a centralized identity provider for multi-cloud SSO, covering both federation setup and ongoing identity lifecycle automation.","Emphasizes phishing-resistant MFA (FastPass/FIDO2) as a core requirement, with detailed policy examples for privileged and break-glass access.","Includes practical multi-cloud offboarding scenarios and a structured security report template for identity posture assessment."],"familyIds":["identity-secrets-and-privileged-access-management"]},{"id":"managing-intelligence-lifecycle","summary":"Provides a structured six-phase workflow for establishing and maturing a cyber threat intelligence (CTI) program, covering PIR definition, collection planning, STIX normalization, tiered analysis, audience-specific dissemination, and feedback metrics aligned with NIST SP 800-150 and FIRST CTI-SIG.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","intelligence-lifecycle","cti-program"],"capabilityTags":["intelligence-lifecycle-management","pir-definition","intelligence-analysis","dissemination-planning"],"capabilityDetails":["Provides a structured six-phase workflow for managing cyber threat intelligence from planning and direction through collection, processing, analysis, dissemination, and feedback, with emphasis on defining Priority Intelligence Requirements (PIRs) and building program maturity."],"techniqueTags":["structured-analytic-techniques","stix-normalization","tlp-classification","maturity-model-evaluation"],"techniqueDetails":["Applies structured analytic techniques such as Analysis of Competing Hypotheses, Key Assumptions Check, and Devil's Advocacy; normalizes intelligence data to STIX 2.1; uses TLP for dissemination; evaluates program maturity against FIRST CTI-SIG model."],"tools":["threatconnect","misp","opencti","recorded-future"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","reporting","knowledge-reference"],"distinctiveFeatures":["Covers the complete intelligence lifecycle from planning to feedback rather than focusing on a single intelligence operation or IOC management.","Embeds NIST SP 800-150 and FIRST CTI-SIG maturity model as reference frameworks.","Emphasizes stakeholder feedback loops and metrics (PIR coverage, true positive rate) for program maturity."],"familyIds":["threat-intelligence-lifecycle-management"]},{"id":"managing-third-party-vendor-risk","summary":"Build and run a third-party vendor risk management (TPRM) program with vendor inventory, risk tiering, SIG/CAIQ due diligence, critical evidence review, contractual security terms, continuous monitoring, and secure offboarding, aligned to NIST SP 800-161.","primaryDomain":"security-knowledge","domainTags":["third-party-risk","vendor-risk-management","supply-chain-risk","compliance-governance","nist-sp-800-161"],"capabilityTags":["vendor-inventory","risk-tiering","due-diligence","evidence-review","contract-terms","continuous-monitoring","offboarding"],"capabilityDetails":["Provides a repeatable workflow to inventory and tier third-party vendors by inherent risk.","Guides tier-appropriate due diligence using SIG or CAIQ questionnaires and SOC 2/ISO 27001 evidence.","Includes contract and DPA clauses such as right-to-audit, breach-notification SLAs, and subprocessor flowdown.","Covers continuous monitoring, Nth-party and concentration risk, and secure offboarding."],"techniqueTags":["inherent-risk-scoring","tiered-assessment","standardized-questionnaire","evidence-review","contractual-controls","nth-party-mapping","security-ratings-monitoring"],"techniqueDetails":["Vendor tiering: scores inherent risk factors (data sensitivity, access, criticality, regulatory scope) to assign tiers.","Evidence review: analyzes SOC 2 Type II exceptions and audit period, ISO 27001 scope, CAIQ 'no' answers, and pen-test age.","Contractual codification: translates identified gaps into binding security terms and right-to-audit obligations.","Continuous monitoring: uses security-ratings feeds, breach news, certificate-expiry tracking, and re-tier triggers."],"tools":["sig","caiq","soc-2-report","iso-27001-certificate","security-ratings","tprm-platform","process.py"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","remediation","reporting"],"distinctiveFeatures":["Covers the entire TPRM lifecycle from inventory to offboarding, not just one assessment step.","Provides specific guidance for critically reading SOC 2 exceptions, ISO 27001 scope statements, and CAIQ blank answers.","Explicitly integrates Nth-party and concentration risk management into the workflow.","Maps to NIST SP 800-161 C-SCRM and NIST CSF GV.SC categories."],"familyIds":["compliance-governance"]},{"id":"mapping-attack-paths-with-bloodhound-ce","summary":"Practical workflow to deploy BloodHound CE, collect AD/Entra data with SharpHound/AzureHound, and map on-prem, cloud, and hybrid privilege escalation paths toward domain/tenant compromise, with built-in and custom Cypher queries.","primaryDomain":"active-directory","domainTags":["active-directory","entra-id","hybrid-identity","attack-path-management"],"capabilityTags":["attack-path-mapping","active-directory-reconnaissance","entra-id-reconnaissance","privilege-escalation-analysis","cypher-querying"],"capabilityDetails":["Provides a full workflow for deploying BloodHound CE, collecting AD data with SharpHound and Entra ID data with AzureHound, and ingesting both into a unified attack graph.","Enables identification of on-prem, cloud, and hybrid privilege escalation paths using built-in queries and custom Cypher.","Includes procedures for marking owned principals and prioritizing/documenting attack paths for reporting."],"techniqueTags":["graph-edge-analysis","shortest-path-queries","acl-abuse-detection","kerberoast-analysis","dcsync-detection","adcs-misconfiguration-analysis","hybrid-identity-edge-analysis"],"techniqueDetails":["Uses BloodHound graph edges such as MemberOf, GenericAll, ForceChangePassword, HasSession, ADCSESC1-8, and SyncedToEntraUser to model escalation.","Runs built-in queries for Shortest Path to Domain Admins, Kerberoastable accounts, DCSync rights, and ADCS abuse.","Uses custom Cypher to find paths from owned principals to high-value targets, including hybrid AD-to-Entra chains."],"tools":["BloodHound CE","SharpHound","AzureHound","bloodhound-ce-python"],"targetTypes":["active-directory","cloud"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","analysis","reporting"],"distinctiveFeatures":["Covers the complete BloodHound CE lifecycle, including collector deployment, API-based ingestion, and custom Cypher for hybrid AD/Entra attack paths.","Specifically targets hybrid identity escalation linking on-prem AD to Entra ID, beyond general AD enumeration or single-domain BloodHound usage."],"familyIds":["active-directory-reconnaissance-and-path-mapping"]},{"id":"mapping-mitre-attack-techniques","summary":"A workflow to map existing detections and Sigma rules to MITRE ATT&CK techniques, score coverage, prioritize gaps using threat intelligence, and generate ATT&CK Navigator heatmaps and executive reports.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","detection-engineering","mitre-attack","coverage-analysis"],"capabilityTags":["attack-technique-mapping","coverage-heatmap-generation","detection-gap-analysis","siem-rule-tagging","threat-group-prioritization"],"capabilityDetails":["Provides a step-by-step workflow to map observed adversary behaviors, SIEM alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques.","Enables generation of coverage heatmaps and risk-ranked gap analysis to guide detection control prioritization."],"techniqueTags":["mitre-attack-mapping","coverage-scoring","threat-intelligence-prioritization"],"techniqueDetails":["Uses coverage scores (0=blind, 50=logged only, 100=alerted) to represent detection completeness for each technique.","Cross-references coverage gaps with adversary group usage to prioritize additions based on sector-specific threat models."],"tools":["mitreattack-python","ATT&CK Navigator","Sigma","Atomic Red Team","curl"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Focuses specifically on mapping existing detections to MITRE ATT&CK for coverage analysis, not on executing or detecting techniques.","Includes explicit steps for generating ATT&CK Navigator heatmap JSON layers and executive reporting with risk-ranked blind spots."],"familyIds":["mitre-attack-coverage-analysis"]},{"id":"mcp-builder","summary":"Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"memory-forensics-volatility","summary":"Operational memory forensics playbook using Volatility 2/3 to acquire and analyze memory dumps, detect malware artifacts (hidden processes, injected code, rootkits), extract credentials and files, and build incident timelines across Windows and Linux images.","primaryDomain":"forensics","domainTags":["memory-forensics","volatility","incident-response","malware-analysis"],"capabilityTags":["memory-acquisition","process-analysis","code-injection-detection","credential-extraction","file-carving","timeline-generation"],"capabilityDetails":["Provides an end-to-end workflow for acquiring and analyzing memory dumps with Volatility 2 and Volatility 3.","Covers hidden process detection, code injection detection, credential extraction, file carving, registry analysis, and timeline generation.","Includes Linux-specific memory analysis and rootkit detection techniques."],"techniqueTags":["hidden-process-detection","code-injection-detection","dll-unlinking-detection","credential-dumping","timeline-analysis","rootkit-detection"],"techniqueDetails":["Uses pslist vs psscan comparison to identify DKOM-hidden processes.","Uses malfind to find RWX memory regions without file backing (shellcode injection).","Uses ldrmodules to detect DLLs unlinked from PEB lists (reflective injection).","Uses hashdump, lsadump, cachedump, and the mimikatz plugin for credential extraction.","Uses Timeliner and mactime to build an incident timeline.","Uses linux.check_syscall and linux.check_afinfo for Linux rootkit detection."],"tools":["Volatility 2","Volatility 3","LiME","AVML","WinPmem","FTK Imager","DumpIt","MagnetRAM","mactime"],"targetTypes":["windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Explicitly maps Volatility 2 and Volatility 3 commands for every analysis step.","Covers both Windows and Linux memory analysis, including Linux rootkit detection plugins.","Provides a decision tree connecting investigation goals (malware, credentials, timeline, CTF) to specific Volatility plugins.","Includes a malware indicator reference table mapping observed anomalies to detection methods."],"familyIds":["memory-forensics"]},{"id":"migrating-to-post-quantum-cryptography","summary":"Operational workflow to inventory enterprise cryptography, prioritize quantum-vulnerable systems by harvest-now-decrypt-later risk, and deploy hybrid post-quantum key exchange (X25519MLKEM768) and PQC certificates using OpenSSL 3.5+.","primaryDomain":"network-security","domainTags":["cryptography","post-quantum","tls","crypto-agility","key-management"],"capabilityTags":["cbom-generation","hybrid-key-exchange","pqc-key-generation","pqc-certificate-issuance","hndl-prioritization"],"capabilityDetails":["Generates a Cryptographic Bill of Materials (CBOM) to inventory algorithms, keys, certs, and protocols.","Deploys hybrid post-quantum key exchange using X25519MLKEM768 on TLS/VPN/SSH endpoints.","Generates ML-KEM and ML-DSA key pairs with OpenSSL 3.5+.","Issues and verifies PQC/hybrid certificates.","Prioritizes migration based on harvest-now-decrypt-later (HNDL) exposure using Mosca's inequality."],"techniqueTags":["hybrid-key-exchange","ml-kem","ml-dsa","cbom","hndl"],"techniqueDetails":["Hybrid key exchange combines classical X25519 with ML-KEM-768 to remain secure if either is broken.","ML-KEM is a module-lattice key encapsulation mechanism standardized in FIPS 203.","ML-DSA is a module-lattice signature scheme standardized in FIPS 204.","CBOM (Cryptography Bill of Materials) is a CycloneDX capability for inventorying crypto assets.","HNDL prioritization applies Mosca's inequality to determine urgent migration targets."],"tools":["openssl","oqs-provider","liboqs","cdxgen","cbomkit-theia","python-cryptography"],"targetTypes":["network","source-code","container","web-application","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","remediation"],"distinctiveFeatures":["Focuses exclusively on post-quantum cryptographic migration, covering the full lifecycle from CBOM inventory to hybrid PQC deployment.","Provides concrete OpenSSL commands for ML-KEM/ML-DSA key generation, certificate issuance, and hybrid TLS negotiation.","Emphasizes HNDL risk prioritization using Mosca's inequality, not just generic crypto agility."],"familyIds":["post-quantum-cryptography-migration"]},{"id":"mobile-ssl-pinning-bypass","summary":"Expert playbook for bypassing SSL certificate pinning in mobile apps to enable HTTPS interception; covers multiple Android/iOS bypass methods, framework-specific hooks, manual patching, and troubleshooting.","primaryDomain":"mobile-security","domainTags":["ssl-pinning","android","ios"],"capabilityTags":["ssl-pinning-bypass","traffic-interception","frida-hooking","framework-specific-bypass","manual-patching"],"capabilityDetails":["Provides multiple techniques for disabling SSL certificate pinning on Android and iOS to allow HTTPS traffic interception.","Includes framework-specific bypasses for Flutter, React Native, and Xamarin applications.","Offers decision tree and troubleshooting guidance for complex or layered pinning implementations."],"techniqueTags":["frida-instrumentation","objection-bypass","xposed-module","network-security-config-override","binary-patching","boringssl-hooking","system-ca-installation","lldb-debugging"],"techniqueDetails":["Frida hooks TrustManager, OkHttp, and SecTrust APIs to bypass validation.","Objection one-liner disables SSL pinning on Android and iOS.","Xposed/LSPosed modules and Magisk system CA installation cover rooted Android devices.","Network Security Config and APK repackaging work for non-rooted Android.","Flutter apps require BoringSSL native hooks or reflutter patching.","Manual binary patching and LLDB breakpoints can be used on iOS when no jailbreak is available."],"tools":["frida","objection","xposed","lsposed","ssl-kill-switch-2","apktool","jadx","reflutter","magisk","burp-suite","mitmproxy","charles-proxy","proxyman","http-toolkit","adb"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["exploitation","analysis"],"distinctiveFeatures":["Specializes exclusively in SSL pinning bypass across Android and iOS, with framework-specific sections for Flutter, React Native, and Xamarin.","Includes a decision tree for selecting bypass methods and a troubleshooting section for layered pinning failures, client certificates, and non-HTTP protocols."],"familyIds":["mobile-network-traffic-interception-and-pinning-bypass"]},{"id":"modeling-threats-with-opencti","summary":"Deploys OpenCTI and uses pycti to model threat actors, intrusion sets, campaigns, and indicators in a STIX 2.1 knowledge graph with relationships, enabling centralized threat-intel correlation and STIX bundle ingestion.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","stix2","knowledge-graph","mitre-attack"],"capabilityTags":["opencti-deployment","threat-actor-modeling","stix-bundle-ingestion","relationship-construction"],"capabilityDetails":["Provides a workflow for deploying OpenCTI via Docker Compose, using pycti to create STIX 2.1 objects (threat actors, intrusion sets, campaigns, indicators), building relationships like uses and attributed-to, and ingesting STIX bundles for centralized threat-intel correlation."],"techniqueTags":["stix2-object-modeling","graph-relationship-building","api-client-automation","connector-based-ingestion"],"techniqueDetails":["Uses the pycti client to create STIX domain objects and relationships forming an adversary knowledge graph.","Uses Docker Compose to deploy the OpenCTI platform and connectors for automated threat-intel ingestion."],"tools":["opencti","pycti","docker-compose","docker","stix2"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","knowledge-reference","reporting"],"distinctiveFeatures":["Focuses entirely on OpenCTI threat-intel modeling with STIX 2.1 and pycti, including deployment, connectors, and bulk bundle import, rather than generic CTI methodology."],"familyIds":["threat-intelligence-data-and-ioc-management"]},{"id":"monitoring-darkweb-sources","summary":"Operational workflow for establishing dark web monitoring using commercial services and OPSEC-safe manual investigation, covering ransomware leak site claims, credential exposure detection, and evidence documentation for early warning threat intelligence.","primaryDomain":"reconnaissance","domainTags":["dark-web","osint","threat-intelligence","credential-monitoring","ransomware-leak-monitoring"],"capabilityTags":["dark-web-monitoring","credential-exposure-detection","leak-site-investigation","paste-site-monitoring","threat-intel-enrichment"],"capabilityDetails":["Provides a workflow for establishing continuous dark web monitoring coverage using commercial CTI services and manual OPSEC-safe investigation.","Covers ransomware leak site claim validation, credential exposure response, and evidence documentation for early warning intelligence."],"techniqueTags":["keyword-based-monitoring","tor-browsing","paste-site-querying","leak-site-verification","credential-correlation"],"techniqueDetails":["Uses commercial CTI platforms to crawl dark web forums and leak sites without analyst exposure.","Manual investigation uses Tor with Whonix/Tails for OPSEC and cover identity.","Leverages paste site APIs for clearnet monitoring and credential breach notification services for exposure detection."],"tools":["recorded-future","flashpoint","intel-471","cybersixgill","spycloud","hibp-enterprise","flare-systems","tor","whonix","tails","psbdmp","pastebin"],"targetTypes":["web-application","other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","analysis","reporting"],"distinctiveFeatures":["Focuses on passive dark web monitoring rather than active exploitation or offensive operations.","Combines commercial services (Recorded Future, Flashpoint, etc.) with manual OPSEC-safe investigation procedures.","Specifically addresses ransomware leak site claim verification and credential exposure response playbooks.","Emphasizes evidence preservation and legal considerations for continuous intelligence monitoring."],"familyIds":["dark-web-leak-monitoring"]},{"id":"monitoring-scada-modbus-traffic-anomalies","summary":"Operational playbook for passively monitoring Modbus TCP traffic on SCADA/ICS networks to baseline normal communication, detect unauthorized writes, function-code anomalies, device enumeration, and process manipulation, using deep packet inspection with pymodbus, Scapy, and Zeek.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","scada-security","modbus-tcp","industrial-network-monitoring"],"capabilityTags":["traffic-monitoring","anomaly-detection","deep-packet-inspection","protocol-analysis","baseline-modeling"],"capabilityDetails":["Provides a passive monitoring workflow for Modbus TCP traffic on OT/SCADA networks, extracting protocol details via deep packet inspection.","Builds baseline communication profiles per device pair and applies statistical and rule-based anomaly detection to identify suspicious function code usage, register writes, and network-level attacks.","Detects process manipulation through per-register safe operating ranges and rate-of-change limits, and identifies reconnaissance via function code 43 and sequential scanning."],"techniqueTags":["statistical-anomaly-detection","rule-based-detection","function-code-analysis","register-value-monitoring","timing-anomaly-detection","rogue-master-detection"],"techniqueDetails":["Uses chi-squared tests and standard-deviation-based thresholds on function-code distributions and inter-packet timing intervals.","Defines per-register safe ranges and maximum rate-of-change to detect unauthorized setpoint writes.","Monitors transaction ID consistency, payload size limits, connection flood rates, and unauthorized source IPs to detect replay, DoS, and rogue master activity."],"tools":["pymodbus","scapy","zeek","wireshark","tshark","suricata","grficsv2"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Specialized for passive Modbus TCP monitoring in OT/ICS/SCADA environments rather than generic network anomaly detection.","Detects protocol-level manipulation including unauthorized register writes, function-code anomalies, and rogue masters.","Combines baseline statistical profiles with configurable per-register process safety limits.","Includes realistic attack scenarios and concrete Python detection code for operational use."],"familyIds":["network-traffic-analysis-and-detection"]},{"id":"moving-laterally-with-netexec","summary":"Operational NetExec playbook for lateral movement on authorized Windows/AD engagements: validates credentials and hashes, finds admin (Pwn3d!) hosts, enumerates SMB/LDAP, performs lockout-safe password spraying, executes commands via SMB/WinRM/MSSQL, dumps SAM/LSA/NTDS credentials, and drives Kerberoasting/ASREProast/BloodHound with NetExec modules.","primaryDomain":"active-directory","domainTags":["active-directory","windows-security","network-security"],"capabilityTags":["lateral-movement","credential-validation","password-spraying","remote-command-execution","credential-dumping","ad-enumeration","ad-attack-modules"],"capabilityDetails":["Validate cleartext credentials and NT hashes across a host range to locate local-admin (Pwn3d!) access for lateral movement.","Enumerate SMB shares, domain users, password policy, logged-on users, and sessions to plan movement.","Perform lockout-safe password spraying with --continue-on-success and pre-checked lockout policy.","Execute remote commands over SMB, WinRM, MSSQL, SSH with selectable exec methods.","Dump SAM, LSA, and NTDS credentials (including DCSync/DRSUAPI and VSS variants).","Drive AD attacks and data collection through LDAP modules (Kerberoasting, ASREProast, LAPS, BloodHound)."],"techniqueTags":["pass-the-hash","password-spraying","smb-remote-exec","winrm-remote-exec","sam-dump","lsa-dump","ntds-dump","kerberoasting","asreproasting","rid-brute"],"techniqueDetails":["Pass-the-hash using NT or LM:NT hashes for SMB and other protocol authentication.","Password spraying one password across many users with --continue-on-success after checking lockout policy.","Remote code execution via ADMIN$/C$ SMB named pipes or task scheduler, with selectable exec methods (smbexec, wmiexec, atexec, mmcexec).","SAM and LSA secret dumping from local hosts; NTDS.dit extraction from domain controllers via DRSUAPI or VSS.","Kerberoasting and ASREProasting through LDAP modules to request service tickets or pre-auth hashes.","RID brute-force to enumerate domain accounts when user listing is blocked."],"tools":["netexec","lsassy","bloodhound"],"targetTypes":["active-directory","windows-host","linux-host","database","network"],"role":"tool-guide","workflowFocus":["enumeration","validation","exploitation","post-exploitation"],"distinctiveFeatures":["Successor to CrackMapExec; unified multi-protocol CLI for SMB/WinRM/LDAP/MSSQL/SSH/FTP/WMI/RDP/VNC/NFS.","Combines credential validation, lockout-safe password spraying, remote command execution, and credential dumping into a single lateral-movement workflow.","Uses the (Pwn3d!) output marker to instantly identify hosts where the credential has local-admin code execution rights.","Includes workspace-based logging and reporting in ~/.nxc for engagement documentation."],"familyIds":["active-directory-lateral-movement"]},{"id":"network-protocol-attacks","summary":"Expert playbook for layer 2/3 network protocol attacks, covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion, with commands and chaining to NTLM relay and AD compromise.","primaryDomain":"network-security","domainTags":["network-security","protocol-attacks","man-in-the-middle"],"capabilityTags":["arp-spoofing","name-resolution-poisoning","wpad-abuse","dhcpv6-attack","vlan-hopping","stp-manipulation","dns-spoofing","ipv6-attacks","ids-evasion"],"capabilityDetails":["Provides an expert operational playbook for layer 2/3 network protocol attacks, including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 takeover, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion."],"techniqueTags":["gratuitous-arp","llmnr-nbtns-mdns-poisoning","wpad-rogue-proxy","dhcpv6-dns-takeover","switch-spoofing","double-tagging","stp-root-bridge-claim","dns-cache-poisoning","router-advertisement-spoofing","slaac-abuse","fragmentation-evasion","session-splicing"],"techniqueDetails":["Includes specific techniques such as gratuitous ARP for MitM positioning, Responder-based LLMNR/NBT-NS/mDNS poisoning, WPAD rogue proxy, mitm6 DHCPv6 DNS takeover, DTP switch spoofing and 802.1Q double tagging for VLAN hopping, STP root bridge claim, DNS cache poisoning, IPv6 router advertisement spoofing, SLAAC abuse, and IDS/IPS evasion via fragmentation, TTL manipulation, and timing."],"tools":["arpspoof","ettercap","bettercap","responder","ntlmrelayx","hashcat","john","mitm6","yersinia","frogger.sh","scapy","atk6-fake_router6","atk6-parasite6","atk6-redir6","fragroute","nmap"],"targetTypes":["network","windows-host","active-directory"],"role":"specialist-playbook","workflowFocus":["exploitation","detection"],"distinctiveFeatures":["Chains layer 2/3 protocol attacks (ARP, name resolution poisoning, DHCPv6, VLAN hopping, STP, DNS, IPv6) into MitM and NTLM relay scenarios, including AD compromise via RBCD, and explicitly covers IDS/IPS evasion."],"familyIds":["network-adversary-simulation"]},{"id":"nosql-injection","summary":"Actionable expert playbook for NoSQL injection, covering operator injection, authentication bypass, blind data extraction, aggregation pipeline attacks, and exploitation of unauthenticated Redis/CouchDB instances, with detection payloads, a testing checklist, and an automation template.","primaryDomain":"injection","domainTags":["web-security","database-security","nosql"],"capabilityTags":["nosql-injection-testing","authentication-bypass","blind-data-extraction","aggregation-pipeline-injection","server-side-javascript-execution"],"capabilityDetails":["Provides a comprehensive playbook for NoSQL injection, including MongoDB operator injection, authentication bypass, blind data extraction via regex, aggregation pipeline injection, and attacks on Redis and CouchDB.","Includes detection payloads, a testing checklist, and an automation template for blind extraction."],"techniqueTags":["operator-injection","regex-based-extraction","javascript-execution","aggregation-pipeline-injection","parameter-pollution","redis-command-injection","couchdb-unauthenticated-access"],"techniqueDetails":["Uses MongoDB operators like $ne, $gt, $regex to manipulate query logic and bypass authentication.","Extracts field values character-by-character using $regex as a boolean oracle.","Exploits $where for JavaScript execution, timing-based blind extraction, and logic abuse.","Injects into aggregation pipeline stages to match all documents or leak data via $lookup/$out.","Exploits HTTP parameter pollution to turn repeated parameters into objects for operator injection.","Attacks unauthenticated Redis instances via command injection and CouchDB via exposed admin API."],"tools":["NoSQLMap","curl"],"targetTypes":["web-application","api","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","enumeration"],"distinctiveFeatures":["Exclusively focuses on NoSQL injection rather than SQL injection, covering MongoDB, CouchDB, and Redis.","Includes a comparison table between SQLi and NoSQLi, detection payloads, and a Python automation template for blind extraction.","Covers advanced topics like aggregation pipeline injection and $where JavaScript execution."],"familyIds":["nosql-injection"]},{"id":"ntlm-relay-coercion","summary":"Expert playbook for capturing and relaying NTLM authentication to escalate privileges in Active Directory, covering SMB, LDAP, HTTP (ADCS), and MSSQL relay targets, responder/mitm6 poisoning, WebDAV coercion, and cross-protocol relay constraints.","primaryDomain":"active-directory","domainTags":["active-directory","ntlm-relay","authentication-coercion"],"capabilityTags":["ntlm-relay-execution","authentication-coercion","privilege-escalation"],"capabilityDetails":["Provides a workflow for capturing NTLM authentication via poisoning or coercion and relaying it to SMB, LDAP, HTTP, or MSSQL targets to execute commands, modify ACLs, or obtain certificates."],"techniqueTags":["responder-poisoning","smb-relay","ldap-relay","webdav-coercion","mitm6","petitpotam"],"techniqueDetails":["Uses Responder for LLMNR/NBT-NS/WPAD/mDNS poisoning, ntlmrelayx for relaying to various protocols, mitm6 for IPv6 DNS takeover, and WebDAV coercion to bypass SMB signing."],"tools":["responder","ntlmrelayx","mitm6","crackmapexec","nmap","petitpotam"],"targetTypes":["active-directory","windows-host","network","database"],"role":"specialist-playbook","workflowFocus":["reconnaissance","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on NTLM relay and authentication coercion rather than hash capture alone","Covers cross-protocol relay constraints and signing/EPA requirements","Provides decision tree for selecting relay targets and handling failures"],"familyIds":["active-directory-lateral-movement"]},{"id":"oauth-oidc-misconfiguration","summary":"Playbook for auditing OAuth 2.0/OIDC misconfigurations: redirect URI validation, state/nonce handling, PKCE enforcement, token audience/issuer checks, account binding and scope issues, with a quick triage workflow.","primaryDomain":"authentication","domainTags":["oauth","oidc","authentication"],"capabilityTags":["oauth-misconfiguration-testing","redirect-uri-validation","pkce-validation","token-binding-check"],"capabilityDetails":["Provides a structured checklist for auditing OAuth 2.0 and OpenID Connect implementations.","Covers redirect URI validation, state and nonce handling, PKCE enforcement, token audience/issuer verification, and account binding flaws."],"techniqueTags":["state-nonce-analysis","redirect-uri-manipulation","pkce-enforcement-testing","token-audience-verification"],"techniqueDetails":["Checks for missing, static, predictable, or session-unbound state and nonce values.","Tests redirect_uri validation weaknesses like prefix matching, path confusion, and open redirect chaining.","Verifies if public clients enforce PKCE and code verifier correctness, including downgrade protection.","Assesses token aud/iss validation strengths and cross-client token reuse risks."],"tools":[],"targetTypes":["web-application","api","mobile"],"role":"specialist-playbook","workflowFocus":["detection","validation"],"distinctiveFeatures":["Dedicated to OAuth/OIDC misconfigurations rather than general authentication testing.","Provides a quick triage procedure to map flows and replay callbacks with altered state, nonce, and redirect_uri.","Covers client-specific concerns for SPA, mobile, and web clients, including cross-client comparison."],"familyIds":["token-authentication-security"]},{"id":"open-redirect","summary":"Expert playbook for detecting and exploiting open redirect vulnerabilities, covering parameter discovery, filter/parser bypass, and chaining into phishing, OAuth token theft, CSRF Referer bypass, SSRF, and reverse tabnabbing.","primaryDomain":"web-security","domainTags":["url-redirection","oauth","ssrf"],"capabilityTags":["open-redirect-testing","filter-bypass","exploitation-chaining"],"capabilityDetails":["Provides an expert playbook for detecting open redirect vulnerabilities, bypassing URL validation filters, and chaining open redirects into phishing, OAuth token theft, CSRF Referer bypass, and SSRF."],"techniqueTags":["parameter-based-redirect","javascript-sinks","protocol-relative-bypass","userinfo-abuse","url-parser-confusion","reverse-tabnabbing","oauth-redirect-uri-bypass"],"techniqueDetails":["Covers server-side Location header sinks and client-side JavaScript sinks.","Includes bypass techniques such as protocol-relative URLs, userinfo abuse, backslash tricks, double encoding, CRLF injection, and URL parser differentials.","Details exploitation chains combining open redirect with OAuth token theft, CSRF Referer bypass, SSRF, and reverse tabnabbing."],"tools":[],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on open redirect as a multi-purpose attack primitive, with an extensive filter/parser bypass catalog and in-depth chaining playbooks for OAuth, SSRF, and reverse tabnabbing."],"familyIds":["ssrf-and-open-redirect"]},{"id":"operating-havoc-c2","summary":"Provides step-by-step instructions for deploying and operating a Havoc C2 team server with Yaotl profiles, generating evasive Demon agents, performing post-exploitation tasks, and establishing pivots during authorized red-team engagements.","primaryDomain":"post-exploitation","domainTags":["red-team","command-and-control","adversary-emulation","evasion","post-exploitation"],"capabilityTags":["c2-deployment","implant-generation","post-exploitation","in-memory-execution","pivoting","process-injection"],"capabilityDetails":["Provides a full workflow for deploying a Havoc C2 team server including Yaotl profile authoring, building from source, and launching the server.","Generates evasive Demon agent binaries with configurable sleep obfuscation, indirect syscalls, and stack spoofing.","Runs post-exploitation commands for situational awareness, file operations, token/privilege enumeration, and process injection.","Executes .NET assemblies and Beacon Object Files (BOFs) in-memory to avoid writing to disk.","Establishes SOCKS5 proxy and reverse port forwarding through the Demon for network pivoting."],"techniqueTags":["indirect-syscalls","sleep-obfuscation","stack-spoofing","http-c2","socks-proxy","reverse-port-forwarding","dotnet-inline-execution","bof-execution"],"techniqueDetails":["Uses indirect syscalls (Hell's Gate / Halo's Gate) to bypass user-mode API hooks.","Applies Ekko sleep obfuscation to encrypt agent memory while sleeping.","Spoofs return addresses and stacks to evade call-stack detection.","C2 traffic is carried over HTTP(S) using malleable Yaotl profiles.","Executes .NET assemblies and BOFs in-memory to minimize forensic footprint.","Pivots through SOCKS5 proxy and reverse port forwarding to reach segmented networks."],"tools":["havoc","havoc-demon","yaotl","proxychains"],"targetTypes":["windows-host","linux-host","network"],"role":"specialist-playbook","workflowFocus":["exploitation","post-exploitation"],"distinctiveFeatures":["Covers the complete lifecycle of Havoc C2 operations from team server deployment to cleanup.","Emphasizes evasive implant generation with indirect syscalls, sleep obfuscation, and stack spoofing.","Includes detailed Yaotl profile authoring and listener configuration.","Provides in-memory execution of .NET assemblies and BOFs, plus SOCKS and port-forward pivoting.","Maps workflows to MITRE ATT&CK techniques and includes defender detection considerations."],"familyIds":["c2-framework-deployment-and-operations"]},{"id":"operating-sliver-c2","summary":"An operational playbook for deploying BishopFox's Sliver open-source C2 framework, generating session/beacon implants, managing mTLS/HTTPS/DNS listeners, executing post-exploitation and pivoting techniques, and installing armory extensions for BOF/.NET tooling during authorized red-team engagements.","primaryDomain":"post-exploitation","domainTags":["command-and-control","adversary-emulation","implant-management","pivoting"],"capabilityTags":["c2-server-setup","implant-generation","listener-management","post-exploitation-execution","pivot-tunneling","armory-extension-management"],"capabilityDetails":["Provides a complete workflow for standing up a Sliver C2 server, configuring mTLS/HTTPS/DNS listeners, generating session and beacon implants for Windows/Linux/macOS, interacting with callbacks, executing post-exploitation commands, installing and running BOF/.NET armory extensions, and establishing SOCKS/port-forward/pivot connections through compromised hosts."],"techniqueTags":["mtls-c2","https-c2","dns-c2","beaconing-with-jitter","in-memory-execution","socks5-proxying","tcp-pivoting","token-impersonation"],"techniqueDetails":["Uses Sliver's dynamically compiled implants with per-binary encryption keys, supports session and asynchronous beacon models with jitter, leverages armory to execute BOFs and .NET assemblies in memory, and enables lateral movement through named-pipe/TCP pivots and SOCKS5 proxies."],"tools":["sliver"],"targetTypes":["windows-host","linux-host","active-directory","network"],"role":"specialist-playbook","workflowFocus":["post-exploitation","reconnaissance"],"distinctiveFeatures":["Comprehensive lifecycle coverage of the open-source Sliver C2 framework rather than a single technique","Includes the Armory package manager for installing and running BOFs and .NET assemblies in-memory","Details multi-protocol C2 listeners (mTLS, HTTPS, HTTP, DNS) with OPSEC tradeoffs for each","Provides concrete workflows for session and beacon implants, staging, and TCP/named-pipe pivots"],"familyIds":["c2-framework-deployment-and-operations"]},{"id":"operationalizing-misp-threat-feeds","summary":"A comprehensive defensive playbook for operationalizing MISP threat feeds: enabling and caching curated feeds, applying warninglists, searching IOCs via PyMISP, and auto-generating Suricata, Sigma, and Wazuh detection rules.","primaryDomain":"network-security","domainTags":["threat-intelligence","ioc-management","detection-engineering","security-operations"],"capabilityTags":["threat-feed-curation","ioc-querying","warninglist-filtering","detection-rule-generation","misp-automation","scheduled-pipeline"],"capabilityDetails":["Provides a step-by-step workflow to enable and cache curated MISP threat feeds, enable warninglists to suppress false positives, search for to_ids IOCs via PyMISP, generate Suricata/Snort rules through the REST API, create Sigma rules with sigma-cli, and build Wazuh CDB lists."],"techniqueTags":["misp-feed-caching","pymisp-api-search","warninglist-enforcement","suricata-rule-export","sigma-rule-creation","wazuh-cdb-list-generation"],"techniqueDetails":["Feed caching loads remote IOCs into Redis for real-time correlation; warninglists are enforced to exclude known-good values; PyMISP search pulls only to_ids published attributes; REST API export renders NIDS rules; Sigma rules are converted to SIEM backends; Wazuh CDB lists provide lookup-based alerting."],"tools":["MISP","PyMISP","misp-docker","Suricata","sigma-cli","Wazuh"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Bridges MISP threat intelligence to active detection rules in Suricata, Sigma, and Wazuh, rather than just ingesting IOCs.","Combines feed curation, warninglist-based false-positive suppression, and automated rule generation into one lifecycle.","Includes concrete PyMISP scripts and REST API calls for feed management, caching, and to_ids-tiered IOC export."],"familyIds":["threat-intelligence-detection-engineering"]},{"id":"orchestrating-llm-attacks-with-pyrit","summary":"Automates multi-turn adversarial attacks against conversational LLMs using PyRIT orchestrators (RedTeaming, Crescendo, TAP) with scorer feedback and persisted conversation memory.","primaryDomain":"injection","domainTags":["ai-security","llm-red-teaming","prompt-injection","jailbreak","multi-turn-attacks"],"capabilityTags":["multi-turn-attack-orchestration","scorer-driven-attack-loop","gradual-escalation-attacks","tree-of-attacks-with-pruning","prompt-encoding-evasion","conversation-memory-persistence"],"capabilityDetails":["Provides an operational workflow to run automated multi-turn adversarial attacks against conversational LLMs, including scorer feedback loops to determine objective success or failure."],"techniqueTags":["crescendo","tree-of-attacks-with-pruning","red-teaming-orchestrator","self-ask-true-false-scoring","prompt-converters"],"techniqueDetails":["Crescendo gradually escalates benign prompts to harmful ones; TAP branches attack lines in parallel and prunes based on scorer feedback; RedTeamingOrchestrator runs a generic adversarial loop."],"tools":["PyRIT"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on multi-turn, scorer-driven LLM attack orchestration rather than single-shot scanning; bundles multiple orchestrator strategies (Crescendo, TAP) and persisted memory for evidence."],"familyIds":["llm-prompt-injection-red-teaming"]},{"id":"owasp-top-10-testing","summary":"Automated OWASP Top 10:2025 security assessment using Strix agents that attempt real exploits for each category, map findings to OWASP taxonomy, and provide honest coverage reporting, with API Top 10 support and remediation guidance.","primaryDomain":"web-security","domainTags":["web-application-security","api-security"],"capabilityTags":["owasp-top-10-assessment","api-security-testing","exploit-validation","coverage-reporting"],"capabilityDetails":["Provides a structured workflow for running OWASP Top 10:2025 assessments using Strix agents, including category-by-category exploit validation and honest coverage reporting.","Handles API-specific requirements via OWASP API Security Top 10 2023 and distinguishes testable vs non-testable categories."],"techniqueTags":["gray-box-testing","source-assisted-assessment","autonomous-exploitation"],"techniqueDetails":["Uses both source code and a running instance for gray-box testing.","Relies on Strix agents to autonomously attempt real exploits and validate findings.","Systematically walks each OWASP category to map findings to the taxonomy."],"tools":["strix"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","reporting","remediation"],"distinctiveFeatures":["Specifically targets OWASP Top 10:2025 and API Top 10 2023 mappings.","Requires proof-of-concept for each finding; only reports validated exploitable issues.","Explicitly documents categories that are not testable or only partially testable, preventing misleading clean-sweep claims.","Integrates with downstream remediation and CI scanning skills."],"familyIds":["automated-web-vulnerability-scanning"]},{"id":"parsing-artifacts-with-eric-zimmerman-tools","summary":"Provides a command-level playbook for parsing Windows forensic artifacts (MFT, Prefetch, ShellBags, registry, Amcache, ShimCache, LNK, Jump Lists, EVTX) using Eric Zimmerman Tools to produce normalized CSV/JSON and load into Timeline Explorer for DFIR analysis.","primaryDomain":"forensics","domainTags":["dfir","windows-forensics","artifact-parsing","registry-forensics","timeline-analysis"],"capabilityTags":["forensic-artifact-parsing","csv-json-conversion","timeline-analysis","program-execution-evidence","file-access-evidence","registry-analysis"],"capabilityDetails":["Provides a step-by-step workflow for parsing Windows forensic artifacts including MFT, $J, Prefetch, ShellBags, registry hives, Amcache, ShimCache, LNK, Jump Lists, and EVTX using Eric Zimmerman's EZ Tools, producing normalized CSV/JSON output for analysis in Timeline Explorer."],"techniqueTags":["mft-parse","prefetch-parse","registry-hive-parse","shellbags-parse","amcache-parse","shimcache-parse","lnk-parse","evtx-parse","cross-artifact-correlation"],"techniqueDetails":["Uses dedicated EZ Tools for each artifact class: MFTECmd for $MFT/$J, PECmd for Prefetch, SBECmd for ShellBags, RECmd with batch plugins for registry hives, AmcacheParser for Amcache, AppCompatCacheParser for ShimCache, LECmd/JLECmd for LNK/Jump Lists, and EvtxECmd for EVTX. Results are loaded into Timeline Explorer and cross-correlated using UTC timestamps."],"tools":["MFTECmd","PECmd","RECmd","SBECmd","AmcacheParser","AppCompatCacheParser","LECmd","JLECmd","EvtxECmd","Timeline Explorer","Get-ZimmermanTools"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Complete workflow for parsing multiple Windows forensic artifacts via a single tool suite producing consistent CSV/JSON output, with direct integration into Timeline Explorer and cross-artifact correlation steps. It is tool-specific rather than generic DFIR methodology."],"familyIds":["disk-and-file-system-forensics"]},{"id":"path-traversal-lfi","summary":"Expert playbook for detecting and exploiting path traversal and LFI, covering encoding bypasses, PHP wrapper abuse, log/session poisoning to achieve RCE, and server-specific misconfigurations (Tomcat, Nginx, Node.js, IIS).","primaryDomain":"web-security","domainTags":["path-traversal","local-file-inclusion","web-exploitation"],"capabilityTags":["path-traversal-testing","lfi-exploitation","rce-escalation","filter-bypass","php-wrapper-abuse"],"capabilityDetails":["Provides an expert workflow for detecting and exploiting path traversal and LFI, including encoding bypass chains, PHP wrapper abuse, and escalation to RCE via log poisoning."],"techniqueTags":["double-url-encoding","null-byte-injection","log-poisoning","php-filter-chains","path-parameter-normalization","short-filename-enumeration"],"techniqueDetails":["Uses encoding variants (URL, double URL, UTF-8 overlong) to evade filters.","Leverages PHP stream wrappers (php://filter, php://input, data://, phar://) for file read and code execution.","Exploits log files, session files, and /proc/self/environ to inject PHP code and achieve RCE.","Abuses server-specific behaviors such as Tomcat path parameter normalization, Nginx alias misconfigurations, and IIS short filename enumeration."],"tools":["php_filter_chain_generator","php_filter_chains_oracle_exploit","wrapwrap","cnext-exploits","ajpShooter.py","iis_shortname_scanner.jar"],"targetTypes":["web-application","api","linux-host","windows-host","source-code"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["In-depth LFI-to-RCE escalation paths including log poisoning, session poisoning, phpinfo-assisted race, and iconv CVE-2024-2961.","Covers server-specific misconfigurations across Tomcat, Nginx, Node.js, and IIS, making it broader than a generic traversal testing guide.","Includes modern filter chain generation and blind file read oracle tools."],"familyIds":["local-file-inclusion-and-arbitrary-file-download"]},{"id":"pdf","summary":"Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting/decrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"penetration-testing-with-strix","summary":"Operational guide for running Strix autonomous penetration tests via self-hosted CLI or managed cloud API, covering target selection, scan configuration, budget controls, result interpretation, and validated PoC-based findings.","primaryDomain":"general-pentesting","domainTags":["web-security","api-security","source-code-security","network-security"],"capabilityTags":["autonomous-pentesting","proof-of-concept-validation","black-box-testing","white-box-testing","api-spec-testing"],"capabilityDetails":["Runs Strix AI agents to automatically test web apps, APIs, repositories, domains, and IPs, and only reports findings validated with working proof-of-concept exploits instead of just flagging potential issues.","Supports both a self-hosted open-source CLI (Docker, BYO LLM) and a managed cloud API, sharing the same engine and output format."],"techniqueTags":["ai-agent-based-testing","dynamic-analysis","static-analysis","exploitation-validation"],"techniqueDetails":["AI agents dynamically interact with targets and attempt to exploit vulnerabilities to confirm them, covering OWASP Top 10 and beyond (injection, XSS, SSRF, auth flaws, IDOR, business logic).","Provides white-box testing via local path or repository targets, black-box testing via URLs, and API testing via OpenAPI/Swagger or Postman specs."],"tools":["strix","docker","curl","jq"],"targetTypes":["web-application","api","source-code","network"],"role":"tool-guide","workflowFocus":["detection","validation","exploitation","reporting"],"distinctiveFeatures":["Explicitly differentiates between self-hosted OSS CLI and managed Cloud API paths, with a decision framework for choosing between them based on environment, privacy, CI, and team needs.","Emphasizes validated findings with PoC evidence over unconfirmed flags, and details exit codes, budget/turn caps, and artifacts for interpreting scan coverage and completeness.","Provides direct commands and flags for running Strix scans, including target lists, workspace files, scan modes, resume, and diff-scope for code targets."],"familyIds":["strix-security-testing-and-remediation-workflows"]},{"id":"pentest-report","summary":"Generates standardized penetration test reports in Markdown with a fixed structure: project info table, vulnerability summary, detailed findings with PoC and remediation, and appendix sections including CVSS explanations. It maps CVSS scores to risk levels, enforces formatting rules, and outputs reports to a specified directory.","primaryDomain":"reporting","domainTags":["security-reporting","documentation"],"capabilityTags":["report-generation","vulnerability-summary","risk-level-assessment","remediation-documentation"],"capabilityDetails":["Generates a complete penetration test report with required sections in Markdown format.","Assigns vulnerability IDs and maps CVSS scores to risk levels.","Structures each finding with description, PoC, evidence, and remediation sub-sections."],"techniqueTags":["markdown-table-format","cvss-score-mapping","vulnerability-id-scheme","risk-level-definitions"],"techniqueDetails":["Uses a standardized vulnerability ID format (VL-001, VL-002, etc.).","Maps CVSS v3.1 numerical scores to five risk levels with emoji icons.","Enforces Markdown tables and code blocks with language identifiers."],"tools":[],"targetTypes":["other"],"role":"reporting","workflowFocus":["reporting"],"distinctiveFeatures":["Strictly enforces a fixed report structure with mandatory chapters and appendix items.","Provides a detailed CVSS-to-risk-level mapping table and naming conventions.","Specifies a report output directory and file naming format."],"familyIds":["pentest-vulnerability-report-generation"]},{"id":"performing-access-recertification-with-saviynt","summary":"Operational playbook for running access recertification campaigns in Saviynt EIC, including campaign configuration, API automation, monitoring, and remediation to support compliance audits.","primaryDomain":"security-knowledge","domainTags":["identity-governance","access-reviews","compliance-audit"],"capabilityTags":["access-recertification","certification-campaign-management","access-review-orchestration","privileged-access-remediation"],"capabilityDetails":["Provides an operational workflow to configure, launch, monitor, and remediate access recertification campaigns in Saviynt Enterprise Identity Cloud."],"techniqueTags":["campaign-lifecycle-management","saviynt-api-automation","certifier-decision-collection","remediation-ticket-integration"],"techniqueDetails":["Uses Saviynt admin console and REST API to create and launch campaigns, monitor progress, and execute revocation tasks."],"tools":["saviynt","python","requests"],"targetTypes":["other","api","cloud"],"role":"specialist-playbook","workflowFocus":["analysis","validation","remediation","reporting"],"distinctiveFeatures":["Enterprise identity governance workflow rather than offensive security; covers full campaign lifecycle from configuration to remediation with Saviynt-specific APIs and compliance evidence generation."],"familyIds":["compliance-governance"]},{"id":"performing-access-review-and-certification","summary":"Designs and runs access review and certification campaigns for IAM compliance, covering scoping, reviewer selection, risk-based prioritization, remediation tracking, and audit evidence generation for SOX, HIPAA, and PCI DSS.","primaryDomain":"authentication","domainTags":["identity-access-management","access-governance","compliance","authorization"],"capabilityTags":["access-review","access-certification","risk-based-prioritization","remediation-tracking"],"capabilityDetails":["Provides a workflow for designing and running access review and certification campaigns, including scoping, reviewer assignment, risk prioritization, and remediation tracking."],"techniqueTags":["user-access-review","entitlement-review","role-review","privileged-access-review","sod-review"],"techniqueDetails":["Uses review types such as user access review, entitlement review, role review, privileged access review, and separation-of-duty review to verify access rights."],"tools":["python"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation","reporting"],"distinctiveFeatures":["Focuses on compliance-driven access recertification and audit evidence rather than technical identity attacks or enforcement.","Emphasizes campaign governance: scoping, reviewer selection, risk prioritization, and exception management."],"familyIds":["access-governance-and-certification"]},{"id":"performing-active-directory-bloodhound-analysis","summary":"Workflow for using BloodHound/SharpHound/AzureHound to enumerate AD relationships, identify attack paths to Domain Admin via Cypher queries, and understand common escalation chains and remediations.","primaryDomain":"active-directory","domainTags":["bloodhound","active-directory-recon","attack-path-analysis"],"capabilityTags":["bloodhound-analysis","ad-attack-path-mapping","privilege-escalation-discovery"],"capabilityDetails":["Provides a step-by-step workflow for collecting Active Directory relationship data with SharpHound/AzureHound, importing into BloodHound, and using Cypher queries to map attack paths from a compromised user to Domain Admin."],"techniqueTags":["kerberoasting","as-rep-roasting","acl-abuse","delegation-abuse","gpo-abuse","trust-abuse","dcsync","cypher-querying"],"techniqueDetails":["Covers attack paths involving Kerberoasting, AS-REP Roasting, ACL abuse (GenericAll/WriteDACL/AddMember), unconstrained/constrained delegation, GPO modification, cross-domain trust abuse, and DCSync rights.","Uses BloodHound's pre-built and custom Cypher queries to enumerate domain relationships and identify privilege escalation chains."],"tools":["BloodHound","SharpHound","AzureHound","Neo4j","Cypher"],"targetTypes":["active-directory","windows-host","cloud"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on graph-based Active Directory attack path analysis using BloodHound, including both BloodHound CE and Legacy workflows.","Covers data collection with SharpHound (exe/PowerShell) and AzureHound for Azure AD.","Provides common attack path patterns (Kerberoasting, ACL abuse, delegation, GPO) and corresponding Cypher queries."],"familyIds":["active-directory-reconnaissance-and-path-mapping"]},{"id":"performing-active-directory-compromise-investigation","summary":"Provides a structured incident response methodology for investigating Active Directory compromises, including analysis of NTDS.dit, Kerberos ticket anomalies, Group Policy modifications, and privileged group changes, with remediation guidance.","primaryDomain":"active-directory","domainTags":["windows-security","identity-forensics","incident-response"],"capabilityTags":["ad-compromise-investigation","kerberos-attack-detection","gpo-abuse-detection","privileged-group-audit"],"capabilityDetails":["Provides a phased investigation methodology for Active Directory compromise, covering scoping, evidence collection, authentication log analysis, persistence detection, and remediation planning."],"techniqueTags":["golden-ticket-detection","silver-ticket-detection","kerberoasting-detection","dcsync-detection","pass-the-hash-detection","sid-history-injection-detection"],"techniqueDetails":["Uses Windows Event IDs and AD artifacts to identify Kerberos ticket anomalies, replication-based credential extraction, Group Policy abuse, and privilege escalation paths."],"tools":["BloodHound","Pingcastle","Purple Knight","ADRecon","Mimikatz","Impacket","Velociraptor","Timeline Explorer","repadmin","ntdsutil"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on post-compromise forensic investigation of Active Directory, differentiating between attack techniques (Golden Ticket, DCSync, Kerberoasting) and providing concrete detection indicators and remediation actions."],"familyIds":["active-directory-incident-investigation"]},{"id":"performing-active-directory-forest-trust-attack","summary":"Impacket-based workflow to enumerate AD forest trust relationships, audit SID filtering and SID history for cross-forest privilege escalation, and assess inter-realm Kerberos ticket risks.","primaryDomain":"active-directory","domainTags":["active-directory","forest-trust","kerberos","sid-filtering"],"capabilityTags":["trust-enumeration","sid-filtering-analysis","sid-history-abuse-detection","kerberos-ticket-assessment","forest-trust-audit"],"capabilityDetails":["Provides a workflow to enumerate and audit AD forest trust relationships, analyze SID filtering status, detect SID history abuse vectors, and assess inter-realm Kerberos tickets for cross-forest privilege escalation."],"techniqueTags":["ldap-trust-enumeration","lsar-sid-lookup","sid-history-analysis","kerberos-ticket-inspection"],"techniqueDetails":["Uses LDAP queries to trusted domain objects, LSA RPC calls (LsarLookupNames3) for cross-forest SID resolution, and Kerberos ticket attribute review to expose trust misconfigurations."],"tools":["impacket","ldap3"],"targetTypes":["active-directory"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection","validation","exploitation","reporting"],"distinctiveFeatures":["Targets cross-forest trust relationships specifically, combining SID filtering/history analysis with inter-realm Kerberos ticket assessment—distinct from general AD enumeration or single-domain privilege escalation playbooks."],"familyIds":["ad-forest-trust-attacks"]},{"id":"performing-active-directory-penetration-test","summary":"A practical playbook for executing an authorized Active Directory penetration test from a standard user foothold, covering enumeration, Kerberos and ADCS attacks, DCSync, persistence, and remediation guidance to demonstrate full domain compromise.","primaryDomain":"active-directory","domainTags":["active-directory","kerberos","adcs","privilege-escalation","domain-compromise"],"capabilityTags":["ad-enumeration","kerberos-abuse","adcs-abuse","domain-escalation","persistence-demonstration"],"capabilityDetails":["Provides an end-to-end Active Directory penetration testing workflow starting from a standard domain user and aiming for Domain Admin or Enterprise Admin.","Covers enumeration with BloodHound/NetExec/LDAP, Kerberos attacks (Kerberoasting, AS-REP roasting, delegation abuse), ADCS attacks (ESC1-8), DCSync, and persistence techniques."],"techniqueTags":["kerberoasting","as-rep-roasting","unconstrained-delegation","constrained-delegation","resource-based-constrained-delegation","dcsync","golden-ticket","silver-ticket","skeleton-key"],"techniqueDetails":["Includes specific tool commands for each technique, such as impacket-GetUserSPNs for Kerberoasting, impacket-GetNPUsers for AS-REP roasting, impacket-getST for delegation abuse, certipy for ADCS exploits, and impacket-secretsdump for DCSync."],"tools":["BloodHound","SharpHound","Impacket","Certipy","Rubeus","NetExec","Mimikatz","ldapsearch","hashcat"],"targetTypes":["active-directory","windows-host","network"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","analysis","exploitation","post-exploitation","remediation"],"distinctiveFeatures":["Comprehensive AD pentest lifecycle from initial enumeration to domain compromise and persistence, covering both Kerberos and ADCS attack paths.","Includes a remediation table with CVSS scores for each finding, bridging offensive testing to defensive recommendations.","Integrates multiple open-source offensive tools into a single coherent methodology rather than focusing on a single tool."],"familyIds":["comprehensive-ad-attack-simulation"]},{"id":"performing-active-directory-vulnerability-assessment","summary":"Comprehensive Active Directory vulnerability assessment playbook combining PingCastle health checks, BloodHound attack path analysis, and Purple Knight security scoring to identify misconfigurations, privilege escalation paths, and Kerberos weaknesses, with remediation prioritization.","primaryDomain":"active-directory","domainTags":["active-directory-security","ad-assessment","identity-management"],"capabilityTags":["ad-vulnerability-assessment","attack-path-analysis","security-posture-scoring","misconfiguration-detection"],"capabilityDetails":["Provides a comprehensive workflow for assessing Active Directory security posture using PingCastle, BloodHound, and Purple Knight.","Covers detection of misconfigurations, privilege escalation paths, Kerberos weaknesses, and lateral movement opportunities."],"techniqueTags":["kerberoasting","as-rep-roasting","unconstrained-delegation","gpo-abuse","llmnr-poisoning"],"techniqueDetails":["Uses BloodHound Cypher queries to identify Kerberoastable accounts, AS-REP roastable accounts, and delegation abuse paths.","Uses PingCastle health checks to detect stale objects, privileged account sprawl, and trust misconfigurations."],"tools":["PingCastle","BloodHound","SharpHound","Purple Knight","PowerShell"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","analysis","remediation"],"distinctiveFeatures":["Integrates three complementary AD assessment tools (PingCastle, BloodHound, Purple Knight) into a single workflow, covering health check, attack path analysis, and security posture scoring.","Provides concrete remediation priorities and PowerShell commands for validating common AD vulnerabilities."],"familyIds":["active-directory-vulnerability-assessment"]},{"id":"performing-adversary-in-the-middle-phishing-detection","summary":"Detect and respond to Adversary-in-the-Middle phishing attacks that bypass MFA via reverse proxy kits, using Azure AD/Entra sign-in logs, SIEM, EDR, Conditional Access, and post-compromise monitoring.","primaryDomain":"authentication","domainTags":["phishing","mfa-bypass","session-hijacking","identity-security"],"capabilityTags":["aitm-phishing-detection","mfa-bypass-detection","session-cookie-theft-detection","log-correlation","detection-rule-building"],"capabilityDetails":["Provides a workflow for detecting and responding to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits to bypass MFA and steal session tokens.","Covers deployment of phishing-resistant MFA, Conditional Access policies, detection rule creation, and post-compromise monitoring."],"techniqueTags":["reverse-proxy-phishing","session-cookie-replay","phishing-resistant-mfa","impossible-travel-analysis","threat-intelligence"],"techniqueDetails":["Explains the AiTM attack chain: victim clicks link, attacker proxies login page, captures credentials and session cookie, replays cookie to bypass MFA.","Lists detection indicators such as unusual IP authentication, session cookie reuse, and impossible travel.","Covers detection rules for sign-in followed by session from different IP, new MFA registration, inbox rules, and OAuth consent."],"tools":["Microsoft Entra ID Protection","Azure AD Sign-in Logs","Okta ThreatInsight","Sekoia TDR","Evilginx"],"targetTypes":["cloud","web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Focuses specifically on AiTM phishing using reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA, rather than general phishing detection.","Emphasizes defensive detection and response through Azure AD/Entra ID sign-in logs, SIEM, EDR, and Conditional Access, not attacker exploitation."],"familyIds":["adversary-in-the-middle-phishing"]},{"id":"performing-agentless-vulnerability-scanning","summary":"Provides practical workflows for performing agentless vulnerability scanning on Linux, Windows, and cloud environments using SSH, WMI/WinRM, cloud snapshot analysis, and the Vuls scanner; includes Python automation examples and operational best practices.","primaryDomain":"general-pentesting","domainTags":["vulnerability-management","cloud-security","network-security"],"capabilityTags":["agentless-vulnerability-scanning","system-package-enumeration","windows-hotfix-enumeration","cloud-snapshot-analysis","scan-automation"],"capabilityDetails":["Enables vulnerability scanning without installing endpoint agents using SSH, WMI/WinRM, cloud snapshot analysis, and API-based discovery.","Includes Python automation for Linux and Windows remote enumeration.","Supports open-source Vuls workflow for Linux/FreeBSD and containerized environments."],"techniqueTags":["ssh-command-execution","wmi-remote-query","winrm-powershell","ebs-snapshot-analysis","vuls-agentless-scan"],"techniqueDetails":["Uses SSH to enumerate packages, kernel version, and listening ports on Linux.","Uses WinRM/WMI to collect installed hotfixes, software, and OS info on Windows.","Uses AWS EBS snapshots for out-of-band disk analysis without endpoint interaction.","Uses Vuls with scan modes like fast and fast-root for agentless vulnerability detection."],"tools":["vuls","paramiko","pywinrm","boto3"],"targetTypes":["linux-host","windows-host","network","cloud","container"],"role":"workflow","workflowFocus":["enumeration","analysis","detection"],"distinctiveFeatures":["Covers multiple agentless methods in one skill, unlike skills focused on a single tool.","Includes cloud snapshot analysis as a core method for cloud VMs.","Provides custom Python scanner classes for both Linux and Windows.","Emphasizes cleanup and credential management for agentless scanning."],"familyIds":["vulnerability-scanning"]},{"id":"performing-ai-driven-osint-correlation","summary":"Produces unified, confidence-scored intelligence profiles by correlating OSINT data from Sherlock, theHarvester, SpiderFoot, and breach databases using AI/LLM reasoning.","primaryDomain":"reconnaissance","domainTags":["osint","threat-intelligence","identity-correlation","link-analysis"],"capabilityTags":["osint-correlation","entity-resolution","confidence-scoring","intelligence-reporting"],"capabilityDetails":["Provides a workflow to normalize OSINT findings from multiple tools into a common schema and correlate them using an LLM to produce confidence-scored intelligence profiles."],"techniqueTags":["username-enumeration","email-harvesting","passive-recon","breach-data-lookup","ai-correlation"],"techniqueDetails":["Uses Sherlock for username enumeration across platforms.","Uses theHarvester for email and subdomain discovery.","Uses SpiderFoot for passive OSINT collection.","Queries HaveIBeenPwned for breach data.","Applies LLM reasoning to correlate findings and assign confidence scores."],"tools":["sherlock","theharvester","spiderfoot","haveibeenpwned","maltego"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis","validation","reporting"],"distinctiveFeatures":["Uses AI/LLM to correlate and score OSINT findings rather than just running tools","Provides confidence-scored identity linkage and entity resolution","Combines Sherlock, theHarvester, SpiderFoot, and breach data into one workflow"],"familyIds":["osint-threat-actor-profiling"]},{"id":"performing-alert-triage-with-elastic-siem","summary":"Provides SOC analysts a practical, time-boxed workflow for triaging Elastic Security alerts, using ES|QL queries and ECS fields to gather context and a classification matrix to prioritize and document response actions.","primaryDomain":"security-knowledge","domainTags":["soc-operations","alert-triage","siem","elastic"],"capabilityTags":["alert-triage","security-operations","investigation-workflow","priority-assessment"],"capabilityDetails":["Provides a structured workflow for triaging security alerts in Elastic SIEM, including assessment, context gathering, classification, and escalation."],"techniqueTags":["esql-querying","ecs-field-analysis","threat-intelligence-enrichment","alert-classification"],"techniqueDetails":["Uses ES|QL queries over ECS-normalized data to gather context and related alerts, applies threat intelligence checks, and classifies alerts using defined criteria."],"tools":["elastic-security","kibana","esql"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Focuses exclusively on Elastic Security SIEM alert triage, with concrete ES|QL queries and an alert classification/prioritization matrix."],"familyIds":["siem-operations-and-optimization"]},{"id":"performing-android-app-static-analysis-with-mobsf","summary":"Provides a step-by-step automated static analysis workflow for Android APK/AAB files using MobSF, covering manifest misconfigurations, hardcoded secrets, insecure cryptography, and network security issues, with CI/CD integration and OWASP Mobile Top 10 alignment.","primaryDomain":"mobile-security","domainTags":["android-security","mobile-application-security","static-analysis"],"capabilityTags":["android-static-analysis","mobsf-scanning","hardcoded-secret-detection","manifest-analysis","owasp-mobile-assessment"],"capabilityDetails":["Provides an automated workflow for static analysis of Android APK/AAB files using MobSF, including file upload, scan triggering, and report retrieval via REST API.","Covers detection of exported components, debuggable backups, hardcoded credentials, weak cryptography, missing certificate pinning, and insufficient binary protections.","Includes guidance for integrating MobSF scanning into CI/CD pipelines as a security gate."],"techniqueTags":["static-analysis","apk-decompilation","manifest-analysis","code-analysis","ci-cd-integration"],"techniqueDetails":["Uses MobSF's automated decompilation via JADX and resource indexing to analyze code and manifest without executing the app.","Applies OWASP Mobile Top 10 categories to classify findings across manifest, code, network, and binary analysis.","Leverages MobSF REST API endpoints for upload, scan, report generation, and scorecard-based CI/CD gating."],"tools":["MobSF","JADX","apktool","Semgrep","Android Lint"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses specifically on automated static analysis of Android apps using MobSF, rather than general mobile security methodology.","Includes step-by-step REST API commands and CI/CD integration examples, making it directly executable for automation.","Explicitly maps findings to OWASP Mobile Top 10 2024 categories and highlights limitations against obfuscated or native code."],"familyIds":["android-static-security-analysis"]},{"id":"performing-api-fuzzing-with-restler","summary":"Provides a stateful REST API fuzzing workflow using Microsoft RESTler: compiles OpenAPI/Swagger specs into a fuzzing grammar, configures authentication, and runs test/fuzz-lean/full fuzz modes with security checkers to find 500 errors, auth bypasses, resource leaks, and injection bugs.","primaryDomain":"api-security","domainTags":["api-security","fuzzing","rest-api","openapi"],"capabilityTags":["api-fuzzing","stateful-fuzzing","openapi-spec-compilation","authentication-configuration","bug-detection"],"capabilityDetails":["Compiles OpenAPI/Swagger v2/v3 specifications into a RESTler fuzzing grammar.","Maintains state across requests by inferring producer-consumer dependencies, enabling multi-step API workflow testing.","Supports authenticated fuzzing via token refresh scripts and engine settings.","Runs test, fuzz-lean, and full fuzz modes with built-in security checkers for use-after-free, namespace isolation, resource leaks, and information leakage.","Provides custom dictionary support for injection payloads targeting SQLi, XSS, path traversal, and template injection."],"techniqueTags":["stateful-fuzzing","producer-consumer-dependency","grammar-based-fuzzing","security-checker","custom-payload-dictionary"],"techniqueDetails":["Uses RESTler's compiled grammar to generate request sequences that maintain state via producer-consumer dependencies.","Leverages checkers like UseAfterFree, NamespaceRule, ResourceHierarchy, LeakageRule, and InvalidDynamicObject to detect specific vulnerability patterns.","Custom dictionary injects application-specific payloads for SQLi, XSS, path traversal, template injection, and boundary values."],"tools":["RESTler","Python"],"targetTypes":["api"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Focuses specifically on stateful REST API fuzzing with RESTler, compiling OpenAPI specs into grammars and using producer-consumer dependencies to uncover bugs requiring multi-step request sequences.","Includes concrete authentication token refresh configuration and custom fuzzing dictionaries for injection payloads.","Differentiates from generic API scanners by emphasizing built-in security checkers and resource lifecycle testing."],"familyIds":["automated-api-security-testing"]},{"id":"performing-api-inventory-and-discovery","summary":"Builds a comprehensive API catalog through passive HAR analysis, DNS/subdomain enumeration, active path probing, JavaScript extraction, and cloud API gateway inventory, and classifies discovered endpoints as documented, shadow, or zombie APIs to map the full API attack surface.","primaryDomain":"api-security","domainTags":["shadow-api","api-inventory","attack-surface","owasp-api9"],"capabilityTags":["api-discovery","shadow-api-detection","zombie-api-detection","api-inventory-audit","attack-surface-mapping"],"capabilityDetails":["Provides a multi-method workflow to inventory all API endpoints in an organization, using passive traffic analysis (HAR), DNS/subdomain enumeration, active path probing, JavaScript source extraction, and cloud API gateway enumeration; cross-references results with documented inventory to identify shadow, zombie, and deprecated APIs."],"techniqueTags":["passive-traffic-analysis","dns-enumeration","http-path-probing","javascript-source-analysis","cloud-api-gateway-inventory","endpoint-normalization"],"techniqueDetails":["Uses HAR file parsing to normalize URLs and extract endpoint patterns; amass/subfinder for API subdomain discovery; httpx/curl for live probing of common API paths; regex extraction of API URLs from JS bundles; boto3 for AWS API Gateway resource enumeration; endpoint normalization and version detection to classify shadow vs zombie APIs."],"tools":["amass","subfinder","httpx","nuclei","curl","boto3","Burp Suite Professional","LinkFinder","JS-Miner"],"targetTypes":["api","web-application","network","cloud"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","analysis","detection"],"distinctiveFeatures":["Focuses exclusively on API inventory/discovery, not endpoint vulnerability testing; combines passive and active sources (HAR, DNS, HTTP probing, JS, cloud gateways) to find undocumented shadow APIs and deprecated zombie APIs; maps directly to OWASP API9:2023."],"familyIds":["api-asset-inventory-and-posture-management"]},{"id":"performing-api-rate-limiting-bypass","summary":"A specialist playbook for discovering, validating, and exploiting API rate-limiting bypasses via header spoofing, path/method/content-type variations, account rotation, parameter pollution, and race conditions, with mapping to OWASP API4:2023.","primaryDomain":"api-security","domainTags":["api-security","rate-limiting","throttling","owasp-api-security"],"capabilityTags":["rate-limit-discovery","rate-limit-bypass-testing","brute-force-enabling","resource-exhaustion-testing"],"capabilityDetails":["Provides a hands-on workflow for discovering and bypassing API rate limiting controls using Python (requests/aiohttp) and Burp Suite Turbo Intruder.","Covers multiple bypass categories: IP spoofing headers, path normalization variations, HTTP method/content-type switching, account identifier rotation, parameter pollution, and race-condition/concurrency testing.","Maps findings to OWASP API4:2023 Unrestricted Resource Consumption and includes a structured finding template."],"techniqueTags":["header-based-ip-spoofing","path-normalization-bypass","http-method-switching","content-type-switching","account-rotation","parameter-pollution","race-condition-testing"],"techniqueDetails":["Uses spoofable headers such as X-Forwarded-For to trick IP-based rate limiting.","Tests path variations like trailing slashes, case changes, API version changes, and path traversal sequences to evade endpoint-scoped limits.","Switches HTTP methods and Content-Type values to find rate limits that are enforced only for specific request shapes.","Rotates usernames or adds random query parameters to bypass per-account or request-identity counters.","Uses concurrent async requests to exploit race conditions in rate limit counters."],"tools":["Python requests","aiohttp","Burp Suite Turbo Intruder","ffuf","wfuzz","Postman Collection Runner","k6"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focused exclusively on API rate-limit bypass rather than general API security testing.","Provides concrete executable Python snippets and async/concurrent testing methodology for rate limit evasion.","Includes a realistic login endpoint scenario and a finding output template with severity, OWASP mapping, impact, and remediation."],"familyIds":["api-rate-limiting-security"]},{"id":"performing-api-security-testing-with-postman","summary":"Provides a Postman-based automated workflow to create and run API security regression tests covering OWASP API Top 10 (BOLA, BFLA, authentication, data exposure, injection, mass assignment, rate limiting), including multi-role environment setup and Newman/GitHub Actions CI/CD integration.","primaryDomain":"api-security","domainTags":["authorization","authentication","injection","data-exposure"],"capabilityTags":["api-security-testing","security-regression-testing","automated-testing","owasp-api-top-10"],"capabilityDetails":["Provides a structured Postman workflow to create and run automated API security regression tests covering OWASP API Top 10 categories.","Supports multi-role environment setup and CI/CD integration via Newman and GitHub Actions."],"techniqueTags":["postman-scripting","newman-cli","multi-role-environment","owasp-zap-proxy"],"techniqueDetails":["Uses Postman pre-request scripts to dynamically authenticate and manage tokens.","Uses Postman test scripts to assert security controls on responses.","Runs collections via Newman CLI in CI/CD pipelines with configurable reporters.","Configures OWASP ZAP as a proxy to passively scan Postman requests."],"tools":["Postman","Newman","OWASP ZAP","newman-reporter-htmlextra"],"targetTypes":["api"],"role":"specialist-playbook","workflowFocus":["detection","validation","reporting"],"distinctiveFeatures":["Focuses specifically on Postman-based automated API security regression testing rather than manual pentesting or general vulnerability scanning.","Covers OWASP API Security Top 10 with ready-to-use test scripts for BOLA, BFLA, authentication, data exposure, mass assignment, and rate limiting.","Includes multi-role environment setup and CI/CD integration with Newman and GitHub Actions for repeatable security testing."],"familyIds":["automated-api-security-testing"]},{"id":"performing-arp-spoofing-attack-simulation","summary":"Simulates ARP spoofing/cache-poisoning attacks in authorized lab or pentest environments using arpspoof, Ettercap, and Scapy, demonstrating man-in-the-middle risk and validating Dynamic ARP Inspection, port security, and network monitoring detections.","primaryDomain":"network-security","domainTags":["network-security","arp-spoofing","man-in-the-middle","layer2-attack"],"capabilityTags":["arp-spoofing-simulation","man-in-the-middle-testing","network-defenses-validation","traffic-interception","detection-testing"],"capabilityDetails":["Provides a step-by-step workflow for simulating ARP cache poisoning attacks in authorized environments, demonstrating MITM risk and validating network security controls such as DAI, port security, and monitoring systems."],"techniqueTags":["arp-cache-poisoning","arp-spoofing","gratuitous-arp","man-in-the-middle","scapy-packet-crafting"],"techniqueDetails":["Uses spoofed ARP replies to associate the attacker's MAC with a legitimate IP, redirecting traffic through the attacker host; includes a custom Scapy script for on-demand spoofing and restoration."],"tools":["arpspoof","ettercap","scapy","arp-scan","nmap","tcpdump","tshark","wireshark"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["reconnaissance","exploitation","detection","validation","analysis"],"distinctiveFeatures":["Focuses specifically on ARP spoofing simulation to validate network security controls (DAI, port security, IDS/SIEM) rather than general network penetration testing; includes both command-line utilities and a custom Scapy script, plus a structured DAI effectiveness test scenario."],"familyIds":["network-adversary-simulation"]},{"id":"performing-asset-criticality-scoring-for-vulns","summary":"Defines a multi-factor asset criticality scoring framework that assigns 1-5 tiers based on business function impact, data sensitivity, regulatory scope, network exposure, recoverability, and user population, and uses those tiers to adjust vulnerability remediation SLAs for risk-proportional patching.","primaryDomain":"security-knowledge","domainTags":["asset-criticality","vulnerability-prioritization","risk-management","cmdb","business-impact","crown-jewels","asset-classification"],"capabilityTags":["asset-criticality-scoring","vulnerability-prioritization","business-impact-assessment","risk-based-sla-adjustment","asset-classification"],"capabilityDetails":["Provides a model and workflow for scoring asset criticality based on business function impact, data sensitivity, regulatory scope, network exposure, recoverability, and user population, producing a 1-5 asset tier that adjusts vulnerability remediation SLAs."],"techniqueTags":["multi-factor-weighted-scoring","criticality-tier-classification","sla-modifier-calculation"],"techniqueDetails":["Uses weight percentages (e.g., 25% business function, 25% data sensitivity) and score ranges to calculate a weighted criticality score, then maps the score to a tier via thresholds and applies SLA modifiers."],"tools":["python"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","remediation"],"distinctiveFeatures":["Distinctively provides a concrete, weighted asset criticality scoring model with specific factor weights, tier thresholds, SLA modifiers, and Python implementation, enabling risk-based vulnerability prioritization directly from CMDB and BIA data."],"familyIds":["vulnerability-prioritization-and-risk-scoring"]},{"id":"performing-authenticated-scan-with-openvas","summary":"Step-by-step guide to configure and run OpenVAS/GVM authenticated vulnerability scans using SSH, SMB, or ESXi credentials, including credential creation, target/task setup, scheduling, report export, and authentication validation.","primaryDomain":"network-security","domainTags":["vulnerability-management","openvas","gvm","authenticated-scan","credentialed-scan"],"capabilityTags":["authenticated-vulnerability-scanning","credential-configuration","scan-task-management","report-export"],"capabilityDetails":["Provides complete workflow for creating scan credentials, targets, tasks, and schedules in GVM.","Supports authenticated scanning of Linux (SSH), Windows (SMB), and VMware ESXi hosts.","Includes validation steps to confirm successful authentication during scans."],"techniqueTags":["ssh-authentication","smb-authentication","esxi-authentication","gmp-cli","python-gvm"],"techniqueDetails":["Uses GMP protocol via gvm-cli and python-gvm for credential, target, and report management.","Uses OpenVAS built-in scan configurations and custom cloned configs.","Verifies authentication via specific NVT result OIDs."],"tools":["openvas","gvm","greenbone","gvm-cli","python-gvm"],"targetTypes":["linux-host","windows-host","network","other"],"role":"tool-guide","workflowFocus":["detection","validation","reporting"],"distinctiveFeatures":["Explicitly covers credentialed scanning setup for three auth types (SSH, SMB, ESXi) in OpenVAS/GVM.","Includes instructions for scheduling scans and verifying authentication success from scan results."],"familyIds":["vulnerability-scanning-management"]},{"id":"performing-authenticated-vulnerability-scan","summary":"Operational playbook for planning and executing authenticated vulnerability scans using scanners like Nessus with SSH, SMB, WinRM, or SNMPv3 credentials, including service account setup, scanner credential configuration, credential validation, and verification of local security checks.","primaryDomain":"general-pentesting","domainTags":["vulnerability-management","credentialed-scanning","patch-assessment"],"capabilityTags":["authenticated-vulnerability-scanning","credential-management","scanner-configuration"],"capabilityDetails":["Provides a workflow for planning and executing credentialed vulnerability scans using scanners such as Nessus, Qualys, OpenVAS, or Rapid7 InsightVM, including service account creation, scanner credential configuration, credential validation, and scan verification."],"techniqueTags":["ssh-authentication","smb-authentication","winrm-authentication","snmpv3-authentication"],"techniqueDetails":["Uses platform-specific credentials (SSH, SMB, WinRM, SNMPv3) to directly query installed software, patches, and configurations on target systems, enabling deeper inspection than unauthenticated scanning."],"tools":["Nessus","Qualys","OpenVAS","Rapid7 InsightVM"],"targetTypes":["linux-host","windows-host","network","database"],"role":"specialist-playbook","workflowFocus":["detection"],"distinctiveFeatures":["Focuses specifically on credentialed vulnerability scanning with detailed guidance for setting up dedicated service accounts, configuring scanner credentials across multiple platforms, validating access, and verifying scan success via Nessus plugins."],"familyIds":["vulnerability-scanning"]},{"id":"performing-automated-malware-analysis-with-cape","summary":"Operational playbook for deploying and using CAPEv2 to automatically analyze malware samples in a sandboxed Windows VM, capturing behavioral signatures, network traffic, dropped files, and extracting configurations for known malware families.","primaryDomain":"forensics","domainTags":["malware-analysis","sandboxing","behavioral-analysis","payload-extraction"],"capabilityTags":["automated-sample-submission","behavioral-monitoring","config-extraction","network-traffic-capture","dropped-file-collection","anti-evasion-debugging"],"capabilityDetails":["Provides an operational workflow to deploy and operate the CAPEv2 malware sandbox for automated dynamic analysis of suspicious files.","Enables submission of samples via REST API, monitoring of analysis progress, retrieval of full reports, and extraction of malware configurations, network IOCs, and dropped files.","Includes anti-evasion debugger techniques to bypass sandbox-aware malware."],"techniqueTags":["api-hooking","yara-signatures","pcap-analysis","debugger-anti-evasion","cape-parsers"],"techniqueDetails":["CAPEv2 uses API hooking for behavioral instrumentation within a Windows guest VM.","YARA signatures trigger behavioral detection and can combine debugger actions for anti-evasion.","Network traffic is captured in PCAP format and IOCs are extracted from DNS, HTTP, and TCP connections.","cape-parsers (70+) extract configuration from families like Emotet, TrickBot, Cobalt Strike, AsyncRAT, and Rhadamanthys."],"tools":["CAPEv2","Cuckoo","cape-parsers","YARA"],"targetTypes":["windows-host","binary","network"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses specifically on CAPEv2 deployment and automation via its REST API, distinguishing it from generic malware analysis methodology.","Emphasizes configuration and payload extraction using cape-parsers, a unique feature compared to standard sandboxing approaches.","Includes anti-evasion debugger tricks within YARA signatures to handle sandbox-aware malware."],"familyIds":["malware-sample-analysis-and-ioc-extraction"]},{"id":"performing-aws-account-enumeration-with-scout-suite","summary":"Step-by-step guide for installing and running ScoutSuite against an AWS account to enumerate resources, identify misconfigurations, and generate interactive HTML security reports.","primaryDomain":"cloud-security","domainTags":["aws","cloud-security","security-audit","misconfiguration"],"capabilityTags":["aws-account-enumeration","misconfiguration-detection","security-posture-assessment","cspm"],"capabilityDetails":["Provides a workflow for installing, configuring, and running ScoutSuite against an AWS account to enumerate cloud resources and identify security misconfigurations."],"techniqueTags":["agentless-scanning","aws-api-enumeration","rule-based-checking","report-generation"],"techniqueDetails":["Uses read-only AWS API calls to inventory resources across services and evaluates them against security rules to produce severity-rated findings."],"tools":["scoutsuite","aws-cli"],"targetTypes":["cloud"],"role":"tool-guide","workflowFocus":["enumeration","analysis","detection","reporting"],"distinctiveFeatures":["Agentless multi-cloud security auditing with ScoutSuite, focused on generating interactive HTML reports and rule-based misconfiguration checks across AWS services."],"familyIds":["cloud-security-posture-assessment"]},{"id":"performing-aws-privilege-escalation-assessment","summary":"Authorized workflow for discovering and validating AWS IAM privilege escalation paths using Pacu, PMapper, and CloudFox, including manual IAM policy and cross-account trust analysis, with remediation guidance.","primaryDomain":"cloud-security","domainTags":["aws","iam","identity-management"],"capabilityTags":["privilege-escalation-testing","iam-policy-analysis","attack-path-mapping","cross-account-trust-review"],"capabilityDetails":["Provides an end-to-end workflow for authorized AWS IAM privilege escalation assessment, from enumerating starting permissions to documenting exploitable paths and remediation."],"techniqueTags":["iam-policy-version-manipulation","iam-passrole-abuse","sts-assume-role-abuse","cross-account-trust-abuse","attack-path-graph-analysis"],"techniqueDetails":["Uses Pacu's iam__privesc_scan to check 21+ known escalation methods, PMapper graph queries to identify paths to admin, manual trust policy review for confused deputy risks, and live assume-role validation."],"tools":["pacu","pmapper","cloudfox","aws-cli","iam-policy-simulator","aws-access-analyzer"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","exploitation","reporting"],"distinctiveFeatures":["Focuses specifically on AWS IAM privilege escalation rather than general cloud security, combining multiple specialized tools (Pacu, PMapper, CloudFox) with manual policy analysis and cross-account trust evaluation, including remediation guidance."],"familyIds":["cloud-offensive-security-and-emulation"]},{"id":"performing-bandwidth-throttling-attack-simulation","summary":"Authorized lab playbook to simulate bandwidth throttling and network degradation with tc/netem, measure impact using iperf3, validate QoS controls and monitoring detection, and document results with a structured report.","primaryDomain":"network-security","domainTags":["network-security","bandwidth-throttling","qos","traffic-shaping","network-degradation"],"capabilityTags":["bandwidth-throttling-simulation","qos-validation","network-resilience-testing","traffic-shaping-simulation","slowloris-simulation","monitoring-detection-testing"],"capabilityDetails":["Provides an operational workflow to simulate bandwidth throttling and progressive network degradation using tc/netem, measure baseline and impact with iperf3, and validate QoS controls and monitoring detection."],"techniqueTags":["tc-traffic-shaping","netem-network-emulation","iperf3-baseline-measurement","slowloris-connection-exhaustion","progressive-degradation","arp-spoofing-mitm"],"techniqueDetails":["Uses tc qdisc TBF/HTB to enforce bandwidth limits and netem to add latency and packet loss.","Uses iperf3 TCP/UDP tests to establish baselines and quantify degradation impact.","Employs a Python slowloris script to exhaust connections by sending partial headers slowly.","Uses ARP spoofing to establish a MITM position for intercepting and throttling traffic."],"tools":["tc","netem","iperf3","Bettercap","Scapy","Zeek","nfdump"],"targetTypes":["network","web-application"],"role":"specialist-playbook","workflowFocus":["validation","detection","analysis","reporting"],"distinctiveFeatures":["Focuses on bandwidth throttling and network degradation simulation rather than vulnerability exploitation.","Combines Linux tc/netem traffic shaping with iperf3 baseline and impact measurement to quantify effects.","Includes progressive degradation phases to test detection evasion.","Provides a VoIP-specific scenario with MOS-based quality assessment."],"familyIds":["network-adversary-simulation"]},{"id":"performing-binary-exploitation-analysis","summary":"A practical guide for analyzing ELF binaries, finding memory corruption vulnerabilities, and building proof-of-concept exploits with buffer overflows and ROP chains using pwntools, checksec, and ROPgadget, including bypassing NX, ASLR, PIE, and RELRO.","primaryDomain":"binary-exploitation","domainTags":["elf-binaries","memory-corruption","exploit-development","mitigation-bypass"],"capabilityTags":["buffer-overflow-exploitation","rop-chain-development","shellcode-injection","mitigation-analysis"],"capabilityDetails":["Provides step-by-step process for exploiting stack buffer overflows in ELF binaries.","Includes automated ROP chain building with pwntools.","Covers bypassing NX, ASLR, and PIE through information leaks."],"techniqueTags":["stack-buffer-overflow","return-oriented-programming","ret2libc","shellcode-injection","cyclic-pattern-offset","format-string-leak"],"techniqueDetails":["Uses cyclic patterns to determine return address offset.","Builds ROP chains to call system or execve when NX enabled.","Leverages pwntools ROP library for automated chain construction.","Exploits format string vulnerabilities to leak addresses for PIE/ASLR bypass."],"tools":["pwntools","checksec","ROPgadget","GDB","pwndbg","GEF"],"targetTypes":["binary","linux-host","ctf"],"role":"specialist-playbook","workflowFocus":["analysis","exploitation","validation"],"distinctiveFeatures":["Covers the complete binary exploitation lifecycle from mitigation assessment through remote exploit deployment, integrating checksec, ROPgadget, pwntools, and GDB debugging."],"familyIds":["stack-overflow-and-code-reuse"]},{"id":"performing-blind-ssrf-exploitation","summary":"A practical, command-driven playbook for detecting and exploiting blind SSRF using out-of-band techniques (Burp Collaborator/interact.sh), including internal network enumeration, cloud metadata credential access, SSRF filter bypasses, and escalation to internal services (e.g., Redis) via gopher payloads.","primaryDomain":"web-security","domainTags":["ssrf","blind-ssrf","cloud-metadata"],"capabilityTags":["blind-ssrf-detection","out-of-band-detection","ssrf-exploitation","cloud-metadata-access","internal-network-enumeration","filter-bypass"],"capabilityDetails":["Provides a complete workflow for detecting blind SSRF via out-of-band interactions, enumerating internal hosts/services, accessing cloud metadata endpoints, bypassing SSRF filters, and escalating to internal service exploitation."],"techniqueTags":["out-of-band-testing","dns-callback","timing-analysis","gopher-payload","dns-rebinding","url-parsing-bypass","metadata-endpoint-testing"],"techniqueDetails":["Uses Burp Collaborator DNS/HTTP callbacks to confirm SSRF, timing differences for host/port enumeration, gopher:// payloads to interact with internal TCP services, and DNS rebinding/IP representation tricks to bypass filters."],"tools":["Burp Collaborator","interact.sh","webhook.site","SSRFmap","Gopherus","rebinder.net"],"targetTypes":["web-application","api","network","cloud","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","enumeration","exploitation"],"distinctiveFeatures":["Specialized for blind SSRF where no response is reflected, combining OOB detection with internal network mapping, cloud metadata credential theft, and gopher-based exploitation of internal services like Redis."],"familyIds":["ssrf-exploitation"]},{"id":"performing-bluetooth-security-assessment","summary":"Provides a hands-on workflow for auditing Bluetooth Low Energy devices using Python's bleak library, including device discovery, GATT service/characteristic enumeration, detection of unencrypted or unauthenticated access to sensitive data, and generation of structured security findings.","primaryDomain":"network-security","domainTags":["bluetooth-security","wireless-security","ble-security","iot-security"],"capabilityTags":["ble-device-discovery","gatt-service-enumeration","characteristic-security-analysis","unencrypted-data-detection"],"capabilityDetails":["Discovers nearby BLE devices using bleak scanner and filters by name, address, or RSSI.","Connects to target devices and enumerates GATT services and characteristics.","Flags characteristics allowing unauthenticated read/write access to sensitive data.","Compares discovered UUIDs against known vulnerable services."],"techniqueTags":["ble-scanning","gatt-enumeration","characteristic-property-analysis","unauthenticated-read-testing"],"techniqueDetails":["Uses BleakScanner to capture device advertisements including name, MAC, RSSI, and service UUIDs.","Uses BleakClient to iterate all GATT services and characteristics.","Examines characteristic properties (read, write, notify) to identify missing authentication or encryption.","Attempts reads on protected characteristics to confirm unencrypted data exposure."],"tools":["bleak","python"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on Bluetooth Low Energy (BLE) security assessment using the Python bleak asyncio library.","Performs deep GATT-level analysis to detect unencrypted and unauthenticated access to sensitive characteristics.","Checks against known vulnerable device fingerprints and service UUIDs, distinct from general wireless or network scanning."],"familyIds":["bluetooth-security-assessment"]},{"id":"performing-brand-monitoring-for-impersonation","summary":"Provides an operational brand impersonation monitoring workflow that scans for lookalike domains, social media impersonation, fake mobile apps, and phishing sites, then generates reports and takedown requests.","primaryDomain":"reconnaissance","domainTags":["brand-monitoring","threat-intelligence","phishing-detection","impersonation-detection"],"capabilityTags":["domain-squatting-detection","social-media-impersonation-detection","fake-app-detection","safe-browsing-checks","takedown-request-generation"],"capabilityDetails":["Provides a multi-channel brand monitoring workflow to detect lookalike domains, social media impersonation, fake mobile apps, and phishing sites.","Includes a Python BrandMonitor class with methods for dnstwist domain permutation scans, Google Safe Browsing checks, social media profile searches, and app store searches.","Automates generation of JSON monitoring reports and takedown request templates with evidence for reported impersonation findings."],"techniqueTags":["domain-permutation-scanning","ssdeep-similarity","safe-browsing-api","keyword-matching","profile-name-search"],"techniqueDetails":["Uses dnstwist to generate domain permutations and identify registered typosquatting or homoglyph variants.","Applies ssdeep fuzzy hash similarity scores to prioritize candidate domains that visually resemble the legitimate brand.","Queries the Google Safe Browsing API to identify URLs already classified as malicious or socially engineered.","Searches social media and app store listings using brand and executive names to find impersonating profiles and counterfeit apps."],"tools":["dnstwist","google-safe-browsing-api","beautifulsoup4","Levenshtein","tweepy","certstream","crt.sh"],"targetTypes":["web-application","mobile","network","other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","analysis","reporting","remediation"],"distinctiveFeatures":["Covers an external brand impersonation attack surface rather than internal penetration testing or vulnerability discovery.","Consolidates domain, social media, app store, and safe-browsing monitoring into a single Python workflow.","Explicitly produces evidence-rich takedown requests, bridging detection to response.","Uses dnstwist and ssdeep similarity scores for automated lookalike domain prioritization."],"familyIds":["domain-impersonation-detection"]},{"id":"performing-clickjacking-attack-test","summary":"A practical playbook for testing clickjacking vulnerabilities in web applications, covering detection of missing anti-framing headers, crafting deceptive overlay PoCs, bypassing frame-busting defenses, and documenting exploitable sensitive actions.","primaryDomain":"web-security","domainTags":["clickjacking","ui-redressing","web-application-security"],"capabilityTags":["clickjacking-testing","frame-protection-assessment","poc-development"],"capabilityDetails":["Provides a workflow for testing web applications for clickjacking vulnerabilities, including checking frame embedding protections, crafting proof-of-concept overlay attacks, and bypassing frame-busting defenses."],"techniqueTags":["iframe-overlay","frame-busting-bypass","multi-step-clickjacking"],"techniqueDetails":["Uses transparent iframes to overlay decoy content over target page actions.","Includes techniques such as sandbox attribute, double framing, and onbeforeunload interception to bypass JavaScript frame busting."],"tools":["curl","python","burp-suite","owasp-zap","browser-devtools"],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on clickjacking/UI redressing, offering step-by-step guidance from header inspection to multi-step exploit PoC creation and impact documentation."],"familyIds":["clickjacking-testing"]},{"id":"performing-cloud-asset-inventory-with-cartography","summary":"Run Cartography to build a Neo4j graph of cloud assets and use security-focused Cypher queries to map IAM permissions, network exposure, and cross-account attack paths across AWS, GCP, and Azure.","primaryDomain":"cloud-security","domainTags":["cloud-security","asset-inventory","attack-path","multi-cloud"],"capabilityTags":["cloud-asset-discovery","attack-path-mapping","iam-permission-analysis","network-exposure-analysis","cross-account-trust-analysis"],"capabilityDetails":["Provides a workflow to sync AWS, GCP, and Azure resources into a Neo4j graph via Cartography and query for security-relevant relationships."],"techniqueTags":["graph-analysis","cypher-query","cloud-api-sync","relation-mapping"],"techniqueDetails":["Uses Cartography to ingest cloud infrastructure into Neo4j and applies Cypher queries to discover IAM chains, network paths, and cross-account trust."],"tools":["cartography","neo4j","docker"],"targetTypes":["cloud"],"role":"tool-guide","workflowFocus":["enumeration","analysis","detection","reporting"],"distinctiveFeatures":["Graph-based multi-cloud asset inventory rather than single-cloud CLI enumeration; provides ready-to-use security-focused Cypher queries for attack path identification."],"familyIds":["cloud-security-posture-assessment"]},{"id":"performing-cloud-forensics-investigation","summary":"Provides a multi-cloud forensic investigation workflow for AWS, Azure, and GCP, covering evidence preservation via volume snapshots, collection and analysis of CloudTrail/Activity/Audit logs, IAM access pattern analysis, disk forensics, and report generation for suspected breaches.","primaryDomain":"forensics","domainTags":["cloud-forensics","incident-response","multi-cloud","aws","azure","gcp"],"capabilityTags":["cloud-evidence-collection","volume-snapshotting","cloud-log-analysis","iam-access-analysis","forensic-reporting"],"capabilityDetails":["Provides a step-by-step workflow for collecting and analyzing forensic evidence from AWS, Azure, and GCP, including volume snapshots, metadata capture, API log analysis, IAM access pattern review, and disk forensics."],"techniqueTags":["cloudtrail-analysis","activity-log-analysis","audit-log-analysis","vpc-flow-log-analysis","disk-imaging","read-only-mount"],"techniqueDetails":["Uses provider-specific CLI commands (aws, az, gcloud) to preserve evidence and collect logs; leverages Athena for large-scale CloudTrail queries; performs read-only disk mounting and analysis on forensic workstations."],"tools":["aws-cli","azure-cli","gcloud","cloudtrail","athena","prowler","scoutsuite","cado-response"],"targetTypes":["cloud","container","kubernetes"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Multi-cloud forensic workflow spanning AWS, Azure, and GCP; combines evidence preservation (volume snapshots, metadata) with log analysis (CloudTrail, Activity Log, Audit Log) and IAM access pattern detection; includes provider-specific CLI commands and Python analysis scripts."],"familyIds":["cloud-forensics-and-evidence-acquisition"]},{"id":"performing-cloud-forensics-with-aws-cloudtrail","summary":"Practical workflow for investigating AWS account compromise by querying CloudTrail logs via boto3/Athena, filtering on indicators and reconstructing attacker timeline.","primaryDomain":"cloud-security","domainTags":["aws","cloudtrail","incident-response","dfir"],"capabilityTags":["cloud-forensics","aws-cloudtrail-analysis","timeline-reconstruction","indicator-filtering"],"capabilityDetails":["Provides a workflow for investigating AWS account compromise by querying CloudTrail logs via boto3 LookupEvents or Athena SQL, filtering on suspicious user agents, source IPs, and event names, and reconstructing an attacker timeline."],"techniqueTags":["event-lookup","athena-sql","user-agent-analysis","source-ip-analysis","access-key-tracking","persistence-detection"],"techniqueDetails":["Uses CloudTrail LookupEvents API and Athena SQL over S3-delivered logs to filter events by user agents, source IPs, event names, and access keys, enabling forensic analysis and persistence identification."],"tools":["boto3","aws-athena","aws-cli","jq","cloudtrail-lake"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on AWS CloudTrail log forensics for account compromise investigation, emphasizing attacker timeline reconstruction and persistence detection via boto3/Athena queries, rather than general cloud security monitoring."],"familyIds":["cloud-incident-response-and-forensics"]},{"id":"performing-cloud-incident-containment-procedures","summary":"Cloud-native incident containment across AWS, Azure, and GCP: revoke compromised IAM credentials, isolate compute and storage resources via security controls, and take forensic snapshots before containment to preserve evidence.","primaryDomain":"cloud-security","domainTags":["cloud-security","incident-response","aws","azure","gcp"],"capabilityTags":["incident-containment","credential-revocation","network-isolation","forensic-evidence","iam-containment"],"capabilityDetails":["Revokes or disables compromised IAM credentials across AWS, Azure, and GCP","Isolates compute instances using security groups, network security groups, and firewall rules","Locks down storage buckets and storage accounts while enabling forensic preservation","Creates disk and volume snapshots before isolation to preserve evidence","Documents evidence preservation best practices and chain of custody"],"techniqueTags":["iam-policy-denial","access-key-rotation","security-group-isolation","network-acl","snapshot-forensics","object-lock"],"techniqueDetails":["Uses IAM deny-all policies and session revocation to stop compromised credentials","Applies quarantine security groups/NSGs/firewall rules to block all traffic","Takes forensic snapshots before applying network isolation","Enables versioning and Object Lock to preserve S3 evidence","Disables service accounts and deletes access keys in GCP"],"tools":["aws-cli","azure-powershell","gcloud","azure-cli"],"targetTypes":["cloud","other"],"role":"specialist-playbook","workflowFocus":["remediation","analysis"],"distinctiveFeatures":["Cross-cloud (AWS, Azure, GCP) containment playbooks with explicit pre-containment forensic snapshot actions","Covers both identity and infrastructure isolation for incident response","Includes platform-specific CLI commands for each cloud provider"],"familyIds":["cloud-incident-response-and-forensics"]},{"id":"performing-cloud-log-forensics-with-athena","summary":"Provides a complete AWS Athena-based workflow for forensic analysis of CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs, enabling large-scale detection of privilege escalation, data exfiltration, lateral movement, and injection attempts through structured SQL queries and cross-log correlation.","primaryDomain":"cloud-security","domainTags":["cloud-security","aws","log-analysis","incident-response"],"capabilityTags":["athena-log-querying","cloudtrail-analysis","vpc-flow-log-analysis","s3-access-log-analysis","alb-access-log-analysis","forensic-correlation"],"capabilityDetails":["Provides SQL DDL and queries to build forensic analysis tables in AWS Athena over CloudTrail, VPC Flow Logs, S3 access logs, and ALB access logs.","Covers detection of unauthorized access, privilege escalation, data exfiltration, lateral movement, port scanning, and web-layer injection attempts.","Demonstrates cross-log correlation to build investigation timelines across multiple AWS log sources."],"techniqueTags":["partition-projection","regex-based-log-parsing","cross-log-correlation","sql-querying","threat-hunting"],"techniqueDetails":["Uses Athena partition projection for automatic partition discovery and efficient querying over partitioned date ranges.","Parses S3 access logs and ALB logs using Hive RegexSerDe with custom regex patterns.","Correlates suspicious CloudTrail actors with VPC Flow Logs to trace network activity."],"tools":["aws-athena","amazon-s3","aws-glue","boto3"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Tailors Athena table schemas specifically for forensic investigation, including CloudTrail userIdentity structures and partition projection with date ranges.","Includes ready-to-run SQL queries for multiple MITRE ATT&CK techniques (e.g., T1078.004, T1530, T1537, T1580, T1021) across separate log sources.","Focuses on cloud-native log forensics at scale rather than general log analysis."],"familyIds":["cloud-incident-response-and-forensics"]},{"id":"performing-cloud-native-forensics-with-falco","summary":"Practical playbook for deploying Falco custom rules to detect container/Kubernetes runtime threats via syscall monitoring and parsing alert output for cloud-native forensic investigation.","primaryDomain":"cloud-security","domainTags":["container-security","kubernetes-security","runtime-security"],"capabilityTags":["runtime-threat-detection","falco-rule-management","alert-parsing","container-forensics"],"capabilityDetails":["Provides a workflow to deploy and manage Falco YAML rules for runtime threat detection in containers and Kubernetes, and parse Falco JSON alerts for incident response."],"techniqueTags":["syscall-monitoring","yaml-rule-authoring","shell-spawn-detection","file-integrity-monitoring","network-anomaly-detection","privilege-escalation-detection"],"techniqueDetails":["Uses Falco rule conditions like spawned_process, container, and proc.name to detect shell execution in containers.","Monitors sensitive file access, unexpected outbound connections, setuid/setgid changes, and ptrace/mount patterns for container escape and privilege escalation."],"tools":["falco","python"],"targetTypes":["container","kubernetes","cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Specializes in Falco-based runtime syscall monitoring for cloud-native forensics rather than general cloud security assessment.","Includes concrete custom Falco YAML rule and alert parsing examples focused on container shell detection and other runtime anomalies."],"familyIds":["cloud-incident-response-and-forensics"]},{"id":"performing-cloud-native-threat-hunting-with-aws-detective","summary":"Provides a workflow for cloud-native threat hunting using AWS Detective, enabling analysts to investigate IAM users and entities via behavior graphs, correlate GuardDuty findings, and validate attack timelines.","primaryDomain":"cloud-security","domainTags":["aws","cloud-security","aws-detective","guardduty","threat-hunting"],"capabilityTags":["incident-investigation","threat-hunting","behavior-graph-analysis","entity-timeline-analysis"],"capabilityDetails":["Provides a workflow to investigate AWS security incidents using Amazon Detective behavior graphs."],"techniqueTags":["entity-profiling","finding-group-correlation","indicator-analysis","aws-detective-api"],"techniqueDetails":["Uses AWS Detective APIs to list behavior graphs, retrieve investigations, and list indicators."],"tools":["aws-cli","boto3","aws-detective"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on AWS Detective as a managed threat hunting service rather than raw log analysis.","Covers both CLI and Python boto3 workflows for entity investigation."],"familyIds":["cloud-incident-response-and-forensics"]},{"id":"performing-cloud-penetration-testing-with-pacu","summary":"Provides a structured Pacu-based workflow for authorized AWS penetration testing, including IAM enumeration, privilege escalation scanning, data access testing, lateral movement, and detection validation with GuardDuty and Security Hub.","primaryDomain":"cloud-security","domainTags":["aws","iam","penetration-testing","offensive-security","red-team"],"capabilityTags":["iam-enumeration","privilege-escalation-scanning","data-access-testing","lateral-movement-testing","detection-validation"],"capabilityDetails":["Maps IAM users, roles, policies, and group memberships to understand the current permission landscape.","Identifies exploitable privilege escalation paths using Pacu's iam__privesc_scan module.","Tests access to S3, Secrets Manager, SSM parameters, and other data stores using compromised credentials.","Assesses lateral movement through cross-account role assumption and service-based exploitation.","Validates whether GuardDuty and Security Hub detect the testing activities and generates a report."],"techniqueTags":["iam-privilege-escalation","cross-account-role-assumption","s3-bucket-enumeration","lambda-code-injection","guardduty-findings-validation"],"techniqueDetails":["Uses Pacu's privilege escalation scanner to test 21+ IAM escalation methods.","Leverages sts:AssumeRole to test cross-account access via trust policies.","Enumerates and downloads S3 bucket contents to validate data exposure.","Checks Lambda functions for updateable code and secrets in environment variables.","Reviews GuardDuty and Security Hub findings to assess detection coverage."],"tools":["pacu","aws-cli"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","detection","post-exploitation","reporting"],"distinctiveFeatures":["End-to-end Pacu workflow for authorized AWS red-team assessments from initial credential compromise to report generation.","Combines IAM privilege escalation scanning with detection validation via GuardDuty and Security Hub in a single playbook.","Provides a realistic red-team scenario and cleanup guidance for post-engagement artifact removal."],"familyIds":["cloud-offensive-security-and-emulation"]},{"id":"performing-cloud-storage-forensic-acquisition","summary":"Practical guide to forensically acquire cloud storage evidence from Google Drive, OneDrive, Dropbox, and Box using both API-based remote acquisition (Python examples) and local endpoint artifact collection (KAPE, SQLite analysis), including revision history and trashed item recovery.","primaryDomain":"forensics","domainTags":["cloud-forensics","digital-forensics","cloud-storage","google-drive","onedrive","dropbox","box"],"capabilityTags":["cloud-storage-acquisition","api-acquisition","endpoint-artifact-collection","sync-client-analysis","revision-history-acquisition"],"capabilityDetails":["Provides a dual-path workflow for forensically acquiring cloud storage evidence: API-based remote acquisition from Google Drive, OneDrive, Dropbox, and Box, plus local endpoint artifact collection from sync clients (e.g., KAPE targets, OneDrive SyncEngineDatabase)."],"techniqueTags":["google-drive-api","microsoft-graph-api","dropbox-api","kape-targets","sqlite-analysis","onedrive-sync-engine-db-analysis"],"techniqueDetails":["Uses provider-specific REST APIs (Google Drive v3, Microsoft Graph, Dropbox SDK) to enumerate, download, and extract metadata/revisions; uses KAPE targets and SQLite queries to analyze local sync-client databases for deleted and cloud-only items."],"tools":["google-api-python-client","msal","dropbox-sdk","kape","magnet-axiom-cloud","cellebrite-cloud-analyzer"],"targetTypes":["cloud","windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","reporting"],"distinctiveFeatures":["Dual acquisition approach (cloud API + local endpoint) for four major cloud storage providers, including revision history, trashed items, and sync-engine database analysis."],"familyIds":["cloud-forensics-and-evidence-acquisition"]},{"id":"performing-container-escape-detection","summary":"Audits Kubernetes pods for container escape vectors (privileged mode, dangerous capabilities, host namespace sharing, writable hostPath mounts, Docker socket exposure) using the Kubernetes Python client, providing a programmatic container escape detection playbook.","primaryDomain":"cloud-security","domainTags":["container-security","kubernetes-security","linux-capabilities","namespace-security"],"capabilityTags":["container-escape-detection","privileged-container-audit","host-namespace-analysis","hostpath-mount-inspection","docker-socket-detection"],"capabilityDetails":["Provides a workflow for auditing Kubernetes pods for container escape vectors including privileged mode, dangerous capabilities, host namespace sharing, and writable hostPath mounts.","Uses the Kubernetes Python client to enumerate pods and inspect container security contexts and volume mounts."],"techniqueTags":["privileged-mode-check","cap-sys-admin-detection","host-namespace-check","hostpath-mount-check","docker-socket-mount-check"],"techniqueDetails":["Checks the security_context.privileged flag to identify containers with full host access.","Looks for CAP_SYS_ADMIN capability assignment that can enable namespace manipulation and container escape.","Detects containers sharing host PID, network, or IPC namespaces.","Identifies writable hostPath mounts targeting / or /etc, and Docker socket mounts at /var/run/docker.sock."],"tools":["kubernetes-python-client"],"targetTypes":["container","kubernetes"],"role":"specialist-playbook","workflowFocus":["detection","analysis","enumeration"],"distinctiveFeatures":["Specializes specifically in container escape detection rather than general container security scanning.","Provides executable Python automation using the Kubernetes client to audit pod security contexts and volume mounts.","Explicitly targets escape vectors such as privileged mode, CAP_SYS_ADMIN, host namespace sharing, writable hostPath mounts, and Docker socket exposure."],"familyIds":["container-kubernetes-configuration-compliance-auditing"]},{"id":"performing-container-image-hardening","summary":"Provides step-by-step guidance to harden container images by reducing size and attack surface, implementing multi-stage builds, non-root execution, read-only filesystems, and validating with vulnerability scanners and CIS Docker Benchmark checks.","primaryDomain":"cloud-security","domainTags":["container-security","devsecops","docker","cis-benchmark"],"capabilityTags":["container-image-hardening","multi-stage-build","non-root-user-configuration","distroless-image-usage","cis-benchmark-compliance"],"capabilityDetails":["Provides a structured workflow to harden container images by minimizing attack surface and reducing vulnerability exposure.","Includes steps for multi-stage builds, distroless base images, removing unnecessary components, read-only filesystems, and digest pinning.","Describes automated validation using vulnerability scanners and CIS Docker Benchmark checks."],"techniqueTags":["multi-stage-build","distroless-base","non-root-user","read-only-filesystem","image-digest-pinning","package-manager-removal","setuid-removal"],"techniqueDetails":["Uses multi-stage Docker builds to separate build-time dependencies from the runtime image, reducing final size.","Leverages distroless base images to eliminate unnecessary OS packages and shells.","Removes shells, package managers, setuid binaries, and cache files to reduce attack surface.","Configures non-root users and read-only root filesystems to limit impact of container escape.","Pins base images by digest for reproducible and immutable builds.","Validates hardening results with Trivy and docker-bench-security."],"tools":["docker","trivy","docker-bench-security","hadolint"],"targetTypes":["container"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Combines multiple container hardening techniques into a single end-to-end workflow, from Dockerfile construction to final validation.","Includes concrete Dockerfile and Kubernetes securityContext examples for hardening.","Provides a detailed output report format for comparing image size and vulnerability counts before/after hardening.","Explicitly covers CIS Docker Benchmark compliance and validation with docker-bench-security."],"familyIds":["cloud-configuration-hardening-remediation"]},{"id":"performing-container-security-scanning-with-trivy","summary":"Provides a workflow for using Trivy to scan container images, filesystems, Git repositories, and Kubernetes manifests for vulnerabilities, secrets, and IaC misconfigurations, generate SBOMs, integrate scanning into CI/CD pipelines, and triage results.","primaryDomain":"cloud-security","domainTags":["container-security","vulnerability-scanning","sbom","kubernetes-security"],"capabilityTags":["image-vulnerability-scanning","sbom-generation","iac-misconfiguration-scanning","secret-detection","ci-cd-integration"],"capabilityDetails":["Scans container images, filesystems, Git repositories, and Kubernetes manifests for OS and language dependency vulnerabilities.","Generates CycloneDX and SPDX SBOM documents for supply chain transparency.","Detects infrastructure-as-code misconfigurations using CIS benchmark policies.","Integrates Trivy scanning into CI/CD pipelines with SARIF and JUnit report generation."],"techniqueTags":["vulnerability-scanning","secret-scanning","misconfiguration-scanning","sbom-export","license-compliance"],"techniqueDetails":["Uses Trivy's vulnerability database to identify CVEs with severity, CVSS scores, and fixed versions.","Employs policy checks for IaC misconfigurations in Dockerfiles, Kubernetes YAML, Terraform, and Helm charts.","Generates SBOMs in CycloneDX and SPDX formats.","Supports gate builds in CI/CD pipelines based on vulnerability thresholds."],"tools":["trivy"],"targetTypes":["container","kubernetes","source-code","other"],"role":"tool-guide","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Comprehensive Trivy-specific workflow covering image scanning, SBOM generation, IaC and Kubernetes manifest scanning, and CI/CD integration in one skill.","Explicitly includes SBOM generation and license compliance in addition to vulnerability scanning."],"familyIds":["container-image-hardening-and-provenance"]},{"id":"performing-content-security-policy-bypass","summary":"Defines a structured methodology for assessing and bypassing Content Security Policy during web application security assessments, enabling XSS exploitation via unsafe directives, whitelisted JSONP, missing base-uri restrictions, nonce/hash weaknesses, and data exfiltration techniques.","primaryDomain":"web-security","domainTags":["content-security-policy","xss","web-application-security","policy-misconfiguration"],"capabilityTags":["csp-bypass","xss-exploitation","csp-auditing","nonce-exploitation","data-exfiltration"],"capabilityDetails":["Provides a step-by-step workflow to analyze Content-Security-Policy headers, identify weak directives, and bypass CSP to achieve cross-site scripting. Covers unsafe-inline/unsafe-eval flaws, whitelisted JSONP endpoints, base-uri and form-action gaps, nonce/hash weaknesses, and data exfiltration even without script-src control."],"techniqueTags":["unsafe-inline","unsafe-eval","jsonp-callback-abuse","base-uri-hijacking","nonce-leakage","dom-clobbering","script-gadgets","css-data-exfiltration"],"techniqueDetails":["Exploits permissive CSP directives by injecting inline scripts or eval-based code. Leverages JSONP endpoints on whitelisted CDN/API domains to execute attacker callbacks. Injects a base element to redirect relative script loads when base-uri is missing. Leaks nonces via CSS attribute selectors or DOM clobbering. Uses whitelisted library gadgets (e.g., AngularJS template injection) and CSS injection to exfiltrate sensitive data when script execution is blocked."],"tools":["curl","Burp Suite","CSP Evaluator","CSP Scanner","csp-bypass","RetireJS","DOM Invader"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Dedicated exclusively to bypassing Content Security Policy rather than general XSS detection. Unlike generic XSS testing, this skill provides a deeper focus on CSP-specific weaknesses such as JSONP, nonce leaking, base-uri hijacking, and data exfiltration without script-src control, making it a specialist playbook for CSP-aware exploitation."],"familyIds":["csp-bypass"]},{"id":"performing-credential-access-with-lazagne","summary":"A red-team playbook for using LaZagne to harvest stored credentials on compromised Windows and Linux hosts, parse and prioritize them, and validate them against Active Directory for lateral movement.","primaryDomain":"post-exploitation","domainTags":["credential-access","windows-security","linux-security","active-directory"],"capabilityTags":["credential-extraction","credential-analysis","credential-validation","password-recovery"],"capabilityDetails":["Provides a complete workflow for deploying LaZagne and extracting stored credentials from browsers, databases, system vaults, and applications on compromised endpoints."],"techniqueTags":["credentials-from-password-stores","browser-credential-theft","dpapi-decryption","lsa-secrets-dumping","windows-credential-manager-access"],"techniqueDetails":["Covers multiple LaZagne modules for password store harvesting, including DPAPI-protected data, LSA secrets, browser login data, and Wi-Fi profiles."],"tools":["lazagne","crackmapexec","impacket","bloodhound"],"targetTypes":["windows-host","linux-host","active-directory","database"],"role":"specialist-playbook","workflowFocus":["post-exploitation","exploitation","validation","analysis"],"distinctiveFeatures":["Tool-specific end-to-end playbook for LaZagne, spanning deployment, module selection, output parsing, credential prioritization, and validation via CrackMapExec/Impacket — differentiates from general credential access methodologies and from Mimikatz-specific guides."],"familyIds":["credential-extraction-and-validation"]},{"id":"performing-cryptographic-audit-of-application","summary":"A structured cryptographic audit methodology that guides the creation of an automated tool to detect weak algorithms, insecure modes, hardcoded secrets, weak KDFs, and TLS issues, with validation criteria and remediation-focused reporting.","primaryDomain":"source-code-security","domainTags":["cryptography","security-audit","source-code-analysis"],"capabilityTags":["cryptographic-audit","weak-algorithm-detection","secret-scanning","kdf-parameter-validation","tls-configuration-review"],"capabilityDetails":["Provides a workflow to build and run an automated scanner that flags deprecated algorithms, insecure cipher modes, hardcoded secrets, weak KDFs, and TLS misconfigurations in application code and configuration files."],"techniqueTags":["static-analysis","pattern-matching","entropy-detection","configuration-review"],"techniqueDetails":["Uses static scanning of source and config files, with pattern matching and entropy heuristics to detect weak cryptographic usage."],"tools":["python","custom-scanner"],"targetTypes":["source-code","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","reporting"],"distinctiveFeatures":["Specializes exclusively in cryptographic audit of application code and configuration, covering both algorithmic weaknesses and secret/key management, unlike general source code scanners."],"familyIds":["cryptographic-audit"]},{"id":"performing-csrf-attack-simulation","summary":"Provides a practical workflow for detecting and validating CSRF vulnerabilities by identifying state-changing requests, testing anti-CSRF token and SameSite protections, and generating proof-of-concept exploits, including advanced bypass techniques for JSON APIs and SameSite=Lax configurations.","primaryDomain":"web-security","domainTags":["csrf","session-management","same-site-cookie"],"capabilityTags":["csrf-testing","csrf-poc-generation","anti-csrf-token-testing","same-site-bypass-testing"],"capabilityDetails":["Provides a workflow for identifying state-changing requests and crafting forged CSRF requests to exploit authenticated user sessions.","Includes testing anti-CSRF token implementations and SameSite cookie enforcement."],"techniqueTags":["csrf-poc","anti-csrf-token-bypass","same-site-lax-bypass","json-csrf","form-based-csrf"],"techniqueDetails":["Uses Burp Suite CSRF PoC generator to create auto-submitting forms.","Demonstrates bypassing anti-CSRF tokens by removing or manipulating token parameters.","Leverages top-level GET navigation to bypass SameSite=Lax restrictions.","Crafts JSON CSRF payloads using HTML form enctype text/plain.","Uses XHR/fetch requests where CORS permits."],"tools":["Burp Suite","OWASP ZAP","XSRFProbe","Python http.server","Browser DevTools","CSRFTester"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on CSRF attack simulation, including anti-CSRF token weakness testing and SameSite cookie bypass techniques.","Provides detailed PoC generation with Burp Suite and advanced payloads for JSON APIs and multi-step forms."],"familyIds":["csrf-testing"]},{"id":"performing-cve-prioritization-with-kev-catalog","summary":"A practical Python workflow to fetch and parse the CISA KEV catalog, enrich CVEs with EPSS scores and CVSS metrics, compute a weighted multi-factor risk score, and output a prioritized remediation report with SLA deadlines aligned to BOD 22-01.","primaryDomain":"security-knowledge","domainTags":["vulnerability-management","threat-intelligence","cisa-kev","epss","cvss"],"capabilityTags":["cve-prioritization","kev-catalog-parsing","epss-enrichment","risk-scoring","remediation-sla"],"capabilityDetails":["Provides a complete Python workflow to fetch and parse the CISA KEV catalog, enrich vulnerabilities with EPSS scores and CVSS metrics, compute a multi-factor risk score, and generate a prioritized remediation report with SLA deadlines."],"techniqueTags":["weighted-risk-scoring","decision-matrix","data-enrichment","threshold-prioritization"],"techniqueDetails":["Uses a weighted composite model combining KEV presence, EPSS, CVSS, asset criticality, and network exposure to assign priority levels and SLAs based on a decision matrix."],"tools":["CISA KEV API","FIRST EPSS API","NVD API","requests","pandas"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on integrating CISA KEV, EPSS, and CVSS with asset criticality into a weighted scoring model and BOD 22-01 remediation deadlines, differentiating it from generic CVSS-based prioritization."],"familyIds":["vulnerability-prioritization-and-risk-scoring"]},{"id":"performing-dark-web-monitoring-for-threats","summary":"Operational playbook for monitoring dark web sources including paste sites, ransomware leak sites, and commercial APIs to detect leaked credentials and organizational mentions, with OPSEC guidance and structured reporting.","primaryDomain":"reconnaissance","domainTags":["threat-intelligence","dark-web","osint","cti"],"capabilityTags":["dark-web-monitoring","credential-leak-detection","ransomware-leak-monitoring","threat-intelligence-reporting"],"capabilityDetails":["Provides an operational workflow for monitoring Tor hidden services, paste sites, ransomware leak sites, and commercial dark web APIs to identify leaked credentials and organizational threat mentions."],"techniqueTags":["tor-based-crawling","paste-site-monitoring","api-based-monitoring","keyword-search"],"techniqueDetails":["Uses Python requests through Tor SOCKS5 proxy to fetch dark web resources, HIBP API for breach data, Ransomwatch aggregator for ransomware leak site posts, and keyword-based content matching."],"tools":["tor","python-requests","haveibeenpwned-api","ransomwatch","flare","darkowl","intel-471"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on organizational dark web threat monitoring with OPSEC guidance, combining open-source APIs (HIBP, Ransomwatch) with Tor-based collection and commercial services.","Includes structured report generation and actionable recommendations for credential leaks and ransomware leak site mentions."],"familyIds":["dark-web-leak-monitoring"]},{"id":"performing-deception-technology-deployment","summary":"Provides a step-by-step playbook for deploying honeypots, honeytokens, and canaries to detect post-compromise lateral movement, credential abuse, and internal reconnaissance, with SIEM/SOAR integration for high-confidence automated response and near-zero false positives.","primaryDomain":"network-security","domainTags":["honeypot","honeytoken","deception","lateral-movement","detection"],"capabilityTags":["honeypot-deployment","honeytoken-creation","canary-deployment","siem-integration","soar-integration"],"capabilityDetails":["Provides a complete workflow for deploying honeypots, honeytokens, and canaries to detect post-compromise lateral movement, credential abuse, and internal reconnaissance with high-fidelity, low-false-positive alerts."],"techniqueTags":["decoy-deployment","credential-planting","canary-tokens","high-fidelity-alerting","lateral-movement-detection"],"techniqueDetails":["Uses fake credentials, documents, and systems that trigger alerts on any interaction; integrates with SIEM and SOAR for automated response."],"tools":["thinkst-canary","canarytokens","attivo","t-pot","splunk","phantom","powershell","python"],"targetTypes":["network","active-directory","windows-host","database","cloud"],"role":"specialist-playbook","workflowFocus":["detection","remediation"],"distinctiveFeatures":["Focuses on operational deployment of deception technology rather than vulnerability discovery or exploitation; includes concrete Thinkst Canary configurations, AD honeytoken creation scripts, and SOAR automated response playbooks."],"familyIds":["deception-based-threat-detection"]},{"id":"performing-directory-traversal-testing","summary":"Provides a structured workflow for testing directory traversal and file inclusion vulnerabilities, including encoding bypasses, automated fuzzing with ffuf and dotdotpwn, and escalation to remote code execution via PHP wrappers and log poisoning.","primaryDomain":"web-security","domainTags":["directory-traversal","local-file-inclusion","remote-file-inclusion"],"capabilityTags":["directory-traversal-testing","file-inclusion-testing","filter-bypass","code-execution-escalation"],"capabilityDetails":["Provides a workflow for discovering and validating path traversal and file inclusion vulnerabilities, including encoding/filter bypass techniques, automated fuzzing, and LFI-to-RCE escalation."],"techniqueTags":["dot-dot-slash","url-encoding","double-url-encoding","null-byte-injection","php-wrappers","log-poisoning","path-canonicalization","fuzzing"],"techniqueDetails":["Covers dot-dot-slash sequences, URL/double encoding, UTF-8 encoding, null byte injection, path truncation, case manipulation, absolute paths, PHP wrappers, log poisoning, /proc/self/environ inclusion, and high-value file enumeration."],"tools":["burp-suite","ffuf","dotdotpwn","curl","seclists","lfi-suite","kadimus"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","reporting"],"distinctiveFeatures":["End-to-end directory traversal testing playbook with comprehensive encoding/filter bypass, automated discovery using ffuf and dotdotpwn, and escalation to remote code execution via PHP wrappers and log poisoning."],"familyIds":["local-file-inclusion-and-arbitrary-file-download"]},{"id":"performing-disk-forensics-investigation","summary":"Provides a complete workflow for disk forensic investigation, including evidence preservation, forensic imaging, file system and artifact analysis, timeline reconstruction, and reporting suitable for legal/HR proceedings.","primaryDomain":"forensics","domainTags":["disk-forensics","forensic-imaging","evidence-acquisition","file-recovery","timeline-analysis"],"capabilityTags":["forensic-imaging","file-system-analysis","timeline-reconstruction","artifact-examination","evidence-preservation"],"capabilityDetails":["Provides a complete workflow for disk forensic investigation, including evidence preservation, forensic imaging, file system and artifact analysis, timeline reconstruction, and reporting suitable for legal/HR proceedings."],"techniqueTags":["forensic-imaging","file-carving","timeline-analysis","registry-analysis","prefetch-analysis","mft-analysis"],"techniqueDetails":["Uses write-blocked bit-for-bit imaging to preserve evidence","Recovers deleted files via file carving and unallocated space analysis","Reconstructs activity timelines using MAC timestamps and artifact correlation","Examines Windows artifacts such as registry hives, Prefetch, and MFT for user and attacker activity"],"tools":["FTK Imager","Autopsy","The Sleuth Kit","dcfldd","KAPE","X-Ways Forensics","Eric Zimmerman's Tools"],"targetTypes":["windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["analysis","reporting"],"distinctiveFeatures":["Focuses specifically on disk forensics with chain of custody and evidence integrity for legal/HR proceedings, contrasting with memory forensics or network forensics skills","Covers end-to-end from evidence acquisition to court-ready reporting, including command-line and GUI tool alternatives"],"familyIds":["disk-and-file-system-forensics"]},{"id":"performing-dmarc-policy-enforcement-rollout","summary":"Provides a phased DMARC rollout workflow, including sender inventory, SPF/DKIM configuration, and gradual DNS policy progression from p=none to p=reject with percentage scaling.","primaryDomain":"authentication","domainTags":["email-security","dns-security","anti-spoofing","phishing-defense"],"capabilityTags":["dmarc-rollout","spf-configuration","dkim-alignment","policy-enforcement"],"capabilityDetails":["Provides a phased workflow for DMARC policy enforcement rollout."],"techniqueTags":["spf-dkim-alignment","pct-scaling","aggregate-report-analysis"],"techniqueDetails":["Uses DMARC policy levels and alignment checks to progressively enforce email authentication."],"tools":["EasyDMARC","DMARCLY","dmarcian","Valimail","MX Toolbox","Google Admin Toolbox"],"targetTypes":["network","other"],"role":"workflow","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Focuses on the operational rollout of DMARC enforcement, including percentage-based gradual policy transitions, rather than general email security or spam filtering."],"familyIds":["email-and-data-authentication-and-anti-spoofing"]},{"id":"performing-dns-enumeration-and-zone-transfer","summary":"Comprehensive DNS reconnaissance skill that enumerates DNS records, attempts zone transfers, brute-forces subdomains, performs reverse DNS lookups, and analyzes DNS security controls to discover information disclosure and misconfigurations.","primaryDomain":"network-security","domainTags":["dns","network-enumeration","dns-security","reconnaissance"],"capabilityTags":["dns-enumeration","zone-transfer-testing","subdomain-brute-forcing","dns-record-analysis","dns-misconfiguration-detection"],"capabilityDetails":["Provides a complete workflow for enumerating DNS records, attempting AXFR/IXFR zone transfers, brute-forcing subdomains, performing reverse DNS lookups, and analyzing DNS security configurations."],"techniqueTags":["zone-transfer","subdomain-brute-force","passive-dns-enumeration","reverse-dns","dnssec-validation","spf-dkim-dmarc-analysis"],"techniqueDetails":["Attempts AXFR and IXFR zone transfers against each discovered name server to identify unauthorized DNS data exposure.","Uses passive discovery via certificate transparency and search engines combined with active brute-force to enumerate subdomains.","Performs reverse DNS enumeration to map IP ranges and detect internal hostnames or naming conventions.","Checks DNS security configurations including DNSSEC, wildcard records, open resolvers, and email authentication protocols."],"tools":["dig","nslookup","host","dnsrecon","dnsenum","subfinder","amass","gobuster","nmap","httpx"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","analysis","detection"],"distinctiveFeatures":["Focuses specifically on DNS enumeration and zone transfer testing rather than general network scanning.","Combines passive and active subdomain discovery with zone transfer attempts and DNS security configuration analysis.","Includes practical detection of open resolvers, wildcard DNS, internal IP leakage, and email authentication misconfigurations."],"familyIds":["network-adversary-simulation"]},{"id":"performing-dns-tunneling-detection","summary":"Provides a practical, scriptable workflow to detect DNS tunneling by applying Shannon entropy analysis to DNS query names, along with query length, TXT record, and subdomain cardinality heuristics, using Python and scapy for packet capture analysis.","primaryDomain":"network-security","domainTags":["dns-tunneling","exfiltration-detection","dns-security"],"capabilityTags":["dns-tunneling-detection","dns-traffic-analysis","entropy-analysis","exfiltration-detection"],"capabilityDetails":["Provides a workflow for detecting DNS tunneling using Shannon entropy, query length analysis, TXT record inspection, and subdomain cardinality statistics."],"techniqueTags":["shannon-entropy","query-length-analysis","txt-record-analysis","subdomain-cardinality"],"techniqueDetails":["Computes Shannon entropy of DNS query names and flags values above typical thresholds; analyzes query length distributions, TXT record volumes, and unique subdomain counts to identify covert channels."],"tools":["scapy","python"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Specializes in passive DNS traffic analysis for tunneling detection using statistical heuristics, distinguishing it from general DNS enumeration or rule-based threat detection."],"familyIds":["network-traffic-analysis-and-detection"]},{"id":"performing-docker-bench-security-assessment","summary":"Provides a practical workflow for running Docker Bench for Security to audit a Docker host against CIS Docker Benchmark, interpret compliance results, remediate common failures, and schedule recurring assessments.","primaryDomain":"cloud-security","domainTags":["container-security","docker","cis-benchmark"],"capabilityTags":["docker-bench-execution","cis-compliance-audit","container-hardening-validation"],"capabilityDetails":["Provides a workflow to run Docker Bench for Security against Docker hosts, interpret the resulting CIS Docker Benchmark compliance report, and remediate common configuration failures."],"techniqueTags":["compliance-scanning","configuration-audit","benchmark-based-assessment"],"techniqueDetails":["Uses the CIS Docker Benchmark as a standard to check host configuration, daemon settings, images, and runtime options."],"tools":["docker-bench-security","docker-compose"],"targetTypes":["container","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation","reporting"],"distinctiveFeatures":["Focused specifically on CIS Docker Benchmark compliance using Docker Bench for Security; includes both interpretation guidance and remediation commands."],"familyIds":["container-kubernetes-configuration-compliance-auditing"]},{"id":"performing-dynamic-analysis-of-android-app","summary":"Provides a hands-on workflow for dynamically analyzing Android apps with Frida and Objection, including method hooking, crypto interception, root detection bypass, and heap-based secret extraction.","primaryDomain":"mobile-security","domainTags":["android","mobile-security","runtime-analysis"],"capabilityTags":["dynamic-analysis","frida-instrumentation","runtime-hooking","root-detection-bypass","secrets-extraction"],"capabilityDetails":["Provides a workflow for performing runtime dynamic analysis of Android apps using Frida, Objection, and ADB to observe live behavior, intercept function calls, modify runtime values, and extract secrets."],"techniqueTags":["method-hooking","api-interception","crypto-operation-monitoring","network-traffic-intercept","root-detection-bypass","heap-inspection"],"techniqueDetails":["Intercepts Java method calls with Frida to dump arguments and return values.","Hooks cryptographic APIs to capture plaintext and ciphertext during encryption/decryption.","Monitors OkHttp and HttpURLConnection to analyze live HTTP traffic.","Bypasses root detection by overriding RootBeer and file-based checks.","Searches the Android heap for sensitive objects and strings."],"tools":["frida","objection","adb","frida-trace","drozer","android-studio-profiler"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","exploitation"],"distinctiveFeatures":["Focuses on runtime dynamic analysis rather than static analysis, emphasizing live instrumentation with Frida and Objection to bypass client-side protections and extract runtime secrets that static analysis would miss."],"familyIds":["mobile-runtime-instrumentation"]},{"id":"performing-dynamic-analysis-with-any-run","summary":"Provides a practical workflow for interactive dynamic malware analysis using ANY.RUN cloud sandbox, covering environment configuration, interactive sample detonation, process tree and network analysis, IOC extraction, and report export via GUI or API.","primaryDomain":"forensics","domainTags":["malware-analysis","dynamic-analysis","sandbox-analysis","any-run"],"capabilityTags":["interactive-malware-detonation","process-tree-analysis","network-traffic-analysis","ioc-extraction","mitre-attack-mapping"],"capabilityDetails":["Provides a workflow for interactive dynamic malware analysis using the ANY.RUN cloud sandbox, including sample detonation, real-time interaction with malware prompts, process tree review, network activity analysis, IOC extraction, and report export."],"techniqueTags":["interactive-execution","process-tree-analysis","network-traffic-analysis","behavioral-signature-analysis","ioc-export"],"techniqueDetails":["Uses ANY.RUN's interactive session to manually trigger macro enablement, click through dialogs, and approve UAC prompts; leverages MITM proxy to decrypt HTTPS C2 traffic; reviews process tree parent-child relationships, DNS and HTTP(S) connections, and applies Suricata and YARA signatures for detection."],"tools":["ANY.RUN","ANY.RUN API","Suricata","VirusTotal","MITRE ATT&CK Navigator"],"targetTypes":["windows-host","binary","network"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","reporting"],"distinctiveFeatures":["Interactive cloud sandbox analysis allowing real-time analyst interaction with malware prompts (e.g., clicking Enable Content, CAPTCHAs, UAC)","Covers both GUI-driven and API-based submission/export workflows for ANY.RUN","Includes a detailed scenario for a macro-enabled document requiring user interaction to trigger an Emotet infection chain"],"familyIds":["malware-sample-analysis-and-ioc-extraction"]},{"id":"performing-endpoint-forensics-investigation","summary":"Provides a structured endpoint forensic investigation workflow covering volatile evidence preservation, memory acquisition, disk imaging, Volatility-based memory analysis, Windows artifact parsing, timeline reconstruction, and forensic reporting for incident response and legal evidence collection.","primaryDomain":"forensics","domainTags":["endpoint-forensics","memory-forensics","disk-forensics","incident-response"],"capabilityTags":["memory-acquisition","disk-imaging","artifact-analysis","timeline-reconstruction","evidence-preservation"],"capabilityDetails":["Provides a structured workflow for endpoint forensic investigation covering volatile evidence preservation, memory acquisition, disk imaging with hash verification, memory analysis, Windows artifact parsing, timeline reconstruction, and forensic report generation."],"techniqueTags":["volatility-memory-analysis","windows-artifact-parsing","order-of-volatility","super-timeline-creation","chain-of-custody"],"techniqueDetails":["Uses order-of-volatility evidence collection, Volatility 3 plugins for process and injection detection, Eric Zimmerman tools for Prefetch/ShimCache/AmCache/Event Log/Registry parsing, and plaso/psort for timeline construction."],"tools":["Volatility 3","KAPE","FTK Imager","Autopsy","Eric Zimmerman Tools","Plaso","WinPMEM","LiME"],"targetTypes":["windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["End-to-end endpoint forensics playbook integrating memory acquisition, disk imaging, Windows artifact analysis, timeline reconstruction, and evidentiary documentation with chain-of-custody emphasis."],"familyIds":["disk-and-file-system-forensics"]},{"id":"performing-endpoint-vulnerability-remediation","summary":"Operational playbook for remediating endpoint vulnerabilities, combining risk-based prioritization (CVSS/EPSS/KEV), patch and configuration deployment, zero-day workarounds, and validation/reporting across commonly used enterprise tools.","primaryDomain":"windows-security","domainTags":["endpoint-security","vulnerability-management","patching","cve","remediation"],"capabilityTags":["vulnerability-prioritization","patch-deployment","configuration-remediation","zero-day-mitigation","remediation-validation","sla-tracking"],"capabilityDetails":["Provides a step-by-step operational workflow for prioritizing endpoint vulnerabilities using CVSS, EPSS, and CISA KEV, deploying patches via WSUS/SCCM/Intune, applying configuration changes, handling zero-day workarounds, and validating remediation."],"techniqueTags":["risk-based-prioritization","patch-management","configuration-hardening","workaround-deployment","validation-and-reporting"],"techniqueDetails":["Combines CVSS, EPSS, and KEV to prioritize; uses patch infrastructure and PowerShell commands for deployment; applies registry/GPO changes; validates with re-scan and scripted checks."],"tools":["Nessus","Qualys VMDR","Rapid7 InsightVM","WSUS","SCCM","Intune","Automox","PowerShell","PSWindowsUpdate","CISA KEV Catalog"],"targetTypes":["windows-host","linux-host","active-directory"],"role":"specialist-playbook","workflowFocus":["analysis","remediation","validation","reporting"],"distinctiveFeatures":["Focuses on remediation rather than vulnerability discovery; integrates EPSS and CISA KEV into prioritization; covers both patching and configuration-based mitigations with zero-day workarounds."],"familyIds":["endpoint-vulnerability-remediation"]},{"id":"performing-entitlement-review-with-sailpoint-iiq","summary":"Runs SailPoint IdentityIQ access certification campaigns: manager and targeted entitlement reviews, SOD violation flagging, automated revocations, and audit reporting via BeanShell scripts.","primaryDomain":"authentication","domainTags":["identity-access-management","access-governance","sailpoint-iiq","entitlement-certification"],"capabilityTags":["entitlement-review","access-certification","sod-violation-remediation","access-revocation","compliance-reporting"],"capabilityDetails":["Provides a workflow for running SailPoint IdentityIQ access certification campaigns, including manager and targeted entitlement reviews, SOD violation flagging, automated revocation, and audit evidence generation."],"techniqueTags":["sailpoint-beanshell","certification-campaign-configuration","sod-policy-constraints","provisioning-revocation-workflow","compliance-report-generation"],"techniqueDetails":["Uses SailPoint IdentityIQ BeanShell scripts to define certification definitions, entitlement filters, SOD policies, and revocation workflows.","Configures manager and application-owner certifiers with approval/signoff requirements, reminders, and escalation."],"tools":["SailPoint IdentityIQ","IdentityIQ Compliance Manager","SailPoint REST API","IdentityIQ Report Builder"],"targetTypes":["active-directory","cloud","database","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation","reporting"],"distinctiveFeatures":["Specializes in SailPoint IdentityIQ access certification and governance rather than general entitlement management or manual review.","Includes executable BeanShell code for campaign setup, SOD constraint enforcement, and automated revocation provisioning."],"familyIds":["access-governance-and-certification"]},{"id":"performing-external-network-penetration-test","summary":"A comprehensive external network penetration testing playbook that walks through PTES-aligned phases including legal scoping, OSINT and active reconnaissance, vulnerability scanning and manual validation, exploitation of internet-facing services, post-exploitation activities, and structured reporting with remediation prioritization.","primaryDomain":"network-security","domainTags":["external-pentest","network-security","vulnerability-assessment","penetration-testing"],"capabilityTags":["external-network-pentest","reconnaissance","vulnerability-scanning","exploitation","post-exploitation","reporting"],"capabilityDetails":["Provides a comprehensive end-to-end workflow for conducting external network penetration tests following PTES methodology.","Covers scoping, reconnaissance, vulnerability analysis, exploitation, post-exploitation, and reporting phases."],"techniqueTags":["nmap-scanning","nessus-scanning","metasploit-exploitation","password-attacks","pivoting","osint-enumeration"],"techniqueDetails":["Uses Nmap for host discovery, port scanning, service enumeration, and script scanning.","Leverages Nessus, OpenVAS, and Nuclei for automated vulnerability scanning.","Demonstrates exploitation of known CVEs (e.g., EternalBlue, Log4Shell, ProxyShell) with Metasploit and manual techniques.","Includes password attacks via hydra, crowbar, and hashcat.","Shows post-exploitation activities like privilege escalation, pivoting via SOCKS proxy, and evidence collection."],"tools":["Nmap","Metasploit","Nessus","OpenVAS","Nuclei","Nikto","Gobuster","sqlmap","Hydra","Hashcat","Burp Suite","Subfinder","Amass","theHarvester"],"targetTypes":["network","web-application","windows-host","linux-host","database"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","analysis","detection","validation","exploitation","post-exploitation","reporting"],"distinctiveFeatures":["Comprehensive external network pentest playbook aligned with PTES, OSSTMM, and NIST frameworks.","Includes legal documentation and scoping checklists (RoE, SOW, MSA).","Provides both automated and manual vulnerability validation techniques.","Covers full engagement lifecycle from pre-engagement through remediation priority matrix."],"familyIds":["network-adversary-simulation"]},{"id":"performing-false-positive-reduction-in-siem","summary":"A systematic playbook for reducing SIEM false positives through threshold tuning, allowlisting, correlation refinement, and validation using Splunk SPL queries and Atomic Red Team.","primaryDomain":"security-knowledge","domainTags":["soc-operations","detection-engineering","siem","alert-tuning"],"capabilityTags":["false-positive-reduction","siem-rule-tuning","allowlisting","correlation-refinement"],"capabilityDetails":["Provides a systematic workflow for reducing SIEM false positives through threshold tuning, allowlisting, and correlation refinement.","Includes Splunk SPL queries to identify noisy rules, compute false positive rates, and apply tuning changes.","Describes a phased tuning process from initial analysis to quarterly reporting."],"techniqueTags":["threshold-tuning","allowlisting","correlation-logic","behavioral-baselining","threat-intelligence-filtering"],"techniqueDetails":["Adjusts detection thresholds using baseline statistics to reduce false positives.","Creates allowlists of known benign sources to exclude them from triggering alerts.","Enhances correlation logic by joining multiple event types and assigning severity based on combined signals.","Builds behavioral baselines for users and hosts using statistical anomaly detection.","Filters alerts using threat intelligence lookups to focus on known malicious indicators."],"tools":["splunk","atomic-red-team"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Dedicated to reducing false positives in SIEM rather than developing new detections from scratch.","Provides Splunk-specific SPL queries for every stage of tuning.","Includes a structured process with weekly/bi-weekly/monthly/quarterly cadence.","Uses Atomic Red Team to validate that tuning does not suppress true positives."],"familyIds":["siem-operations-and-optimization"]},{"id":"performing-file-carving-with-foremost","summary":"Provides a complete workflow for recovering files from disk images and unallocated space using Foremost's header-footer signature carving, including Scalpel for high-performance alternates, validation of carved artifacts, and evidence cataloging via hashing and metadata extraction.","primaryDomain":"forensics","domainTags":["digital-forensics","file-carving","data-recovery","evidence-recovery"],"capabilityTags":["file-carving","data-recovery","signature-based-carving","evidence-cataloging"],"capabilityDetails":["Provides a full workflow for recovering files from disk images and unallocated space using header-footer signature carving with Foremost, including configuration, execution, validation, and cataloging."],"techniqueTags":["header-footer-carving","file-signature-matching","unallocated-space-analysis","evidence-hashing"],"techniqueDetails":["Uses known file header/footer byte sequences to extract files from raw disk images, including custom signatures for OLE/OpenXML/evtx; validates recovered files with 'file' and catalogs via SHA-256 hashes."],"tools":["foremost","scalpel","blkls","mmls","exiftool","hashdeep"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","validation","reporting"],"distinctiveFeatures":["Focuses on Foremost/Scalpel header-footer carving with practical validation and evidence cataloging, including custom signature configuration for specialized file types (EVTX, PST, SQLite)."],"familyIds":["file-carving-and-data-recovery"]},{"id":"performing-firmware-extraction-with-binwalk","summary":"Provides an operational workflow for extracting and analyzing IoT/embedded firmware with binwalk, including signature scanning, entropy analysis, recursive extraction, filesystem mounting, and credential discovery.","primaryDomain":"reverse-engineering","domainTags":["firmware-analysis","iot-security","embedded-systems"],"capabilityTags":["firmware-extraction","entropy-analysis","filesystem-inspection","credential-discovery"],"capabilityDetails":["Provides a step-by-step workflow for extracting and analyzing embedded firmware images using binwalk.","Includes entropy analysis to identify compressed or encrypted regions within firmware.","Covers mounting and inspecting SquashFS, CramFS, and JFFS2 filesystems extracted from firmware.","Guides searching extracted filesystems for hardcoded credentials, API keys, certificates, and configuration data."],"techniqueTags":["signature-scanning","entropy-analysis","recursive-extraction","string-analysis","filesystem-mounting"],"techniqueDetails":["Uses magic-byte signatures to identify embedded file types and offsets.","Interprets entropy values to distinguish plaintext, compressed, and encrypted data regions.","Extracts nested archives recursively using matryoshka mode with depth limits.","Searches extracted filesystems and raw firmware for credentials, secrets, and endpoints.","Mounts or extracts SquashFS, CramFS, and JFFS2 images for file-level inspection."],"tools":["binwalk","unsquashfs","jefferson","sasquatch","firmware-mod-kit","strings"],"targetTypes":["binary","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","enumeration","reporting"],"distinctiveFeatures":["Focused specifically on firmware extraction and embedded filesystem analysis using binwalk, including entropy-based encrypted region detection and vendor-specific SquashFS handling.","Distinct from general binary/malware reverse-engineering playbooks by targeting IoT/embedded device firmware and credential discovery in extracted filesystems."],"familyIds":["firmware-bootkit-and-rootkit-analysis"]},{"id":"performing-firmware-malware-analysis","summary":"Provides a comprehensive workflow to extract, analyze, and document malware within firmware images from routers, IoT devices, and UEFI/BIOS, using static and dynamic techniques to identify backdoors, unauthorized modifications, and bootkits.","primaryDomain":"reverse-engineering","domainTags":["firmware-security","iot-security","embedded-security","malware-analysis"],"capabilityTags":["firmware-extraction","filesystem-analysis","binary-reverse-engineering","uefi-firmware-analysis","firmware-emulation","bootkit-detection","integrity-verification","ioc-extraction"],"capabilityDetails":["Provides a complete workflow for extracting firmware images, analyzing embedded filesystems for malicious changes, reverse engineering suspicious binaries, investigating UEFI/BIOS for bootkits, emulating firmware for dynamic analysis, and documenting findings with IOCs and remediation steps."],"techniqueTags":["binwalk-extraction","entropy-analysis","squashfs-mounting","hash-comparison","ghidra-disassembly","radare2-triage","uefitool-parsing","chipsec-assessment","yara-scanning","qemu-emulation"],"techniqueDetails":["Uses binwalk with entropy analysis to identify and extract embedded filesystems.","Mounts or unsquashfs filesystems for detailed inspection of startup scripts, hardcoded credentials, and unauthorized SSH keys.","Applies Ghidra/radare2 for reverse engineering of embedded binaries (ARM/MIPS).","Leverages UEFITool and chipsec for UEFI/BIOS bootkit detection and hardware security assessment.","Emulates firmware with QEMU or firmadyne for dynamic analysis and network behavior monitoring."],"tools":["binwalk","Ghidra","radare2","UEFITool","chipsec","firmadyne","QEMU","yara"],"targetTypes":["binary","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting","remediation"],"distinctiveFeatures":["Specializes exclusively in firmware-level malware analysis for IoT devices, routers, and UEFI/BIOS, covering extraction, static reverse engineering, dynamic emulation, and bootkit detection—distinct from general OS-level malware analysis."],"familyIds":["firmware-bootkit-and-rootkit-analysis"]},{"id":"performing-fuzzing-with-aflplusplus","summary":"Provides a practical workflow for running AFL++ coverage-guided fuzzing campaigns on compiled binaries, including compile-time instrumentation, corpus minimization, parallel fuzzing, and crash triage. Useful for discovering memory-corruption vulnerabilities.","primaryDomain":"binary-exploitation","domainTags":["fuzzing","vulnerability-research"],"capabilityTags":["coverage-guided-fuzzing","crash-triage","corpus-minimization","parallel-fuzzing"],"capabilityDetails":["Provides a workflow for instrumenting target binaries with AFL++'s compilers, running parallel coverage-guided fuzzing campaigns, minimizing corpora with afl-cmin/afl-tmin, and triaging crashes with CASR or GDB."],"techniqueTags":["compile-time-instrumentation","qemu-emulation","persistent-mode","input-mutation"],"techniqueDetails":["Uses compile-time instrumentation (afl-cc/afl-clang-fast) or QEMU mode for binary-only targets, and applies mutation strategies like CMPLOG for solving comparison puzzles."],"tools":["AFL++","CASR","GDB"],"targetTypes":["binary"],"role":"tool-guide","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focused specifically on the AFL++ fuzzing workflow for compiled binaries, covering instrumentation, corpus minimization, parallel campaigns, and crash triage with CASR/GDB. This differentiates it from general binary fuzzing methodology or other fuzzers."],"familyIds":["aflplusplus-coverage-guided-fuzzing"]},{"id":"performing-gcp-penetration-testing-with-gcpbucketbrute","summary":"Enumerates publicly accessible GCP storage buckets with GCPBucketBrute, tests their IAM permissions, audits project IAM bindings and service account keys, and maps privilege escalation paths, producing a risk-scored findings report.","primaryDomain":"cloud-security","domainTags":["gcp","bucket-security","iam-security","privilege-escalation"],"capabilityTags":["gcp-bucket-enumeration","bucket-permission-testing","iam-policy-audit","service-account-key-analysis","privilege-escalation-testing"],"capabilityDetails":["Provides a step-by-step playbook for using GCPBucketBrute to enumerate discoverable storage buckets and test their permissions via the TestIamPermissions API.","Includes IAM policy enumeration with gcloud to find over-privileged bindings and service account keys that enable impersonation or privilege escalation.","Generates a structured JSON report with risk-severity ratings and remediation guidance."],"techniqueTags":["bucket-name-permutation","test-iam-permissions","iam-policy-enumeration","service-account-key-analysis"],"techniqueDetails":["Uses keyword permutations on bucket naming to discover publicly exposed buckets.","Calls TestIamPermissions to determine read/write/admin access levels on each bucket.","Enumerates project IAM policies and checks for iam.serviceAccounts.actAs, setIamPolicy, and similar escalation vectors.","Checks for service accounts with user-managed keys to identify key exposure paths."],"tools":["GCPBucketBrute","gcloud"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","validation","exploitation","reporting"],"distinctiveFeatures":["Combines GCPBucketBrute bucket enumeration with gcloud IAM policy auditing to trace exposure-to-privilege-escalation chains.","Explicitly checks service account user-managed key exposure and impersonation paths.","Specific to GCP rather than generic cloud bucket testing."],"familyIds":["cloud-offensive-security-and-emulation"]},{"id":"performing-gcp-security-assessment-with-forseti","summary":"Comprehensive GCP security assessment workflow using Security Command Center, Cloud Asset Inventory, gcloud CLI, and ScoutSuite to audit IAM, firewall rules, storage permissions, and CIS benchmarks, with a standardized reporting template.","primaryDomain":"cloud-security","domainTags":["gcp-security","iam-auditing","network-security","storage-security","compliance"],"capabilityTags":["gcp-security-assessment","iam-policy-auditing","firewall-rule-assessment","storage-bucket-auditing","security-command-center-findings-review","scoutsuite-assessment"],"capabilityDetails":["Provides a step-by-step GCP security assessment workflow using Security Command Center, Cloud Asset Inventory, gcloud CLI, and ScoutSuite.","Audits IAM policies for overly permissive roles, primitive roles, service account keys, and public access bindings.","Assesses VPC firewall rules for overly permissive ingress from 0.0.0.0/0, open SSH/RDP, and missing VPC flow logs.","Checks Cloud Storage buckets for public access, encryption configuration, and uniform bucket-level access.","Retrieves and groups Security Command Center findings, including CIS compliance violations.","Includes an output report template for standardized GCP security assessment findings."],"techniqueTags":["cloud-asset-inventory","iam-policy-analysis","firewall-rule-analysis","storage-permission-audit","cis-benchmark-assessment","scc-findings-analysis"],"techniqueDetails":["Uses gcloud asset search-all-resources and search-all-iam-policies to enumerate resources and IAM bindings.","Uses gcloud compute firewall-rules list with filters to identify overly permissive rules.","Uses gsutil iam get, kms encryption, and uniformbucketlevelaccess to inspect bucket permissions and encryption.","Uses ScoutSuite to run automated multi-check security assessment across GCP projects.","Queries Security Command Center findings via gcloud scc findings list and group for vulnerabilities and compliance violations."],"tools":["gcloud","ScoutSuite","Security Command Center","Cloud Asset Inventory","Forseti Security","gsutil"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection"],"distinctiveFeatures":["Covers multiple GCP security domains (IAM, network, storage, compliance) in one assessment workflow with an output report template.","Includes a real-world acquisition scenario with hierarchy inheritance pitfalls.","References Forseti Security but primarily operationalizes modern gcloud, SCC, and ScoutSuite commands."],"familyIds":["cloud-security-posture-assessment"]},{"id":"performing-graphql-depth-limit-attack","summary":"Provides a comprehensive workflow for testing GraphQL APIs for depth limit vulnerabilities, including multiple attack techniques (recursion, aliases, fragments, batching) and an automated Python script that progressively increases query depth and reports whether the server enforces depth limits.","primaryDomain":"api-security","domainTags":["graphql","denial-of-service","query-complexity","resource-exhaustion","api-security"],"capabilityTags":["graphql-depth-limit-testing","dos-vulnerability-assessment","nested-query-testing","alias-amplification-testing"],"capabilityDetails":["Provides a workflow for executing and testing GraphQL depth limit attacks to identify denial-of-service vulnerabilities in GraphQL APIs."],"techniqueTags":["recursive-depth-attack","alias-based-amplification","fragment-spread-attack","field-duplication-attack","batch-query-attack"],"techniqueDetails":["Uses progressively nested queries to test recursion depth limits, aliases to amplify field requests, fragments to create complex queries, field duplication to increase processing load, and batch queries to send multiple requests simultaneously."],"tools":["graphiql","altair","insomnia","curl","burp-suite","mitmproxy","python-requests"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on GraphQL depth limit denial-of-service attacks, distinguishing itself from general GraphQL security scanning by providing a structured testing methodology and automated depth and alias amplification tests."],"familyIds":["graphql-api-security-testing"]},{"id":"performing-graphql-introspection-attack","summary":"Provides a hands-on workflow to perform GraphQL introspection attacks, extract or reconstruct the full API schema, identify sensitive fields and mutations, and test GraphQL-specific resource exhaustion and field-level authorization weaknesses using Python scripts and specialized tools.","primaryDomain":"api-security","domainTags":["graphql","schema-extraction","graphql-security"],"capabilityTags":["graphql-introspection","schema-extraction","graphql-query-abuse","field-level-authorization-testing"],"capabilityDetails":["Provides a complete workflow for extracting GraphQL API schemas via introspection, reconstructing schemas when introspection is disabled, identifying sensitive fields and mutations, and testing GraphQL-specific attack surfaces such as query depth, aliases, batching, and field-level access controls."],"techniqueTags":["full-introspection-query","error-based-schema-reconstruction","alias-based-batching","query-depth-attack","field-duplication-attack"],"techniqueDetails":["Uses full introspection queries to dump types, fields, queries, mutations, and directives.","Leverages GraphQL error messages and field suggestions to enumerate valid fields when introspection is disabled.","Demonstrates alias-based batching to perform brute-force attacks that bypass per-request rate limiting.","Generates deeply nested and wide queries to test query depth/complexity limits and induce DoS.","Tests field-level authorization by comparing regular user vs admin access to sensitive fields."],"tools":["Python requests","gql","Burp Suite InQL","Clairvoyance","GraphQL Voyager","Altair","graphql-cop"],"targetTypes":["api"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","detection","validation","exploitation"],"distinctiveFeatures":["Specializes exclusively in GraphQL API security, covering introspection-based schema extraction, error-based schema reconstruction, and GraphQL-specific denial-of-service and rate-limit bypass techniques (depth, aliases, batching) not found in generic web API scanners."],"familyIds":["graphql-api-security-testing"]},{"id":"performing-graphql-security-assessment","summary":"A structured specialist workflow for GraphQL API penetration testing, covering endpoint discovery, schema introspection, injection, authorization bypass, DoS, and batching attacks with concrete curl commands and reporting format.","primaryDomain":"api-security","domainTags":["graphql","api-security","web-security"],"capabilityTags":["graphql-introspection-testing","injection-testing","authorization-testing","dos-testing","batch-attack-testing","schema-enumeration"],"capabilityDetails":["Provides a complete structured workflow for security testing GraphQL APIs, from endpoint discovery to reporting.","Covers schema introspection, injection (SQL, NoSQL, SSRF, stored XSS), field-level authorization flaws, denial-of-service via query depth/width/batching/fragments, and authentication bypass via batched login or OTP attempts.","Includes concrete curl commands for each test phase and a reporting template."],"techniqueTags":["graphql-introspection","sql-injection","nosql-injection","ssrf","stored-xss","query-depth-attack","batch-query-attack","alias-based-batching"],"techniqueDetails":["Introspection queries extract the full GraphQL schema to map the API surface.","Injection testing covers SQL, NoSQL, SSRF, and stored XSS through GraphQL arguments and mutations.","Denial-of-service testing uses deep nesting, wide queries, batch queries, and circular fragments to overwhelm resolvers.","Batched queries and alias-based aliasing bypass rate limits to enable credential brute-forcing."],"tools":["Burp Suite","InQL","GraphQL Voyager","Altair GraphQL Client","clairvoyance","curl","graphql-cop","BatchQL"],"targetTypes":["api"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","exploitation","reporting"],"distinctiveFeatures":["Dedicated entirely to GraphQL API security, covering GraphQL-specific attacks such as introspection abuse, field-level authorization, query complexity DoS, and batched query rate-limit bypass.","Provides copy-pasteable curl commands for each test case, including schema introspection, injection payloads, and batch login attacks.","Includes common real-world scenarios and a structured report format tailored to GraphQL findings."],"familyIds":["graphql-api-security-testing"]},{"id":"performing-hardware-security-module-integration","summary":"Provides a practical workflow for integrating hardware security modules through PKCS#11, enabling secure key generation, signing, encryption, and compliance auditing for FIPS 140-2/3 with support for SoftHSM2, AWS CloudHSM, and YubiHSM2.","primaryDomain":"security-knowledge","domainTags":["hardware-security-module","pkcs11","key-management","cryptographic-operations","fips-140"],"capabilityTags":["key-generation","signing","encryption","verification","token-slot-query","compliance-validation"],"capabilityDetails":["Provides a workflow for integrating Hardware Security Modules (HSMs) via the PKCS#11 interface using python-pkcs11.","Performs key generation, signing, encryption, and verification operations on HSM-backed keys.","Queries token and slot information and validates HSM configuration for FIPS 140-2/3 compliance."],"techniqueTags":["pkcs11-interface","python-pkcs11","on-device-key-operations","token-slot-enumeration","mechanism-query"],"techniqueDetails":["Uses python-pkcs11 to interact with HSM tokens over the standard PKCS#11 interface.","Enumerates slots, tokens, and supported mechanisms to audit the HSM configuration."],"tools":["python-pkcs11","SoftHSM2","AWS CloudHSM","YubiHSM2"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","validation","reporting"],"distinctiveFeatures":["Focuses specifically on HSM integration and cryptographic operations via PKCS#11, including FIPS 140-2/3 compliance validation rather than general security assessment or exploitation."],"familyIds":["cryptographic-infrastructure-configuration"]},{"id":"performing-hash-cracking-with-hashcat","summary":"Cracks password hashes with Hashcat for authorized pentesting, covering hash identification, dictionary/brute-force/rule-based/hybrid attack modes, custom rule creation, GPU benchmarking, and password-strength compliance reporting.","primaryDomain":"general-pentesting","domainTags":["cryptography","password-security","hash-cracking","penetration-testing"],"capabilityTags":["hash-cracking","hash-type-identification","password-auditing","rule-based-cracking","gpu-benchmarking"],"capabilityDetails":["Executes dictionary, brute-force, rule-based, hybrid, and combination attack modes with hashcat; identifies over 300 hash types; creates custom rules; benchmarks GPU performance; and generates password-strength and compliance reports."],"techniqueTags":["dictionary-attack","mask-attack","rule-based-attack","hybrid-attack","combination-attack"],"techniqueDetails":["Uses hashcat attack modes -a 0 (dictionary), -a 3 (mask/brute-force), -a 0 -r (rule-based), -a 6/7 (hybrid), and -a 1 (combination) to crack hashes."],"tools":["hashcat"],"targetTypes":["other"],"role":"tool-guide","workflowFocus":["analysis","exploitation","reporting"],"distinctiveFeatures":["Tool-specific skill exclusively for Hashcat, covering attack modes, hash-type identification, custom rule creation, GPU benchmarking, and compliance reporting, as opposed to general password-cracking methodology."],"familyIds":["hash-cracking"]},{"id":"performing-http-parameter-pollution-attack","summary":"Provides a practical playbook for detecting, exploiting, and reporting HTTP Parameter Pollution vulnerabilities, covering server-side and client-side HPP, WAF evasion, and technology-specific parameter precedence.","primaryDomain":"web-security","domainTags":["http-parameter-pollution","waf-bypass","input-validation","server-parsing"],"capabilityTags":["hpp-testing","waf-evasion-testing","parameter-manipulation","input-validation-bypass"],"capabilityDetails":["Provides a structured workflow for executing HTTP Parameter Pollution attacks, including server-side and client-side HPP, WAF bypass, and automated testing."],"techniqueTags":["server-side-hpp","client-side-hpp","parameter-precedence","url-encoding-hpp","header-pollution"],"techniqueDetails":["Describes how to split attack payloads across duplicate parameters, leverage technology-specific parsing behavior, and exploit OAuth and payment flows."],"tools":["burp-suite","param-miner","owasp-zap","arjun","ffuf","wfuzz","curl"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on HTTP Parameter Pollution rather than generic injection testing, emphasizing duplicate parameter parsing differences across technologies and practical WAF/validation bypass techniques."],"familyIds":["http-parameter-pollution-testing"]},{"id":"performing-ics-asset-discovery-with-claroty","summary":"Provides a workflow for performing ICS/OT asset discovery using Claroty xDome, combining passive monitoring with Claroty Edge active queries to build a validated asset inventory, including Purdue Model categorization, shadow device identification, and CMDB/NVD enrichment.","primaryDomain":"reconnaissance","domainTags":["ot-security","ics-security","asset-discovery","network-visibility"],"capabilityTags":["asset-discovery","passive-monitoring","active-querying","inventory-validation","vulnerability-enrichment"],"capabilityDetails":["Provides a workflow for performing ICS/OT asset discovery using Claroty xDome, combining passive monitoring with Claroty Edge active queries to build and validate an asset inventory."],"techniqueTags":["passive-network-monitoring","native-protocol-querying","purdue-model-categorization","cmdb-cross-referencing","nvd-vulnerability-lookup"],"techniqueDetails":["Uses SPAN/TAP based passive monitoring and safe active queries with industrial protocols (e.g., Siemens S7, Rockwell CIP, Modbus, BACnet) to identify assets, map them to Purdue Model levels, and enrich with CMDB and NVD data."],"tools":["claroty-xdome","claroty-edge","python","nvd-api"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","validation","reporting"],"distinctiveFeatures":["Focuses exclusively on Claroty xDome-based ICS/OT asset discovery, not general IT scanning","Combines passive monitoring with Claroty Edge active queries using native industrial protocols","Includes Purdue Model level reporting and identification of shadow OT devices","Provides Python automation for inventory export, CMDB cross-referencing, and NVD vulnerability enrichment"],"familyIds":["ics-ot-asset-discovery"]},{"id":"performing-indicator-lifecycle-management","summary":"Provides a comprehensive workflow and Python implementation for managing threat intelligence indicator lifecycle, including validation, enrichment, deployment, confidence decay, hit-rate monitoring, and automated retirement, to maintain high-quality IOC databases and reduce analyst fatigue.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","ioc-management","cti","stix","indicator-lifecycle"],"capabilityTags":["ioc-lifecycle-management","confidence-decay","false-positive-tracking","ioc-enrichment","ioc-retirement"],"capabilityDetails":["Provides a structured workflow for managing threat intelligence indicators from discovery through retirement.","Implements confidence decay based on indicator type half-life to age out stale IOCs automatically.","Tracks hit rates, false positives, and aging policies to maintain indicator quality and reduce analyst fatigue."],"techniqueTags":["state-machine","half-life-decay","enrichment-api","stix-format","aging-policy"],"techniqueDetails":["Uses a Python state machine to transition indicators through lifecycle phases (discovered, validated, enriched, deployed, monitoring, under review, retired).","Applies half-life decay functions for different IOC types (IP, domain, hash, URL) to reduce confidence over time.","Leverages STIX indicator valid-from/until fields and MISP/OpenCTI for structured indicator management."],"tools":["misp","opencti","pymisp","stix2","virustotal","shodan","splunk","elastic"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","validation","detection","reporting"],"distinctiveFeatures":["Covers the entire indicator lifecycle from discovery to automated retirement, not just detection or enrichment.","Includes a concrete Python implementation for state transitions, confidence decay, and false-positive-driven review.","Focuses on reducing analyst fatigue by implementing aging policies and quality metrics for IOC databases."],"familyIds":["threat-intelligence-data-and-ioc-management"]},{"id":"performing-initial-access-with-evilginx3","summary":"Provides a structured playbook for conducting adversary-in-the-middle phishing attacks using EvilGinx3 to capture session cookies and bypass MFA, including infrastructure setup, phishlet configuration, phishing delivery, session hijacking, and post-access activities.","primaryDomain":"authentication","domainTags":["phishing","credential-theft","mfa-bypass","session-hijacking","adversary-in-the-middle"],"capabilityTags":["phishing-campaign-setup","session-cookie-capture","mfa-bypass","session-hijacking","initial-access"],"capabilityDetails":["Provides a complete workflow for carrying out initial access using adversary-in-the-middle phishing to capture session tokens and bypass multi-factor authentication."],"techniqueTags":["adversary-in-the-middle","session-cookie-replay","phishing-lure","ssl-certificate-provisioning","credential-phishing"],"techniqueDetails":["Uses a transparent reverse proxy to intercept the full authentication flow, including MFA tokens and session cookies, and replays the stolen cookies to hijack authenticated sessions."],"tools":["evilginx3","gophish","evilgophish","cookie-editor","modlishka","muraena"],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["exploitation","validation","post-exploitation"],"distinctiveFeatures":["Distinguishes from password-only phishing by capturing the full authentication flow including session cookies and MFA tokens via a reverse proxy, enabling MFA bypass through session hijacking."],"familyIds":["adversary-in-the-middle-phishing"]},{"id":"performing-insider-threat-investigation","summary":"Provides an insider threat investigation playbook for validating DLP/UBA alerts, covertly collecting evidence, analyzing user behavior, reconstructing timelines, and coordinating legal/HR response with proper evidence preservation.","primaryDomain":"forensics","domainTags":["insider-threat","user-behavior-analytics","data-exfiltration","digital-forensics"],"capabilityTags":["insider-threat-investigation","evidence-collection","behavioral-analysis","impact-assessment","evidence-preservation"],"capabilityDetails":["Provides a structured workflow for investigating insider threat incidents, including allegation validation, covert evidence collection, user behavior analysis, timeline reconstruction, and legal/HR coordination."],"techniqueTags":["user-behavior-analytics","dlp-log-analysis","endpoint-forensics","timeline-reconstruction","chain-of-custody"],"techniqueDetails":["Uses baseline-vs-anomaly behavior comparison, DLP/USB/email log correlation, forensic imaging, and legal evidence handling to build an evidence-based case."],"tools":["Microsoft Purview","Exabeam/Securonix","Digital Guardian","Magnet AXIOM","Relativity"],"targetTypes":["windows-host","linux-host","cloud","network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting","remediation"],"distinctiveFeatures":["Focuses exclusively on insider threat investigation rather than external attacker incident response; integrates DLP/UBA alerts with HR/legal case management and emphasizes legal admissibility of evidence."],"familyIds":["scenario-specific-incident-response-playbooks"]},{"id":"performing-ioc-enrichment-automation","summary":"Provides an automated multi-source IOC enrichment workflow that queries VirusTotal, AbuseIPDB, Shodan, GreyNoise, URLScan.io, and MalwareBazaar, computes a composite risk score, and generates disposition reports for SOC alert triage and incident investigation.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","soc-operations","incident-response"],"capabilityTags":["ioc-enrichment","multi-source-lookup","risk-scoring","disposition-recommendation"],"capabilityDetails":["Automates enrichment of IPs, domains, URLs, and file hashes across multiple threat intelligence sources.","Computes a composite risk score and provides disposition recommendations (malicious/suspicious/low risk/clean)."],"techniqueTags":["api-orchestration","composite-risk-scoring","batch-processing","splunk-integration"],"techniqueDetails":["Uses a weighted scoring model to combine VirusTotal detections, AbuseIPDB confidence, GreyNoise classification, and other signals into a 0-100 risk score.","Includes batch enrichment with rate limiting and Splunk lookup table integration for inline alert triage."],"tools":["virustotal","abuseipdb","shodan","greynoise","urlscan.io","malwarebazaar","splunk","misp"],"targetTypes":["network","other"],"role":"workflow","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Distinct from single-source IOC lookup skills by providing a unified multi-source enrichment engine with composite risk scoring, disposition recommendations, batch processing, and Splunk integration."],"familyIds":["threat-intelligence-data-and-ioc-management"]},{"id":"performing-ios-app-security-assessment","summary":"Operational playbook for authorized iOS app security assessments, covering static IPA analysis, Frida/Objection dynamic instrumentation, SSL pinning bypass, keychain extraction, runtime method hooking, and data storage/transport security checks aligned with OWASP MASTG.","primaryDomain":"mobile-security","domainTags":["ios-security","mobile-app-security","frida"],"capabilityTags":["frida-instrumentation","objection-runtime-exploration","ssl-pinning-bypass","keychain-extraction","ipa-static-analysis"],"capabilityDetails":["Provides a comprehensive workflow for authorized iOS application security assessments, including static IPA analysis, Frida-based dynamic instrumentation, SSL pinning bypass for traffic interception, keychain credential extraction, and runtime method hooking.","Covers environment setup for both jailbroken and non-jailbroken devices, including Frida Gadget injection and IPA re-signing.","Includes data storage assessment, network/transport security checks, and jailbreak detection bypass techniques.","Aligns testing activities with OWASP MASTG/MASVS verification categories and provides a structured finding output format."],"techniqueTags":["dynamic-instrumentation","runtime-hooking","certificate-pinning-bypass","keychain-audit","static-binary-analysis"],"techniqueDetails":["Uses Frida to inject JavaScript into iOS app processes for runtime hooking and modification of method behavior.","Uses Objection pre-built commands for SSL pinning disable, keychain dump, class enumeration, and method watching.","Performs static analysis of IPA packages using otool, plutil, strings, and provisioning profile inspection to identify hardcoded secrets, entitlements, and binary protections.","Hooks NSURLSession, NSURLConnection, AFNetworking/Alamofire trust evaluation delegates to bypass SSL/TLS certificate pinning.","Dumps keychain items and checks accessibility attributes to identify credentials readable without device unlock."],"tools":["frida","objection","frida-tools","burp-suite","ideviceinstaller","otool"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","analysis","detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on iOS applications with a full lifecycle approach from static IPA analysis to dynamic runtime instrumentation.","Combines Frida and Objection for a wide range of iOS-specific security tests, including SSL pinning bypass, keychain extraction, and method hooking.","Addresses both jailbroken and non-jailbroken device workflows, with Frida Gadget patching for non-jailbroken testing.","Explicitly aligns testing activities and findings with OWASP MASTG and MASVS categories."],"familyIds":["mobile-runtime-instrumentation"]},{"id":"performing-iot-security-assessment","summary":"Provides an end-to-end workflow for security testing IoT devices, including hardware interface analysis (UART/JTAG), firmware extraction and reverse engineering, network protocol analysis, firmware emulation, and exploitation demonstration, with practical guidance for assessing the entire IoT ecosystem.","primaryDomain":"general-pentesting","domainTags":["iot-security","embedded-systems","firmware-analysis","hardware-hacking"],"capabilityTags":["firmware-extraction","firmware-analysis","hardware-debugging","network-protocol-analysis","firmware-emulation","exploitation","credential-extraction"],"capabilityDetails":["Provides a comprehensive workflow for assessing IoT device security across hardware, firmware, network, and application layers.","Includes hands-on techniques for extracting and analyzing firmware, identifying hardware debug interfaces (UART/JTAG), and emulating firmware for dynamic testing.","Covers network communication analysis including protocol decoding, TLS verification, and cloud API testing.","Demonstrates exploitation and post-exploitation impact, including credential extraction and lateral movement."],"techniqueTags":["firmware-unpacking","uart-console-access","jtag-debugging","spi-flash-dumping","qemu-emulation","tls-interception","ble-sniffing","command-injection-testing"],"techniqueDetails":["Firmware extraction via SPI flash programmer and binwalk unpacking.","Hardware interface probing using multimeter, JTAGulator, and debugger connection to obtain root shells or memory access.","Firmware emulation using FirmAE/Firmadyne for dynamic testing of web interfaces and network services.","Network traffic analysis with Wireshark and interception of TLS with Burp Suite.","BLE enumeration with nRF Connect/Ubertooth and Zigbee capture/replay with KillerBee.","Command injection testing in web configuration parameters."],"tools":["Binwalk","Ghidra","FirmAE","Firmadyne","QEMU","Wireshark","Bus Pirate","JTAGulator","CH341A","flashrom","Ubertooth","nRF Connect","KillerBee","Burp Suite","Nmap"],"targetTypes":["other","network","web-application","api","mobile"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis","detection","validation","exploitation","post-exploitation"],"distinctiveFeatures":["Comprehensive IoT security assessment covering the full stack: hardware interfaces, firmware, network protocols, cloud APIs, and companion mobile apps.","Includes physical hardware debugging techniques (UART/JTAG) alongside firmware reverse engineering and emulation.","Provides an end-to-end workflow from device reconnaissance to exploitation and impact demonstration, with a realistic enterprise IP camera scenario."],"familyIds":["iot-security-assessment"]},{"id":"performing-ip-reputation-analysis-with-shodan","summary":"Provides a practical workflow to assess IP reputation using Shodan and InternetDB APIs, including automated scoring, batch analysis, and infrastructure correlation for SOC triage.","primaryDomain":"reconnaissance","domainTags":["threat-intelligence","ip-reputation","osint","external-asset-discovery"],"capabilityTags":["ip-enrichment","reputation-scoring","batch-analysis","infrastructure-correlation","threat-intelligence-enrichment"],"capabilityDetails":["Provides a complete workflow for enriching IP addresses with Shodan scan data, including open ports, service banners, vulnerabilities, and hosting context.","Includes an automated reputation scoring algorithm that classifies IPs as low/medium/high/critical based on open ports, vulnerability counts, and malicious tags.","Supports batch processing of IP lists with rate limiting and output sorted by risk level.","Correlates infrastructure by shared organization or SSL certificate to expand investigations during incident triage."],"techniqueTags":["shodan-api-query","internetdb-free-api","port-banner-analysis","ssl-certificate-analysis","infrastructure-correlation"],"techniqueDetails":["Uses Shodan host API to retrieve open ports, service banners, OS fingerprints, and CVE data.","Uses InternetDB API for quick, unauthenticated IP lookups to avoid rate limits in high-volume enrichment.","Builds a custom reputation score from suspicious port sets, CVE counts, and host tags.","Searches Shodan by organization or SSL certificate CN to find related infrastructure."],"tools":["shodan","internetdb","shodan-python-library"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis","detection"],"distinctiveFeatures":["Focuses specifically on IP reputation scoring, not just general Shodan search.","Builds a custom threat score by combining Shodan data fields, rather than returning raw results.","Combines the full Shodan API with the free InternetDB API to manage rate limits and scale batch jobs.","Includes infrastructure correlation via shared organization and SSL certificate attributes for deeper investigation."],"familyIds":["infrastructure-threat-intelligence"]},{"id":"performing-jwt-none-algorithm-attack","summary":"A specialist playbook for executing and validating the JWT none algorithm attack, providing Python tooling to forge tokens with alg=none, test case-variant signatures, and detect servers that fail to enforce signature verification, including related algorithm confusion and JWK injection techniques.","primaryDomain":"api-security","domainTags":["jwt","authentication-bypass","web-security","token-security"],"capabilityTags":["jwt-none-algorithm-testing","token-forgery","signature-verification-bypass","privilege-escalation"],"capabilityDetails":["Provides a hands-on workflow to craft JWT tokens with alg=none and test for signature verification bypass.","Includes automated testing of multiple 'none' case variants and empty signature formats."],"techniqueTags":["jwt-none-algorithm-attack","algorithm-confusion","jwk-header-injection","token-manipulation"],"techniqueDetails":["Exploits JWT libraries that accept alg=none, forging arbitrary claims without a valid signature.","Also describes RS256-to-HS256 algorithm confusion and JWK header injection (CVE-2018-0114) as related variants."],"tools":["PyJWT","Burp Suite","mitmproxy","requests"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on the JWT none algorithm attack with a custom Python script for automated variant testing.","Covers multiple none case variations and empty signature formats, plus related JWT bypass techniques.","Includes both exploitation and mitigation code examples with explicit algorithm allowlists."],"familyIds":["api-authentication-and-token-security"]},{"id":"performing-kerberoasting-attack","summary":"Provides a tactical playbook for executing Kerberoasting attacks against Active Directory, from enumerating SPN-enabled service accounts and requesting crackable TGS tickets to offline cracking and credential validation.","primaryDomain":"active-directory","domainTags":["active-directory","kerberoasting","credential-access"],"capabilityTags":["kerberoasting","spn-enumeration","tgs-ticket-request","offline-cracking","credential-validation"],"capabilityDetails":["Provides a step-by-step workflow for performing Kerberoasting against Active Directory, including SPN enumeration, TGS ticket request, offline cracking with hashcat/john, and credential validation."],"techniqueTags":["kerberoasting","ldap-spn-enumeration","tgs-request","rc4-encryption","aes-encryption","hashcat-cracking"],"techniqueDetails":["Requests Kerberos TGS tickets for SPN-enabled accounts and cracks them offline using hashcat modes 13100, 19700, and 19800."],"tools":["Rubeus","Impacket GetUserSPNs.py","PowerView","hashcat","John the Ripper"],"targetTypes":["active-directory"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","post-exploitation"],"distinctiveFeatures":["Focuses specifically on the Kerberoasting attack path, distinguishing RC4 and AES ticket cracking modes and including detection indicators for blue team monitoring."],"familyIds":["kerberos-attack-and-ticket-abuse"]},{"id":"performing-kubernetes-cis-benchmark-with-kube-bench","summary":"Provides an automated workflow for auditing Kubernetes clusters against the CIS Kubernetes Benchmark using kube-bench, including component-specific checks, managed Kubernetes profiles, CI/CD integration, and remediation guidance.","primaryDomain":"cloud-security","domainTags":["kubernetes-security","container-security","compliance","hardening"],"capabilityTags":["kubernetes-cis-benchmark","compliance-audit","configuration-assessment"],"capabilityDetails":["Provides a workflow for running automated CIS Kubernetes Benchmark checks with kube-bench, covering control plane, etcd, worker node, and RBAC/policy configurations."],"techniqueTags":["automated-benchmarking","configuration-auditing"],"techniqueDetails":["Uses kube-bench to execute pass/fail/warn checks against Kubernetes components, supports component-specific targeting and managed Kubernetes benchmark profiles."],"tools":["kube-bench","kubectl"],"targetTypes":["kubernetes","container"],"role":"tool-guide","workflowFocus":["detection","analysis","reporting","remediation"],"distinctiveFeatures":["Focuses specifically on automating CIS Kubernetes Benchmark compliance checks rather than general Kubernetes vulnerability scanning."],"familyIds":["container-kubernetes-configuration-compliance-auditing"]},{"id":"performing-kubernetes-etcd-security-assessment","summary":"Assesses security posture of Kubernetes etcd by verifying encryption at rest, TLS transport, access controls, backup encryption, and network isolation, plus provides a key rotation procedure.","primaryDomain":"cloud-security","domainTags":["kubernetes-security","etcd-security","encryption","tls","access-control","backup-security","network-isolation"],"capabilityTags":["etcd-security-assessment","encryption-at-rest-verification","tls-transport-review","access-control-audit","backup-encryption-check","network-isolation-check","key-rotation"],"capabilityDetails":["Provides a step-by-step workflow for assessing the security posture of Kubernetes etcd clusters.","Covers verification of encryption at rest, TLS transport security, access controls, backup encryption, and network isolation.","Includes a key rotation procedure for encryption keys using EncryptionConfiguration and kubectl to re-encrypt secrets."],"techniqueTags":["etcdctl-query","encryption-configuration-review","tls-certificate-inspection","process-flag-analysis","network-port-check","snapshot-encryption"],"techniqueDetails":["Uses etcdctl commands to retrieve secrets directly from etcd and inspect whether they are encrypted.","Reviews kube-apiserver and etcd process flags to verify encryption provider configuration and TLS settings.","Inspects certificates with openssl to check expiration and configuration.","Checks listening ports and firewall rules to validate network isolation.","Encrypts etcd backups using gpg and verifies snapshot integrity with etcdctl."],"tools":["etcdctl","openssl","kubectl","gpg","iptables"],"targetTypes":["kubernetes","database","container"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Focuses exclusively on Kubernetes etcd security assessment, distinct from general Kubernetes or container security reviews.","Provides direct etcdctl-based verification of whether Secrets are encrypted at rest.","Covers both assessment of security controls and a concrete key rotation remediation procedure.","Maps checks to CIS Kubernetes Benchmark etcd-specific controls."],"familyIds":["container-kubernetes-configuration-compliance-auditing"]},{"id":"performing-kubernetes-penetration-testing","summary":"Provides a systematic Kubernetes penetration testing workflow covering external reconnaissance, automated scanning with kube-hunter/Kubescape/kube-bench, manual RBAC and secret exploitation, pod escape, and network policy testing to identify cluster compromise paths.","primaryDomain":"cloud-security","domainTags":["kubernetes-security","container-security","cloud-security"],"capabilityTags":["kubernetes-cluster-pentesting","rbac-abuse-testing","secret-extraction-testing","network-policy-testing","privileged-pod-exploitation"],"capabilityDetails":["Provides a systematic workflow to simulate attacker techniques against Kubernetes clusters, covering API server, kubelet, etcd, RBAC, network policies, and secrets."],"techniqueTags":["kube-hunter-scanning","kubescape-scanning","kube-bench-cis-benchmark","kubectl-manual-exploitation","etcd-secret-extraction","privileged-container-escape","service-account-token-theft"],"techniqueDetails":["Uses kube-hunter for remote/internal detection of known Kubernetes vulnerabilities.","Uses Kubescape for compliance scans against NSA, MITRE ATT&CK, and CIS frameworks.","Uses kube-bench for CIS Benchmark checks on master and worker nodes.","Manual kubectl commands to assess RBAC permissions and test abuse paths.","Direct etcd access to extract cluster secrets.","Deploys privileged pods with hostPath mounts to access the host filesystem."],"tools":["kube-hunter","kubescape","kube-bench","kubectl","nmap","etcdctl","jq"],"targetTypes":["kubernetes","container"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","detection","validation","exploitation"],"distinctiveFeatures":["Comprehensive Kubernetes-specific pentesting workflow combining automated scanners with manual kubectl exploitation of RBAC, secrets, etcd, and pod escape, mapped to MITRE ATT&CK for Containers."],"familyIds":["cloud-offensive-security-and-emulation"]},{"id":"performing-lateral-movement-detection","summary":"Provides a SOC-focused detection playbook for lateral movements (PtH, PsExec, WMI, RDP, SMB) using Splunk SPL queries that correlate Windows Security/Sysmon logs and network flows, mapped to MITRE ATT&CK TA0008, including kill-chain correlation and report output.","primaryDomain":"active-directory","domainTags":["lateral-movement","windows-security","network-security","soc-operations"],"capabilityTags":["lateral-movement-detection","splunk-spl-query-writing","windows-event-log-analysis","sysmon-analysis","network-flow-correlation","mitre-attack-mapping"],"capabilityDetails":["Provides a step-by-step detection workflow and Splunk SPL queries to identify attacker lateral movement by correlating Windows Security/Sysmon logs with network flow data."],"techniqueTags":["pass-the-hash","pass-the-ticket","kerberos-attacks","psexec","wmi-execution","rdp-pivoting","smb-spreading","winrm-remoting","dcom-execution","scheduled-task-creation"],"techniqueDetails":["Documented Splunk queries detect each technique via specific Windows Event IDs (4624, 4769, 7045, 5140, 4698) and Sysmon process/pipe events, plus network flow anomalies."],"tools":["splunk","sysmon","zeek","bloodhound","microsoft-defender-for-identity","crowdstrike-falcon"],"targetTypes":["active-directory","windows-host","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Defensive detection playbook for lateral movement rather than offensive exploitation","Correlates Windows Security/Sysmon event logs with network flow data in a SIEM","Provides ready-to-use Splunk SPL queries for PtH, PsExec, WMI, RDP, and SMB detection","Maps detections to MITRE ATT&CK TA0008 and includes kill-chain phase correlation"],"familyIds":["ad-lateral-movement-detection"]},{"id":"performing-lateral-movement-with-wmiexec","summary":"A specialist red-team playbook for performing stealthy lateral movement in Windows networks through WMI-based remote execution, using Impacket wmiexec.py/dcomexec.py, CrackMapExec, and native WMI/PowerShell CIM, including pass-the-hash, WMI persistence, and chaining with credential harvesting.","primaryDomain":"post-exploitation","domainTags":["windows-security","lateral-movement","wmi"],"capabilityTags":["lateral-movement","remote-command-execution","pass-the-hash","wmi-persistence","credential-harvesting"],"capabilityDetails":["Provides a hands-on playbook for stealthy WMI-based lateral movement using Impacket wmiexec.py, dcomexec.py, CrackMapExec, and native Windows WMI/PowerShell CIM tools.","Demonstrates pass-the-hash and Kerberos authentication for remote command execution without creating services on the target.","Includes WMI event subscription persistence and chaining WMI execution with SAM/SYSTEM registry hive harvesting for credential extraction."],"techniqueTags":["wmi-execution","win32-process-create","dcom-object-execution","wmi-event-subscription","temporary-file-output"],"techniqueDetails":["WMI remote execution works via Win32_Process.Create, with command output normally written to temporary files on the ADMIN$ share.","DCOM execution through MMC20.Application or ShellWindows objects reduces footprint compared to PsExec.","WMI event subscriptions (__EventFilter + CommandLineEventConsumer) enable persistence that triggers on system events such as logons.","CrackMapExec enables multi-target WMI command execution across subnets with password or hash authentication."],"tools":["wmiexec.py","dcomexec.py","crackmapexec","wmic.exe","powershell","smbclient.py","secretsdump.py","sharpwmi"],"targetTypes":["windows-host","active-directory"],"role":"specialist-playbook","workflowFocus":["exploitation","post-exploitation","validation"],"distinctiveFeatures":["Focused exclusively on WMI-based lateral movement rather than covering all remote execution methods.","Compares stealth levels of different WMIexec implementations and PsExec, emphasizing absence of service creation.","Provides both Linux attacker tooling and native Windows/PowerShell WMI execution methods, plus persistence and credential harvesting chaining."],"familyIds":["lateral-movement"]},{"id":"performing-linux-log-forensics-investigation","summary":"Conducts forensic investigation of Linux logs by extracting authentication events, systemd journal entries, auditd records, and cron activity to detect unauthorized access, privilege escalation, and brute-force attacks, with automated report generation.","primaryDomain":"forensics","domainTags":["linux-forensics","log-analysis","system-log-investigation"],"capabilityTags":["linux-log-forensics","authentication-event-analysis","brute-force-detection"],"capabilityDetails":["Provides a workflow for forensic investigation of Linux system logs, including parsing auth.log, syslog, systemd journal, auditd, and cron logs to reconstruct user sessions, identify unauthorized access, and establish event timelines."],"techniqueTags":["syslog-analysis","auth-log-parsing","journalctl-querying","auditd-analysis","cron-log-review","python-log-parsing"],"techniqueDetails":["Uses grep regex patterns to extract SSH login, sudo, and useradd events.","Uses journalctl output formatting and time filters for systemd journal forensics.","Uses ausearch and aureport to query Linux Audit Framework events.","Provides a Python class to parse auth.log and detect brute force attempts."],"tools":["grep","awk","journalctl","ausearch","aureport","python3","last","lastb","atq"],"targetTypes":["linux-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Combines manual command-line analysis with an automated Python parser for auth logs, covering multiple Linux log sources (auth, syslog, journald, auditd, cron) in a single investigation workflow."],"familyIds":["log-analysis-and-timeline-reconstruction"]},{"id":"performing-log-analysis-for-forensic-investigation","summary":"Collects, parses, and correlates Windows, Linux, and web logs to reconstruct security incident timelines and produce forensic reports.","primaryDomain":"forensics","domainTags":["digital-forensics","log-analysis","event-correlation","timeline-analysis"],"capabilityTags":["log-collection","log-parsing","event-correlation","timeline-reconstruction","forensic-reporting"],"capabilityDetails":["Provides an end-to-end workflow for collecting, parsing, and correlating Windows, Linux, and web logs to reconstruct security incident timelines.","Includes specific Windows Event IDs, Linux audit queries, and log parsing commands for forensic evidence analysis."],"techniqueTags":["windows-event-log-analysis","syslog-analysis","evtx-parsing","log-normalization","timeline-analysis"],"techniqueDetails":["Uses Windows Event IDs for authentication, process creation, and privilege escalation detection.","Uses ausearch and grep-based parsing for Linux auth, audit, and web access logs.","Normalizes timestamps and merges log sources into a correlated chronological timeline."],"tools":["python-evtx","evtxexport","LogParser","ausearch","jq","ELK Stack","Chainsaw","Hayabusa"],"targetTypes":["windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["End-to-end forensic log analysis workflow spanning evidence preservation, parsing, correlation, and report generation.","Includes concrete Windows Event IDs and Linux audit queries for incident reconstruction.","Focuses on timeline reconstruction across heterogeneous log sources rather than live monitoring or alerting."],"familyIds":["log-analysis-and-timeline-reconstruction"]},{"id":"performing-log-source-onboarding-in-siem","summary":"Provides a complete operational playbook for integrating new log sources into a SIEM, including a tiered prioritization framework, collection configuration for syslog/Windows/cloud, custom parsing and CIM normalization, data quality validation, and detection enablement, with actionable examples for Splunk and AWS.","primaryDomain":"security-knowledge","domainTags":["siem","log-management","soc-operations","data-ingestion"],"capabilityTags":["log-source-prioritization","log-collection-configuration","log-parsing","field-normalization","data-quality-validation","detection-coverage-enablement"],"capabilityDetails":["Provides a structured workflow for onboarding log sources into SIEM platforms, including prioritization using a tiered value framework, configuration of collection agents (syslog, Windows Event, CloudTrail), custom parser and field extraction, normalization to a common schema (CIM), and validation of data quality.","Includes tools for enabling detection coverage by verifying existing correlation searches and creating source-specific detection rules."],"techniqueTags":["syslog-ingestion","windows-event-log-forwarding","aws-cloudtrail-ingestion","splunk-parser-configuration","cim-field-mapping","splunk-data-quality-validation"],"techniqueDetails":["Uses rsyslog for syslog-based collection from firewalls and network devices, Splunk Universal Forwarder for Windows Event logs and Sysmon, and AWS CloudTrail for cloud audit logs.","Demonstrates custom parser creation via Splunk props.conf/transforms.conf with regex-based field extraction and CIM field mapping.","Employs Splunk SPL queries to check event arrival, field extraction quality, CIM compliance, and timestamp lag."],"tools":["splunk","rsyslog","splunk-universal-forwarder","aws-cloudtrail"],"targetTypes":["active-directory","network","cloud","windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation"],"distinctiveFeatures":["Focuses specifically on the end-to-end process of integrating log sources into a SIEM, from prioritization and collection to parsing, normalization, and data quality validation.","Provides concrete, copy-pasteable configuration examples for Splunk, rsyslog, and AWS CloudTrail, along with a tiered priority framework and an onboarding checklist.","Distinct from detection engineering or general SIEM administration by targeting the onboarding gap between raw logs and actionable monitoring."],"familyIds":["siem-operations-and-optimization"]},{"id":"performing-malware-hash-enrichment-with-virustotal","summary":"Automates malware hash enrichment via VirusTotal API v3 to assess maliciousness, gather behavioral and network intelligence, and generate actionable IR reports.","primaryDomain":"forensics","domainTags":["threat-intelligence","malware-analysis","incident-response"],"capabilityTags":["hash-enrichment","ioc-enrichment","threat-classification","behavioral-analysis","yara-matching"],"capabilityDetails":["Enriches file hashes with VirusTotal multi-engine detection stats, sandbox behavior, YARA matches, and network IOCs to determine maliciousness and support SOC triage/IR decisions."],"techniqueTags":["virustotal-api","hash-lookup","yara-matching","behavioral-analysis","network-pivoting"],"techniqueDetails":["Uses VirusTotal API v3 to query file hash reports, parse detection statistics, retrieve YARA rule matches, and pivot to related network indicators."],"tools":["virustotal","vt-py"],"targetTypes":["binary","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Provides a complete Python automation pipeline for VirusTotal hash enrichment, including batch rate-limited processing, behavioral report extraction, network IOC pivoting, and YARA-based classification."],"familyIds":["signature-and-ioc-based-malware-detection"]},{"id":"performing-malware-ioc-extraction","summary":"Provides a workflow for extracting actionable indicators of compromise from malware samples, including PE static analysis, string pattern extraction, YARA scanning, and STIX 2.1 indicator generation.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","threat-intelligence","ioc-extraction","pe-analysis"],"capabilityTags":["ioc-extraction","malware-analysis","static-analysis","yara-scanning","stix-formatting"],"capabilityDetails":["Provides a step-by-step workflow for extracting actionable indicators of compromise from malware samples, including PE static analysis, string pattern extraction, YARA scanning, and STIX 2.1 indicator generation."],"techniqueTags":["pe-parsing","imphash","string-extraction","regex-pattern-matching","yara-rules","stix2-indicators","network-ioc-extraction","registry-ioc-extraction"],"techniqueDetails":["Uses pefile to parse PE headers, sections, imports, and version information.","Extracts IPs, domains, URLs, registry paths, mutexes via regex from ASCII and Unicode strings.","Scans with YARA rules for malware classification and packed binary detection.","Generates STIX 2.1 Bundle with Indicator and Malware objects."],"tools":["pefile","yara","stix2","oletools","Cuckoo","CAPE","Any.Run","Joe Sandbox","VirusTotal"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting","validation"],"distinctiveFeatures":["Combines PE static analysis, string IOC extraction, YARA scanning, and STIX 2.1 indicator generation in a single workflow with Python code examples.","Focuses specifically on actionable IOC extraction for CTI, not general malware reverse engineering."],"familyIds":["malware-indicator-and-signature-development"]},{"id":"performing-malware-persistence-investigation","summary":"Systematic forensics playbook for identifying malware persistence mechanisms across Windows and Linux using registry, scheduled tasks, WMI, COM, startup, and Linux autostart analysis, with scripts and report generation.","primaryDomain":"forensics","domainTags":["malware-persistence","digital-forensics","incident-response"],"capabilityTags":["persistence-enumeration","registry-analysis","scheduled-task-analysis","wmi-subscription-analysis"],"capabilityDetails":["Provides a systematic workflow for enumerating and analyzing malware persistence mechanisms on Windows and Linux, including registry run keys, services, scheduled tasks, WMI event subscriptions, COM hijacking, startup folders, and Linux cron/systemd/SSH keys."],"techniqueTags":["run-key-analysis","service-analysis","wmi-event-subscription-analysis","com-hijacking-detection","linux-cron-analysis","ld-preload-analysis"],"techniqueDetails":["Inspects HKLM/HKCU Run keys and auto-start services, parses scheduled task XML for suspicious commands, detects WMI __EventFilter subscriptions, identifies COM CLSID hijacking, and evaluates Linux cron/systemd/ld.so.preload for persistence."],"tools":["Autoruns","RegRipper","KAPE","Velociraptor","OSQuery","PersistenceSniper","RECmd","Volatility"],"targetTypes":["windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","analysis","reporting"],"distinctiveFeatures":["Covers both Windows and Linux persistence mechanisms in one workflow; provides concrete forensic scripts for registry hive parsing, XML scheduled task analysis, raw WMI repository inspection, and Linux autostart locations, plus scenario-based guidance for APT, ransomware, fileless, and post-remediation verification."],"familyIds":["endpoint-artifact-collection-and-analysis"]},{"id":"performing-malware-triage-with-yara","summary":"Operational playbook for triaging and classifying malware samples using YARA, including scanning with existing rule sets, crafting custom string/byte/PE structural rules, automating batch scans with Python, and validating rules against false positives.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","yara","pattern-matching"],"capabilityTags":["malware-triage","yara-rule-writing","malware-classification","automated-scanning"],"capabilityDetails":["Provides a step-by-step workflow for rapid malware triage using YARA, covering scanning with community rules, writing custom rules based on strings/bytes/PE structure, batch automation in Python, and rule validation."],"techniqueTags":["string-matching","byte-pattern-matching","pe-module-analysis","imphash-matching","rich-header-hash","entropy-analysis","yara-python-scripting"],"techniqueDetails":["Uses YARA string conditions, hex byte patterns with wildcards, PE module traits (imports, timestamps, sections), imphash and Rich header hashes, and entropy for packed sections."],"tools":["yara","yara-python","yarGen","signature-base"],"targetTypes":["binary","windows-host","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses exclusively on YARA-based malware triage, from applying existing rules to authoring custom signatures and automating pipelines, rather than general malware reverse engineering or sandbox analysis."],"familyIds":["malware-indicator-and-signature-development"]},{"id":"performing-memory-forensics-with-volatility3","summary":"Provides a step-by-step incident response workflow for analyzing RAM dumps with Volatility 3, covering process enumeration, network connection analysis, credential extraction, and YARA-based malware detection, including techniques to uncover hidden processes and rootkits.","primaryDomain":"forensics","domainTags":["memory-forensics","digital-forensics","incident-response"],"capabilityTags":["memory-dump-analysis","process-enumeration","credential-extraction","malware-detection","rootkit-detection"],"capabilityDetails":["Provides a workflow for analyzing volatile memory dumps to enumerate processes, network connections, registry data, and credentials.","Detects process hollowing, DLL injection, hidden processes, and rootkits using cross-view analysis and memory scanning."],"techniqueTags":["cross-view-analysis","yara-scanning","pool-scanning","ssdt-hook-analysis","process-memory-dump"],"techniqueDetails":["Compares process lists from EPROCESS linked lists with pool scanning to identify hidden processes.","Uses YARA rules to scan memory regions for malware signatures.","Checks for SSDT hooks to detect kernel-level rootkits.","Dumps process memory for further static analysis."],"tools":["Volatility 3","YARA","LiME","WinPmem","DumpIt"],"targetTypes":["windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis","enumeration","reporting"],"distinctiveFeatures":["Focuses specifically on Volatility 3 memory forensics rather than general disk or endpoint forensics.","Includes comprehensive rootkit detection via cross-view process/module comparison and SSDT hook inspection.","Covers credential extraction from memory (hashdump, lsadump, cachedump) as part of incident response."],"familyIds":["memory-forensics"]},{"id":"performing-memory-forensics-with-volatility3-plugins","summary":"Provides a Python automation framework for running Volatility3 plugins to detect process injection, hidden processes, malicious network connections, and suspicious DLLs/YARA signatures in memory dumps, enabling rapid malware triage during incident response.","primaryDomain":"forensics","domainTags":["memory-forensics","malware-analysis","incident-response","dfir"],"capabilityTags":["memory-dump-analysis","malware-detection","process-injection-detection","hidden-process-detection","network-connection-analysis","dll-enumeration","yara-scanning"],"capabilityDetails":["Provides an automated Python workflow for running Volatility3 plugins on memory dumps.","Detects injected code regions via the windows.malfind plugin.","Identifies hidden processes by comparing pslist and psscan results.","Extracts active network connections using windows.netscan.","Enumerates loaded DLLs per process with windows.dlllist.","Scans memory for malware signatures using YARA rules via windows.yarascan.","Consolidates findings in a full triage report."],"techniqueTags":["volatility3-plugin-automation","malfind-injection-detection","pslist-psscan-comparison","netscan-connection-analysis","dlllist-enumeration","yarascan-memory-scanning"],"techniqueDetails":["Uses the Volatility3 framework to run forensic plugins against memory images.","Identifies RWX memory regions indicative of injected code.","Detects hidden processes by cross-referencing process listings.","Analyzes active network connections to spot C2 communication.","Lists loaded DLLs to identify suspicious modules.","Applies YARA rules to scan memory content for known patterns."],"tools":["volatility3","yara"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Provides a ready-to-use Python automation class for Volatility3 plugin orchestration.","Combines multiple plugins (malfind, pslist/psscan, netscan, dlllist, yarascan) into a single malware triage workflow.","Emphasizes detection of process injection and hidden processes through comparisons and memory region analysis.","Includes validation criteria for confirming malicious activity such as C2 connections and YARA rule matches."],"familyIds":["memory-forensics"]},{"id":"performing-mobile-app-certificate-pinning-bypass","summary":"Practical skill for bypassing certificate pinning in Android and iOS mobile apps, using Objection and Frida to disable trust enforcement and capture HTTPS traffic through a proxy.","primaryDomain":"mobile-security","domainTags":["android","ios","certificate-pinning","mobile-tls","traffic-interception"],"capabilityTags":["certificate-pinning-bypass","traffic-interception","frida-scripting","objection-usage","mitm-testing"],"capabilityDetails":["Provides a workflow for bypassing SSL/TLS certificate pinning in Android and iOS apps to enable HTTPS traffic interception during authorized security assessments."],"techniqueTags":["okhttp-bypass","trustmanager-bypass","nsurlsession-bypass","network-security-config-bypass","frida-hooking"],"techniqueDetails":["Uses Objection pre-built hooks to disable pinning in common libraries; custom Frida scripts override TrustManagerImpl, OkHttp CertificatePinner, custom X509TrustManager, SSLContext, NSURLSession delegate, and SecTrustEvaluate functions."],"tools":["Frida","Objection","Burp Suite","apktool","SSLUnpinning","ssl-kill-switch2"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["analysis","exploitation","validation"],"distinctiveFeatures":["Covers both Android and iOS pinning bypass with layered techniques from quick Objection hooks to custom Frida scripts for OkHttp, TrustManager, NSURLSession, and native code checks."],"familyIds":["mobile-network-traffic-interception-and-pinning-bypass"]},{"id":"performing-mobile-device-forensics-with-cellebrite","summary":"A practical playbook for acquiring and analyzing mobile device evidence using Cellebrite UFED and open-source tools, covering iOS and Android extraction methods, communications and location data recovery, and report generation.","primaryDomain":"forensics","domainTags":["mobile-forensics","digital-forensics","ios-forensics","android-forensics"],"capabilityTags":["mobile-device-acquisition","artifact-analysis","deleted-data-recovery","communication-extraction","location-analysis"],"capabilityDetails":["Provides a step-by-step workflow for acquiring and analyzing mobile device evidence using Cellebrite UFED and open-source alternatives.","Covers logical, file system, and physical extraction methods for iOS and Android devices.","Includes techniques for recovering deleted messages, call logs, location data, and application artifacts.","Offers practical commands and Python scripts for extracting WhatsApp, iMessage/SMS, and GPS metadata."],"techniqueTags":["physical-extraction","logical-extraction","file-system-extraction","sqlite-analysis","gps-metadata-extraction","backup-acquisition"],"techniqueDetails":["Physical extraction creates bit-for-bit image enabling deleted data recovery.","Logical extraction retrieves accessible user data through device APIs.","File system extraction accesses app databases and system files.","SQLite queries to extract messages and communications from app databases.","EXIF/GPS metadata extraction from photos to map locations.","iOS backup acquisition via libimobiledevice, including encrypted backups."],"tools":["Cellebrite UFED","UFED Physical Analyzer","ALEAPP","iLEAPP","libimobiledevice","ADB","Magnet AXIOM","MEAT"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Combines commercial Cellebrite UFED workflows with open-source tools like ALEAPP/iLEAPP and libimobiledevice in a single mobile forensics playbook.","Covers both iOS and Android acquisitions, including physical extraction for deleted data recovery and GPS/location analysis.","Provides concrete command-line examples and Python scripts for extracting messaging app data and geotagged photo locations."],"familyIds":["mobile-device-forensics"]},{"id":"performing-network-forensics-with-wireshark","summary":"A practical network forensics playbook for analyzing PCAP/PCAPNG files with Wireshark and tshark, covering traffic validation, suspicious traffic filtering, object and credential extraction, TCP stream reconstruction, automated analysis with NetworkMiner, and reporting of C2 communications and data exfiltration.","primaryDomain":"forensics","domainTags":["network-forensics","packet-analysis","pcap-analysis"],"capabilityTags":["pcap-analysis","traffic-reconstruction","artifact-extraction","c2-detection","credential-extraction"],"capabilityDetails":["Provides a step-by-step workflow for validating PCAP files, filtering suspicious traffic, extracting transferred files and objects, reconstructing TCP streams, and using NetworkMiner for automated analysis.","Covers detection of C2 beaconing, DNS tunneling, data exfiltration, and credential harvesting from network captures."],"techniqueTags":["beaconing-detection","dns-tunneling-detection","tcp-stream-reconstruction","protocol-hierarchy-analysis","file-hash-verification"],"techniqueDetails":["Uses tshark display filters and statistics to identify beaconing patterns and unusual DNS queries.","Reconstructs TCP streams and exports HTTP/SMB/FTP objects to recover transmitted files and credentials.","Leverages capinfos and protocol hierarchy statistics to validate capture integrity and understand traffic composition."],"tools":["Wireshark","tshark","NetworkMiner","capinfos","tcpdump"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Dedicated to post-capture network forensics rather than live network monitoring, with emphasis on artifact extraction and C2/exfiltration reconstruction from PCAP files.","Combines command-line tshark analysis with NetworkMiner automated extraction and VirusTotal hash checking for a complete forensic workflow."],"familyIds":["network-traffic-forensics"]},{"id":"performing-network-packet-capture-analysis","summary":"Provides a comprehensive workflow for forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, tcpdump, and Python Scapy, enabling traffic reconstruction, file extraction, malicious activity detection (e.g., beaconing), and evidence reporting.","primaryDomain":"network-security","domainTags":["network-forensics","packet-capture","protocol-analysis","traffic-analysis"],"capabilityTags":["packet-capture-analysis","traffic-reconstruction","malicious-traffic-detection","file-extraction"],"capabilityDetails":["Provides a comprehensive workflow for forensic analysis of PCAP/PCAPNG files, including traffic capture, protocol filtering, file extraction, malicious activity detection, and report generation."],"techniqueTags":["beaconing-detection","dns-query-analysis","conversation-analysis","file-extraction","protocol-statistics"],"techniqueDetails":["Uses tcpdump for capture, Wireshark display filters for traffic filtering, tshark for CLI-based extraction and statistics, and Python Scapy for custom beaconing detection and automated report generation."],"tools":["wireshark","tshark","tcpdump","scapy","pyshark"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Focuses on forensic PCAP analysis using both CLI tools and programmatic Scapy analysis, including custom beaconing detection based on interval variance and comprehensive JSON report generation."],"familyIds":["network-traffic-analysis-and-detection"]},{"id":"performing-network-traffic-analysis-with-tshark","summary":"Automates network traffic analysis from PCAP files using tshark and pyshark; computes protocol statistics, detects suspicious flows like port scans and beaconing, extracts IOCs, and identifies DNS tunneling patterns.","primaryDomain":"network-security","domainTags":["network-security","pcap-analysis","packet-analysis","network-forensics"],"capabilityTags":["protocol-statistics","suspicious-flow-detection","ioc-extraction","dns-tunneling-detection","port-scan-detection","beaconing-detection"],"capabilityDetails":["Automates extraction of protocol hierarchy and conversation statistics from PCAP files.","Detects suspicious network flows including port scans, beaconing, and unusual port usage.","Extracts IOCs such as IPs, domains, and URLs from network captures.","Identifies DNS tunneling patterns via high-entropy subdomains and excessive TXT records."],"techniqueTags":["tshark","pyshark","pcap-analysis","dns-tunneling","beacon-detection","port-scan-analysis"],"techniqueDetails":["Uses Wireshark CLI (tshark) and Python wrapper (pyshark) for scripted packet analysis.","Detects DNS tunneling using entropy analysis of subdomain queries.","Identifies beaconing and port scans through connection frequency and port usage patterns."],"tools":["tshark","pyshark","wireshark"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses on automated, scriptable PCAP analysis rather than interactive inspection.","Includes DNS tunneling detection and IOC extraction in addition to flow statistics.","Provides a structured workflow for repeatable network traffic analysis tasks."],"familyIds":["network-traffic-analysis-and-detection"]},{"id":"performing-network-traffic-analysis-with-zeek","summary":"Provides a comprehensive operational guide to deploying Zeek as a passive network security monitor, generating structured protocol logs, writing custom Zeek scripts to detect DNS tunneling and C2 beaconing, and integrating logs with SIEM platforms for ongoing threat detection and forensic analysis.","primaryDomain":"network-security","domainTags":["traffic-analysis","intrusion-detection","pcap-analysis","siem-integration","protocol-metadata"],"capabilityTags":["zeek-deployment","custom-detection-scripting","log-analysis","siem-integration","intel-framework"],"capabilityDetails":["Provides a complete workflow for deploying Zeek, generating structured protocol logs, writing custom detection scripts, and integrating outputs with SIEM platforms."],"techniqueTags":["dns-tunneling-detection","beaconing-detection","ja3-fingerprinting","protocol-analysis","file-extraction"],"techniqueDetails":["Detects DNS tunneling using long query name lengths and high query volumes.","Identifies C2 beaconing by analyzing connection interval regularity and jitter.","Uses JA3 fingerprinting to identify TLS clients.","Extracts files and computes hashes from network traffic."],"tools":["zeek","zeekctl","zeek-cut","filebeat"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["Focuses on Zeek's structured log generation and custom scripting for threat detection, distinguishing it from raw PCAP analysis or signature-based IDS tools.","Provides complete operational guidance from installation, custom detection script development, to SIEM integration."],"familyIds":["network-traffic-analysis-and-detection"]},{"id":"performing-nist-csf-maturity-assessment","summary":"Conducts a NIST CSF 2.0 maturity assessment across six core functions, scoring organizational posture against four implementation tiers and producing a prioritized improvement roadmap for cybersecurity program enhancement.","primaryDomain":"security-knowledge","domainTags":["compliance","governance","nist-csf","risk-management"],"capabilityTags":["nist-csf-maturity-assessment","gap-analysis","roadmap-development","tier-scoring"],"capabilityDetails":["Provides a structured workflow for scoring organizational cybersecurity posture against NIST CSF 2.0 functions and implementation tiers.","Produces current and target profiles, gap analysis, and an improvement roadmap with prioritized initiatives."],"techniqueTags":["implementation-tier-scoring","current-target-profile-comparison","subcategory-evaluation","stakeholder-interview"],"techniqueDetails":["Uses a four-tier scoring system (Partial, Risk-Informed, Repeatable, Adaptive) to rate each CSF subcategory.","Compares current state to a defined target state to prioritize gaps based on risk reduction potential."],"tools":[],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","reporting","remediation"],"distinctiveFeatures":["Focuses on organizational program maturity assessment rather than technical vulnerability discovery or exploitation.","Specifically implements NIST CSF 2.0 with the new Govern function and six core functions.","Emphasizes governance, policy, and people alongside technology, and produces a phased roadmap over a 12-week assessment cycle."],"familyIds":["compliance-governance"]},{"id":"performing-oauth-scope-minimization-review","summary":"Delivers a comprehensive OAuth scope minimization review workflow that inventories delegated and application permissions, classifies scopes by risk, detects over-permissioned or unapproved third-party apps, identifies stale grants, and produces prioritized remediation actions.","primaryDomain":"api-security","domainTags":["oauth","scope-minimization","identity-access-management","consent-review","third-party-risk"],"capabilityTags":["oauth-scope-audit","api-permission-review","third-party-app-risk-assessment","consent-grant-minimization","stale-token-detection"],"capabilityDetails":["Provides a structured workflow for auditing OAuth 2.0 consent grants and API scopes across identity providers, identifying over-permissioned third-party applications, excessive or unused scopes, and risky consent patterns, then generating a prioritized remediation plan."],"techniqueTags":["scope-risk-classification","over-permission-detection","token-usage-audit","least-privilege-remediation"],"techniqueDetails":["Categorizes OAuth scopes by risk level and weighted scoring, detects excessive scopes by comparing actual grants to an approved catalog, identifies overly broad permissions using broad-to-narrow pattern matching, audits sign-in logs to find stale grants, and executes scope reduction via Microsoft Graph API operations."],"tools":["Microsoft Graph API","Microsoft Entra Admin Center","Nudge Security","Cerby","jwt.io"],"targetTypes":["cloud","api"],"role":"specialist-playbook","workflowFocus":["analysis","detection","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on OAuth scope minimization for third-party and cross-boundary consent grants, not general OAuth configuration or first-party application reviews.","Includes both automated enumeration/risk scoring and executable remediation actions through Microsoft Graph API."],"familyIds":["api-authorization-and-data-exposure-testing"]},{"id":"performing-oil-gas-cybersecurity-assessment","summary":"Provides a specialized cybersecurity assessment playbook for oil and gas OT/ICS facilities, covering pipeline SCADA, refinery DCS, safety systems, and remote access, with a Python script that automates findings and TSA/API compliance reporting.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","scada-security","pipeline-security","industrial-control-systems"],"capabilityTags":["ot-cybersecurity-assessment","scada-security-assessment","compliance-evaluation","pipeline-security-assessment","finding-generation"],"capabilityDetails":["Provides a structured assessment workflow for oil and gas OT/ICS facilities, covering pipeline SCADA, refinery DCS, safety instrumented systems, and remote access.","Includes a Python script (PipelineSCADAAssessment) that generates findings, severity summaries, and TSA compliance status.","Maps assessment findings to API 1164, TSA SD-01/SD-02, and IEC 62443 compliance requirements."],"techniqueTags":["architecture-review","compliance-gap-analysis","protocol-security-review","remote-access-review","physical-cyber-analysis"],"techniqueDetails":["Evaluates IT/OT network segmentation, encrypted RTU communications, physical intrusion detection at remote sites, and flow computer authentication.","Uses facility type scoping to tailor assessment areas based on upstream, midstream, or downstream operations.","Performs compliance checks against TSA Pipeline Security Directives and API 1164 with remediation timelines."],"tools":["Dragos Platform","Claroty xDome","Nozomi Guardian","Honeywell Forge Cybersecurity"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting","remediation"],"distinctiveFeatures":["Focused specifically on oil and gas OT environments (pipeline SCADA, refinery DCS, custody transfer, remote wellhead RTUs) rather than general IT/network penetration testing.","Includes compliance mapping to API 1164, TSA Pipeline Security Directives, and IEC 62443, with a built-in Python script for report generation."],"familyIds":["ot-ics-security-assessment"]},{"id":"performing-open-source-intelligence-gathering","summary":"Provides a structured OSINT workflow for red team engagements to map external attack surface, profile personnel, discover leaked credentials, and identify technology stacks using various open-source tools.","primaryDomain":"reconnaissance","domainTags":["osint","red-teaming","attack-surface"],"capabilityTags":["osint-gathering","subdomain-enumeration","credential-leak-discovery","personnel-profiling","technology-fingerprinting"],"capabilityDetails":["Provides a multi-phase workflow to collect publicly available information about a target organization.","Covers domain and network reconnaissance, personnel intelligence, credential and data leak discovery, and technology stack identification."],"techniqueTags":["whois-lookup","certificate-transparency","dns-bruteforce","shodan-search","google-dorking","breach-database-search","social-media-reconnaissance"],"techniqueDetails":["Uses WHOIS, CT logs, and DNS brute-force for subdomain enumeration.","Employs Shodan/Censys for exposed services and cloud bucket discovery.","Leverages LinkedIn, social media, and conference talks for personnel targeting.","Searches breach databases, paste sites, and GitHub for leaked credentials and secrets."],"tools":["Amass","Subfinder","theHarvester","Maltego","SpiderFoot","Shodan","Censys","Recon-ng","GitDorker","Photon"],"targetTypes":["network","web-application","cloud","other"],"role":"general-playbook","workflowFocus":["reconnaissance","enumeration","analysis"],"distinctiveFeatures":["Covers the full OSINT lifecycle for red team initial access, integrating domain, personnel, credential, technology, physical, and document intelligence.","Structured by OSINT categories with explicit MITRE ATT&CK mapping and validation criteria."],"familyIds":["attack-surface-discovery"]},{"id":"performing-osint-with-spiderfoot","summary":"Automates OSINT reconnaissance and attack-surface mapping using SpiderFoot's REST API/CLI, with module selection, scan management, and parsing of findings into target intelligence profiles.","primaryDomain":"reconnaissance","domainTags":["osint","threat-intelligence","attack-surface-mapping"],"capabilityTags":["osint-collection","scan-automation","result-parsing","target-profiling"],"capabilityDetails":["Automates OSINT data collection across 200+ SpiderFoot modules via REST API and CLI, with scan modes for footprint, investigate, and passive collection; parses results into structured intelligence profiles for domains, IPs, emails, DNS records, and leaked credentials."],"techniqueTags":["api-automation","passive-reconnaissance","active-reconnaissance","data-source-integration"],"techniqueDetails":["Uses SpiderFoot's modular scanning to query multiple OSINT data sources, selecting passive or active modules depending on scan mode and correlating results by target and data type."],"tools":["SpiderFoot","spiderfoot-cli"],"targetTypes":["network","other"],"role":"tool-guide","workflowFocus":["reconnaissance","enumeration","analysis"],"distinctiveFeatures":["Dedicated to SpiderFoot automation for OSINT, not manual OSINT methodology; emphasizes selecting modules by scan mode and programmatically parsing results into an intelligence profile, including leaked credential discovery."],"familyIds":["attack-surface-discovery"]},{"id":"performing-ot-network-security-assessment","summary":"A specialist playbook for conducting security assessments of OT/ICS networks, covering passive asset discovery, Purdue zone segmentation analysis, firewall rule review, and industrial protocol security checks.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","scada","industrial-control","iec-62443"],"capabilityTags":["ot-network-assessment","passive-discovery","asset-inventory","firewall-rule-analysis","protocol-security-assessment"],"capabilityDetails":["Provides a comprehensive workflow for security assessment of OT/ICS networks, including passive asset discovery, firewall rule analysis between Purdue zones, and industrial protocol configuration review."],"techniqueTags":["passive-traffic-analysis","purdue-level-classification","zone-conduit-mapping","firewall-rule-audit","modbus-protocol-analysis","opc-ua-security-review"],"techniqueDetails":["Uses passive pcap analysis to classify devices by Purdue level and detect cross-zone communication flows.","Evaluates firewall rules against IEC 62443 allowed conduit definitions and flags prohibited or overly permissive rules.","Inspects industrial protocol traffic (Modbus, OPC UA) for missing authentication and encryption."],"tools":["Nozomi Guardian","Dragos Platform","Claroty","Wireshark","tshark","Nmap","Scapy","Grassmarlin"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis","detection","validation","reporting"],"distinctiveFeatures":["Dedicated to OT/ICS network assessments, incorporating Purdue Reference Model and IEC 62443 zones/conduits.","Prioritizes passive discovery and safety boundaries to avoid disruption of live industrial systems."],"familyIds":["ot-ics-security-assessment"]},{"id":"performing-ot-vulnerability-assessment-with-claroty","summary":"Provides a workflow and Python-based tooling for performing OT/ICS vulnerability assessments using Claroty xDome, covering passive asset discovery, CVE/ICS-CERT correlation, OT-specific risk scoring, and compliance evidence generation for IEC 62443/NERC CIP.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","scada-security","industrial-control-system","vulnerability-assessment","iec-62443","nerc-cip"],"capabilityTags":["ot-vulnerability-assessment","asset-discovery","vulnerability-correlation","risk-scoring","compliance-evidence-generation"],"capabilityDetails":["Provides a workflow for performing OT vulnerability assessments using Claroty xDome, including passive asset discovery, CVE/ICS-CERT correlation, and OT-specific risk scoring for remediation prioritization."],"techniqueTags":["passive-discovery","safe-active-query","cvss-risk-scoring","purdue-level-analysis","virtual-patching"],"techniqueDetails":["Uses passive network monitoring and safe active querying to inventory OT assets without disrupting operations; correlates vulnerabilities using CISA KEV and ICS-CERT advisories; applies OT-specific risk scoring with asset criticality and Purdue level factors."],"tools":["claroty-xdome","claroty-ctd","cisa-ics-cert","dragos-platform","nozomi-guardian"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting","remediation"],"distinctiveFeatures":["Specialized for OT/ICS vulnerability assessment as opposed to IT scanning or penetration testing; uses Claroty xDome passive discovery and OT-specific risk scoring with Purdue levels and compensating controls; integrates with IEC 62443 and NERC CIP compliance evidence generation."],"familyIds":["ot-ics-security-assessment"]},{"id":"performing-ot-vulnerability-scanning-safely","summary":"Provides a safety-first vulnerability scanning workflow for OT/ICS environments using passive traffic analysis, native industrial protocol queries, and controlled active scans, with prerequisite checks and risk-prioritized reporting.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","vulnerability-scanning"],"capabilityTags":["ot-vulnerability-scanning","passive-vulnerability-detection","native-protocol-query","safe-active-scanning","risk-prioritization"],"capabilityDetails":["Provides a workflow for safely performing vulnerability scanning in OT/ICS environments, emphasizing passive monitoring and controlled active scans to avoid disrupting industrial processes.","Includes safety prerequisite checks such as lab validation, vendor warranty verification, change management approval, and SIS exclusion.","Supports risk-based reporting with CVSS adjusted for OT context and compensating control recommendations for unpatched assets."],"techniqueTags":["passive-network-monitoring","traffic-fingerprinting","protocol-analysis","native-protocol-queries","controlled-active-scanning"],"techniqueDetails":["Passive monitoring observes mirrored traffic without sending packets to OT devices, using traffic fingerprinting and protocol analysis for version detection.","Native protocol queries (Modbus, S7, CIP, BACnet) minimally interrogate devices to extract identity information.","Controlled active scanning uses OT-safe profiles, lab-tested and approved, to run credentialed scans and service detection with low-to-moderate risk."],"tools":["tenable-ot-security","nessus"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Prioritizes zero-impact passive vulnerability detection before any active scanning.","Requires safety prerequisite checks including lab validation, change management approval, and SIS scope exclusion.","Uses native industrial protocol queries as an intermediate step between passive and active scanning.","Contextualizes CVSS scores for OT availability and safety impact, and recommends compensating controls for unpatched assets."],"familyIds":["ot-ics-security-assessment"]},{"id":"performing-packet-injection-attack","summary":"Operational playbook for crafting and injecting custom network packets with Scapy, hping3, and Nemesis to test IDS/IPS detection, firewall rules, anti-spoofing controls, and network stack resilience, including alert verification and reporting.","primaryDomain":"network-security","domainTags":["packet-injection","protocol-testing","ids-ips-validation","firewall-testing","anti-spoofing"],"capabilityTags":["packet-crafting","network-traffic-generation","security-control-validation","ids-alert-verification","session-reset-testing"],"capabilityDetails":["Provides a hands-on workflow for crafting and injecting custom network packets to test firewall rules, IDS/IPS detection, anti-spoofing controls, and network stack resilience."],"techniqueTags":["tcp-flag-manipulation","ip-spoofing","tcp-rst-injection","ip-fragmentation","protocol-anomaly"],"techniqueDetails":["Uses Scapy and hping3 to generate SYN/XMAS/NULL scans, spoofed-source packets, RST injection, fragmented payloads, and malformed TCP flag combinations."],"tools":["scapy","hping3","nemesis","tcpreplay","nping"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["validation","detection","reporting"],"distinctiveFeatures":["Unlike general vulnerability scanners, this skill focuses on constructing raw packets at the protocol level to validate inline security controls and document detection gaps; includes IDS alert verification and report generation."],"familyIds":["network-adversary-simulation"]},{"id":"performing-paste-site-monitoring-for-credentials","summary":"Skill for building automated paste site and GitHub monitoring for leaked credentials, using scraping APIs, regex credential pattern matching, and organization-specific keywords to generate early breach alerts.","primaryDomain":"reconnaissance","domainTags":["threat-intelligence","osint","credential-leak","paste-monitoring"],"capabilityTags":["paste-site-monitoring","credential-leak-detection","github-secret-scanning","alert-generation"],"capabilityDetails":["Provides an automated workflow for continuously monitoring paste sites and GitHub for leaked credentials, API keys, and sensitive data."],"techniqueTags":["pastebin-scraping-api","github-code-search","regex-pattern-matching","keyword-matching"],"techniqueDetails":["Uses Pastebin Scraping API to fetch recent pastes and regex patterns to detect credentials and secrets.","Uses GitHub Search API to find exposed organization secrets."],"tools":["pastebin-scraping-api","github-api","python","requests","regex","beautifulsoup4","pymisp","elasticsearch"],"targetTypes":["web-application","cloud","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting","reconnaissance"],"distinctiveFeatures":["Focuses specifically on continuous paste site and Gist monitoring for credential leaks, combining Pastebin Scraping API, GitHub code search, and org-specific keyword matching into a single alert pipeline."],"familyIds":["dark-web-leak-monitoring"]},{"id":"performing-phishing-simulation-with-gophish","summary":"Operational playbook for deploying GoPhish and running authorized phishing awareness campaigns, covering SMTP sending profiles, email templates, landing page cloning, target user groups, campaign scheduling, and measuring open/click/credential-submission rates.","primaryDomain":"general-pentesting","domainTags":["phishing","social-engineering","email-security","security-awareness"],"capabilityTags":["phishing-simulation","campaign-management","email-template-creation","landing-page-cloning","credential-capture"],"capabilityDetails":["Provides an operational workflow for deploying GoPhish and conducting authorized phishing awareness campaigns.","Covers SMTP sending profile configuration, email template creation with tracking placeholders, landing page cloning, user group management, campaign scheduling, and result analysis."],"techniqueTags":["email-tracking","credential-harvesting","login-page-cloning","smtp-delivery"],"techniqueDetails":["Uses GoPhish's {{.Tracker}} pixel and {{.URL}} link placeholders to track email opens and link clicks.","Clones legitimate login pages to capture submitted credentials during authorized testing.","Configures SMTP sending profiles to deliver simulated phishing emails."],"tools":["gophish","evilginx2","king-phisher"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["validation","exploitation","reporting"],"distinctiveFeatures":["Tool-specific operational playbook focused on GoPhish rather than general phishing methodology.","Includes practical deployment via Docker/binary, campaign component setup, and API-based analytics with a custom process.py script.","References advanced AiTM testing with Evilginx2 as an extension."],"familyIds":["social-engineering-testing"]},{"id":"performing-physical-intrusion-assessment","summary":"A specialist playbook for conducting authorized physical intrusion assessments, covering tailgating, RFID badge cloning, lock bypassing, rogue device deployment, and dumpster diving, with a structured methodology, tool-specific commands, and ethical considerations.","primaryDomain":"general-pentesting","domainTags":["physical-security","red-team","physical-pentest"],"capabilityTags":["physical-intrusion-assessment","tailgating","badge-cloning","lock-bypassing","rogue-device-deployment","dumpster-diving"],"capabilityDetails":["Provides a structured methodology for conducting authorized physical penetration tests against facilities, server rooms, and restricted areas.","Includes techniques for tailgating employees, cloning RFID badges, bypassing locks, deploying rogue network devices, and testing security guard procedures.","Covers pre-assessment reconnaissance, execution phases, and documentation requirements for physical security assessments."],"techniqueTags":["tailgating","rfid-cloning","lock-picking","lock-bypass","evil-twin","usb-keystroke-injection","social-engineering","physical-reconnaissance"],"techniqueDetails":["Tailgating methods include hands-full approach, smoke break return, delivery driver disguise, and busy entrance timing.","Badge cloning uses tools like Proxmark3 and Flipper Zero to read and clone low-frequency and high-frequency RFID badges.","Lock bypassing covers pin tumbler, wafer, tubular, electronic, magnetic, and smart locks with specific bypass methods and difficulty ratings.","Rogue device deployment uses LAN Turtle, WiFi Pineapple, and USB Rubber Ducky to gain network access or capture credentials.","Dumpster diving for sensitive documents, employee directories, network diagrams, and discarded hardware."],"tools":["Proxmark3","Flipper Zero","lock-pick-set","under-door-tool","shove-knife","LAN-Turtle","WiFi-Pineapple","Rubber-Ducky","Bash-Bunny","body-camera","FLIR-camera"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","exploitation","validation"],"distinctiveFeatures":["Focuses specifically on physical intrusion assessment, a unique domain not covered by typical network/web penetration testing skills.","Provides tool-specific commands for RFID cloning and rogue device deployment (Proxmark3, Flipper Zero, LAN Turtle, WiFi Pineapple).","Integrates human-element techniques (tailgating, social engineering) with technical hardware-based bypass methods.","Includes comprehensive ethical and safety considerations for physical testing, such as authorization letters and deconfliction procedures."],"familyIds":["physical-intrusion-assessment"]},{"id":"performing-plc-firmware-security-analysis","summary":"Provides an advanced workflow for PLC firmware security analysis, enabling firmware extraction from Siemens/Rockwell/Schneider platforms, integrity verification against known-good baselines, static analysis with tools like binwalk and Ghidra, and Modbus protocol security testing for authentication and crash-resilience issues.","primaryDomain":"reverse-engineering","domainTags":["ot-security","ics-security","scada","industrial-control","iec62443","firmware-analysis","plc-security"],"capabilityTags":["firmware-acquisition","firmware-extraction","firmware-integrity-verification","static-analysis","dynamic-analysis","protocol-security-testing","modbus-security-testing","vulnerability-assessment"],"capabilityDetails":["Provides a workflow to acquire PLC firmware from vendor projects and hardware, verify firmware integrity via hashing and baseline comparison, and identify security vulnerabilities through static and dynamic analysis.","Includes tools and code for extracting firmware from Siemens and Rockwell project files, running binwalk and Ghidra analysis, and testing Modbus protocol implementations for authentication, access control, and malformed packet handling."],"techniqueTags":["sha256-hashing","baseline-comparison","binwalk-unpacking","entropy-analysis","strings-analysis","ghidra-reverse-engineering","modbus-packet-crafting","malformed-packet-testing"],"techniqueDetails":["Uses cryptographic hashing to compare firmware against known-good baselines and detect tampering.","Employs binwalk to unpack firmware images and identify components, and Ghidra for disassembly of PLC firmware architectures.","Crafts Modbus/TCP packets to test for unauthenticated reads/writes, dangerous function code access, broadcast unit ID issues, and crash resilience via malformed packets."],"tools":["binwalk","firmware-mod-kit","Ghidra","IDA Pro","Binary Ninja","EMUX","FIRMADYNE","PLCinject","OpenPLC","JTAG/SWD debugger","Siemens TIA Portal","Rockwell Studio 5000","Schneider EcoStruxure","custom Python scripts"],"targetTypes":["binary","network"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","reporting"],"distinctiveFeatures":["Tailored specifically to PLC/ICS firmware security analysis, covering Siemens S7, Allen-Bradley, and Schneider Modicon platforms.","Combines firmware static analysis with active Modbus protocol security testing in a single workflow, unlike general firmware reverse engineering skills.","Emphasizes firmware integrity verification via baseline hashing and diffing to detect tampering or supply chain compromise.","Includes vendor-specific extraction from TIA Portal and Studio 5000 project files, reducing effort for common PLC assessment targets."],"familyIds":["plc-firmware-security-analysis"]},{"id":"performing-post-quantum-cryptography-migration","summary":"Operational workflow to assess enterprise readiness for NIST post-quantum cryptography migration, including cryptographic inventory scanning, crypto-agility assessment, hybrid TLS testing, ML-KEM/ML-DSA validation, and prioritized roadmap generation.","primaryDomain":"security-knowledge","domainTags":["cryptography","post-quantum-cryptography","tls-security","crypto-agility"],"capabilityTags":["cryptographic-inventory-scanning","crypto-agility-assessment","hybrid-tls-testing","pqc-readiness-validation"],"capabilityDetails":["Provides a phased workflow to inventory cryptographic algorithms, assess crypto-agility, test hybrid TLS with X25519MLKEM768, validate ML-KEM and ML-DSA support, and generate a prioritized migration roadmap aligned with NIST IR 8547 timelines."],"techniqueTags":["quantum-vulnerable-algorithm-identification","hybrid-key-exchange-testing","openssl-pqc-configuration","migration-roadmap-generation"],"techniqueDetails":["Identifies RSA, ECDH, ECDSA, DH, DSA as quantum-vulnerable via Shor's algorithm; tests hybrid key exchange combining X25519 with ML-KEM-768; uses oqs-provider with OpenSSL for post-quantum algorithm support."],"tools":["openssl","oqs-provider","python-cryptography"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","remediation"],"distinctiveFeatures":["Focuses on post-quantum cryptography migration readiness rather than offensive security; integrates NIST FIPS 203/204/205 standards, hybrid TLS testing, and migration roadmap generation."],"familyIds":["cryptographic-infrastructure-configuration"]},{"id":"performing-power-grid-cybersecurity-assessment","summary":"Provides a specialized workflow for assessing cybersecurity of power grid infrastructure, including IEC 61850 substation protocol security, EMS/SCADA controls, and NERC CIP compliance, with a Python-based finding generator.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","power-grid","scada","substation-automation","industrial-control"],"capabilityTags":["power-grid-cybersecurity-assessment","substation-security-assessment","nerc-cip-compliance-check","scada-security-review","ems-security-assessment"],"capabilityDetails":["Provides a structured workflow for assessing cybersecurity of power grid infrastructure including EMS/SCADA control centers, substations, and synchrophasor networks, with NERC CIP compliance verification and IEC 61850 GOOSE/MMS security checks."],"techniqueTags":["goose-authentication-validation","mms-security-analysis","network-segmentation-assessment","remote-access-control-review"],"techniqueDetails":["Assesses IEC 61850 GOOSE message authentication, MMS client authentication, station bus network segmentation, and vendor remote access controls against NERC CIP and IEC 62351 recommendations."],"tools":["Dragos Platform","SEL-3620 Ethernet Security Gateway","GRIDsure","Wireshark"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis","detection","validation","reporting"],"distinctiveFeatures":["Specialized for power grid OT/ICS, covering NERC CIP compliance and IEC 61850 GOOSE/MMS protocol security with a Python-based assessment script; not a generic OT assessment."],"familyIds":["ot-ics-security-assessment"]},{"id":"performing-privacy-impact-assessment","summary":"Automates privacy impact assessments: creates processing activity inventories, maps data flows, scores privacy risks across 10 categories, checks GDPR/CCPA compliance, generates remediation plans and DPIA reports using NIST PRAM and ICO guidance.","primaryDomain":"security-knowledge","domainTags":["privacy-compliance","data-protection","gdpr","ccpa"],"capabilityTags":["privacy-impact-assessment","data-inventory","data-flow-mapping","risk-scoring","regulatory-compliance-check","remediation-planning"],"capabilityDetails":["Provides an end-to-end workflow for conducting privacy impact assessments, including data inventory, data flow mapping, privacy risk scoring, GDPR/CCPA compliance checks, remediation planning, and DPIA report generation."],"techniqueTags":["nist-privacy-framework-pram","ico-dpia-guidance","data-flow-mapping","privacy-risk-scoring-matrix","regulatory-alignment-check"],"techniqueDetails":["Uses structured risk scoring (likelihood × impact) across 10 privacy risk categories; maps processing activities to GDPR articles and CCPA/CPRA sections; applies screening checklist to determine DPIA necessity."],"tools":["PrivacyImpactAssessmentEngine"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting","remediation"],"distinctiveFeatures":["Covers the full privacy impact assessment lifecycle from data inventory to report generation, unlike typical security vulnerability skills.","Integrates GDPR Article 35 DPIA, CCPA/CPRA alignment, NIST PRAM, and ICO DPIA guidance into an automated Python workflow.","Includes a screening checklist to determine whether a full DPIA is required."],"familyIds":["privacy-impact-assessment"]},{"id":"performing-privilege-escalation-assessment","summary":"A specialist playbook that performs comprehensive privilege escalation assessments on compromised Linux and Windows systems, covering host misconfigurations, kernel exploits, container/cloud breakouts, and impact documentation.","primaryDomain":"post-exploitation","domainTags":["privilege-escalation","linux-security","windows-security","container-security"],"capabilityTags":["privilege-escalation-enumeration","local-exploitation","escalation-validation","container-breakout-testing"],"capabilityDetails":["Provides a systematic workflow for enumerating privilege escalation paths on compromised Linux and Windows hosts.","Includes validation of specific misconfigurations such as sudo rules, SUID binaries, unquoted service paths, and token impersonation.","Covers container and cloud breakout scenarios in addition to host-based escalation."],"techniqueTags":["sudo-misconfiguration","suid-abuse","kernel-exploit","token-impersonation","unquoted-service-path","dll-hijacking","writable-passwd","alwaysinstallelevated"],"techniqueDetails":["Exploits GTFOBins-listed sudo entries to spawn root shells.","Abuses Set User ID binaries for command execution or shell escape.","Matches kernel versions to known exploits like DirtyPipe and PwnKit.","Uses SeImpersonatePrivilege with tools like PrintSpoofer for SYSTEM access.","Exploits unquoted service paths and writable service binaries on Windows."],"tools":["linPEAS","winPEAS","GTFOBins","LOLBAS","PrintSpoofer","GodPotato","Linux Exploit Suggester"],"targetTypes":["linux-host","windows-host","container","kubernetes","cloud"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","exploitation","post-exploitation"],"distinctiveFeatures":["Dual-OS (Linux and Windows) privilege escalation assessment workflow with container and cloud breakout coverage.","Integrates automated enumeration scripts (linPEAS/winPEAS) with manual validation techniques and references (GTFOBins/LOLBAS).","Emphasizes documenting impact and mapping to MITRE ATT&CK."],"familyIds":["privilege-escalation"]},{"id":"performing-privilege-escalation-on-linux","summary":"A structured Linux privilege escalation playbook covering enumeration and exploitation of SUID/SGID binaries, sudo misconfigurations, kernel vulnerabilities, cron jobs, capabilities, and writable service files using manual commands and automated tools.","primaryDomain":"linux-security","domainTags":["privilege-escalation","post-exploitation","red-teaming"],"capabilityTags":["linux-privilege-escalation","privilege-escalation-enumeration","privilege-escalation-exploitation"],"capabilityDetails":["Provides a workflow to enumerate and exploit multiple Linux privilege escalation vectors, combining manual commands with automated tooling to move from a low-privilege user to root."],"techniqueTags":["suid-sgid-abuse","sudo-misconfiguration-exploitation","kernel-exploit","cron-job-abuse","linux-capabilities-abuse","writable-service-files","path-hijacking","wildcard-injection"],"techniqueDetails":["Covers finding SUID/SGID binaries and checking GTFOBins, analyzing sudo -l output for dangerous commands and wildcards, matching kernel exploits using linux-exploit-suggester, abusing cron jobs via writable scripts or PATH/wildcard injection, exploiting Linux capabilities with setuid/dac_override, and leveraging writable systemd/init service files."],"tools":["LinPEAS","LinEnum","linux-exploit-suggester","pspy","GTFOBins","PEASS-ng"],"targetTypes":["linux-host"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","exploitation"],"distinctiveFeatures":["Combines multiple Linux privilege escalation vectors into one structured playbook, mapping techniques to MITRE ATT&CK and pairing manual enumeration commands with automated tools like LinPEAS and linux-exploit-suggester."],"familyIds":["linux-privilege-escalation"]},{"id":"performing-privileged-account-access-review","summary":"A structured workflow for auditing privileged accounts across AD, cloud, and databases, including discovery, review criteria, certification decisions, remediation, and compliance reporting.","primaryDomain":"security-knowledge","domainTags":["identity-access-management","privileged-access-management","access-governance","compliance","audit"],"capabilityTags":["privileged-account-audit","access-certification","least-privilege-enforcement","access-review-workflow","compliance-validation"],"capabilityDetails":["Provides a structured workflow for reviewing privileged accounts across AD, cloud, and databases.","Covers account discovery, review criteria, certification decisions, remediation actions, and compliance reporting."],"techniqueTags":["four-pillar-framework","decision-matrix","account-enumeration","access-remediation","continuous-monitoring"],"techniqueDetails":["Uses a Four-Pillar Review Framework: Discover, Validate, Remediate, Monitor.","Applies a decision matrix to certify, revoke, or flag privileged access based on activity and justification."],"tools":["CyberArk","BeyondTrust","Delinea","SailPoint","Saviynt"],"targetTypes":["active-directory","cloud","database","windows-host"],"role":"workflow","workflowFocus":["enumeration","validation","remediation","reporting"],"distinctiveFeatures":["Focuses on identity governance and compliance for privileged access, not offensive exploitation.","Cross-platform coverage of domain admins, service accounts, cloud IAM roles, and database administrators.","Provides a decision matrix and validation checklist for access certification and least privilege."],"familyIds":["privileged-access-review"]},{"id":"performing-privileged-account-discovery","summary":"Structured workflow to discover and inventory privileged accounts across AD, local systems, services, databases, and cloud IAM, with risk classification and PAM onboarding alignment.","primaryDomain":"authentication","domainTags":["identity-access-management","privileged-access","account-inventory","pam-scoping"],"capabilityTags":["privileged-account-discovery","account-inventory","risk-classification","pam-onboarding"],"capabilityDetails":["Provides a workflow for discovering and inventorying privileged accounts across enterprise infrastructure, including domain admins, local admins, service accounts, database admins, cloud IAM roles, and application admin accounts."],"techniqueTags":["automated-scanning","ad-enumeration","local-account-audit","service-account-discovery","cloud-iam-enumeration","risk-classification"],"techniqueDetails":["Uses automated scanning to enumerate privileged accounts across AD, local systems, services, databases, and cloud IAM; classifies accounts by risk to aid PAM onboarding."],"tools":["python"],"targetTypes":["active-directory","windows-host","linux-host","database","cloud","other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","analysis","reporting"],"distinctiveFeatures":["Covers privileged account discovery across multiple infrastructure types (AD, local, service, database, cloud) with risk classification and PAM onboarding alignment, rather than focusing on a single account type or environment."],"familyIds":["privileged-access-and-identity-lifecycle-operations"]},{"id":"performing-purple-team-atomic-testing","summary":"Operational playbook for executing Atomic Red Team tests to validate SIEM/EDR detection coverage, generate ATT&CK Navigator heatmaps, and drive iterative detection engineering.","primaryDomain":"general-pentesting","domainTags":["purple-team","atomic-red-team","mitre-attack","detection-engineering","adversary-emulation"],"capabilityTags":["atomic-test-execution","detection-validation","coverage-gap-analysis","navigator-heatmap-generation","sigma-correlation"],"capabilityDetails":["Executes MITRE ATT&CK-mapped Atomic Red Team tests via Invoke-AtomicRedTeam, validates SIEM/EDR detections, generates ATT&CK Navigator coverage heatmaps, and runs an iterative detection validation loop."],"techniqueTags":["mitre-attack-techniques","atomic-red-team-tests","sigma-rule-correlation","coverage-gap-analysis"],"techniqueDetails":["Uses the Atomic Red Team library to run small, focused tests mapped to individual ATT&CK techniques and correlates results with detection rules."],"tools":["Invoke-AtomicRedTeam","Atomic Red Team","ATT&CK Navigator","Sigma","Splunk","Elastic","Microsoft Sentinel","Sysmon","VECTR"],"targetTypes":["windows-host","linux-host","active-directory"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","remediation","reporting"],"distinctiveFeatures":["Focuses on validating existing detection capabilities through known atomic tests rather than discovering or exploiting new vulnerabilities.","Combines atomic test execution, SIEM querying, coverage-gap analysis, Alpha-Navigator layer generation, and a closed-loop detection tuning workflow."],"familyIds":["purple-team-exercises-and-threat-emulation"]},{"id":"performing-purple-team-exercise","summary":"Provides a complete operational playbook for running purple team exercises: defines scope, builds an ATT&CK-mapped test plan, executes attack techniques with tools like Atomic Red Team, monitors SIEM in real time to measure detection latency, and collaboratively develops new detection rules for gaps, concluding with a structured exercise report.","primaryDomain":"general-pentesting","domainTags":["soc-operations","purple-team","adversary-emulation","detection-validation"],"capabilityTags":["purple-team-coordination","detection-validation","gap-remediation","red-blue-team-collaboration"],"capabilityDetails":["Provides a structured workflow for coordinating purple team exercises, including adversary emulation with red team techniques, real-time blue team detection monitoring, measurement of detection latency, and collaborative creation of new detection rules to close coverage gaps."],"techniqueTags":["mitre-attack-mapping","atomic-red-team","siem-monitoring","detection-latency-measurement"],"techniqueDetails":["Uses MITRE ATT&CK technique matrix to plan and execute attacks, relies on Atomic Red Team to run individual technique tests, leverages SIEM queries to detect events in real time, and measures the time between technique execution and alert generation."],"tools":["Atomic Red Team","MITRE Caldera","Vectr","Prelude Operator","AttackIQ","Splunk","PowerShell"],"targetTypes":["windows-host","active-directory","network"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on structured red/blue team collaboration rather than standalone offensive or defensive activity.","Measures detection latency for each ATT&CK technique and immediately builds new detection rules for gaps identified during the exercise.","Integrates real-time coordination through communication channels and provides reusable Python and SPL scripts for reporting and monitoring."],"familyIds":["purple-team-exercises-and-threat-emulation"]},{"id":"performing-ransomware-response","summary":"Executes a structured ransomware incident response from detection through containment, forensic analysis, recovery decision (restore, decryptor, pay, or rebuild), recovery execution, and post-incident hardening, with backup integrity verification, dwell-time analysis, and regulatory notification.","primaryDomain":"forensics","domainTags":["ransomware","incident-response","digital-forensics","backup-restoration","ransom-negotiation"],"capabilityTags":["ransomware-response","containment","forensic-analysis","backup-integrity-verification","recovery-decision-analysis","post-incident-hardening"],"capabilityDetails":["Provides an end-to-end structured ransomware response workflow from detection through containment, damage assessment, recovery, and post-incident hardening.","Supports recovery decisions among backup restore, free decryptor, ransom negotiation/payment (with OFAC screening), and full rebuild.","Includes forensic analysis steps such as preserving encrypted systems for memory forensics and using KAPE/Cado for triage."],"techniqueTags":["ransomware-variant-identification","network-isolation","memory-forensics","dwell-time-analysis","decryptor-testing","backup-restoration","ransom-payment-decision"],"techniqueDetails":["Identifies ransomware family from ransom note content, appended file extensions, and online identification services (ID Ransomware, NoMoreRansom).","Contains outbreaks by disconnecting network segments, isolating domain controllers, blocking SMB/RDP/WinRM, and preserving live encrypted systems for memory forensics.","Uses dwell-time analysis to identify clean backup restore points and avoid restoring compromised systems.","Evaluates decryptor availability, backup immutability (3-2-1-1-0), and OFAC sanctions before deciding on payment."],"tools":["ID Ransomware","NoMoreRansom","Veeam","Commvault","KAPE","Cado Response"],"targetTypes":["windows-host","active-directory","network","cloud","database"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Dedicated to ransomware/crypto-ransomware response rather than general malware IR; explicitly defers non-encryption malware to standard malware procedures.","Covers the full response arc including ransom payment decisioning (OFAC sanctions screening, negotiation) and regulatory notification obligations.","Emphasizes backup integrity verification and dwell-time analysis to determine clean restore points and avoid restoring backdoored systems.","Includes a detailed LockBit 3.0 via compromised VPN scenario and an incident report output template for operational use."],"familyIds":["scenario-specific-incident-response-playbooks"]},{"id":"performing-ransomware-tabletop-exercise","summary":"Provides a comprehensive methodology for planning, facilitating, and evaluating ransomware tabletop exercises, using realistic threat actor scenarios (e.g., LockBit, ALPHV/BlackCat) with injects for double extortion and backup destruction, and producing scorecard-based evaluations aligned to NIST CSF and CISA guidelines, culminating in an after-action report with remediation actions.","primaryDomain":"security-knowledge","domainTags":["ransomware","incident-response","tabletop-exercise","preparedness"],"capabilityTags":["tabletop-exercise-facilitation","ransomware-scenario-design","incident-response-evaluation","after-action-reporting"],"capabilityDetails":["Provides a structured workflow for planning, facilitating, and evaluating ransomware tabletop exercises.","Includes scenario templates and injects for double extortion and backup destruction scenarios.","Evaluates participant responses against NIST CSF and CISA guidelines using a scored evaluation matrix.","Generates a detailed after-action report with remediation actions and owners."],"techniqueTags":["phased-scenario-injects","probing-questions","scorecard-evaluation","decision-point-analysis","after-action-review"],"techniqueDetails":["Uses phased scenario injects to escalate pressure and simulate realistic ransomware attack progression.","Probing questions guide participants through detection, escalation, decision, and recovery phases.","Scores responses across eight functional areas to identify strengths and gaps.","After-action review compares results to previous exercises and tracks remediation."],"tools":["CISA-CTEP","FEMA-HSEEP","Immersive-Labs","NCSC-Exercise-in-a-Box","CISA-Ransomware-Readiness-Assessment"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting","remediation"],"distinctiveFeatures":["Ransomware-specific tabletop exercise methodology with threat actor injects based on LockBit and ALPHV/BlackCat.","Explicitly covers double extortion and backup destruction scenarios.","Evaluation scorecard aligned to NIST CSF Respond/Recover and CISA guidelines.","Customizable after-action report template with remediation tracking."],"familyIds":["tabletop-exercise-facilitation"]},{"id":"performing-red-team-phishing-with-gophish","summary":"Provides an automated workflow for running GoPhish phishing simulation campaigns, including email template creation with tracking pixels, SMTP configuration, target group import from CSV, campaign launch, and analysis of open/click/credential-submission metrics.","primaryDomain":"general-pentesting","domainTags":["social-engineering","phishing-simulation","security-awareness"],"capabilityTags":["phishing-campaign-automation","campaign-result-analysis","security-awareness-testing"],"capabilityDetails":["Provides an automated workflow for orchestrating GoPhish phishing simulation campaigns, including creating email templates with tracking pixels, configuring SMTP sending profiles, importing target groups from CSV, launching campaigns, and analyzing campaign metrics such as open rates, click rates, and credential submissions."],"techniqueTags":["social-engineering","email-tracking","credential-harvesting"],"techniqueDetails":["Uses HTML email templates with embedded tracking pixels to monitor opens and clicks, and employs landing pages designed to capture credentials submitted by targets."],"tools":["gophish","python-gophish","requests"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["analysis","validation","reporting"],"distinctiveFeatures":["Tool-specific automation of GoPhish phishing campaigns via the Python gophish library, with emphasis on campaign setup, tracking, and post-campaign metric analysis rather than general social engineering methodology."],"familyIds":["social-engineering-testing"]},{"id":"performing-red-team-with-covenant","summary":"API-driven workflow for operating Covenant C2 in authorized red team engagements, covering listener setup, launcher generation, grunt deployment, task execution, and operational reporting.","primaryDomain":"post-exploitation","domainTags":["red-team","c2","adversary-simulation","command-and-control"],"capabilityTags":["c2-listener-setup","launcher-generation","grunt-deployment","task-execution","lateral-movement-tracking","api-automation"],"capabilityDetails":["Automates Covenant C2 operations via its REST API to create listeners, generate launchers, deploy grunts, and run tasks on compromised hosts."],"techniqueTags":["http-listener","https-listener","binary-launcher","powershell-launcher","msbuild-launcher","jwt-authentication"],"techniqueDetails":["Uses Covenant's Swagger API with JWT authentication to configure listeners and launchers."],"tools":["covenant","python-requests"],"targetTypes":["windows-host","active-directory"],"role":"tool-guide","workflowFocus":["post-exploitation","reporting"],"distinctiveFeatures":["Focuses specifically on automating Covenant C2 operations via its REST API, including listener/launcher lifecycle, distinguishing it from general C2 usage guides."],"familyIds":["c2-framework-deployment-and-operations"]},{"id":"performing-s7comm-protocol-security-analysis","summary":"Provides an advanced workflow and Python tool to analyze S7comm protocol traffic from PCAP files, identify unauthorized engineering access, CPU stop commands, program downloads/uploads, and assess known vulnerabilities in Siemens S7 PLCs.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","s7comm-protocol","plc-security"],"capabilityTags":["s7comm-traffic-analysis","plc-vulnerability-assessment","unauthorized-access-detection","pcap-parsing"],"capabilityDetails":["Provides a Python script that parses S7comm packets from PCAP files and flags critical functions (CPU stop, program download/upload, write variable).","Checks for known CVEs and vulnerabilities affecting S7-300/400/1200/1500 controllers."],"techniqueTags":["pcap-analysis","protocol-parsing","function-code-monitoring","known-vuln-mapping"],"techniqueDetails":["Uses Scapy to read PCAPs and parse TPKT/COTP/S7comm headers.","Detects security-relevant S7comm function codes and correlates with CVE information."],"tools":["scapy"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Specialized for Siemens S7comm/S7CommPlus protocols rather than generic OT/ICS traffic analysis.","Includes a custom Python script to parse and inspect S7comm PDUs from PCAPs.","Checks for specific CVEs affecting S7-300/400/1200/1500 controllers."],"familyIds":["ot-ics-security-assessment"]},{"id":"performing-sca-dependency-scanning-with-snyk","summary":"A practical workflow for implementing SCA with Snyk, covering dependency vulnerability scanning in CI/CD, automated fix PRs, license compliance, and continuous monitoring, with special attention to transitive dependency risk.","primaryDomain":"source-code-security","domainTags":["devsecops","software-composition-analysis","dependency-scanning","cicd-pipeline"],"capabilityTags":["dependency-vulnerability-detection","fix-pr-generation","license-compliance-scanning","continuous-monitoring","ci-cd-integration"],"capabilityDetails":["Provides a workflow for scanning package manifests and lockfiles to detect known vulnerabilities in open-source dependencies.","Includes automated fix pull request generation to remediate vulnerable dependencies.","Implements license compliance checking against organizational policies.","Enables continuous monitoring of deployed applications for newly disclosed vulnerabilities."],"techniqueTags":["snyk-cli","package-manifest-scanning","dependency-path-analysis","exploit-maturity-assessment","policy-configuration"],"techniqueDetails":["Uses Snyk CLI commands for local and CI/CD scanning across multiple language ecosystems.","Analyzes transitive dependencies and reachability to prioritize fixes.","Leverages Snyk Monitor for continuous vulnerability tracking.","Configures .snyk policy files for ignore rules and severity thresholds."],"tools":["Snyk CLI","Snyk Open Source","Snyk Advisor","GitHub Actions","Snyk Monitor"],"targetTypes":["source-code"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on SCA with Snyk, not a general security scanning skill.","Provides integration patterns for GitHub Actions, GitLab, and Jenkins CI/CD pipelines.","Covers automated fix PR generation, license policy enforcement, and continuous monitoring in one workflow.","Includes practical guidance for triaging critical transitive dependency vulnerabilities, including dependency path analysis and version overrides."],"familyIds":["sca-dependency-scanning"]},{"id":"performing-scada-hmi-security-assessment","summary":"Provides a structured methodology and Python tool for assessing SCADA HMI security across authentication, communication, web interface, and hardening, aligned with IEC 62443 and NIST SP 800-82.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","scada","hmi-security"],"capabilityTags":["hmi-security-assessment","authentication-auditing","communication-security-review","web-hmi-vulnerability-assessment","hardening-review"],"capabilityDetails":["Provides a structured workflow and Python script for assessing SCADA HMI systems, covering authentication policies, HMI-PLC communication encryption, web-based HMI vulnerabilities (XSS, CSRF, IDOR), and OS/application hardening."],"techniqueTags":["compliance-checklist","web-vulnerability-testing","network-traffic-capture","configuration-audit"],"techniqueDetails":["Uses IEC 62443 and NIST SP 800-82 aligned checklists to evaluate authentication, communication, web HMI, and hardening; includes port scanning, TLS inspection, and known CVE verification."],"tools":["wireshark","python-script"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","validation","reporting"],"distinctiveFeatures":["Focuses exclusively on SCADA HMI systems in OT environments, combining IEC 62443/NIST compliance checks with web HMI vulnerability testing and HMI-PLC communication security."],"familyIds":["ot-ics-security-assessment"]},{"id":"performing-second-order-sql-injection","summary":"Practical playbook for detecting, validating, and exploiting second-order SQL injection by storing payloads at one endpoint and triggering them at another, including blind extraction with sqlmap and manual requests, plus remediation guidance.","primaryDomain":"injection","domainTags":["sql-injection","database-security","web-application-security"],"capabilityTags":["second-order-sql-injection-testing","stored-payload-exploitation","blind-sql-injection-validation","database-enumeration"],"capabilityDetails":["Provides a workflow for identifying storage and trigger points, injecting SQL payloads into stored data fields, and triggering deferred execution in separate application operations.","Supports automated second-order SQLi detection and exploitation using sqlmap --second-url/--second-req and manual blind extraction techniques."],"techniqueTags":["boolean-based-sqli","time-based-sqli","union-based-sqli","out-of-band-sqli"],"techniqueDetails":["Uses response differences in boolean conditions to infer data from stored payloads.","Uses time delays (e.g., WAITFOR DELAY) to confirm and exploit blind second-order injection.","Uses UNION SELECT payloads to extract database content through stored fields.","Uses out-of-band DNS (e.g., xp_dirtree) to exfiltrate data when direct output is unavailable."],"tools":["SQLMap","Burp Suite","OWASP ZAP","Commix","Custom Python scripts","DBeaver","DataGrip"],"targetTypes":["web-application","api","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on second-order (stored) SQL injection rather than general first-order SQLi, emphasizing multi-step storage-to-trigger workflows and deferred payload execution.","Distinctive for its coverage of cross-context attacks, stored procedure chains, and use of sqlmap second-order flags."],"familyIds":["sql-injection"]},{"id":"performing-security-headers-audit","summary":"Provides a structured workflow to audit HTTP security headers, including collection via curl, assessment of CSP, HSTS, frame protection, cookie flags, and permissions policy, and generation of a prioritized hardening report.","primaryDomain":"web-security","domainTags":["http-security-headers","content-security-policy","hsts","cookie-security","clickjacking-protection"],"capabilityTags":["security-header-auditing","csp-analysis","hsts-validation","cookie-flag-assessment","clickjacking-defense-review"],"capabilityDetails":["Provides a structured workflow to collect, evaluate, and report on HTTP security headers, including CSP, HSTS, X-Frame-Options, and cookie attributes, to identify missing or misconfigured browser-level protections."],"techniqueTags":["curl-header-fetching","csp-directive-analysis","hsts-preload-check","cookie-attribute-inspection","online-scanner-usage"],"techniqueDetails":["Uses curl to extract response headers and online scanners for grading; inspects CSP directives for dangerous values like unsafe-inline and missing frame-ancestors."],"tools":["curl","SecurityHeaders.com","Mozilla Observatory","Google CSP Evaluator","Burp Suite","securityheaders CLI"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting","remediation"],"distinctiveFeatures":["Dedicated entirely to HTTP security header auditing rather than general web vulnerability scanning","Covers a broad set of headers including CSP, HSTS, cookie attributes, and permissions policy with concrete curl-based checks","Combines manual header inspection with online scanner grading (SecurityHeaders.com, Mozilla Observatory)"],"familyIds":["security-headers-audit"]},{"id":"performing-serverless-function-security-review","summary":"A specialist security review playbook for serverless functions on AWS Lambda, Azure Functions, and Google Cloud Functions, covering function enumeration, execution role and IAM policy auditing, environment variable secrets detection, trigger access control review, source code vulnerability scanning, and automated compliance scanning with Checkov and Prowler, including remediation guidance and report generation.","primaryDomain":"cloud-security","domainTags":["cloud-security","serverless-security","aws-lambda","azure-functions","gcp-cloud-functions"],"capabilityTags":["serverless-security-review","execution-role-auditing","secrets-management-review","function-code-analysis","compliance-scanning"],"capabilityDetails":["Provides a structured workflow for security reviewing serverless functions across AWS Lambda, Azure Functions, and Google Cloud Functions.","Includes IAM execution role auditing to detect overly permissive policies and wildcard actions.","Scans environment variables for hardcoded secrets and credentials across multiple cloud CLI interfaces.","Conducts function code analysis for injection vulnerabilities, insecure deserialization, and other common serverless flaws.","Leverages automated scanning tools such as Checkov and Prowler for infrastructure-as-code and cloud security compliance checks."],"techniqueTags":["iam-policy-analysis","environment-variable-scanning","static-code-analysis","trigger-access-review","runtime-deprecation-check"],"techniqueDetails":["Audits attached IAM policies for wildcard actions and excessive permissions using AWS CLI and custom Python parsing.","Identifies sensitive patterns in environment variable names and values using regex-based secret detection.","Performs static analysis with Bandit for Python and ESLint for Node.js to find code-level vulnerabilities.","Reviews function URLs and resource-based policies for unauthenticated invocation or public ingress.","Checks for deprecated runtimes to identify functions lacking security patches and support."],"tools":["aws-cli","azure-cli","gcloud-cli","checkov","prowler","bandit","eslint"],"targetTypes":["cloud","source-code"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection","reporting"],"distinctiveFeatures":["Focuses exclusively on serverless functions across three major cloud providers.","Covers both infrastructure-level security (IAM, execution roles, triggers, environment variables) and application-level code analysis.","Provides concrete, copy-paste CLI commands for each step in the review process.","Includes a realistic common scenario with remediation guidance and an output report format for findings."],"familyIds":["cloud-security-posture-assessment"]},{"id":"performing-service-account-audit","summary":"Audit service accounts across AD, cloud, and databases to identify orphaned, over-privileged, and non-compliant accounts, with risk classification and remediation guidance.","primaryDomain":"active-directory","domainTags":["identity-access-management","cloud-security","database-security","access-control"],"capabilityTags":["service-account-discovery","privilege-assessment","orphaned-account-detection","credential-rotation-compliance","compliance-reporting"],"capabilityDetails":["Provides a structured workflow for discovering service accounts across Active Directory, cloud platforms, databases, and applications, assessing their privileges and ownership, and identifying orphaned or over-privileged accounts."],"techniqueTags":["active-directory-enumeration","cloud-iam-enumeration","ownership-verification","password-age-analysis","risk-classification"],"techniqueDetails":["Uses AD queries (SPN, flags), cloud IAM enumeration, and asset inventory comparison to evaluate account ownership, activity, and credential rotation."],"tools":[],"targetTypes":["active-directory","cloud","database","other"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection","validation","remediation","reporting"],"distinctiveFeatures":["Spans service account audits across AD, cloud, and databases rather than a single platform.","Includes ownership verification and orphaned account detection via CMDB alignment.","Provides risk classification matrix and security control mapping to NIST."],"familyIds":["service-account-audit"]},{"id":"performing-service-account-credential-rotation","summary":"Automates service account credential rotation across Active Directory, cloud platforms, and databases using gMSA, AWS Secrets Manager, and Vault dynamic secrets, with post-rotation health checks.","primaryDomain":"authentication","domainTags":["identity-access-management","service-accounts","secrets-management","active-directory","cloud-security","database-security"],"capabilityTags":["credential-rotation","service-account-management","secrets-automation","post-rotation-verification"],"capabilityDetails":["Provides automated workflows for rotating service account credentials across Active Directory, AWS, GCP, Azure, and application databases.","Includes post-rotation verification through health checks and validation checklists to ensure service continuity."],"techniqueTags":["gmsa","dynamic-secrets","access-key-rotation","vault-database-rotation"],"techniqueDetails":["Uses Group Managed Service Accounts (gMSA) for automatic Active Directory password management.","Uses AWS Secrets Manager and IAM access key rotation to replace and deactivate old credentials.","Uses HashiCorp Vault database secrets engine for dynamic database credential generation.","Uses automated health checks to verify services after credential rotation."],"tools":["PowerShell","AWS Secrets Manager","HashiCorp Vault","boto3","hvac"],"targetTypes":["active-directory","windows-host","cloud","database"],"role":"workflow","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Covers credential rotation holistically across AD, cloud IAM, and database secrets rather than focusing on a single platform.","Emphasizes automation via secrets managers and gMSA rather than manual password changes.","Includes concrete code examples for AWS Secrets Manager rotation and Vault dynamic secrets configuration.","Provides post-rotation health verification and a validation checklist specific to credential rotation."],"familyIds":["privileged-access-and-identity-lifecycle-operations"]},{"id":"performing-soap-web-service-security-testing","summary":"Automated SOAP web service security assessment that parses WSDL to enumerate operations, then tests for XXE, XML bomb, SQL injection, SOAPAction spoofing, and WS-Security bypass, generating a structured report.","primaryDomain":"api-security","domainTags":["soap","wsdl","web-services","xml","ws-security"],"capabilityTags":["wsdl-analysis","xxe-testing","xml-bomb-testing","sql-injection-testing","soapaction-spoofing-testing","ws-security-bypass-testing"],"capabilityDetails":["Parses WSDL documents to enumerate SOAP operations, endpoints, and SOAPAction headers.","Tests SOAP endpoints for XXE using classic file read, blind OOB, and XML bomb payloads.","Tests SOAP parameters for SQL injection using common error-based payloads.","Tests whether SOAPAction header can be spoofed by sending requests with mismatched action values.","Tests WS-Security enforcement by sending requests with missing, empty, or expired security tokens."],"techniqueTags":["xxe-injection","blind-xxe","xml-bomb","sql-injection","soapaction-mismatch","ws-security-header-manipulation","wsdl-parsing"],"techniqueDetails":["Uses lxml to parse WSDL and extract binding operations and endpoint addresses.","Injects DOCTYPE declarations with external entities to read files or trigger OOB callbacks.","Crafts billion-laughs XML entities to test for entity expansion denial of service.","Sends SQLi payloads in SOAP body parameters and detects SQL errors in responses.","Sends request bodies for one operation with the SOAPAction of another to check authorization.","Omits or alters WS-Security headers (empty UsernameToken, expired timestamp) to see if access is granted."],"tools":["python","requests","lxml","soapui","burp-suite"],"targetTypes":["api","web-application","database"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","exploitation","reporting"],"distinctiveFeatures":["Targets SOAP/WSDL-based APIs with protocol-specific vulnerabilities (SOAPAction spoofing, WS-Security bypass) that are not applicable to REST API testing.","Includes a complete, runnable Python security tester that automates WSDL enumeration and multiple vulnerability classes.","Combines XML-specific attacks (XXE, XML bombs) with backend injection (SQLi) in a unified workflow for SOAP web services."],"familyIds":["automated-api-security-testing"]},{"id":"performing-soc-tabletop-exercise","summary":"Enables SOC teams to plan, run, and evaluate discussion-based tabletop exercises that test incident response procedures, communication workflows, and decision-making under pressure, with a full ransomware scenario and remediation tracking.","primaryDomain":"security-knowledge","domainTags":["soc-operations","incident-response","tabletop-exercise","security-testing"],"capabilityTags":["incident-response-testing","tabletop-exercise-facilitation","playbook-validation","scenario-design","after-action-reporting"],"capabilityDetails":["Provides a complete workflow to design, facilitate, and evaluate SOC tabletop exercises, including scenario injects, participant scoring, and after-action reporting, to validate incident response procedures and improve team readiness."],"techniqueTags":["scenario-based-simulation","timed-injects","discussion-based-exercise","hot-wash","gap-analysis"],"techniqueDetails":["Uses timed scenario injects and guided questions to simulate an incident, followed by hot-wash debriefs and gap analysis to identify weaknesses in IR processes and communication."],"tools":["FEMA HSEEP","NIST SP 800-84","Immersive Labs","Infection Monkey","Archer","Splunk"],"targetTypes":["other"],"role":"workflow","workflowFocus":["validation","analysis","reporting","remediation"],"distinctiveFeatures":["Specifically targets SOC tabletop exercise facilitation rather than technical red teaming or detection testing.","Includes a complete ransomware scenario with 6 timed injects, evaluation scorecard, and actionable after-action report with remediation tracking."],"familyIds":["tabletop-exercise-facilitation"]},{"id":"performing-soc2-type2-audit-preparation","summary":"Provides a structured workflow for preparing for SOC 2 Type II audits, including gap assessment against AICPA Trust Services Criteria, automated evidence collection from cloud and identity systems via APIs, control validation, and continuous compliance monitoring.","primaryDomain":"cloud-security","domainTags":["aicpa-tsc","compliance","audit-preparation","grc"],"capabilityTags":["gap-assessment","evidence-collection","control-validation","compliance-monitoring"],"capabilityDetails":["Provides a structured workflow for SOC 2 Type II audit preparation, including gap assessment against AICPA Trust Services Criteria, automated evidence collection from cloud and identity systems, control testing validation, and continuous compliance monitoring."],"techniqueTags":["api-based-evidence-collection","control-mapping","automated-compliance-checks","evidence-packaging"],"techniqueDetails":["Uses Python code with APIs (boto3, requests) to automate evidence collection from AWS, Azure, GCP, Okta, GitHub, and Jira, and to validate controls against TSC criteria."],"tools":["boto3","requests","pyyaml"],"targetTypes":["cloud","other"],"role":"specialist-playbook","workflowFocus":["analysis","validation","reporting","remediation"],"distinctiveFeatures":["Specialized for SOC 2 Type II audit preparation rather than general cloud security scanning","Covers all five Trust Services Categories with detailed mapping to CC1-CC9 criteria","Automates evidence collection from multiple cloud and identity providers via API integrations"],"familyIds":["compliance-audit-preparation"]},{"id":"performing-sqlite-database-forensics","summary":"Provides forensic analysis of SQLite databases, including recovery of deleted records from freelist pages and WAL files, decoding of application-specific timestamps, and extraction of evidence from browser and mobile app databases.","primaryDomain":"forensics","domainTags":["sqlite","database-forensics","digital-forensics"],"capabilityTags":["deleted-record-recovery","wal-file-analysis","unallocated-space-analysis","timestamp-decoding","browser-history-analysis"],"capabilityDetails":["Provides forensic analysis of SQLite databases including recovery of deleted records from freelist pages, WAL files, and unallocated space; decoding of application-specific timestamps; and evidence extraction from browser and mobile app databases."],"techniqueTags":["b-tree-page-analysis","freelist-page-walking","wal-frame-parsing","unallocated-space-scanning","timestamp-conversion"],"techniqueDetails":["Uses low-level SQLite page structure analysis to inspect B-tree pages, freelist trunks/leaves, WAL frames, and unallocated page regions. Includes Python scripts for parsing these structures and converting Chrome, Unix, Mac Absolute, and Mozilla timestamps."],"tools":["sqlite3","python","db-browser-for-sqlite","belkasoft-evidence-center","axiom","hex-editor"],"targetTypes":["database","mobile"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses on SQLite internals (B-tree pages, freelist, WAL) to recover deleted records, not just running SQL queries. Provides Python scripts for low-level page analysis and timestamp decoding across multiple applications."],"familyIds":["database-forensics"]},{"id":"performing-ssl-certificate-lifecycle-management","summary":"Provides a structured approach for automating SSL/TLS certificate lifecycle management, including CSR generation, issuance, deployment, monitoring, renewal, and revocation, to prevent certificate-expiry outages and maintain PKI trust.","primaryDomain":"security-knowledge","domainTags":["cryptography","pki","ssl-certificates","tls"],"capabilityTags":["csr-generation","certificate-issuance","certificate-deployment","expiration-monitoring","certificate-renewal","certificate-revocation"],"capabilityDetails":["Automates the full certificate lifecycle including CSR generation, issuance, deployment, monitoring, renewal, and revocation."],"techniqueTags":["acme-protocol","x509-certificate-validation","ocsp-stapling","crl-checking","certificate-transparency-monitoring"],"techniqueDetails":["Uses ACME protocol to automate issuance and renewal.","Validates certificate chains and trust paths.","Implements OCSP and CRL checks for revocation status."],"tools":["python","acme-protocol-tools"],"targetTypes":["web-application","api","network"],"role":"knowledge-base","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Focuses on the operational lifecycle of certificates rather than vulnerability testing; covers full PKI automation from CSR to revocation, including ACME-based renewal and OCSP/CRL checks."],"familyIds":["certificate-lifecycle-management"]},{"id":"performing-ssl-stripping-attack","summary":"Provides an authorized workflow for simulating SSL stripping/HTTPS downgrade attacks using Bettercap, sslstrip2, and mitmproxy, testing HSTS enforcement and preloading, validating detection indicators, and producing an assessment report.","primaryDomain":"network-security","domainTags":["network-security","tls-security","hsts","https-downgrade"],"capabilityTags":["ssl-stripping","hsts-validation","mitm-testing","traffic-interception"],"capabilityDetails":["Provides a practical workflow for executing SSL stripping/HTTPS downgrade attacks, validating HSTS enforcement and preloading, demonstrating downgrade risks, and training SOC detection."],"techniqueTags":["arp-spoofing","sslstrip","hsts-bypass","downgrade-attack","traffic-sniffing"],"techniqueDetails":["Uses ARP spoofing to establish MITM position, then Bettercap or sslstrip2 to rewrite HTTPS links to HTTP, and validates HSTS headers/preload lists, including bypass attempts like subdomain substitution and DNS spoofing."],"tools":["bettercap","sslstrip2","mitmproxy","tshark","curl"],"targetTypes":["network","web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on SSL stripping and HSTS enforcement, including preload list validation and bypass techniques, rather than general network sniffing or ARP spoofing."],"familyIds":["tls-ssl-security"]},{"id":"performing-ssl-tls-inspection-configuration","summary":"A specialist playbook for configuring SSL/TLS inspection on NGFWs and proxies, covering internal CA generation, endpoint certificate deployment, forward/inbound decryption policies, exemption management for pinned apps and privacy, and validation using openssl/curl.","primaryDomain":"network-security","domainTags":["ssl-inspection","tls-decryption","certificate-management","proxy"],"capabilityTags":["tls-inspection-configuration","ca-certificate-deployment","decryption-policy-management"],"capabilityDetails":["Provides a step-by-step workflow for configuring SSL/TLS break-and-inspect on next-generation firewalls and forward proxies, including generating internal CAs, deploying trusted certificates to endpoints, configuring forward and inbound inspection policies, managing exemptions, and validating decryption."],"techniqueTags":["ssl-forward-proxy","ssl-inbound-inspection","man-in-the-middle","certificate-authority"],"techniqueDetails":["Uses trusted man-in-the-middle interception to decrypt TLS sessions, generate on-the-fly certificates signed by an internal CA, and re-encrypt traffic after inspection."],"tools":["openssl","curl","powershell","palo-alto"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["remediation","validation"],"distinctiveFeatures":["Focuses on defensive configuration of TLS inspection on network security devices, including CA deployment, exemption management, and compliance, rather than offensive decryption or vulnerability exploitation."],"familyIds":["tls-ssl-security"]},{"id":"performing-ssl-tls-security-assessment","summary":"Conducts SSL/TLS server configuration assessments using sslyze, evaluating protocol versions, cipher suites, certificate chain validity, HSTS, OCSP stapling, and known vulnerabilities like Heartbleed and ROBOT.","primaryDomain":"network-security","domainTags":["ssl-tls","cipher-suites","certificate-validation","vulnerability-assessment"],"capabilityTags":["tls-configuration-assessment","ssl-configuration-audit","tls-vulnerability-scanning"],"capabilityDetails":["Provides a workflow for assessing SSL/TLS server configurations using sslyze, covering supported protocol versions, cipher suite strength, certificate chain validation, HSTS enforcement, OCSP stapling, and known vulnerabilities such as Heartbleed and ROBOT."],"techniqueTags":["ssl-tls-scanning","cipher-analysis","certificate-chain-validation","vulnerability-scanning"],"techniqueDetails":["Uses sslyze's ServerScanRequest and Scanner to enumerate supported protocols, accepted cipher suites, certificate chain issues, and vulnerability scan results."],"tools":["sslyze"],"targetTypes":["network","web-application"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Focuses specifically on SSL/TLS server configuration assessment using the sslyze Python library, covering both protocol/cipher strength and known TLS vulnerabilities (e.g., Heartbleed, ROBOT) in a single workflow."],"familyIds":["tls-ssl-security"]},{"id":"performing-ssrf-vulnerability-exploitation","summary":"A specialist playbook for confirming SSRF in URL-fetching web parameters by probing cloud metadata and internal resources, using bypass techniques like IP encoding and DNS rebinding, and generating a vulnerability report.","primaryDomain":"web-security","domainTags":["ssrf","cloud-metadata-abuse","web-application-security"],"capabilityTags":["ssrf-testing","cloud-metadata-probing","protocol-handler-testing","bypass-validation","vulnerability-reporting"],"capabilityDetails":["Provides a workflow for identifying and confirming SSRF in URL-fetching parameters by probing cloud metadata endpoints, internal services, and protocol handlers, and includes report generation."],"techniqueTags":["cloud-metadata-request","ip-encoding-bypass","dns-rebinding","url-redirect","protocol-handler-abuse"],"techniqueDetails":["Uses AWS/GCP/Azure metadata endpoints at 169.254.169.254, internal IP probes, file/gopher/dict handlers, and IP-encoding or DNS rebinding to circumvent filters."],"tools":["python","requests","scripts/agent.py"],"targetTypes":["web-application","api","cloud","network"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","reporting"],"distinctiveFeatures":["Distinct from generic SSRF scanners by combining cloud metadata abuse, protocol handlers, and multiple filter-bypass techniques in a single workflow; provides a Python script and automated output."],"familyIds":["ssrf-exploitation"]},{"id":"performing-static-malware-analysis-with-pe-studio","summary":"Provides a structured pre-execution workflow for static analysis of Windows PE malware using PEStudio and pefile to identify suspicious imports, strings, resources, packing, and potential indicators of compromise.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","static-analysis","pe-analysis"],"capabilityTags":["static-malware-analysis","pe-triage","import-analysis","string-analysis","packing-detection"],"capabilityDetails":["Provides a step-by-step workflow for static analysis of Windows PE malware without executing the binary.","Enables identification of suspicious imports, strings, resources, packing, and potential indicators of compromise."],"techniqueTags":["entropy-analysis","import-address-table-analysis","string-extraction","resource-inspection","packer-detection"],"techniqueDetails":["Uses section entropy and virtual-to-raw size ratios to identify packed or encrypted executables.","Categorizes API imports by malware capability (injection, keylogging, persistence, evasion, network).","Extracts both ASCII and Unicode strings and uses FLOSS for obfuscated string recovery.","Inspects PE resources for embedded payloads or high-entropy data blobs.","Detects packers via common section names and import table characteristics."],"tools":["PEStudio","pefile","FLOSS","Detect It Easy","CFF Explorer","VirusTotal API"],"targetTypes":["binary","windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Focuses specifically on pre-execution static triage of PE executables, combining GUI inspection with scripted automation.","Covers packer detection and anti-analysis identification as a core part of the workflow, not just general malware scanning."],"familyIds":["malware-indicator-and-signature-development"]},{"id":"performing-steganography-detection","summary":"Forensic workflow for detecting and extracting hidden data in images, audio, and video using steganalysis tools (zsteg, binwalk, steghide, stegoveritas) and custom LSB statistical analysis, supporting investigations into covert communication and data exfiltration.","primaryDomain":"forensics","domainTags":["steganography","digital-forensics","media-analysis","covert-channels"],"capabilityTags":["steganography-detection","hidden-data-extraction","lsb-analysis","statistical-steganalysis"],"capabilityDetails":["Provides a step-by-step workflow to detect and extract hidden data in media files using automated tools and custom scripts.","Covers image, audio, and video steganography analysis for forensic investigations."],"techniqueTags":["lsb-steganography","dct-steganography","spread-spectrum","chi-square-analysis","appended-data-detection","metadata-analysis"],"techniqueDetails":["Uses bit-plane extraction to identify non-random LSB distributions.","Checks for data appended after file end markers and embedded archives via signature scanning."],"tools":["StegDetect","zsteg","StegSolve","binwalk","steghide","OpenStego","ExifTool","stegoveritas","stegseek"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Covers both image and audio media with custom statistical LSB analysis.","Integrates multiple open-source steganalysis tools with a forensic case workflow.","Includes scenario-based guidance for covert communication, data exfiltration, malware C2, and IP theft."],"familyIds":["steganography-detection-and-analysis"]},{"id":"performing-subdomain-enumeration-with-subfinder","summary":"Provides a practical workflow for passive subdomain enumeration using Subfinder, including API key configuration, source selection, recursive enumeration, live host validation with httpx, and integration with vulnerability scanning tools.","primaryDomain":"reconnaissance","domainTags":["subdomain-enumeration","dns-recon","passive-recon","osint","attack-surface"],"capabilityTags":["subdomain-enumeration","passive-dns-enumeration","attack-surface-mapping","recon-pipeline-integration"],"capabilityDetails":["Provides a structured workflow for discovering subdomains using Subfinder's passive sources and validating live hosts with httpx."],"techniqueTags":["certificate-transparency","dns-aggregation","recursive-enumeration","api-source-queries"],"techniqueDetails":["Leverages multiple passive DNS and certificate transparency sources; supports recursive enumeration and source filtering."],"tools":["subfinder","httpx","dnsx","nuclei","amass","gowitness"],"targetTypes":["network","web-application"],"role":"tool-guide","workflowFocus":["reconnaissance","enumeration","validation"],"distinctiveFeatures":["Tool-specific workflow centered on Subfinder, with API key configuration, source control, recursive enumeration, and seamless piping to httpx for live validation and broader recon tooling."],"familyIds":["attack-surface-discovery"]},{"id":"performing-supply-chain-attack-simulation","summary":"Provides an automated workflow to simulate and detect software supply chain attacks, including typosquatting via Levenshtein distance, dependency confusion, package hash verification, and known-CVE scanning, producing a risk-scored JSON report.","primaryDomain":"general-pentesting","domainTags":["supply-chain-security","software-composition-analysis","dependency-management"],"capabilityTags":["typosquatting-detection","dependency-confusion-testing","hash-verification","known-cve-scanning"],"capabilityDetails":["Detect typosquatting by computing Levenshtein distance between package names and popular PyPI packages.","Test for dependency confusion by checking private package names against public PyPI and version numbers.","Verify package integrity by comparing SHA-256 hashes of downloaded packages to published digests.","Scan installed dependencies for known vulnerabilities using pip-audit against OSV and PyPA advisory databases."],"techniqueTags":["levenshtein-distance","sha256-hash-comparison","pip-audit","version-comparison"],"techniqueDetails":["Uses edit distance thresholds to find package names similar to well-known PyPI packages.","Downloads packages and computes SHA-256 digests to compare with published hashes.","Runs pip-audit to identify known CVEs from advisory databases.","Compares version numbers of public packages against private package names to detect dependency confusion."],"tools":["pip-audit","Levenshtein","requests","PyPI JSON API"],"targetTypes":["source-code"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Combines multiple supply chain attack vectors (typosquatting, dependency confusion, hash mismatch, known CVEs) into a single auditing workflow.","Uses Levenshtein distance algorithm for typosquatting detection rather than simple string matching.","Automates dependency confusion testing by checking package existence and version numbers against public PyPI."],"familyIds":["supply-chain-attack-simulation"]},{"id":"performing-thick-client-application-penetration-test","summary":"Provides a complete penetration testing methodology for thick client desktop applications, covering static analysis, dynamic monitoring, DLL hijacking, memory manipulation, and backend API security testing.","primaryDomain":"general-pentesting","domainTags":["thick-client","desktop-application","application-security","binary-analysis"],"capabilityTags":["thick-client-penetration-testing","static-analysis","dynamic-analysis","dll-hijacking-testing","memory-manipulation","api-security-testing"],"capabilityDetails":["Provides an end-to-end methodology for penetration testing desktop thick client applications, including static code analysis, process and filesystem monitoring, DLL hijacking, memory manipulation, and API security assessment."],"techniqueTags":["dotnet-decompilation","dll-hijacking","memory-modification","traffic-interception","hardcoded-credential-search","certificate-pinning-bypass"],"techniqueDetails":["Uses dnSpy to decompile .NET assemblies and inspect for hardcoded secrets and insecure logic.","Uses Procmon to observe file/registry operations and identify DLL search order hijacking opportunities.","Demonstrates modifying process memory to bypass license or privilege checks.","Intercepts application traffic using Burp Suite, Echo Mirage, or Fiddler to assess API endpoints.","Searches binaries and configuration files for hardcoded credentials and sensitive strings.","Covers techniques to bypass certificate pinning, such as patching validation or using Frida hooks."],"tools":["dnSpy","Procmon","Process Hacker","Wireshark","Burp Suite","Echo Mirage","Fiddler","IDA Pro","Ghidra","Cheat Engine","x64dbg","Frida"],"targetTypes":["binary","windows-host","linux-host","api"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis","detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on thick client desktop applications rather than web or mobile targets, covering local storage, DLL hijacking, memory manipulation, and client-server API misconfigurations."],"familyIds":["thick-client-penetration-testing"]},{"id":"performing-threat-emulation-with-atomic-red-team","summary":"Executes Atomic Red Team attack simulations via atomic-operator to validate detection coverage against MITRE ATT&CK techniques, supporting purple team exercises and SIEM/EDR rule testing.","primaryDomain":"general-pentesting","domainTags":["threat-emulation","mitre-attack","purple-team"],"capabilityTags":["atomic-test-execution","detection-validation","purple-team-workflow","siem-edr-testing"],"capabilityDetails":["Executes Atomic Red Team tests for specified MITRE ATT&CK techniques using the atomic-operator Python framework.","Loads atomic test definitions from YAML files and parses supported platforms.","Validates SIEM/EDR detection coverage by comparing alerts to executed atomic tests.","Documents detection gaps to inform rule updates."],"techniqueTags":["adversary-simulation","mitre-attack-techniques"],"techniqueDetails":["Runs arbitrary MITRE ATT&CK technique implementations from Atomic Red Team on target hosts.","Uses response from SIEM/EDR to validate whether technique behavior is detected or missed."],"tools":["atomic-operator","atomic-red-team","PyYAML"],"targetTypes":["windows-host","linux-host"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on programmatic execution of Atomic Red Team atomics via atomic-operator for detection validation, rather than manual attack simulation.","Integrated with purple team workflow to validate SIEM/EDR coverage against ATT&CK techniques."],"familyIds":["purple-team-exercises-and-threat-emulation"]},{"id":"performing-threat-hunting-with-elastic-siem","summary":"Provides a structured workflow for proactive threat hunting in Elastic Security SIEM, using KQL/EQL queries, Timeline investigation, and detection rule creation to uncover attacker activity and improve detection coverage.","primaryDomain":"security-knowledge","domainTags":["soc-operations","siem","threat-hunting","elastic","detection"],"capabilityTags":["threat-hunting","siem-querying","detection-rule-creation","log-analysis","incident-investigation"],"capabilityDetails":["Provides a structured workflow for proactive threat hunting using Elastic Security SIEM.","Covers KQL/EQL querying, Timeline investigation, and conversion of findings into detection rules.","Includes hypothesis-driven investigation and coverage validation against MITRE ATT&CK."],"techniqueTags":["kql-queries","eql-queries","mitre-attack-mapping","sequence-detection","lolbin-detection"],"techniqueDetails":["Uses KQL for detailed log filtering and anomaly discovery in Kibana Discover.","Uses EQL to detect multi-step attack sequences such as parent-child process anomalies and lateral movement.","Maps hunting findings to MITRE ATT&CK for gap analysis and detection rule enrichment."],"tools":["Elastic Security","Kibana","Elasticsearch","Elastic Agent","ATT&CK Navigator"],"targetTypes":["windows-host","network","active-directory"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Specialized in proactive hypothesis-driven hunting within Elastic Security SIEM, not just general log querying.","Covers the full cycle from hypothesis to detection rule creation and coverage validation.","Includes EQL sequence detection and Timeline-based collaborative investigation, distinguishing it from simple log search."],"familyIds":["threat-hunting"]},{"id":"performing-threat-hunting-with-yara-rules","summary":"Provides a practical workflow for threat hunting using YARA rules, covering rule authoring, scanning files and memory dumps with yara-python, generating rules with yarGen, integrating community rule sets, and building a continuous detection pipeline.","primaryDomain":"forensics","domainTags":["threat-hunting","malware-detection","yara","pattern-matching"],"capabilityTags":["yara-rule-authoring","file-scanning","memory-dump-scanning","ioc-validation","automated-detection-pipeline"],"capabilityDetails":["Covers authoring YARA rules using strings, hex patterns, and conditions.","Provides workflows for scanning files and directories with yara-python.","Includes scanning process memory dumps for in-memory indicators.","Explains automated rule generation with yarGen from malware samples.","Demonstrates continuous file monitoring pipeline for new files."],"techniqueTags":["pattern-matching","string-matching","hex-patterns","pe-module-analysis","entropy-analysis","memory-analysis","automated-rule-generation"],"techniqueDetails":["Uses YARA pattern matching on strings and byte sequences.","Applies PE module inspection for section names, imports, and characteristics.","Uses entropy analysis to detect packed or encrypted executables.","Scans raw memory dumps for in-memory payloads and beacons.","Generates rules automatically by extracting distinctive strings from malware samples."],"tools":["yara","yara-python","yarGen","pefile","malduck","watchdog","signature-base","YARA-Rules"],"targetTypes":["binary","windows-host","linux-host","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Provides a complete YARA-specific workflow from rule authoring to continuous hunting pipeline.","Covers both file and memory dump scanning, distinguishing it from general malware analysis skills.","Integrates manual rule creation with automated yarGen rule generation and community rule sets.","Includes practical Python code for compiling rules, scanning directories, and monitoring file arrivals."],"familyIds":["signature-and-ioc-based-malware-detection"]},{"id":"performing-threat-intelligence-sharing-with-misp","summary":"Operational workflow for using PyMISP to create, enrich, publish, search, and export threat intelligence events on a MISP instance.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","misp","ioc-sharing","stix"],"capabilityTags":["misp-event-management","ioc-creation","stix-export","threat-feed-integration"],"capabilityDetails":["Provides a workflow for creating, enriching, publishing, searching, and exporting threat intelligence events on a MISP instance using PyMISP."],"techniqueTags":["pymisp","misp-rest-api","mitre-attack-enrichment","tlp-tagging"],"techniqueDetails":["Uses the official PyMISP library to interact with the MISP REST API.","Applies MITRE ATT&CK tags and galaxy clusters for event enrichment.","Exports events in STIX 2.1 format for interoperability."],"tools":["pymisp","misp"],"targetTypes":["other"],"role":"tool-guide","workflowFocus":["knowledge-reference"],"distinctiveFeatures":["Specifically automates MISP platform operations via PyMISP for creating, enriching, and sharing structured IOCs with STIX export, rather than general threat intel analysis."],"familyIds":["threat-intelligence-sharing-and-processing"]},{"id":"performing-threat-landscape-assessment-for-sector","summary":"Conducts a sector-specific threat landscape assessment by profiling threat actors, mapping MITRE ATT&CK TTPs, analyzing attack vectors, and generating an executive report for risk management and board-level reporting.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","sector-analysis","cti"],"capabilityTags":["threat-actor-profiling","ttp-mapping","attack-vector-analysis","incident-trend-analysis","report-generation"],"capabilityDetails":["Profiles threat actors known to target a specific industry sector.","Maps MITRE ATT&CK techniques to sector-specific threat actor groups.","Identifies primary and emerging attack vectors for the sector.","Generates an executive-level markdown threat report for risk management."],"techniqueTags":["mitre-attack-mapping","threat-actor-correlation","sector-risk-analysis"],"techniqueDetails":["Uses MITRE ATT&CK group data to associate threat actors with techniques.","Correlates known sector-targeting actors from curated lists.","Analyzes common techniques and attack vectors to assess sector risk."],"tools":["attackcti","pandas","matplotlib","requests"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis","reporting"],"distinctiveFeatures":["Focuses on industry vertical threat intelligence rather than organization-specific vulnerability assessment.","Combines MITRE ATT&CK group data with sector-specific actor profiles.","Produces strategic threat landscape reports for board-level consumption."],"familyIds":["threat-actor-and-landscape-analysis"]},{"id":"performing-threat-modeling-with-owasp-threat-dragon","summary":"Provides a practical workflow for creating and maintaining threat models with OWASP Threat Dragon, from DFD diagrams to STRIDE/LINDDUN threat identification, mitigation tracking, and PDF report generation.","primaryDomain":"security-knowledge","domainTags":["threat-modeling","secure-design","data-flow"],"capabilityTags":["dfd-creation","threat-identification","mitigation-planning","report-generation"],"capabilityDetails":["Provides a step-by-step workflow for building data flow diagrams and identifying threats using STRIDE, LINDDUN, and other methodologies."],"techniqueTags":["stride","linddun","dfd-element-analysis"],"techniqueDetails":["Applies STRIDE categories based on DFD element types (external entity, process, data store, data flow) and LINDDUN for privacy-specific threats."],"tools":["threat-dragon"],"targetTypes":["web-application","api","cloud"],"role":"workflow","workflowFocus":["analysis","detection","reporting","remediation"],"distinctiveFeatures":["Tool-specific threat modeling workflow using OWASP Threat Dragon; combines DFD creation, automated threat suggestion rules, and report generation while mapping STRIDE/LINDDUN to DFD element types."],"familyIds":["application-threat-modeling"]},{"id":"performing-timeline-reconstruction-with-plaso","summary":"Provides a complete workflow for building forensic super-timelines from disk images using Plaso (log2timeline/psort), correlating Windows file system, event log, browser, and registry artifacts into unified chronological views for incident reconstruction, with Timesketch/Timeline Explorer visualization.","primaryDomain":"forensics","domainTags":["digital-forensics","timeline-analysis","plaso"],"capabilityTags":["timeline-construction","event-correlation","forensic-analysis","artifact-parsing"],"capabilityDetails":["Provides a workflow for building comprehensive forensic super-timelines from multiple evidence sources using Plaso, correlating events across file system metadata, event logs, browser history, and registry artifacts into a unified chronological view."],"techniqueTags":["super-timeline-generation","macb-timestamps","plaso-storage-file","psort-filtering","timesketch-analysis"],"techniqueDetails":["Uses log2timeline to parse artifacts into a unified Plaso storage file and psort to filter/export timelines; applies timestamp analysis and pivot points to identify suspicious activity."],"tools":["log2timeline","psort","Timesketch","Timeline Explorer","KAPE"],"targetTypes":["windows-host","other"],"role":"workflow","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Focuses specifically on building unified forensic super-timelines with Plaso, combining Windows artifacts (registry, Prefetch, MFT, USN Journal, event logs) into a single chronological view, with Timesketch integration."],"familyIds":["log-analysis-and-timeline-reconstruction"]},{"id":"performing-user-behavior-analytics","summary":"Operational UEBA playbook using Splunk SPL to baseline user authentication behavior, detect impossible travel, off-hours logins, unusual data access, and privilege abuse, then prioritize investigation through composite risk scoring.","primaryDomain":"authentication","domainTags":["soc-operations","ueba","insider-threat","anomaly-detection"],"capabilityTags":["user-behavior-baselining","impossible-travel-detection","off-hours-access-detection","unusual-data-access-detection","privilege-abuse-detection","risk-scoring","investigation-prioritization"],"capabilityDetails":["Provides a step-by-step Splunk-based workflow to build behavioral baselines for users from 30 days of authentication and access logs.","Detects impossible travel by calculating geographic distance and speed between successive logins.","Identifies logins outside normal working hours and on weekends using historical hour distributions.","Flags unusual file/data access volumes using z-scores and byte thresholds.","Monitors privileged account usage anomalies such as access to many hosts or high privilege event counts.","Aggregates all anomalies into a weighted composite risk score prioritized by user criticality."],"techniqueTags":["statistical-baselining","z-score-analysis","haversine-distance","splunk-spl","behavioral-anomaly-detection"],"techniqueDetails":["Builds per-user baselines with averages, standard deviations, and percentiles from 30-day historical data.","Uses the haversine formula in SPL to compute login speed and flag impossible travel (>900 km/h, >500 km).","Applies z-score thresholds (>3) to identify unusual data access volumes.","Combines multiple anomaly signals into a risk score using weighted sums and case-based multipliers."],"tools":["splunk","splunk-uba","microsoft-sentinel","exabeam-advanced-analytics","securonix","maxmind-geolite2"],"targetTypes":["active-directory","windows-host","cloud","network"],"role":"specialist-playbook","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["End-to-end UEBA methodology encoded as executable Splunk SPL, not just conceptual guidance.","Specifically targets insider threat and compromised account detection through behavioral baselining, covering impossible travel, off-hours access, data exfiltration patterns, and privilege abuse.","Produces a prioritized weekly risk report with investigation statuses, bridging detection to SOC workflow."],"familyIds":["authentication-threat-detection-and-user-behavior-analytics"]},{"id":"performing-vlan-hopping-attack","summary":"Step-by-step playbook to assess VLAN segmentation by performing switch spoofing and double-tagging attacks, verifying switch hardening, and generating a remediation-focused report.","primaryDomain":"network-security","domainTags":["vlan-hopping","switch-security","layer2-attack","8021q","dtp","vtp"],"capabilityTags":["vlan-hopping-attack","switch-spoofing","double-tagging","vlan-segmentation-testing","switch-configuration-audit"],"capabilityDetails":["Simulates VLAN hopping via DTP switch spoofing and 802.1Q double tagging.","Validates trunk port hardening and native VLAN misconfigurations.","Tests VLAN segmentation effectiveness between isolated zones.","Generates an assessment report with findings and remediation steps."],"techniqueTags":["dtp-spoofing","8021q-double-tagging","vtp-injection","vlan-subinterface-access"],"techniqueDetails":["Crafts DTP desirable frames to negotiate a trunk on an access port.","Constructs double-tagged 802.1Q frames to reach a target VLAN via native VLAN stripping.","Injects VTP summary advertisement with high revision number to overwrite VLAN database.","Creates VLAN subinterfaces to pivot into other VLANs once trunk is established."],"tools":["yersinia","scapy","frogger","wireshark","tcpdump","nmap"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","validation","reporting","remediation"],"distinctiveFeatures":["Combines switch spoofing (DTP), double-tagging, and VTP injection into one VLAN hopping playbook","Provides Scapy payloads for crafting DTP, 802.1Q double-tagged, and VTP frames","Includes switch configuration verification and remediation steps for network teams"],"familyIds":["network-adversary-simulation"]},{"id":"performing-vulnerability-scanning-with-nessus","summary":"Provides an operational workflow for performing credentialed and uncredentialed vulnerability scans with Tenable Nessus, covering scan policy configuration, execution, result validation, false-positive elimination, risk-based prioritization, and report generation.","primaryDomain":"network-security","domainTags":["vulnerability-scanning","nessus","cve","patch-management","tenable"],"capabilityTags":["vulnerability-scanning","authenticated-scanning","unauthenticated-scanning","vulnerability-validation","vulnerability-prioritization","patch-audit"],"capabilityDetails":["Provides a complete workflow for planning, configuring, executing, validating, and reporting authenticated and unauthenticated vulnerability scans using Tenable Nessus, including false-positive identification and remediation prioritization."],"techniqueTags":["nessus-scan-configuration","credentialed-scanning","plugin-family-selection","cvss-scoring","false-positive-analysis","risk-based-prioritization"],"techniqueDetails":["Uses Nessus plugin families and credentialed checks to detect known vulnerabilities, then validates findings against CVE data and exploit availability, prioritizing based on CVSS score, exposure, and asset criticality."],"tools":["Nessus Professional","Nessus Expert","Tenable.io","OpenVAS"],"targetTypes":["network","windows-host","linux-host","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting","remediation"],"distinctiveFeatures":["Specialized for Tenable Nessus vulnerability scanning, covering advanced scan configuration, credentialed authentication methods, plugin tuning, and hands-on false-positive validation (e.g., backported patch detection) uncommon in generic scanning playbooks."],"familyIds":["vulnerability-scanning-management"]},{"id":"performing-web-application-firewall-bypass","summary":"Practical workflow to bypass WAF filters during penetration tests: fingerprint the WAF, obfuscate SQLi/XSS payloads via encoding, HTTP protocol tricks, parameter pollution, and SQLMap tamper scripts, then produce a bypass assessment report with remediations.","primaryDomain":"web-security","domainTags":["waf","sql-injection","xss","web-application-security"],"capabilityTags":["waf-fingerprinting","payload-encoding","http-method-manipulation","parameter-pollution","sqlmap-tampering","xss-evasion"],"capabilityDetails":["Identifies and fingerprints WAFs using wafw00f and manual response header analysis.","Demonstrates encoding and obfuscation techniques (URL, double URL, Unicode, HTML entity, comments, null bytes) to evade WAF regex filters.","Exploits HTTP protocol features including method override, HTTP/0.9, Content-Type confusion, chunked transfer encoding, and parameter pollution.","Automates SQL injection WAF bypass using SQLMap tamper scripts.","Provides XSS-specific bypass payloads using case variation, event handler alternatives, JS URI schemes, template literals, and HTML encoding."],"techniqueTags":["url-encoding-bypass","http-method-override","http-parameter-pollution","chunked-transfer-encoding","sqlmap-tamper","xss-event-handler-bypass","json-sqli","content-type-confusion"],"techniqueDetails":["Uses URL encoding, double URL encoding, Unicode encoding, HTML entity encoding, mixed case, inline comments, null bytes, and whitespace substitution to obscure malicious payloads.","Leverages HTTP method changes (PUT/PATCH), HTTP/0.9, Content-Type charset changes, multipart forms, and chunked transfer encoding to bypass inspection.","Splits payloads using HTTP Parameter Pollution, across parameters, or inside JSON/XML bodies to evade per-parameter scanning.","Applies SQLMap tamper scripts like between, randomcase, space2comment, charunicodeencode, chardoubleencode, and percentage to automate bypass attempts.","Employs XSS-specific evasions including case variation, alternative event handlers, JavaScript URI scheme, template literals, concatenation, and HTML attribute encoding."],"tools":["wafw00f","sqlmap","burp-suite","xsstrike","curl","netcat"],"targetTypes":["web-application","api","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","reporting","remediation"],"distinctiveFeatures":["Assumes a confirmed vulnerability already exists and focuses exclusively on evading WAF signature detection rather than discovering vulnerabilities.","Combines manual curl-based bypass techniques with automated SQLMap tamper script execution in a single workflow.","Covers both SQL injection and XSS WAF bypass in one skill, including JSON/XML content-type abuse.","Provides WAF-specific fingerprinting indicators for Cloudflare, AWS WAF, ModSecurity, Akamai, and Imperva.","Delivers a structured WAF bypass assessment report template with remediation guidance."],"familyIds":["waf-evasion-and-bypass"]},{"id":"performing-web-application-penetration-test","summary":"A comprehensive web application penetration testing playbook following OWASP WSTG, providing a seven-step methodology from reconnaissance to reporting, using Burp Suite and supporting tools to manually identify vulnerabilities across authentication, authorization, input validation, session management, and business logic.","primaryDomain":"web-security","domainTags":["owasp-wstg","web-application-security","burp-suite","penetration-testing"],"capabilityTags":["web-application-pentest","owasp-wstg-methodology","manual-vulnerability-testing","burp-suite-analysis"],"capabilityDetails":["Provides a comprehensive methodology for web application penetration testing based on OWASP WSTG, covering reconnaissance, authentication, authorization, input validation, session management, business logic, and reporting, with emphasis on manual testing using Burp Suite to identify flaws automated scanners miss."],"techniqueTags":["reconnaissance","access-control-testing","injection-testing","session-analysis","business-logic-testing"],"techniqueDetails":["Reconnaissance maps the application attack surface using manual browsing, fuzzing, and JavaScript analysis.","Access control testing verifies horizontal and vertical privilege escalation including IDOR and forced browsing.","Input validation testing covers SQLi, XSS, SSRF, command injection, XXE, and SSTI.","Session management testing analyzes tokens, cookies, CSRF, and expiration.","Business logic testing examines race conditions, workflow bypass, and numeric manipulation."],"tools":["Burp Suite Professional","ffuf","sqlmap","Nuclei","SecLists"],"targetTypes":["web-application","api"],"role":"general-playbook","workflowFocus":["reconnaissance","detection","validation","exploitation","reporting"],"distinctiveFeatures":["Complete OWASP WSTG-aligned web application penetration testing playbook that spans the full lifecycle from initial mapping to final reporting.","Explicitly includes business logic testing and manual testing techniques that are often neglected by automated scanners.","Provides detailed step-by-step workflows, tool commands, common scenarios, and a structured output format for findings."],"familyIds":["full-web-application-penetration-testing"]},{"id":"performing-web-application-scanning-with-nikto","summary":"Provides a practical guide to using Nikto to scan web servers for misconfigurations, dangerous files, outdated software, and common vulnerabilities, including command examples, tuning options, SSL/TLS checks, and reporting best practices.","primaryDomain":"web-security","domainTags":["vulnerability-management","web-scanning","server-misconfiguration"],"capabilityTags":["vulnerability-scanning","misconfiguration-detection","outdated-software-detection"],"capabilityDetails":["Provides a workflow for running Nikto scans to identify dangerous files, outdated server software, misconfigurations, and common web vulnerabilities."],"techniqueTags":["signature-based-scanning","http-method-enumeration","ssl-configuration-assessment","file-discovery"],"techniqueDetails":["Uses Nikto's vulnerability database to match server responses against known dangerous files, outdated versions, and misconfigurations; supports tuning to focus on specific test categories."],"tools":["nikto"],"targetTypes":["web-application"],"role":"tool-guide","workflowFocus":["detection","enumeration","analysis","reporting"],"distinctiveFeatures":["Tool-specific guide to Nikto that emphasizes server-side misconfiguration and outdated software detection, with advanced tuning, SSL/TLS checks, multi-target scanning, and interoperability with Nmap and Metasploit."],"familyIds":["nikto-web-scanning"]},{"id":"performing-web-application-vulnerability-triage","summary":"Provides a structured workflow to triage DAST/SAST web application findings, validate true/false positives, compute OWASP risk ratings, and generate prioritized remediation reports.","primaryDomain":"web-security","domainTags":["vulnerability-management","risk-assessment","owasp","dast","sast"],"capabilityTags":["vulnerability-triage","false-positive-validation","risk-scoring","owasp-top10-mapping","report-generation"],"capabilityDetails":["Provides a structured process for triaging web application scanner findings, including categorization by OWASP Top 10, distinguishing true positives from false positives, calculating OWASP risk ratings, and generating prioritized triage reports."],"techniqueTags":["owasp-risk-rating","sql-injection-validation","xss-validation","boolean-based-sqli","time-based-sqli"],"techniqueDetails":["Uses the OWASP Risk Rating Methodology to score likelihood and impact factors and derive a risk level. Includes manual validation techniques for SQL injection (boolean and time-based) and XSS to confirm findings."],"tools":["burp-suite","owasp-zap","acunetix","semgrep","sonarqube","checkmarx","snyk-code","defectdojo"],"targetTypes":["web-application","source-code"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Focuses on post-scan triage and prioritization rather than vulnerability discovery","Employs the OWASP Risk Rating Methodology as a formal scoring model","Includes Python code for automating false-positive detection and risk calculation","Handles both DAST and SAST findings with distinct validation approaches"],"familyIds":["vulnerability-triage-and-prioritization"]},{"id":"performing-web-cache-deception-attack","summary":"Step-by-step playbook for detecting and exploiting web cache deception vulnerabilities in CDN/reverse-proxy configurations, leveraging path normalization and cache key discrepancies to expose authenticated content.","primaryDomain":"web-security","domainTags":["web-cache-deception","cdn-attack","cache-poisoning","path-normalization"],"capabilityTags":["web-cache-deception-testing","cache-key-analysis","cdn-misconfiguration-testing","path-normalization-testing"],"capabilityDetails":["Provides a step-by-step workflow for detecting and exploiting web cache deception vulnerabilities by abusing inconsistent path normalization between CDN/proxy caching layers and origin servers."],"techniqueTags":["static-extension-appending","path-delimiter-injection","encoded-path-traversal","cache-key-manipulation"],"techniqueDetails":["Uses static file extensions such as .css appended to dynamic URLs to trick the CDN into caching authenticated responses.","Exploits delimiter characters (;, %, #) interpreted differently by CDN and origin.","Tests path traversal normalization differences to bypass cache key rules.","Manipulates cache key components to store and retrieve sensitive content."],"tools":["Burp Suite","curl","Web Cache Vulnerability Scanner","Param Miner","Cloudflare Diagnostics","Varnish CLI"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","reporting"],"distinctiveFeatures":["Dedicated to web cache deception, distinguishing it from general cache poisoning or SSRF skills.","Covers multiple CDN platforms and both classic static-extension and advanced delimiter/normalization bypasses.","Provides a complete workflow from cache layer identification to exploitation and report generation."],"familyIds":["web-cache-attacks"]},{"id":"performing-web-cache-poisoning-attack","summary":"Provides a step-by-step playbook for web cache poisoning attacks, covering unkeyed header discovery, cache deception, parameter-based poisoning, and impact validation using Burp Suite and curl.","primaryDomain":"web-security","domainTags":["cache-poisoning","web-cache-deception"],"capabilityTags":["cache-poisoning-testing","cache-deception-testing","unkeyed-header-discovery"],"capabilityDetails":["Provides a workflow for discovering unkeyed headers and parameters and exploiting them to poison cached responses with malicious content."],"techniqueTags":["header-poisoning","cache-deception","parameter-based-poisoning","host-header-injection"],"techniqueDetails":["Uses reflected unkeyed headers such as X-Forwarded-Host and X-Forwarded-Proto to inject malicious content into cached pages, and path confusion to achieve cache deception."],"tools":["burpsuite","param-miner","curl","web-cache-vulnerability-scanner"],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on web cache poisoning and cache deception, distinguishing between unkeyed header, parameter-based, and path-based attacks, with safety practices like cache busters."],"familyIds":["web-cache-attacks"]},{"id":"performing-wifi-password-cracking-with-aircrack","summary":"Enables authorized penetration testers to assess WPA/WPA2 passphrase strength by capturing 4-way handshakes or PMKIDs and cracking them offline using aircrack-ng and hashcat, with guidance on hardware, wordlists, and reporting.","primaryDomain":"network-security","domainTags":["wifi-security","wireless-security","wpa2","password-cracking"],"capabilityTags":["wifi-password-cracking","handshake-capture","offline-password-cracking","pmkid-attack"],"capabilityDetails":["Provides a step-by-step workflow for capturing WPA/WPA2 handshakes and PMKIDs, then cracking passphrases offline using aircrack-ng and hashcat."],"techniqueTags":["dictionary-attack","rule-based-attack","mask-attack","combination-attack","deauthentication-attack","pmkid-capture"],"techniqueDetails":["Uses deauthentication to force client reconnection and capture the 4-way handshake; also supports PMKID capture without a client; cracks with wordlist, rule, mask, and combination attacks."],"tools":["aircrack-ng","airodump-ng","aireplay-ng","hashcat","hcxdumptool","hcxpcapngtool","cowpatty"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["reconnaissance","exploitation","validation","reporting"],"distinctiveFeatures":["Focuses on the full wireless password-cracking lifecycle: adapter setup, handshake/PMKID capture, GPU-accelerated cracking, and deliverable reporting, covering both CPU aircrack-ng and GPU hashcat approaches."],"familyIds":["wireless-network-security-assessment"]},{"id":"performing-windows-artifact-analysis-with-eric-zimmerman-tools","summary":"Provides a comprehensive Windows forensic artifact analysis workflow using Eric Zimmerman's EZ Tools (KAPE, MFTECmd, PECmd, RECmd, EvtxECmd, LECmd, JLECmd, SBECmd, Timeline Explorer) to parse MFT, registry, prefetch, event logs, and shortcut files, enabling timeline construction and detection of program execution, file access, persistence, and timestomping.","primaryDomain":"forensics","domainTags":["windows-forensics","artifact-analysis","digital-forensics","timeline-analysis"],"capabilityTags":["windows-artifact-parsing","timeline-construction","execution-evidence-analysis","timestomping-detection"],"capabilityDetails":["Provides a workflow for collecting and parsing Windows forensic artifacts using the EZ Tools suite, building timelines, and correlating evidence across multiple artifact sources."],"techniqueTags":["mft-parsing","prefetch-parsing","registry-analysis","event-log-analysis","lnk-analysis","jumplist-analysis","shellbag-analysis","timeline-correlation"],"techniqueDetails":["Uses MFTECmd to parse $MFT and USN Journal; PECmd for prefetch; RECmd for registry hives; EvtxECmd for event logs; LECmd/JLECmd for LNK and jump lists; SBECmd for shellbags; then correlates output in Timeline Explorer."],"tools":["KAPE","MFTECmd","PECmd","RECmd","EvtxECmd","LECmd","JLECmd","SBECmd","Timeline Explorer"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Dedicated to the Eric Zimmerman Tools suite rather than generic Windows forensics, covering automated collection and processing with KAPE, and specific artifact parsers for MFT, registry, prefetch, event logs, LNK, jump lists, and shellbags."],"familyIds":["endpoint-artifact-collection-and-analysis"]},{"id":"performing-wireless-network-penetration-test","summary":"A structured wireless network penetration testing workflow from reconnaissance to exploitation, including handshake/PMKID cracking, enterprise EAP attacks, evil twin, rogue AP detection, and segmentation checks using Aircrack-ng, Hashcat, Bettercap, and hostapd-mana.","primaryDomain":"network-security","domainTags":["wireless-security","wifi-security","wpa2","wpa3","rogue-ap","80211"],"capabilityTags":["wireless-pen-testing","handshake-capture","wpa-cracking","rogue-ap-detection","evil-twin-attack","enterprise-wifi-attack","wps-pin-attack"],"capabilityDetails":["Provides a structured wireless penetration testing workflow covering reconnaissance, handshake and PMKID capture, WPA2/WPA3 key cracking, enterprise EAP attacks, evil twin, rogue AP detection, WPS attacks, and client isolation testing."],"techniqueTags":["wpa2-psk-crack","wpa3-sae","pmkid","eap-mschap","evil-twin","wps-pixie-dust","client-isolation-testing","deauth-attack"],"techniqueDetails":["Uses deauthentication to capture WPA2 4-way handshakes and PMKID for offline cracking.","Uses hostapd-mana to create rogue enterprise AP for EAP credential harvesting.","Uses bettercap and hostapd/dnsmasq for evil twin and captive portal attacks.","Uses reaver wash for WPS PIN and Pixie-Dust attacks."],"tools":["aircrack-ng","airodump-ng","aireplay-ng","hashcat","hcxdumptool","hcxpcapngtool","hostapd-mana","bettercap","kismet","reaver","wash","nmap","dnsmasq"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","exploitation"],"distinctiveFeatures":["Comprehensive wireless pentest playbook covering WPA2/WPA3 cracking, WPA2-Enterprise rogue AP, evil twin, rogue AP detection, WPS attacks, and client isolation testing—unlike skills focused solely on WPA2 handshake cracking."],"familyIds":["wireless-network-security-assessment"]},{"id":"performing-wireless-security-assessment-with-kismet","summary":"Passive wireless security assessment using Kismet to enumerate WiFi networks, detect rogue APs, identify weak encryption, discover hidden SSIDs, and analyze client probe requests, with Python analysis workflows.","primaryDomain":"network-security","domainTags":["wireless-security","wifi-assessment","rogue-ap-detection","rf-monitoring","802-11"],"capabilityTags":["passive-wireless-monitoring","rogue-ap-detection","weak-encryption-identification","hidden-ssid-discovery","client-probe-analysis"],"capabilityDetails":["Provides a passive wireless security assessment workflow using Kismet to enumerate access points, detect rogue APs, identify weak encryption (open/WEP/WPA-TKIP), discover hidden SSIDs, and analyze client probe requests."],"techniqueTags":["passive-rf-monitoring","802-11-frame-analysis","rest-api-device-querying","sqlite-database-analysis"],"techniqueDetails":["Uses Kismet in passive monitor mode to capture raw 802.11 frames without transmitting packets, queries device information via the Kismet REST API, and analyzes the Kismet SQLite database to identify security issues."],"tools":["kismet","airmon-ng","curl","python3"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","detection","analysis"],"distinctiveFeatures":["Passive-only approach avoids any packet transmission, unlike active wireless tools such as Aircrack-ng","Includes automated rogue AP detection by comparing discovered devices against an authorized AP inventory","Provides Python scripts for parsing Kismet SQLite database and generating structured security findings","Covers hidden SSID discovery and client probe analysis to assess evil twin susceptibility"],"familyIds":["wireless-network-security-assessment"]},{"id":"performing-yara-rule-development-for-detection","summary":"Provides a workflow for developing YARA and YARA-X detection rules from malware samples by extracting unique strings, byte patterns, and PE import traits, along with testing and performance optimization to minimize false positives.","primaryDomain":"forensics","domainTags":["malware-detection","threat-hunting","signature-development","yara"],"capabilityTags":["yara-rule-authoring","malware-pattern-extraction","rule-testing","performance-benchmarking"],"capabilityDetails":["Provides a workflow for developing YARA and YARA-X detection rules from malware samples, including string extraction, PE import analysis, byte pattern discovery, rule creation, and performance testing."],"techniqueTags":["string-extraction","pe-import-analysis","hex-pattern-matching","regex-matching","rule-optimization"],"techniqueDetails":["Uses Python scripts to extract ASCII/wide strings and unique byte sequences from malware binaries, analyzes PE import tables for suspicious API calls, and constructs YARA conditions with boolean logic and filesize limits."],"tools":["yara","yara-x","yara-python","pefile"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation"],"distinctiveFeatures":["Focuses specifically on authoring YARA/YARA-X detection signatures from malware sample analysis","Includes performance benchmarking and explicit false-positive minimization criteria"],"familyIds":["signature-and-ioc-based-malware-detection"]},{"id":"php-archive-extract-audit","summary":"PHP Web 归档解压（Zip Slip/路径穿越）审计工具。识别解压条目名如何与目标目录拼接、是否存在 base dir 约束缺失，输出可利用性分级、可观测 PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-audit-pipeline","summary":"PHP Web 全链路白盒代码安全审计流水线（多文件版编排）。作为总编排参考，按 Sink 类型调用各子审计 skill（`php-route-mapper/php-auth-audit/php-route-tracer/php-*-audit`），并复用统一输出与分级标准。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-audit-skills","summary":"This skill should be used when the user asks to \"审计 PHP 代码\", \"PHP security audit\", \"扫描 PHP 漏洞\", \"PHP penetration test\", \"代码安全审计\", \"run php-audit-skills\", \"php audit\", or mentions PHP source code security analysis, vulnerability scanning, or code review for PHP projects. Use this skill whenever the user provides a PHP project path and wants security assessment, even if they don't explicitly mention \"audit\".","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-auth-audit","summary":"PHP Web 源码鉴权机制审计工具。从源码中识别所有认证/鉴权实现并分析风险，输出路由-鉴权映射与漏洞分析（含 PoC 与修复建议）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-cmd-audit","summary":"PHP Web 源码命令注入审计工具。识别命令执行 Sink（exec/system/shell_exec 等），追踪用户输入进入命令拼接，输出可利用性分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-codeigniter-audit","summary":"CodeIgniter 框架特效安全审计工具。针对 CodeIgniter 的 CSRF、XSS 输出过滤、数据库查询构造、路由与验证器配置、会话 Cookie 安全等机制进行白盒静态审计，并映射到通用漏洞类型体系（CSRF/AUTH/XSS/SQL/CFG/SESS 等）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-config-audit","summary":"PHP Web 配置安全审计工具。识别 CORS/错误暴露/调试开关/安全头/危险运行时开关等，输出分级、可利用性分析、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-crlf-audit","summary":"PHP Web 源码 CRLF/响应分割审计工具。识别用户输入进入 HTTP 响应头，分析换行/控制字符过滤与编码，输出分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-crypto-audit","summary":"PHP Web 源码加密与密钥安全审计工具。识别弱哈希/弱加密/硬编码密钥/签名校验缺陷，输出分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-csrf-audit","summary":"PHP Web 源码 CSRF 审计工具。识别状态变更接口是否受 CSRF 保护，追踪 token 生成、校验与绕过条件，输出可利用性分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-deser-audit","summary":"PHP Web 源码反序列化/对象注入审计工具。识别 unserialize 注入点与可控数据来源，追踪魔术方法链，输出可利用性分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-exploit-chain-audit","summary":"PHP 利用链/POP(回弹)链聚合器。把已产出的各类漏洞报告按“前置条件满足”串成可利用链路叙事（不新增证据点字典）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-expr-audit","summary":"PHP Web 源码表达式注入（非模板）审计工具。识别用户可控表达式字符串进入表达式引擎求值/编译并最终导致敏感语义执行，输出可利用性分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-file-read-audit","summary":"PHP Web 源码任意文件读取/路径穿越审计工具。识别文件读取 Sink，追踪路径来源与校验逻辑，输出可利用性分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-file-upload-audit","summary":"PHP Web 源码文件上传审计工具。识别上传入口与保存路径、文件名处理与校验逻辑，检测任意文件上传/路径穿越/可执行上传风险，输出可利用性分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-file-write-audit","summary":"PHP Web 源码任意文件写入审计工具。识别用户可控数据进入写入 Sink 的链路，追踪任意落点写入/路径穿越到 write，并评估写入后的可执行性（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-filesystem-audit","summary":"PHP 文件系统操作审计工具。聚焦 mkdir/chmod/chown/unlink/rmdir/link/symlink/readlink/touch/权限与 TOCTOU 等操作的安全风险，为路径校验绕过与写入链利用提供“可利用性增强证据”（不替代 FILE/UPLOAD/WRITE 等 sink 子审计）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-laravel-audit","summary":"Laravel 框架特效安全审计工具。针对 Laravel 常见鉴权/CSRF/Session/模型填充/Blade 渲染等框架特性进行白盒静态审计，并将风险映射到你现有通用漏洞类型体系（AUTH/CSRF/LOGIC/XSS/CFG 等）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-ldap-audit","summary":"PHP Web 源码 LDAP 注入审计工具。识别用户可控数据进入 LDAP filter/DN 构造并被 ldap_search/ldap_read 执行，输出可利用性分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-logging-audit","summary":"PHP Web 安全日志与监控审计工具。识别安全事件缺失、敏感信息写入日志、日志注入/伪造风险，以及日志与告警链路缺陷，并输出可利用性分级、可观测 PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-logic-audit","summary":"PHP Web 业务逻辑漏洞审计工具。识别认证/授权以外的逻辑缺陷：Mass Assignment、流程绕过、竞态条件、状态机缺陷、支付/权限时序漏洞等，输出证据链、分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-nosql-audit","summary":"PHP Web 源码 NoSQL 注入审计工具。识别用户输入进入 MongoDB/DocumentDB 查询构造，分析是否存在 operator 注入（$gt/$ne/$where 等），输出分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-open-redirect-audit","summary":"PHP Web 源码开放重定向审计工具。识别用户可控重定向目的地进入 header Location/跳转函数，分析校验与 allowlist，输出分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-route-mapper","summary":"PHP Web 源码路由与参数映射分析工具。从源码中提取所有入口路由与参数结构，输出完整请求模板与参数清单（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-route-tracer","summary":"PHP Web 路由到 Sink 的多层数据流追踪工具。根据用户指定路由，追踪从 handler 到最终敏感操作点，输出层级证据、参数变量追踪、可控性分析（不做漏洞结论）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-session-cookie-audit","summary":"PHP Web 源码会话与 Cookie 安全审计工具。识别 session 固定、Cookie flags 不安全、JWT 验证缺陷与记住登录风险，输出分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-sql-audit","summary":"PHP Web 源码 SQL 注入漏洞审计工具。从源码中识别所有 SQL 执行点并分析注入风险，输出可利用性分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-ssrf-audit","summary":"PHP Web 源码 SSRF 审计工具。识别用户可控 URL/地址进入网络请求 Sink，追踪内网/协议/端口限制与回显，输出可利用性分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-symfony-audit","summary":"Symfony 框架特效安全审计工具。针对 Symfony 常见 security.yaml、CSRF、Twig/Twig raw、表达式与访问控制等框架机制做白盒静态审计，并将风险映射到通用漏洞类型体系（AUTH/CSRF/CFG/XSS/TPL/LOGIC 等）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-thinkphp-audit","summary":"ThinkPHP 框架特效安全审计工具。针对 ThinkPHP 常见的鉴权/CSRF/模板转义/ORM 写入（Mass Assignment）/调试与配置暴露等机制进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/TPL/XSS/LOGIC/CFG/SESS/SQL 等）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-tpl-audit","summary":"PHP Web 源码模板注入/SSTI 审计工具。识别模板引擎渲染点与模板名/表达式可控性，追踪到 eval/执行链，输出可利用性分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-vuln-scanner","summary":"PHP 组件版本漏洞检测工具。扫描 composer.json / composer.lock 或 jar/包元信息，匹配已知漏洞规则并输出报告（包含可能的触发点分析框架）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-wordpress-audit","summary":"WordPress 框架特效安全审计工具。针对 WordPress 常见 nonce/capability/check_admin_referer、AJAX action、escape/sanitize、重定向、安全上传与远程请求等机制进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/XSS/SQL/CFG/SSRF 等）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-xss-audit","summary":"PHP Web 源码 XSS 审计工具。识别用户输入进入输出上下文（HTML/属性/JS/URL/模板），分析转义与防护策略，输出可利用性分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-xxe-audit","summary":"PHP Web 源码 XXE 审计工具。识别 XML 解析点与实体处理配置，追踪 XML 输入来源与回显，输出可利用性分级、PoC 与修复建议（禁止省略）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"php-yii-audit","summary":"Yii 框架特效安全审计工具。针对 Yii（通常指 Yii2）访问控制（AccessControl/RBAC）、CSRF、输入过滤规则、输出编码策略、URL/重定向安全等进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/XSS/CFG/LOGIC 等）。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"post-exploiting-microsoft-graph-with-graphrunner","summary":"Operationalizes a Microsoft Graph foothold token into M365/Entra ID post-exploitation using GraphRunner: tenant recon, OAuth app and inbox-rule persistence, updatable-group privilege escalation, and mailbox/SharePoint/Teams data pillage, with visibility into Entra/M365 telemetry.","primaryDomain":"post-exploitation","domainTags":["microsoft-graph","entra-id","microsoft-365","oauth","identity-access-management"],"capabilityTags":["tenant-recon","oauth-app-injection","inbox-forwarding-rule","group-membership-abuse","mailbox-search","sharepoint-search","teams-search"],"capabilityDetails":["Enumerates M365/Entra ID tenant users, groups, conditional-access policies, and OAuth app registrations using GraphRunner over Microsoft Graph.","Establishes persistence via malicious OAuth consent grants and inbox forwarding rules.","Escalates privilege by adding members to updatable groups, cloning security group membership, and inviting guests.","Searches and exfiltrates data from mailboxes, SharePoint/OneDrive, and Teams using Graph search APIs."],"techniqueTags":["graph-api-abuse","oauth-consent-grant","device-code-login","token-refresh","updatable-group-abuse","security-group-cloning","inbox-rule-persistence"],"techniqueDetails":["Uses GraphRunner PowerShell module to perform all actions through the Microsoft Graph API, blending with normal cloud traffic.","Gains tokens via device-code login or imports previously captured tokens, then refreshes them automatically.","Injects a malicious OAuth app and walks the consent-grant flow for persistence.","Creates hidden inbox forwarding rules to exfiltrate email.","Leverages updatable/dynamic groups to add controlled principals and clone privileged security group memberships."],"tools":["GraphRunner","ROADtools"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","exploitation","post-exploitation"],"distinctiveFeatures":["Specializes in Microsoft Graph API post-exploitation using GraphRunner, uniquely combining OAuth consent-grant persistence, updatable-group privilege escalation, and M365 data pillage in one workflow.","Includes explicit OPSEC/detection mapping showing what each GraphRunner action looks like in Entra sign-in logs, audit logs, and MicrosoftGraphActivityLogs."],"familyIds":["microsoft-365-post-exploitation"]},{"id":"pptx","summary":"Use this skill any time a .pptx or .potx file is involved in any way — as input, output, or both. This includes: creating slide decks, pitch decks, or presentations; reading, parsing, or extracting text from any .pptx or .potx file (even if the extracted content will be used elsewhere, like in an email or summary); editing, modifying, or updating existing presentations; combining or splitting slide files; working with templates (.potx), layouts, speaker notes, or comments. Trigger whenever the user mentions \\\"deck,\\\" \\\"slides,\\\" \\\"presentation,\\\" or references a .pptx or .potx filename, regardless of what they plan to do with the content afterward. If a .pptx or .potx file needs to be opened, created, or touched, use this skill.","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"prioritizing-vulnerabilities-with-cvss-scoring","summary":"Teaches how to calculate and interpret CVSS v4.0 scores, combine them with EPSS, CISA KEV, and asset criticality in a weighted matrix, and define remediation SLAs for effective vulnerability prioritization.","primaryDomain":"security-knowledge","domainTags":["vulnerability-management","cvss","cve","risk-prioritization"],"capabilityTags":["cvss-scoring","vulnerability-prioritization","risk-assessment","threat-intelligence-enrichment"],"capabilityDetails":["Provides a workflow for calculating CVSS v4.0 scores and combining them with EPSS, CISA KEV, asset criticality, and network exposure to prioritize remediation."],"techniqueTags":["cvss-vector-analysis","metric-scoring","multi-factor-prioritization"],"techniqueDetails":["Uses CVSS v4.0 vector strings and metric groups; applies a weighted prioritization matrix with EPSS, asset criticality, and CISA KEV; defines remediation SLAs."],"tools":["nvd","epss","cisa-kev"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","knowledge-reference"],"distinctiveFeatures":["Provides a complete CVSS v4.0 metric reference with a worked example (XZ Utils) and a weighted multi-factor prioritization matrix including EPSS and CISA KEV, unlike generic vulnerability scanning guides."],"familyIds":["vulnerability-prioritization-and-risk-scoring"]},{"id":"processing-stix-taxii-feeds","summary":"Operational playbook for ingesting, validating, normalizing, and routing STIX 2.1 threat intelligence from TAXII 2.1 servers, including TLP-aware distribution and bi-directional publishing.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","stix","taxii","cti","ioc"],"capabilityTags":["stix-bundle-processing","taxii-collection-ingestion","threat-intel-normalization","intelligence-sharing","tlp-enforcement"],"capabilityDetails":["Provides workflow for discovering TAXII 2.1 collections, fetching STIX 2.1 bundles with pagination, validating required fields, and routing objects to consuming platforms.","Supports bi-directional intelligence sharing by publishing validated STIX indicators back to TAXII collections.","Enforces TLP marking definitions to restrict sharing of sensitive intelligence."],"techniqueTags":["stix-parsing","taxii-pagination","incremental-polling","object-marking-definitions","stix-pattern-language"],"techniqueDetails":["Uses taxii2-client v21 as_pages for paginated retrieval and added_after filter for incremental polling.","Validates STIX objects for required fields like id, type, spec_version, created, modified, pattern, pattern_type, and valid_from, plus confidence range check.","Parses STIX bundles using stix2 library and maps object types to destination systems such as SIEM, EDR, TIP, and SOAR."],"tools":["stix2","taxii2-client","MISP","OpenCTI","Cabby"],"targetTypes":["api","other"],"role":"specialist-playbook","workflowFocus":["analysis","validation"],"distinctiveFeatures":["Specializes in STIX 2.1/TAXII 2.1 interoperability rather than general CTI analysis, with concrete Python code for both ingestion and publishing back to TAXII collections.","Includes TLP marking enforcement and validation of required STIX fields to prevent malformed data from entering downstream systems."],"familyIds":["threat-intelligence-sharing-and-processing"]},{"id":"profiling-threat-actor-groups","summary":"Provides a structured workflow to research and profile threat actor groups, map their TTPs to MITRE ATT&CK, assess detection coverage, and package executive/SOC/technical briefings.","primaryDomain":"security-knowledge","domainTags":["threat-intelligence","mitre-attack","threat-actor","attribution"],"capabilityTags":["threat-actor-profiling","ttp-mapping","detection-coverage-assessment","intelligence-reporting"],"capabilityDetails":["Provides a workflow to aggregate threat intelligence from multiple sources and develop structured adversary profiles."],"techniqueTags":["mitre-attack-mapping","stix-modeling","campaign-analysis"],"techniqueDetails":["Uses MITRE ATT&CK techniques and STIX data models to document and map adversary TTPs."],"tools":["MITRE ATT&CK Groups","Mandiant Advantage","CrowdStrike Falcon Intelligence","Recorded Future","OpenCTI","mitreattack-python","ATT&CK Navigator","CISA KEV"],"targetTypes":["other"],"role":"workflow","workflowFocus":["analysis","knowledge-reference","reporting"],"distinctiveFeatures":["Focuses on adversary-centric intelligence analysis rather than vulnerability exploitation.","Combines commercial and open-source threat intel sources into a structured profile.","Explicitly addresses detection coverage mapping and gap assessment.","Includes packaging profiles for executive, SOC, and technical audiences."],"familyIds":["threat-actor-and-landscape-analysis"]},{"id":"proj-analyzer","summary":"Deep-read a whole repository from source and produce a single self-contained PROJECT-ANALYSIS.html that works offline as an architecture explorer, codebase map, API explorer and onboarding guide. Use this whenever someone needs to understand, hand over, onboard onto, audit, map, or document an unfamiliar or large codebase — including phrasings like \\\"分析这个项目\\\", \\\"生成项目分析报告\\\", \\\"整理项目架构\\\", \\\"帮我快速接手这个仓库\\\", \\\"codebase overview\\\", \\\"architecture report\\\", \\\"onboarding doc\\\", \\\"map this repo\\\", \\\"document the API surface\\\", \\\"what does this project do\\\", \\\"reverse-engineer this codebase\\\", or any request to explain a repository's structure, modules, endpoints, data model, config, auth, deployment, or risks. Also use it when someone inherits a project and wants a durable map before changing anythin","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"prototype-pollution","summary":"Expert playbook for prototype pollution attacks on JavaScript web applications and APIs, with client-side fragment probes, server-side black-box detection, and gadget chain exploitation for RCE.","primaryDomain":"web-security","domainTags":["prototype-pollution","javascript-security","node-js-security","client-side-javascript","server-side-javascript"],"capabilityTags":["prototype-pollution-testing","client-side-pollution-detection","server-side-pollution-detection","gadget-chain-exploitation"],"capabilityDetails":["Provides a step-by-step expert playbook for detecting and exploiting prototype pollution in JavaScript applications, covering both client-side and server-side vectors and leading to RCE via gadget chains."],"techniqueTags":["proto-merge","proto-constructor","proto-qs-config","proto-rce-gadget","proto-persistence-testing"],"techniqueDetails":["Tests both `__proto__` and `constructor.prototype` pollution paths.","Uses black-box qs configuration pollution to detect server-side parsing quirks.","Builds gadget chains using polluted options read by template engines or child_process."],"tools":["yeswehack/pp-finder","yuske/silent-spring","yuske/server-side-prototype-pollution","BlackFan/client-side-prototype-pollution","portswigger/server-side-prototype-pollution","msrkp/PPScan"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on prototype pollution in JavaScript stacks, covering both `__proto__` and `constructor.prototype` paths.","Provides black-box server-side detection using qs configuration pollution like `parameterLimit` and `json spaces`.","Includes RCE gadget chains for EJS, Timelion (CVE-2019-7609), and child_process/NODE_OPTIONS."],"familyIds":["prototype-pollution-testing-and-exploitation"]},{"id":"prototype-pollution-advanced","summary":"Advanced prototype pollution exploitation playbook that escalates confirmed pollution to server-side RCE via Node.js child_process and template engine gadgets, and to client-side XSS via framework script gadgets, with detection, filter bypass, and automated tooling.","primaryDomain":"web-security","domainTags":["prototype-pollution","javascript-security","nodejs-security"],"capabilityTags":["prototype-pollution-exploitation","template-engine-rce","client-side-gadget-exploitation","filter-bypass","rce-escalation"],"capabilityDetails":["Provides advanced exploitation workflows for confirmed prototype pollution, escalating to server-side RCE via template engine and child_process gadgets and to client-side XSS via framework script gadgets."],"techniqueTags":["server-side-prototype-pollution","client-side-prototype-pollution","ejs-output-function-name-gadget","pug-block-gadget","handlebars-type-program-gadget","nunjucks-type-gadget","node-child-process-shell-env-pollution","lodash-source-url-gadget","jquery-inner-html-gadget","constructor-prototype-bypass"],"techniqueDetails":["Uses template engine options (EJS outputFunctionName, Pug block, Handlebars type/program, Nunjucks type) to inject code into template compilation and execute commands.","Pollutes child_process.spawn/fork properties (shell, argv0, NODE_OPTIONS) to run attacker code when no explicit env is passed.","Leverages client-side script gadgets (jQuery innerHTML, Lodash template sourceURL) for DOM-based XSS after prototype pollution.","Bypasses __proto__ keyword filters using constructor.prototype paths, bracket notation variants, and JSON key variations."],"tools":["PPScan","server-side-prototype-pollution","ppfuzz","ppmap"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","analysis"],"distinctiveFeatures":["Companion to the basic prototype-pollution skill; assumes confirmed pollution and focuses exclusively on escalation to RCE or XSS, with a deep gadget catalog for EJS, Pug, Handlebars, Nunjucks, jQuery, and Lodash, plus filter bypass and automated detection tools."],"familyIds":["prototype-pollution-testing-and-exploitation"]},{"id":"race-condition","summary":"Playbook for testing and exploiting race conditions and TOCTOU vulnerabilities in web applications, including one-time operation duplication, rate-limit bypass, HTTP/2 single-packet attacks, and database isolation issues, with practical Turbo Intruder templates.","primaryDomain":"web-security","domainTags":["race-condition","toctou","concurrency-security"],"capabilityTags":["race-condition-testing","toctou-testing","parallel-request-testing","rate-limit-bypass-testing","http2-single-packet-testing"],"capabilityDetails":["Provides a playbook for detecting, validating, and exploiting race conditions and TOCTOU bugs in web applications using concurrent request delivery, transport-layer synchronization, and database isolation analysis."],"techniqueTags":["last-byte-synchronization","http2-single-packet","turbo-intruder-gate-release","database-isolation-level-abuse","multi-endpoint-race"],"techniqueDetails":["Covers HTTP/1.1 last-byte synchronization, HTTP/2 single-packet attacks, Turbo Intruder gate patterns, and database isolation level exploitation."],"tools":["PortSwigger/turbo-intruder","Raceocat","h2spacex","Burp Suite Repeater"],"targetTypes":["web-application","api","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on race conditions and TOCTOU rather than general logic flaws; emphasizes transport-layer synchronization (HTTP/2 single-packet, last-byte sync) and database isolation-level exploitation, with practical Turbo Intruder templates and multi-endpoint attack patterns."],"familyIds":["race-condition-exploitation"]},{"id":"recon-and-methodology","summary":"A comprehensive reconnaissance and methodology playbook for bug bounty hunting, covering asset discovery, subdomain enumeration, tech fingerprinting, endpoint discovery, source code recon, and structured vulnerability testing methodology.","primaryDomain":"reconnaissance","domainTags":["web-recon","subdomain-enumeration","endpoint-discovery","tech-fingerprinting","source-code-recon"],"capabilityTags":["asset-discovery","subdomain-enumeration","endpoint-discovery","tech-fingerprinting","source-code-recon","bug-bounty-methodology"],"capabilityDetails":["Provides a systematic reconnaissance methodology for mapping assets, discovering endpoints, and fingerprinting technology."],"techniqueTags":["passive-enumeration","active-enumeration","dns-bruteforce","vhost-bruteforce","directory-bruteforce","javascript-analysis"],"techniqueDetails":["Uses passive sources like certificate transparency and search engines for initial subdomain discovery.","Employs active DNS brute force and virtual host brute force to uncover additional subdomains.","Discovers endpoints via directory brute force, parameter fuzzing, and JavaScript source mining.","Fingerprints technologies using headers, cookies, HTML comments, and tools like httpx and whatweb."],"tools":["subfinder","amass","massdns","ffuf","gobuster","feroxbuster","httpx","whatweb","nmap","masscan","arjun","x8","gau","waybackurls","linkfinder","trufflehog","gitleaks","nuclei"],"targetTypes":["web-application","api","network","source-code","cloud"],"role":"general-playbook","workflowFocus":["reconnaissance","enumeration","analysis","detection"],"distinctiveFeatures":["Combines a full recon hierarchy with a bug hunter's mental model for systematic coverage.","Includes a Java middleware fingerprint matrix and Spring Boot Actuator exploitation priority.","Provides bug bounty program triage and high-value feature focus to prioritize testing."],"familyIds":["attack-surface-discovery"]},{"id":"recon-dir-scan","summary":"Practical workflow for web directory/file enumeration using ffuf, gobuster, feroxbuster, dirsearch, including recursive scanning, API discovery, vhost fuzzing, and storing results.","primaryDomain":"reconnaissance","domainTags":["web-security","content-discovery"],"capabilityTags":["directory-enumeration","file-discovery","path-fuzzing","api-endpoint-enumeration","virtual-host-discovery"],"capabilityDetails":["Discovers hidden and backup files, directories, API endpoints, and virtual hosts via wordlist-based HTTP fuzzing."],"techniqueTags":["wordlist-fuzzing","recursive-scanning","status-code-filtering","extension-fuzzing","parameter-fuzzing"],"techniqueDetails":["Uses ffuf FUZZ keyword to replace wordlist entries in URL paths, headers, and parameters.","Employs recursion to deep-scan discovered directories.","Filters results by HTTP status codes (e.g., 200, 301, 403)."],"tools":["ffuf","gobuster","feroxbuster","dirsearch","dirb"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration"],"distinctiveFeatures":["Multi-tool coverage with selection guide and comparison table","Includes virtual host and API endpoint fuzzing beyond classic directory scans","Offers persistent storage of scan findings via Python script"],"familyIds":["attack-surface-discovery"]},{"id":"recon-fingerprint","summary":"Provides actionable command recipes and decision guidance for identifying web technologies, detecting WAF/CDN, analyzing headers, and persisting fingerprint results using whatweb, wafw00f, nuclei, httpx, nmap, and curl.","primaryDomain":"web-security","domainTags":["web-fingerprinting","waf-detection","technology-identification"],"capabilityTags":["web-technology-fingerprinting","waf-detection","cdn-detection","cms-detection","ssl-tls-analysis"],"capabilityDetails":["Provides a practical workflow for identifying web technologies, detecting WAF/CDN, analyzing server headers, and fingerprinting web applications and frameworks using a combination of tools."],"techniqueTags":["http-header-analysis","passive-fingerprinting","active-probing","waf-signature-matching","ssl-tls-analysis"],"techniqueDetails":["Uses HTTP response headers, page content, and tool-specific probes to identify technologies and WAF/CDN presence; includes version and signature matching for servers, CMSs, frontend frameworks, and WAFs."],"tools":["whatweb","wafw00f","curl","nuclei","httpx","nmap","testssl.sh","fingerprintx"],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","analysis"],"distinctiveFeatures":["Combines multiple web fingerprinting tools with a tool selection guide and detailed reference tables for technology and WAF signatures; also includes optional persistence of fingerprinting results to a database."],"familyIds":["web-technology-fingerprinting"]},{"id":"recon-for-sec","summary":"Router skill for initiating reconnaissance on new targets, providing a structured methodology for asset discovery, fingerprinting, and endpoint inventory, then directing users to relevant specialized skills.","primaryDomain":"reconnaissance","domainTags":["asset-discovery","methodology"],"capabilityTags":["scope-mapping","asset-discovery","tech-fingerprinting","endpoint-inventory","test-route-planning"],"capabilityDetails":["Provides a starting point for new targets, guiding asset discovery, fingerprinting, and endpoint collection before routing to specialized testing skills."],"techniqueTags":["reconnaissance-methodology","attack-surface-mapping"],"techniqueDetails":["Structured workflow to plan follow-up testing instead of random enumeration."],"tools":[],"targetTypes":["other"],"role":"router","workflowFocus":["reconnaissance","enumeration","analysis","navigation"],"distinctiveFeatures":["Entry-point router that maps to specialized skills; no direct scanning or exploitation itself."],"familyIds":["attack-surface-discovery"]},{"id":"recon-port-scan","summary":"Provides practical, multi-tool port scanning and service identification workflows using nmap, masscan, and rustscan, covering fast/full/stealth/UDP scans, OS fingerprinting, NSE scripts, output formats, and persistent storage of scan results via helper scripts.","primaryDomain":"reconnaissance","domainTags":["network-security","reconnaissance","service-discovery"],"capabilityTags":["port-scanning","service-identification","os-fingerprinting","stealth-scanning","udp-scanning","high-speed-scanning","nse-scripting","scan-result-persistence"],"capabilityDetails":["Discovers open TCP/UDP ports across single hosts, hostnames, or CIDR ranges.","Identifies running services and their versions using nmap version detection.","Fingerprints target operating systems using nmap OS detection.","Performs quieter reconnaissance via SYN scans, packet fragmentation, timing adjustments, and decoy IPs.","Covers UDP service discovery with nmap -sU.","Scans large IP ranges at high packet rates using masscan.","Leverages Nmap Scripting Engine categories for vulnerability, auth, brute-force, discovery, and info checks.","Persists scan results into a local database using provided Python helper scripts."],"techniqueTags":["syn-scan","version-detection","os-detection","udp-scan","timing-templates","packet-fragmentation","decoy-scan","nmap-scripting-engine","masscan-high-rate-scanning","rustscan-nmap-pipeline"],"techniqueDetails":["Uses nmap -sS for stealthy SYN scanning requiring root privileges.","Uses nmap -sV to probe open ports and determine service/version information.","Uses nmap -O for operating system fingerprinting.","Uses nmap -sU for scanning top UDP ports and combined TCP/UDP scans.","Uses nmap timing templates -T0 through -T5 to balance scan speed and stealth.","Uses -f and --data-length flags to fragment packets and evade simple filters.","Uses -D RND:10 to generate decoy source IPs during scans.","Uses NSE script categories like vuln, auth, brute, discovery, and info.","Uses masscan with --rate and port ranges for high-speed large network scans.","Uses rustscan to perform fast port discovery and pipe results to nmap for detailed service scanning."],"tools":["nmap","masscan","rustscan"],"targetTypes":["network"],"role":"tool-guide","workflowFocus":["reconnaissance","enumeration","detection"],"distinctiveFeatures":["Covers three complementary scanners (nmap, masscan, rustscan) with a tool selection guide rather than focusing on a single tool.","Provides stealth and evasion techniques including SYN scans, fragmentation, decoys, and timing templates.","Includes Python helper scripts for parsing nmap XML, converting masscan output, merging scan results, and persisting results to a local SQLite database.","Bundles reference cheatsheets, port lists, and common service fingerprint data for operational use."],"familyIds":["attack-surface-discovery"]},{"id":"recon-subdomain","summary":"Operational playbook for subdomain enumeration and DNS reconnaissance using subfinder, amass, dnsx, assetfinder, and puredns, with DNS record gathering, wildcard detection, brute-forcing, takeover detection, and persistent storage of results.","primaryDomain":"reconnaissance","domainTags":["dns-reconnaissance","subdomain-enumeration"],"capabilityTags":["subdomain-enumeration","dns-resolution","dns-record-enumeration","wildcard-detection","subdomain-takeover-detection"],"capabilityDetails":["Provides workflows for discovering subdomains using passive and active techniques.","Includes DNS resolution verification and DNS record gathering (A, AAAA, CNAME, TXT, MX, NS, SOA).","Covers wildcard detection and remediation to avoid false positives.","Describes subdomain takeover detection using subjack and nuclei.","Offers scripts for merging subdomain lists, filtering resolved subdomains, generating statistics, and persisting results to a database."],"techniqueTags":["passive-enumeration","active-enumeration","certificate-transparency-log-search","dns-zone-transfer","subdomain-bruteforce","wildcard-detection"],"techniqueDetails":["Passive enumeration via subfinder, assetfinder, and amass passive mode using public data sources.","Active enumeration with amass active mode and puredns brute force using wordlists.","Certificate transparency log search using crt.sh and subfinder sources.","DNS zone transfer attempts using dig and host.","Wildcard detection using puredns discard and manual random hostname testing."],"tools":["subfinder","dnsx","amass","assetfinder","puredns","subjack","nuclei","dig","host","httpx","curl","jq"],"targetTypes":["network"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","detection","validation"],"distinctiveFeatures":["Orchestrates multiple popular subdomain discovery tools into a single workflow.","Integrates persistent storage of enumeration results via a dedicated Python script.","Includes a tool selection guide and comparison table for choosing appropriate tools.","Covers both passive and active techniques plus edge cases like wildcard handling and takeover detection."],"familyIds":["attack-surface-discovery"]},{"id":"recovering-deleted-files-with-photorec","summary":"Provides an operational workflow for recovering deleted files from forensic disk images and storage media using PhotoRec's signature-based carving engine, including interactive and non-interactive command-line modes, targeted file-type selection, and post-recovery organization, validation, and hashing.","primaryDomain":"forensics","domainTags":["digital-forensics","file-recovery","data-recovery","file-carving"],"capabilityTags":["file-carving","deleted-file-recovery","evidence-recovery","disk-image-analysis"],"capabilityDetails":["Provides a workflow for recovering deleted files from disk images and storage media using PhotoRec's signature-based carving engine, effective even with damaged file systems."],"techniqueTags":["signature-based-carving","file-signature-matching","unallocated-space-scanning","command-line-automation"],"techniqueDetails":["Uses file magic bytes and header/footer signatures to identify and reconstruct files from raw disk sectors, bypassing file system metadata; supports targeted recovery via PhotoRec's fileopt command-line options."],"tools":["photorec","testdisk","hashdeep","jpeginfo","file","exiftool","foremost","scalpel"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Focuses specifically on file-signature-based carving independent of file system metadata, including non-interactive command-line automation and post-recovery validation/hash manifests."],"familyIds":["file-carving-and-data-recovery"]},{"id":"recovering-from-ransomware-attack","summary":"Provides a step-by-step ransomware recovery runbook covering clean environment isolation, Active Directory/system state restoration, krbtgt double-reset, backup integrity validation, dependency-ordered system restore, and phased network reconnection to prevent re-infection.","primaryDomain":"active-directory","domainTags":["ransomware-recovery","incident-response","active-directory","backup-restoration","windows-security"],"capabilityTags":["ransomware-recovery","ad-restore","backup-validation","credential-reset","network-isolation","phased-reconnection"],"capabilityDetails":["Provides a structured ransomware recovery workflow following NIST/CISA frameworks.","Covers Active Directory restore via DSRM, krbtgt double-reset, and validation with dcdiag/repadmin.","Includes backup integrity verification methods such as ClamAV scanning and RESTORE VERIFYONLY."],"techniqueTags":["dsrm-boot","system-state-restore","krbtgt-reset","instant-recovery","backup-scanning","canary-files"],"techniqueDetails":["Uses Directory Services Restore Mode (DSRM) to boot and restore Active Directory system state.","Resets krbtgt password twice to invalidate Kerberos tickets and defeat Golden Ticket persistence.","Employs Veeam/Rubrik Instant Recovery to boot VMs directly from backup for near-zero RTO.","Scans backup files with ClamAV and checks for ransomware indicators before restoration.","Deploys canary files on recovered systems to detect re-infection during phased reconnection."],"tools":["Veeam Instant Recovery","Rubrik Instant Recovery","Microsoft DSRM","DSInternals PowerShell Module","ClamAV","wbadmin"],"targetTypes":["active-directory","windows-host","network","database"],"role":"specialist-playbook","workflowFocus":["remediation","validation","analysis"],"distinctiveFeatures":["Focuses exclusively on post-encryption recovery rather than prevention/detection.","Emphasizes Active Directory recovery first and double krbtgt reset to counter Golden Ticket persistence.","Provides dependency-ordered restoration phases and a phased network reconnection plan to avoid re-infection."],"familyIds":["ad-ransomware-recovery"]},{"id":"red-teaming-llms-with-garak","summary":"Provides a complete workflow for deploying NVIDIA garak to scan LLM endpoints for prompt injection, jailbreak, data leakage and other AI-specific vulnerabilities, and for interpreting and reporting hit-rate results to support AI risk assessments and mitigation validation.","primaryDomain":"general-pentesting","domainTags":["ai-security","llm-red-teaming","prompt-injection","jailbreak","vulnerability-scanning"],"capabilityTags":["llm-vulnerability-scanning","probe-execution","report-interpretation","risk-assessment"],"capabilityDetails":["Provides a workflow for running NVIDIA garak probe suites (jailbreak, prompt injection, data leakage, toxicity, malware generation, etc.) against LLM endpoints.","Supports multiple target types: local Hugging Face models, OpenAI-compatible APIs, AWS Bedrock, Replicate, Cohere, NIM, and arbitrary REST endpoints via custom generator specs.","Includes interpretation of garak's hit-rate reports, extraction of successful attack strings, and before/after mitigation comparison."],"techniqueTags":["prompt-injection","jailbreak","data-leakage","encoding-bypass","malware-generation","xss-exfiltration"],"techniqueDetails":["Prompt injection probes attempt to subvert model behavior with malicious instructions.","Jailbreak probes (e.g., DAN) attempt to bypass safety guardrails to produce restricted content.","Data leakage probes try to extract memorized training data or hidden system prompts.","Encoding-based bypasses use base64/ROT13 to evade filters.","Malware generation probes request AV-evading or malicious code.","XSS probes test if models emit markdown/HTML exfiltration payloads."],"tools":["garak"],"targetTypes":["api"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","analysis","reporting"],"distinctiveFeatures":["Specifically targets LLM security using NVIDIA garak, covering AI-specific vulnerabilities (prompt injection, jailbreak, data leakage) not addressed by traditional web/network scanners.","Provides concrete commands for hands-on probing of multiple LLM endpoint types and a structured workflow for interpreting garak hit-rate reports for risk assessment."],"familyIds":["ai-ml-security-testing"]},{"id":"relaying-ntlm-for-adcs-esc8","summary":"Operational playbook for abusing AD CS ESC8 by relaying coerced NTLM authentication from a domain controller to the HTTP web-enrollment endpoint, yielding a DC certificate that enables PKINIT and DCSync for full domain compromise.","primaryDomain":"active-directory","domainTags":["active-directory","adcs","certificate-services","ntlm-relay","privilege-escalation"],"capabilityTags":["adcs-esc8-exploitation","ntlm-relay","dc-coercion","certificate-to-tgt","pkinit","dcsync"],"capabilityDetails":["Provides a step-by-step workflow to relay coerced NTLM authentication from a domain controller to AD CS HTTP web enrollment, obtain a machine certificate, convert it to a TGT/NT hash via PKINIT, and achieve DCSync."],"techniqueTags":["ntlm-relay","forced-authentication","adcs-web-enrollment","certificate-abuse","pkinit-auth","dcsync"],"techniqueDetails":["Uses Impacket ntlmrelayx --adcs to relay NTLM to the /certsrv/ endpoint; coercion via PetitPotam/Coercer/printerbug; uses Certipy to import certificate for Kerberos authentication."],"tools":["impacket-ntlmrelayx","certipy","petitpotam","coercer","printerbug","impacket-secretsdump"],"targetTypes":["active-directory","windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","post-exploitation"],"distinctiveFeatures":["Dedicated to the ESC8 AD CS web-enrollment relay path, using coerced DC authentication and certificate-to-DCSync; distinct from generic SMB relay or AD CS enumeration by combining ntlmrelayx, coercion, and Certipy into a single domain-compromise playbook."],"familyIds":["ad-cs-abuse-and-exploitation"]},{"id":"remediating-s3-bucket-misconfiguration","summary":"Practical playbook for remediating S3 bucket misconfigurations via Block Public Access, policy/ACL hardening, encryption enforcement, access logging, and preventive SCP/Config controls, with an incident response scenario.","primaryDomain":"cloud-security","domainTags":["s3-security","bucket-misconfiguration","data-exposure","public-access-block","aws-config"],"capabilityTags":["s3-misconfiguration-remediation","public-access-block-enforcement","bucket-policy-auditing","encryption-enforcement","access-logging-setup"],"capabilityDetails":["Provides step-by-step procedures for identifying and remediating S3 bucket misconfigurations that expose sensitive data, including enabling Block Public Access, auditing and tightening bucket policies/ACLs, enforcing encryption, enabling access logging, and deploying preventive controls via AWS Config and SCPs."],"techniqueTags":["block-public-access-config","bucket-policy-hardening","acl-disabling","server-side-encryption","service-control-policy","auto-remediation"],"techniqueDetails":["Uses AWS CLI to apply Block Public Access settings at account and bucket level, replaces permissive bucket policies with deny policies, disables ACLs via BucketOwnerEnforced, configures SSE-KMS encryption with policy enforcement, and deploys SCPs and AWS Config rules with auto-remediation for preventive security."],"tools":["AWS CLI","AWS Config","Amazon Macie","IAM Access Analyzer","S3 Storage Lens","Prowler"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["remediation","detection","analysis"],"distinctiveFeatures":["Focuses exclusively on remediating S3 bucket misconfigurations rather than discovering or classifying data; includes account-level and organization-level preventive controls with SCPs and AWS Config auto-remediation; provides a data breach scenario with steps for access log analysis and incident response."],"familyIds":["cloud-configuration-hardening-remediation"]},{"id":"request-smuggling","summary":"Expert playbook for detecting and exploiting HTTP request smuggling and desynchronization attacks, including CL.TE, TE.CL, TE.TE, HTTP/2 downgrade, and client-side desync, with tool guidance and a detection decision tree.","primaryDomain":"web-security","domainTags":["http-protocol","request-smuggling","proxy-security"],"capabilityTags":["request-smuggling-testing","http-desync-detection","desync-exploitation","h2-downgrade-testing","client-side-desync"],"capabilityDetails":["Provides expert workflows for identifying and exploiting CL.TE, TE.CL, and TE.TE HTTP request smuggling vulnerabilities.","Covers HTTP/2 to HTTP/1 downgrade smuggling and client-side desync via browser fetch pipelines.","Includes a detection decision tree and tool usage guidance for Burp Suite and Python scripts."],"techniqueTags":["cl-te","te-cl","te-te","h2-downgrade","client-side-desync","chunked-encoding","content-length","obfuscation-variants"],"techniqueDetails":["Uses conflicting Content-Length and Transfer-Encoding headers to cause front-end and back-end message boundary disagreement.","Employs eight obfuscated Transfer-Encoding variants to probe parser differentials.","Exploits HTTP/2 to HTTP/1 translation flaws and browser fetch pipeline behavior for desync attacks."],"tools":["burp-suite","smuggler","simple-http-smuggler-generator"],"targetTypes":["web-application","api","network"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Specializes in HTTP message boundary desynchronization between front proxies/CDNs and origins, not general header injection.","Covers classic CL.TE/TE.CL/TE.TE, HTTP/2 downgrade, and client-side desync with a detection decision tree and 8 TE obfuscation variants."],"familyIds":["http-request-parsing-and-smuggling"]},{"id":"rev-dex-dumper","summary":"Operational playbook to dump DEX files from a running Android app using panda-dex-dumper via ADB, supporting unpacking and deobfuscation by extracting decrypted class code from memory.","primaryDomain":"mobile-security","domainTags":["android-security","dex-unpacking","reverse-engineering"],"capabilityTags":["dex-dumping","memory-extraction","packer-defeat","android-adb"],"capabilityDetails":["Provides a step-by-step ADB workflow to dump DEX files from a running Android app's memory, enabling recovery of decrypted DEX after packer/class-loader execution."],"techniqueTags":["ptrace-attachment","process-memory-dump","adb-push-pull","pid-resolution"],"techniqueDetails":["Uses panda-dex-dumper to ptrace the target process and dump loaded DEX files from memory; identifies package/pid via dumpsys, pushes/pulls files over ADB, and cleans up device artifacts."],"tools":["panda-dex-dumper","adb"],"targetTypes":["mobile"],"role":"tool-guide","workflowFocus":["analysis"],"distinctiveFeatures":["Specialized exclusively in live memory DEX dumping from a running app, not static APK analysis; includes optional package resolution and mandatory cleanup operations.","Works around packers by waiting for class-loader decryption before dumping."],"familyIds":["mobile-malware-analysis"]},{"id":"rev-frida","summary":"A practical reference and script generator for Frida-based dynamic instrumentation, covering modern API usage, runtime hooking of native/ObjC/Java methods, memory inspection, and safe native module load timing for reverse engineering tasks.","primaryDomain":"reverse-engineering","domainTags":["dynamic-instrumentation","runtime-hooking","mobile-reversing"],"capabilityTags":["frida-script-generation","function-hooking","argument-retval-tracing","memory-inspection","native-module-instrumentation"],"capabilityDetails":["Generates Frida instrumentation scripts using the modern Frida API for runtime hooking, tracing, and memory inspection."],"techniqueTags":["interceptor-attach","native-callback","objc-hooking","java-hooking","module-load-timing","memory-scanning"],"techniqueDetails":["Uses Interceptor.attach/replace to hook functions at runtime.","Resolves module exports with Process.getModuleByName and getExportByName.","Handles native module load timing by hooking dlopen/android_dlopen_ext and deferring hooks to onLeave.","Uses ObjC.classes and Java.use for platform method hooks.","Uses Memory.scan and hexdump for binary inspection."],"tools":["frida"],"targetTypes":["mobile","other"],"role":"tool-guide","workflowFocus":["analysis","knowledge-reference"],"distinctiveFeatures":["Emphasizes safe module-load timing with helper functions like hookModuleLoad, avoiding blind init hooks, and preferring constructor dispatchers for anti-debug analysis."],"familyIds":["runtime-instrumentation-and-emulation"]},{"id":"rev-idapython","summary":"Concise reference of IDAPython and IDALib scripts for automating IDA Pro reverse engineering tasks including disassembly, debugging, memory manipulation, decompilation, and headless batch analysis of binaries.","primaryDomain":"reverse-engineering","domainTags":["ida-pro","idapython","idalib","binary-analysis"],"capabilityTags":["idapython-scripting","ida-automation","headless-analysis","decompilation","debug-memory-manipulation","binary-patching"],"capabilityDetails":["Provides a script reference for automating IDA Pro reverse engineering, covering interactive IDAPython usage and headless IDALib analysis."],"techniqueTags":["idapython-api","microcode-inspection","breakpoint-management","cplusplus-struct-parsing","batch-decompilation","binary-nop-patching"],"techniqueDetails":["Uses IDAPython API calls to read/write debug memory and registers, traverse functions and basic blocks, and operate on IDB databases.","Uses IDALib for headless open/save/close of databases and batch decompilation of binaries.","Includes Hex-Rays microcode inspection and custom microcode filter installation."],"tools":["ida-pro","idapython","idalib"],"targetTypes":["binary"],"role":"reference","workflowFocus":["knowledge-reference"],"distinctiveFeatures":["Covers both interactive IDAPython and IDALib headless batch analysis in one reference.","Includes advanced Hex-Rays microcode-level APIs and OLLVM obfuscation handling.","Provides practical code snippets for debug memory manipulation, C++ structure parsing, and firmware function creation."],"familyIds":["ida-automation-and-symbol-recovery"]},{"id":"rev-ios-dump","summary":"Dumps decrypted iOS app binaries (IPA) from jailbroken devices using frida-ios-dump, enabling static analysis and reverse engineering; covers setup, execution, verification, and troubleshooting.","primaryDomain":"reverse-engineering","domainTags":["mobile-security","ios-reversing"],"capabilityTags":["ios-app-decryption","macho-binary-dump","ipa-extraction"],"capabilityDetails":["Provides a complete workflow for dumping decrypted iOS app binaries from jailbroken devices using frida-ios-dump, including setup, execution, verification, and troubleshooting."],"techniqueTags":["frida-instrumentation","runtime-memory-dump","fairplay-drm"],"techniqueDetails":["Uses Frida to attach to a running iOS app and dump the decrypted Mach-O from memory, bypassing App Store FairPlay encryption; verifies success via cryptid 0."],"tools":["frida-ios-dump","frida","otool"],"targetTypes":["mobile","binary"],"role":"specialist-playbook","workflowFocus":["analysis"],"distinctiveFeatures":["Specialized for FairPlay DRM decryption on jailbroken iOS devices, with explicit steps for frida-server verification, bundle ID discovery, and cryptid-based validation."],"familyIds":["mobile-application-reverse-engineering"]},{"id":"rev-struct","summary":"Recover likely C struct definitions from decompiled binary code by analyzing memory access offsets, callers/callees, and identified patterns.","primaryDomain":"reverse-engineering","domainTags":["reverse-engineering","static-analysis","binary-analysis"],"capabilityTags":["data-structure-recovery","memory-access-pattern-analysis","reverse-engineering-workflow"],"capabilityDetails":["Provides a structured workflow to recover data structures by analyzing memory access patterns in decompiled functions and their callers/callees."],"techniqueTags":["memory-access-pattern-analysis","offset-analysis","struct-inference"],"techniqueDetails":["Examines direct offset accesses, array accesses, and nested pointers in decompiled code.","Traverses callers/callees to infer struct size, field types, and common patterns like vtables and linked lists."],"tools":["IDA Pro MCP","IDA-NO-MCP","IDA Pro"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["analysis"],"distinctiveFeatures":["Recovers struct definitions from decompiled C and memory access patterns rather than symbol or debug info.","Supports both live IDA Pro MCP and offline IDA-NO-MCP exported projects."],"familyIds":["ida-automation-and-symbol-recovery"]},{"id":"rev-symbol","summary":"A specialist reverse-engineering playbook for recovering function symbols from stripped binaries by analyzing decompiled code, strings, constants, imports/exports, and call relationships, with optional direct IDA Pro integration and web-search-based algorithm identification.","primaryDomain":"reverse-engineering","domainTags":["reverse-engineering","binary-analysis","static-analysis","ida-pro"],"capabilityTags":["symbol-recovery","function-identification","algorithm-recognition","cross-reference-analysis"],"capabilityDetails":["Provides a workflow for restoring function symbols by analyzing code patterns, strings, constants, imports, exports, and cross-references."],"techniqueTags":["code-pattern-analysis","cross-reference-analysis","magic-constant-matching","paired-function-patterns"],"techniqueDetails":["Uses internal function characteristics such as strings and magic numbers to recognize known algorithms.","Identifies library/API calls through callee analysis and import table matching.","Recognizes paired function patterns (alloc/free, lock/unlock, open/close) to infer function roles.","Traces callers upward to symboled functions for contextual inference."],"tools":["IDA Pro","IDA-NO-MCP","web-search"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["analysis"],"distinctiveFeatures":["Specializes in recovering lost or stripped function symbols from binaries using a combination of local code analysis and external web search","Offers two access methods: direct IDA Pro MCP integration or IDA-NO-MCP exported decompiled files"],"familyIds":["ida-automation-and-symbol-recovery"]},{"id":"rev-u3d-dump","summary":"Workflow to recover C# symbols from Unity IL2CPP mobile builds using global-metadata.dat, then import the recovered names into IDA or Ghidra for reverse engineering.","primaryDomain":"reverse-engineering","domainTags":["unity","il2cpp","mobile-reversing","binary-analysis"],"capabilityTags":["symbol-recovery","metadata-parsing","ida-import","ghidra-import"],"capabilityDetails":["Extracts C# class/method names, addresses, and type information from Unity IL2CPP binaries and global-metadata.dat files.","Generates import scripts for IDA and Ghidra to automatically rename functions with recovered symbols."],"techniqueTags":["static-analysis","metadata-version-detection","address-resolution","symbol-mapping"],"techniqueDetails":["Reads global-metadata.dat to map native function addresses to original C# names.","Supports Unity metadata versions up to 39 by selecting the appropriate dump tool fork.","Converts decimal addresses to hex for IDA imports and uses provided Python scripts."],"tools":["Il2CppDumper","Cpp2IL","IDA","Ghidra","dotnet","xxd"],"targetTypes":["mobile","binary"],"role":"specialist-playbook","workflowFocus":["analysis"],"distinctiveFeatures":["Specializes specifically in Unity IL2CPP symbol recovery rather than general binary analysis.","Provides concrete guidance for handling different metadata versions (v29 vs v39) with tool selection and troubleshooting.","Covers both IDA and Ghidra import workflows for recovered symbols."],"familyIds":["mobile-application-reverse-engineering"]},{"id":"rev-unicorn-debug","summary":"A practical guide for emulating and debugging specific code fragments with the Unicorn engine, including hooking external dependencies (JNI, syscalls, libc) and using callbacks for iterative fault diagnosis.","primaryDomain":"reverse-engineering","domainTags":["binary-emulation","binary-analysis","reverse-engineering"],"capabilityTags":["function-emulation","dependency-simulation","execution-tracing","hook-based-debugging"],"capabilityDetails":["Provides a workflow for emulating specific code fragments or functions using the Unicorn engine, simulating external dependencies (libc, JNI, syscalls) via hooks, and iteratively debugging emulation failures."],"techniqueTags":["unicorn-engine-usage","hook-callbacks","memory-mapping","syscall-emulation"],"techniqueDetails":["Uses Unicorn hook callbacks (UC_HOOK_CODE, UC_HOOK_BLOCK, UC_HOOK_MEM_*, UC_HOOK_INTR) to intercept imports and system calls, map missing memory, and trace execution at block level.","Loads binaries as raw bytes without parsing headers, mapping only required code segments into Unicorn memory."],"tools":["Unicorn Engine"],"targetTypes":["binary","other"],"role":"specialist-playbook","workflowFocus":["analysis","validation"],"distinctiveFeatures":["Focused specifically on Unicorn-based function emulation and dependency bypass, rather than general binary analysis or disassembly.","Emphasizes iterative debugging using Unicorn callback output to diagnose and fix crashes (unmapped memory, unhandled imports, infinite loops)."],"familyIds":["runtime-instrumentation-and-emulation"]},{"id":"reverse-engineering-android-malware-with-jadx","summary":"Reverse engineers Android malware by decompiling APKs with JADX, analyzing permissions, components, and source code to identify data theft, C2 communication, overlay attacks, and extract IOCs for reporting.","primaryDomain":"mobile-security","domainTags":["android","malware-analysis","mobile-malware"],"capabilityTags":["apk-decompilation","permission-analysis","malicious-code-detection","c2-extraction","ioc-extraction"],"capabilityDetails":["Provides a step-by-step static analysis workflow for reverse engineering malicious Android APKs using JADX to inspect decompiled Java/Kotlin source, manifest permissions, components, and network indicators."],"techniqueTags":["dex-to-java-decompilation","manifest-analysis","pattern-search","c2-communication-analysis","base64-decoding"],"techniqueDetails":["Uses JADX deobfuscation and grep-based searches over decompiled source to identify malicious behavior; extracts C2 URLs/IPs with regex patterns; decodes Base64-encoded strings for hidden indicators."],"tools":["jadx","apktool","androguard","aapt2","frida","mobsf"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","detection","reporting"],"distinctiveFeatures":["Focused specifically on Android malware analysis rather than general APK reverse engineering, covering banking trojan behaviors (overlay attacks, accessibility abuse, device admin abuse)","Provides a structured IOC extraction workflow for C2 endpoints, permissions, and component analysis","Explicitly excludes native .so reverse engineering, directing users to Ghidra/IDA for such analysis"],"familyIds":["mobile-malware-analysis"]},{"id":"reverse-engineering-dotnet-malware-with-dnspy","summary":"Actionable workflow for analyzing .NET malware: identify assembly/obfuscator, deobfuscate with de4dot, inspect decompiled code in dnSpy, extract C2 config, and optionally debug dynamically.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","dotnet","decompilation"],"capabilityTags":["dotnet-decompilation","deobfuscation","config-extraction","runtime-debugging"],"capabilityDetails":["Provides a workflow for decompiling .NET malware to readable C# source, deobfuscating protected code, and extracting hardcoded C2 servers, encryption keys, and credentials."],"techniqueTags":["dnspy-static-analysis","de4dot-deobfuscation","debugger-breakpoints","string-literal-search"],"techniqueDetails":["Uses dnSpy's decompiler to view C# source; uses de4dot for automated deobfuscation; uses dnSpy debugger breakpoints to capture decrypted strings at runtime; uses IL dump string searching for network indicators."],"tools":["dnSpy","de4dot","ILSpy","Detect It Easy"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Focuses specifically on .NET (C#/VB.NET) malware rather than native executables","Integrates deobfuscation tooling (de4dot) with decompiler/debugger (dnSpy)","Provides structured output template for C2/IOC documentation"],"familyIds":["malware-reverse-engineering-workflows"]},{"id":"reverse-engineering-ios-app-with-frida","summary":"Dynamic instrumentation playbook using Frida to reverse-engineer iOS apps: decrypt FairPlay binaries, enumerate ObjC/Swift classes, trace methods, hook crypto/authentication logic, and extract secrets from running apps.","primaryDomain":"mobile-security","domainTags":["mobile-security","ios","dynamic-instrumentation","reverse-engineering"],"capabilityTags":["ios-app-reversing","frida-hooking","runtime-tracing","secret-extraction","security-control-bypass"],"capabilityDetails":["Provides a workflow for reverse engineering iOS applications without source code using Frida dynamic instrumentation.","Supports enumerating Objective-C and Swift classes, tracing method calls, and extracting encryption keys or API secrets at runtime.","Enables bypassing jailbreak detection, anti-tampering, and anti-debugging mechanisms through hooks."],"techniqueTags":["objc-runtime-hooking","swift-name-mangling-analysis","frida-instrumentation","fairplay-decryption","commoncrypto-interception"],"techniqueDetails":["Uses ObjC.classes enumeration and Interceptor.attach for Objective-C method hooking.","Handles Swift methods via name mangling and Module.enumerateExports for non-ObjC classes.","Decrypts FairPlay-protected binaries using frida-ios-dump before static analysis.","Hooks CommonCrypto functions like CCCrypt to extract keys and analyze encryption behavior."],"tools":["frida","frida-trace","frida-ios-dump","class-dump","ghidra"],"targetTypes":["mobile","binary"],"role":"specialist-playbook","workflowFocus":["enumeration","analysis","exploitation"],"distinctiveFeatures":["Focuses specifically on dynamic instrumentation of iOS apps with Frida, combining binary decryption, runtime class/method enumeration, and crypto/secret hooks in a single playbook.","Distinguishes between Objective-C and pure Swift analysis, including anti-Frida considerations."],"familyIds":["mobile-runtime-instrumentation"]},{"id":"reverse-engineering-malware-with-ghidra","summary":"A specialist playbook for statically reverse engineering malware with Ghidra, covering project setup, function discovery, decompiler analysis, C2 protocol reversal, encryption identification, and YARA signature generation.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","disassembly","decompilation","static-analysis"],"capabilityTags":["malware-reverse-engineering","c2-protocol-reversing","encryption-analysis","obfuscation-analysis","yara-rule-generation"],"capabilityDetails":["Provides step-by-step workflow for importing malware into Ghidra, running auto-analysis, and navigating to key functions.","Explains how to trace C2 communication logic from API calls to command dispatcher and document protocol details.","Covers identification of common malware encryption patterns and use of crypto-related plugins.","Shows how to produce a structured analysis report and generate YARA rules from reversed code patterns."],"techniqueTags":["ghidra-workflow","decompiler-analysis","cross-reference-tracing","crypto-constant-identification","function-signature-recovery"],"techniqueDetails":["Uses Ghidra's decompiler and cross-references to lift binary code to readable pseudo-C.","Employs headless Ghidra analysis for automated batch reversing.","Guides searching for suspicious APIs and crypto constants to locate core logic.","Applies function signature recovery, variable renaming, and typing to improve decompiler output."],"tools":["ghidra","ida-pro","binary-ninja","x64dbg","findcrypt"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["analysis","detection","reporting"],"distinctiveFeatures":["Ghidra-specific static reverse engineering workflow with headless analysis support.","Focuses on reversing C2 protocols and encryption routines rather than general binary exploitation.","Includes concrete YARA rule generation from reversed code patterns for detection.","Provides detailed navigation shortcuts and analyst actions for Ghidra."],"familyIds":["malware-reverse-engineering-workflows"]},{"id":"reverse-engineering-ransomware-encryption-routine","summary":"A specialist playbook for reverse engineering ransomware encryption routines, using static and dynamic analysis to identify cryptographic algorithms, key generation flaws, and potential decryption opportunities without paying the ransom.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","ransomware","cryptanalysis","encryption"],"capabilityTags":["ransomware-encryption-reverse-engineering","cryptographic-algorithm-identification","key-flaw-analysis","decryption-opportunity-assessment"],"capabilityDetails":["Provides a structured workflow to reverse engineer ransomware encryption routines using static and dynamic analysis.","Identifies cryptographic algorithms (AES, RSA, ChaCha20), key generation methods, and implementation flaws that may enable decryption without ransom."],"techniqueTags":["static-analysis","dynamic-analysis","pe-import-analysis","entropy-analysis","hybrid-encryption-analysis"],"techniqueDetails":["Uses PE import tables and embedded constants to identify crypto APIs and algorithms.","Analyzes encrypted file structure, appended key material, and header preservation to infer encryption flow.","Assesses PRNG weaknesses, IV reuse, hardcoded keys, and other implementation flaws."],"tools":["IDA Pro","Ghidra","x64dbg","WinDbg","Python","pycryptodome","pefile"],"targetTypes":["binary","windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Dedicated specifically to ransomware encryption routine reverse engineering for decryption opportunities.","Provides ready-to-use Python analysis scripts for PE imports and encrypted file pattern recognition.","Covers both static and dynamic analysis approaches with a focus on cryptographic flaws."],"familyIds":["malware-reverse-engineering-workflows"]},{"id":"reverse-engineering-rust-malware","summary":"A specialist playbook for reverse engineering Rust-compiled malware, covering Rust-specific binary identification, crate dependency extraction, string analysis, and decompilation challenges using IDA Pro and Ghidra.","primaryDomain":"reverse-engineering","domainTags":["malware-analysis","binary-analysis","rust-malware"],"capabilityTags":["rust-binary-identification","crate-extraction","rust-string-analysis","rust-specific-deobfuscation"],"capabilityDetails":["Provides a workflow to identify Rust-compiled binaries, extract crate dependencies and strings, and analyze Rust-specific constructs like fat pointers and monomorphized code."],"techniqueTags":["fat-pointer-analysis","monomorphization-analysis","unwrap-chain-analysis","crate-path-regex-extraction","calling-convention-analysis"],"techniqueDetails":["Uses regex patterns to identify Rust metadata and crate paths from binary strings.","Analyzes non-null-terminated fat-pointer strings unique to Rust.","Explains how to handle duplicated generic code from monomorphization and Result/Option unwrap chains in decompilers."],"tools":["IDA Pro","Ghidra","Python 3"],"targetTypes":["binary"],"role":"specialist-playbook","workflowFocus":["analysis","detection"],"distinctiveFeatures":["Specifically targets Rust-compiled malware, addressing language-specific reverse engineering challenges not covered by generic binary analysis skills.","Includes a custom Python script for Rust binary identification and crate/string extraction."],"familyIds":["malware-reverse-engineering-workflows"]},{"id":"reverse-shell-techniques","summary":"Expert playbook for establishing remote shells on Linux/Windows and web servers, covering encrypted shell variants, PTY upgrades, file transfer, and payload generation, with a decision tree for selecting the right technique.","primaryDomain":"post-exploitation","domainTags":["remote-shell-access","reverse-shell","bind-shell","web-shell","encrypted-shell","payload-generation"],"capabilityTags":["reverse-shell-establishment","encrypted-shell-handling","web-shell-deployment","pty-stabilization","file-transfer","payload-generation","command-execution"],"capabilityDetails":["Provides hands-on command sequences for establishing reverse shells across Linux/Windows and web applications, including encrypted variants, web shells, PTY upgrades, file transfer methods, and msfvenom payload generation."],"techniqueTags":["openssl-reverse-shell","socat-ssl","ncat-ssl","php-web-shell","aspx-web-shell","jsp-web-shell","powershell-reverse-shell","msfvenom-payloads","pty-upgrade","base64-file-transfer","certutil-download","smb-file-transfer"],"techniqueDetails":["Covers OpenSSL, socat, and ncat encrypted shell setups.","Includes PHP, ASPX, and JSP web shell patterns.","Details PTY upgrade sequences using Python, script, socat, and rlwrap.","Lists file transfer methods for Linux and Windows, including wget, curl, nc, base64, PowerShell, certutil, bitsadmin, and SMB.","Provides msfvenom commands for Linux/Windows/web payload generation."],"tools":["openssl","socat","ncat","msfvenom","python","bash","powershell","wget","curl","certutil","bitsadmin","impacket-smbserver","rlwrap","expect"],"targetTypes":["linux-host","windows-host","web-application"],"role":"specialist-playbook","workflowFocus":["exploitation","post-exploitation"],"distinctiveFeatures":["Comprehensive reverse shell playbook covering encrypted shells (OpenSSL/socat/ncat) that are often missing from basic RCE guides.","Includes a decision tree for selecting reverse vs bind shells, web shells, or PowerShell payloads based on target environment.","Provides cross-platform file transfer methods tailored to Linux and Windows victims."],"familyIds":["remote-shell-access"]},{"id":"rsa-attack-techniques","summary":"Enables decrypting RSA ciphertexts and factoring weak moduli by selecting and applying the appropriate cryptanalytic attack from a decision tree, covering small exponents, shared factors, padding oracles, and CRT faults.","primaryDomain":"ctf","domainTags":["rsa","cryptography","cryptanalysis","public-key-cryptography"],"capabilityTags":["rsa-cryptanalysis","ciphertext-decryption","modulus-factorization","oracle-based-decryption"],"capabilityDetails":["Provides a comprehensive playbook for recovering RSA plaintext or private keys by exploiting weak parameters, small exponents, shared factors, and padding oracles."],"techniqueTags":["small-exponent-attack","hastad-broadcast","wiener-attack","boneh-durfee","coppersmith","common-modulus-attack","padding-oracle-attack","rsa-crt-fault-attack"],"techniqueDetails":["Includes classical attacks (direct factorization, Fermat, Pollard p-1, batch GCD) and lattice-based attacks (Wiener, Boneh-Durfee, Coppersmith), as well as broadcast, common modulus, padding oracle, and RSA-CRT fault attacks."],"tools":["RsaCtfTool","SageMath","factordb","yafu","msieve","gmpy2","pycryptodome"],"targetTypes":["ctf","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","exploitation"],"distinctiveFeatures":["Comprehensive RSA attack playbook that combines a decision tree for attack selection with detailed implementations of factorization, small exponent, lattice, oracle, and fault attacks, plus integration with automated tools like RsaCtfTool."],"familyIds":["ctf-cryptanalysis"]},{"id":"saml-sso-assertion-attacks","summary":"A specialist playbook for testing SAML SSO assertion trust, focusing on signature validation, audience restrictions, ACS handling, and XML parser weaknesses to identify enterprise SSO flaws.","primaryDomain":"authentication","domainTags":["saml","sso","xml-security","identity-management"],"capabilityTags":["saml-assertion-testing","signature-validation-testing","xml-trust-boundary-testing","acs-handling-testing"],"capabilityDetails":["Provides a playbook for testing SAML SSO assertion trust, including signature validation, audience restrictions, ACS handling, and XML parser behavior."],"techniqueTags":["signature-wrapping","assertion-wrapping","replay-attack","audience-restriction-bypass","xml-parser-abuse"],"techniqueDetails":["Describes checks for unsigned assertions, wrapped signatures, weak audience/recipient validation, and parser-level XML issues."],"tools":[],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focused specifically on SAML SSO assertion trust boundaries rather than general authentication bypass; includes specific checks for signature coverage, ACS handling, and XML trust."],"familyIds":["identity-federation-sso-security"]},{"id":"sandbox-escape-techniques","summary":"Expert playbook for escaping a wide range of sandboxed environments by identifying the sandbox type and applying the correct escape primitive (Python/Lua introspection, chroot tricks, seccomp bypass, namespace escape, browser Mojo IPC), with a decision tree linking to deeper specialized playbooks.","primaryDomain":"general-pentesting","domainTags":["sandbox-escape","python-sandbox","lua-sandbox","seccomp-bypass","chroot-escape","browser-sandbox"],"capabilityTags":["sandbox-escape","sandbox-type-identification","python-sandbox-escape","lua-sandbox-escape","chroot-escape","rbash-escape"],"capabilityDetails":["Playbook covering escape from Python/Lua sandboxes, seccomp filters, chroot jails, containers, browser sandboxes, namespaces, and restricted shells.","Uses a decision tree to identify sandbox type before applying appropriate escape technique."],"techniqueTags":["python-subclass-walk","lua-debug-registry","luajit-ffi","double-chroot","tiocsti-injection","seccomp-architecture-confusion","namespace-nsenter","mojo-ipc-attack"],"techniqueDetails":["Uses Python object introspection to reach restricted modules via __subclasses__().","Leverages Lua debug library to access global registry or upvalues.","Uses LuaJIT FFI to call C system() from sandbox.","Performs double chroot and chdir to traverse out of jail.","Exploits terminal ioctl TIOCSTI to inject input into parent shell.","Bypasses seccomp filters via 32-bit syscall confusion.","Uses nsenter to enter host namespaces from misconfigured container.","Targets Mojo IPC interface bugs to escape browser renderer."],"tools":["nsenter","unshare","chroot","mount"],"targetTypes":["container","linux-host","other"],"role":"specialist-playbook","workflowFocus":["detection","exploitation","navigation"],"distinctiveFeatures":["Single playbook spanning multiple sandbox types (Python, Lua, seccomp, chroot, container, browser, namespace, rbash) rather than deep-diving one type.","Includes a decision tree to route to specialized sub-skills (container-escape-techniques, browser-exploitation-v8, kernel-exploitation).","Provides concrete escape primitives as code snippets and Unix commands, not just methodology."],"familyIds":["sandbox-escape-techniques"]},{"id":"scanning-container-images-with-grype","summary":"Provides a tool guide for scanning container images, filesystems, and SBOMs for known CVEs using Anchore Grype, with support for multiple input types, severity thresholds, SBOM workflows, and CI/CD integration.","primaryDomain":"general-pentesting","domainTags":["container-security","vulnerability-scanning","sbom","supply-chain"],"capabilityTags":["container-image-scanning","sbom-scanning","cve-detection","severity-threshold-enforcement"],"capabilityDetails":["Scans container images, filesystems, and SBOMs for known CVEs using Anchore Grype."],"techniqueTags":["sbom-based-matching","cve-matching","severity-filtering","ci-integration"],"techniqueDetails":["Matches packages against NVD, GitHub Advisories, and OS-specific feeds.","Supports multiple scan sources including docker, docker-archive, oci-dir, sif, dir, and sbom."],"tools":["grype","syft"],"targetTypes":["container","linux-host","other"],"role":"tool-guide","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Tool-specific guide for Anchore Grype covering installation, scanning modes, filters, SBOM integration, and CI/CD workflows."],"familyIds":["vulnerability-scanning"]},{"id":"scanning-containers-with-trivy-in-cicd","summary":"A specialist playbook for integrating Aqua Security's Trivy scanner into CI/CD pipelines to automatically detect container image vulnerabilities (OS packages and application dependencies), Dockerfile and Kubernetes misconfigurations, generate SBOMs, and enforce severity-based quality gates that block vulnerable images from deployment, with support for GitHub Actions, GitLab CI, offline scanning, and VEX-based exception management.","primaryDomain":"cloud-security","domainTags":["devsecops","container-security","cicd","vulnerability-management"],"capabilityTags":["container-vulnerability-scanning","misconfiguration-scanning","cicd-integration","quality-gate-enforcement","sbom-generation","license-scanning"],"capabilityDetails":["Automated container image vulnerability scanning using Trivy with CVE detection for OS packages and application dependencies.","Integration into GitHub Actions and GitLab CI pipelines via YAML workflow definitions.","Enforcement of severity-based quality gates using Trivy exit codes to block deploy of critical/high vulnerabilities.","Misconfiguration scanning for Dockerfiles and Kubernetes manifests using Trivy config scanning.","SBOM generation in CycloneDX and SPDX formats, plus license compliance scanning.","Support for persistent database caching, offline/air-gapped scanning, and false-positive management via ignore files and VEX."],"techniqueTags":["cve-database-matching","dockerfile-static-analysis","kubernetes-manifest-analysis","exit-code-gating","sbom-correlation"],"techniqueDetails":["Matches installed package and dependency versions against Trivy's vulnerability database (including NVD and vendor advisories).","Static analysis of Dockerfile instructions (USER, HEALTHCHECK, COPY vs ADD, secrets in ENV/ARG) via built-in policies.","Generates SBOM using CycloneDX and SPDX, then can correlate SBOM against the vulnerability DB.","Uses exit code 1 when severity threshold met to fail CI job and prevent pipeline progression.","Reads .trivyignore.yaml for whitelisted vulnerabilities/misconfigurations with expiry dates."],"tools":["trivy","trivy-action"],"targetTypes":["container","kubernetes"],"role":"specialist-playbook","workflowFocus":["detection","validation"],"distinctiveFeatures":["Focuses specifically on CI/CD pipeline integration of Trivy with quality-gate enforcement rather than on-demand scanning.","Covers both image vulnerability scanning and IaC misconfiguration scanning in a single pipeline-oriented workflow.","Includes advanced DevOps features such as SBOM generation, air-gapped scanning, database caching, and VEX exception handling."],"familyIds":["container-image-hardening-and-provenance"]},{"id":"scanning-docker-images-with-trivy","summary":"Provides actionable workflows for using Trivy to scan Docker images and IaC configurations for vulnerabilities, misconfigurations, secrets, and license issues, with CI/CD integration and SBOM generation.","primaryDomain":"cloud-security","domainTags":["container-security","docker","kubernetes","vulnerability-scanning"],"capabilityTags":["vulnerability-scanning","misconfiguration-scanning","secret-scanning","license-scanning","sbom-generation"],"capabilityDetails":["Scans container images for known CVEs in OS packages and language dependencies.","Detects misconfigurations in Dockerfiles, Kubernetes manifests, Helm charts, and Terraform files.","Finds exposed secrets such as passwords, API keys, and tokens.","Checks software license compliance.","Generates SBOMs in CycloneDX and SPDX formats."],"techniqueTags":["cve-database-matching","dependency-database-matching","iac-config-audit","secret-pattern-detection","license-classification"],"techniqueDetails":["Matches OS packages and language dependencies against NVD and vendor security trackers.","Audits IaC files using built-in policy rules.","Detects secrets using regex patterns and entropy analysis.","Classifies licenses based on file metadata and heuristics.","Exports SBOMs using CycloneDX and SPDX standards."],"tools":["trivy","docker"],"targetTypes":["container","kubernetes","cloud"],"role":"tool-guide","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Combines vulnerability, misconfiguration, secret, and license scanning in a single tool, with SBOM and SARIF output.","Provides direct CI/CD integration examples for GitHub Actions and GitLab CI.","Covers scanning of Docker images as well as Kubernetes manifests and other IaC configurations."],"familyIds":["container-image-hardening-and-provenance"]},{"id":"scanning-iac-and-images-with-trivy","summary":"CI/CD-oriented workflow using Trivy to scan container images, IaC, filesystems, and git repos for vulnerabilities, misconfigurations, secrets, and license issues; includes SBOM generation/rescanning, SARIF reporting, and build gating via exit codes.","primaryDomain":"cloud-security","domainTags":["container-security","iac-security","vulnerability-scanning","devsecops","sbom","secret-detection"],"capabilityTags":["container-image-scanning","iac-misconfiguration-scanning","secret-scanning","license-scanning","sbom-generation","sbom-rescanning","ci-cd-gating"],"capabilityDetails":["Provides a workflow for scanning container images, Infrastructure-as-Code, filesystems, Git repos, and SBOMs using Trivy's vulnerability, misconfiguration, secret, and license scanners; includes generating CycloneDX/SPDX SBOMs and failing CI/CD pipelines on policy violations via exit codes."],"techniqueTags":["vulnerability-scanning","misconfiguration-scanning","secret-scanning","license-policy-scanning","sbom-analysis"],"techniqueDetails":["Uses Trivy's built-in scanners: CVE matching against the Trivy vulnerability DB, Rego-based policy checks for IaC misconfigurations, secret pattern matching, and license policy evaluation. SBOMs are generated in CycloneDX/SPDX formats and re-scanned to identify newly disclosed vulnerabilities."],"tools":["trivy"],"targetTypes":["container","kubernetes","source-code","cloud"],"role":"specialist-playbook","workflowFocus":["detection","validation","reporting"],"distinctiveFeatures":["Merges multiple Trivy scanners (vuln, misconfig, secret, license) into a single CI/CD gate, covering container images, IaC, filesystems, and git repos with one tool; additionally supports SBOM generation and re-scanning plus SARIF output for code-scanning dashboards."],"familyIds":["container-image-hardening-and-provenance"]},{"id":"scanning-infrastructure-with-nessus","summary":"Provides a practical guide to deploying and using Tenable Nessus for infrastructure vulnerability scanning, covering scan policy creation, credentialed scanning, REST API management, and CVSS-based severity interpretation.","primaryDomain":"network-security","domainTags":["vulnerability-management","infrastructure-scanning","cve","tenable-nessus"],"capabilityTags":["infrastructure-vulnerability-scanning","credentialed-scanning","scan-policy-configuration","vulnerability-detection","scan-result-analysis"],"capabilityDetails":["Provides a workflow for performing authenticated and unauthenticated vulnerability scans of network infrastructure using Tenable Nessus, including policy configuration, plugin selection, result analysis, and REST API automation."],"techniqueTags":["nessus-plugin-architecture","credentialed-scanning","unauthenticated-scanning","cvss-scoring","rest-api-automation"],"techniqueDetails":["Explains Nessus plugin architecture, scan types (host discovery, patch audit, compliance), CVSS-based severity classification, and credential-based scanning methods."],"tools":["nessus"],"targetTypes":["network","windows-host","linux-host"],"role":"tool-guide","workflowFocus":["detection","analysis","reporting"],"distinctiveFeatures":["Full lifecycle of Tenable Nessus scanning: policy creation, credentialed scanning, REST API automation, and result interpretation","Distinct from generic vulnerability assessment methodology by being tool-specific to Nessus with concrete commands and configuration steps"],"familyIds":["vulnerability-scanning-management"]},{"id":"scanning-kubernetes-manifests-with-kubesec","summary":"Hands-on guide for using Kubesec to scan Kubernetes manifests for security misconfigurations and privilege escalation risks, with scoring, CI/CD integration, and admission webhook enforcement.","primaryDomain":"cloud-security","domainTags":["kubernetes-security","container-security","cloud-native-security"],"capabilityTags":["kubernetes-manifest-scanning","static-security-analysis","misconfiguration-detection","security-scoring"],"capabilityDetails":["Provides a workflow for scanning Kubernetes manifests with Kubesec to identify security misconfigurations, privilege escalation risks, and best-practice violations.","Explains Kubesec's security scoring system, check categories, and selector-based evaluation logic.","Demonstrates integration options including CLI, Docker, kubectl plugin, HTTP API, CI/CD pipelines, and admission webhook."],"techniqueTags":["static-analysis","security-context-review","privilege-escalation-detection"],"techniqueDetails":["Uses Kubesec's selector-based rules to evaluate security context, Linux capabilities, volume mounts, and resource limits.","Assigns a numerical score based on the presence or absence of hardening controls, with negative points for critical risks."],"tools":["kubesec"],"targetTypes":["kubernetes","container"],"role":"tool-guide","workflowFocus":["detection","analysis","validation"],"distinctiveFeatures":["Specific to Kubesec, covering its unique scoring system and the precise set of check selectors it uses.","Provides multiple operational modes and deployment patterns, including CLI, Docker, kubectl plugin, HTTP API, and admission webhook.","Includes CI/CD integration examples that gate deployments based on negative security scores."],"familyIds":["container-kubernetes-configuration-compliance-auditing"]},{"id":"scanning-network-with-nmap-advanced","summary":"An advanced Nmap operational playbook for layered host discovery, optimized TCP/UDP port scanning, service version detection, OS fingerprinting, NSE vulnerability scanning, firewall/IDS evasion, and structured output parsing for reporting or vulnerability management integration.","primaryDomain":"network-security","domainTags":["network-security","port-scanning","service-enumeration","reconnaissance","nmap"],"capabilityTags":["host-discovery","port-scanning","service-version-detection","os-fingerprinting","nse-vulnerability-scanning","firewall-evasion","output-parsing"],"capabilityDetails":["Provides a multi-step operational workflow for advanced network reconnaissance using Nmap, including layered host discovery, optimized TCP/UDP port scanning, service version detection, OS fingerprinting, NSE vulnerability scanning, firewall/IDS evasion, and structured output parsing for integration into reporting or vulnerability management pipelines."],"techniqueTags":["tcp-syn-scan","udp-scan","idle-scan","decoy-scan","fragmented-scan","source-port-spoofing","timing-template","version-intensity","os-guessing","nse-scripting"],"techniqueDetails":["Uses half-open TCP SYN scans and UDP scans with tunable timing templates for efficient large-scale port discovery.","Employs evasion techniques such as fragmenting packets, using decoy addresses, spoofing source ports, idle scanning via a zombie host, and slow scan rates to bypass firewalls/IDS.","Leverages Nmap Scripting Engine (NSE) scripts for vulnerability detection and default-credential checks.","Controls service version detection fidelity through version-intensity levels and OS guessing for fingerprinting."],"tools":["nmap","nmap-parse-output","ndiff","zenmap","metasploit"],"targetTypes":["network","linux-host","windows-host"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","detection","validation","reporting"],"distinctiveFeatures":["Covers the full advanced Nmap lifecycle in one playbook — from layered host discovery and timing-optimized port scanning to firewall/IDS evasion and NSE vulnerability checks.","Explicitly focuses on structured output parsing (XML, grepable, CSV) and feeds into vulnerability management or Metasploit for downstream automation."],"familyIds":["network-adversary-simulation"]},{"id":"secknowledge-skill","summary":"A Web+AI security testing knowledge base and router that maps attack/audit requests to a corpus of Web vulnerability references and GAARM-based AI/LLM risk references, enforcing evidence-grounded output with explicit citation and hallucination controls.","primaryDomain":"security-knowledge","domainTags":["web-security","ai-security","llm-security"],"capabilityTags":["security-testing-knowledge-base","scenario-routing","reference-navigation","web-ai-security-methodology"],"capabilityDetails":["Provides a scenario-driven router and built-in read-only knowledge base for Web security testing and AI/LLM security testing, mapping user symptoms to reference files and enforcing source-cited output."],"techniqueTags":["security-testing-methodology","scenario-navigation","knowledge-retrieval"],"techniqueDetails":["Uses a three-step workflow (target classification, lazy reference loading, L1-L4 methodology output) with strict citation checking and UNABLE TO CITE fallback for unverified content."],"tools":["read","grep","websearch","bash"],"targetTypes":["web-application","api","database","container","cloud","ctf","other"],"role":"router","workflowFocus":["navigation","knowledge-reference","analysis"],"distinctiveFeatures":["Phenomenon-based routing from user symptom descriptions (e.g., agent off-policy, RAG poisoning, WAF bypass) to AI/LLM security references; integrates WooYun cases, Xianzhi methodology, GAARM 173-risk matrix, and OWASP Top 10 (LLM/ASI/WSTG) into one navigable corpus with strict source citation and hallucination prevention."],"familyIds":["security-knowledge-router"]},{"id":"securing-agentic-ai-tool-invocation","summary":"Provides runnable defense-in-depth controls—tool allowlisting, argument schema validation, per-call scoped identities, NeMo Guardrails policy enforcement, human-in-the-loop approvals, and audit logging—to secure an AI agent's tool-invocation boundary against prompt injection and tool misuse.","primaryDomain":"api-security","domainTags":["ai-security","agentic-ai","tool-invocation-security"],"capabilityTags":["tool-allowlisting","argument-schema-validation","least-privilege-identity-binding","human-in-the-loop-approval","audit-logging"],"capabilityDetails":["Implements deny-by-default tool allowlisting with per-tool argument schemas.","Binds each tool call to scoped, short-lived credentials on a per-session basis.","Enforces allow, require_approval, or deny policy decisions before every invocation.","Adds human-in-the-loop approval for high-impact tools with fail-closed behavior."],"techniqueTags":["deny-by-default","json-schema-validation","short-lived-credentials","policy-decision-gate","fail-closed-approval"],"techniqueDetails":["Uses JSON Schema validation to constrain tool arguments and reject unexpected properties.","Uses AWS STS session policies to issue least-privilege credentials per call.","Logs argument hashes to avoid storing sensitive data while preserving audit trail."],"tools":["nemoguardrails","jsonschema","boto3"],"targetTypes":["api"],"role":"specialist-playbook","workflowFocus":["analysis","validation","detection","remediation"],"distinctiveFeatures":["Specifically addresses the AI agent tool-invocation boundary, not generic API security.","Combines tool allowlisting, argument schema validation, scoped short-lived identities, NeMo Guardrails, HITL approvals, and audit logging in one defense-in-depth workflow.","Maps controls to OWASP Agentic AI Top 10 and MITRE ATLAS AML.T0053."],"familyIds":["ai-llm-api-security"]},{"id":"securing-api-gateway-with-aws-waf","summary":"Provides a complete operational playbook to secure AWS API Gateway with AWS WAF, covering managed rule groups, rate limiting, bot control, custom rules, logging, and CloudWatch-based monitoring.","primaryDomain":"cloud-security","domainTags":["aws","api-gateway","web-application-firewall","api-security"],"capabilityTags":["api-gateway-protection","waf-policy-management","rate-limiting","bot-mitigation","threat-detection","security-monitoring"],"capabilityDetails":["Provides step-by-step AWS CLI commands to create a WAF Web ACL with AWS Managed Rules for OWASP Top 10 protection.","Configures rate-based rules for per-IP throttling and endpoint-specific limits.","Implements AWS WAF Bot Control managed rule group for automated traffic detection.","Adds custom rules for API key validation, geo-restriction, and request size limits.","Enables WAF logging and CloudWatch metrics monitoring for tuning."],"techniqueTags":["aws-managed-rules","rate-based-statement","bot-control-rule-set","ip-reputation-list","custom-waf-rules","cloudwatch-alarms"],"techniqueDetails":["Uses AWS WAF managed rule groups to apply OWASP Top 10 protections.","Implements rate-based rules with scope-down statements to target specific endpoints.","Applies Bot Control with COMMON inspection level and exclusions.","Leverages IP reputation lists and custom geo-match statements.","Configures logging via Kinesis Firehose and CloudWatch metrics/alarms."],"tools":["aws-waf","aws-api-gateway","aws-cli","amazon-cloudwatch","amazon-kinesis-firehose","aws-managed-rules"],"targetTypes":["api","cloud"],"role":"specialist-playbook","workflowFocus":["remediation","detection","analysis","reporting"],"distinctiveFeatures":["Specializes exclusively in AWS WAF integration with API Gateway, unlike generic WAF or web security skills.","Provides concrete AWS CLI commands for every step, including Web ACL creation, rule updates, association, and logging.","Covers both AWS managed rule groups and custom rules for API-specific constraints such as required headers, geo-fencing, and body size limits.","Includes operational monitoring and tuning guidance using CloudWatch metrics, sampled requests, and rate-based managed keys."],"familyIds":["cloud-configuration-hardening-remediation"]},{"id":"securing-aws-iam-permissions","summary":"Provides a step-by-step AWS IAM hardening workflow that inventories identities, uses IAM Access Analyzer for least-privilege policy generation, scopes policies, implements permission boundaries, enforces MFA via SCPs, rotates stale credentials, and automates continuous monitoring using Config and EventBridge.","primaryDomain":"cloud-security","domainTags":["aws-iam","least-privilege","permission-boundaries","access-analyzer","cloud-identity"],"capabilityTags":["iam-policy-scoping","permission-boundary-configuration","access-analyzer-integration","credential-rotation","mfa-enforcement"],"capabilityDetails":["Provides a step-by-step workflow for hardening AWS IAM: inventorying identities, generating least-privilege policies with Access Analyzer, scoping resources and conditions, implementing permission boundaries, enforcing MFA via SCPs, rotating stale access keys, and automating continuous monitoring."],"techniqueTags":["least-privilege-policy-generation","permission-boundary","scp-mfa-enforcement","credential-report-analysis","access-key-rotation","cloudtrail-activity-review"],"techniqueDetails":["Uses IAM Access Analyzer to generate policies from CloudTrail activity and identify external resource sharing.","Uses AWS Organizations SCPs to enforce MFA at the organization level.","Uses IAM credential reports to find stale access keys and unused permissions."],"tools":["aws-cli","iam-access-analyzer","aws-config","aws-security-hub","prowler"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on AWS IAM least-privilege enforcement, combining Access Analyzer policy generation, permission boundaries, SCP-based MFA enforcement, and credential rotation in one operational playbook."],"familyIds":["aws-iam-least-privilege-hardening"]},{"id":"securing-aws-lambda-execution-roles","summary":"Provides an advanced, step-by-step workflow to audit AWS Lambda execution roles, derive least-privilege IAM policies from actual usage, apply permission boundaries, validate with IAM Access Analyzer, and enforce role scoping via SCPs.","primaryDomain":"cloud-security","domainTags":["aws","lambda","iam","least-privilege","execution-roles"],"capabilityTags":["lambda-execution-role-hardening","iam-least-privilege","permission-boundary-enforcement","access-analyzer-policy-validation","scp-role-scoping"],"capabilityDetails":["Provides a step-by-step workflow to audit AWS Lambda execution roles, generate least-privilege IAM policies from CloudTrail usage, apply permission boundaries, validate policies with IAM Access Analyzer, and enforce role standards via SCPs."],"techniqueTags":["cloudtrail-usage-analysis","iam-policy-generation","policy-validation","permission-boundary","scp-enforcement"],"techniqueDetails":["Uses CloudTrail lookup and IAM Access Analyzer policy generation to determine actual API usage, builds resource-scoped policies with explicit Deny actions, applies permission boundaries, validates effective permissions with the policy simulator, and enforces guardrails via service control policies."],"tools":["aws-cli","iam-access-analyzer","cloudtrail","iam-policy-simulator","prowler","checkov"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["analysis","detection","remediation","validation"],"distinctiveFeatures":["Focuses exclusively on AWS Lambda execution role least-privilege hardening, combining CloudTrail activity analysis with IAM Access Analyzer to derive scoped policies, then applying permission boundaries and SCP enforcement to prevent privilege escalation."],"familyIds":["aws-iam-least-privilege-hardening"]},{"id":"securing-azure-with-microsoft-defender","summary":"Provides a workflow for onboarding Azure and multi-cloud workloads to Microsoft Defender for Cloud: enabling Defender plans, connecting AWS/GCP, prioritizing Secure Score recommendations, configuring JIT access and automation, and analyzing attack paths to remediate exploitable risks.","primaryDomain":"cloud-security","domainTags":["microsoft-defender","azure-security","cnapp","multi-cloud-security","cloud-workload-protection"],"capabilityTags":["cloud-security-posture-management","microsoft-defender-configuration","secure-score-management","attack-path-analysis","multi-cloud-connector-setup","security-automation"],"capabilityDetails":["Provides a step-by-step workflow for onboarding Azure and multi-cloud workloads to Microsoft Defender for Cloud, including enabling Defender plans, connecting AWS/GCP accounts, prioritizing Secure Score recommendations, configuring JIT VM access and adaptive application controls, setting up security alert automation, and using cloud security graph for attack path analysis."],"techniqueTags":["defender-plan-enablement","multi-cloud-connector-configuration","secure-score-review","jit-access-configuration","adaptive-application-controls","cloud-security-graph","security-alert-automation"],"techniqueDetails":["Uses Azure CLI commands to enable Defender plans per workload type, create AWS/GCP security connectors, query Secure Score and assessments, configure Just-In-Time VM access and security automations, and query attack paths via Azure Resource Graph."],"tools":["Microsoft Defender for Cloud","Azure CLI","Azure Resource Graph","Azure Logic Apps","Azure Policy"],"targetTypes":["cloud"],"role":"specialist-playbook","workflowFocus":["detection","analysis","remediation","reporting"],"distinctiveFeatures":["Focuses specifically on Microsoft Defender for Cloud as a CNAPP for Azure and multi-cloud environments, covering plan enablement, Secure Score management, and attack path analysis rather than generic cloud security hardening."],"familyIds":["cloud-security-posture-management"]},{"id":"securing-container-registry-images","summary":"Workflow to secure container registries by scanning images with Trivy and Grype, generating SBOMs with Syft, signing with Cosign/Sigstore, enforcing scan/signature gates in CI/CD, and applying registry-specific controls for ECR, ACR, and GCR.","primaryDomain":"cloud-security","domainTags":["container-security","supply-chain-security","registry-security"],"capabilityTags":["container-image-scanning","image-signing","sbom-creation","registry-hardening","ci-cd-security-gates"],"capabilityDetails":["Provides step-by-step workflows for scanning container images with Trivy and Grype.","Includes procedures for generating SBOMs with Syft and attaching them to images as OCI artifacts.","Covers Cosign key-based and keyless image signing, verification, and attestation.","Configures ECR, ACR, and GCR registry-level security controls.","Builds CI/CD pipelines with security gates that block unscanned or unsigned images."],"techniqueTags":["trivy-scanning","grype-scanning","syft-sbom","cosign-signing","keyless-signing","tag-immutability"],"techniqueDetails":["Uses Trivy for high-severity vulnerability scanning with JSON output and CI/CD exit codes.","Uses Grype as a complementary scanner for broader vulnerability database coverage.","Generates SPDX and CycloneDX SBOMs using Syft and attaches them with cosign attach sbom.","Signs images with Cosign using key-based or keyless OIDC workflows.","Configures ECR tag immutability and lifecycle policies to prevent overwrites and clean up untagged images."],"tools":["trivy","grype","cosign","syft","aws-cli","azure-cli","google-cloud-cli","github-actions"],"targetTypes":["container","cloud"],"role":"specialist-playbook","workflowFocus":["detection","validation","remediation"],"distinctiveFeatures":["Combines vulnerability scanning, SBOM generation, image signing, and registry-level controls into a single workflow.","Covers provider-specific configurations for ECR, ACR, and GCR.","Provides complementary scanning with both Trivy and Grype and integrates security gates into CI/CD pipelines."],"familyIds":["container-image-hardening-and-provenance"]},{"id":"securing-container-registry-with-harbor","summary":"Provides a step-by-step workflow to harden a Harbor container registry by configuring Trivy vulnerability scanning, Cosign image signing and content trust, project-level RBAC, immutable tag and retention policies, and OIDC authentication, with validation commands to confirm the controls are enforced.","primaryDomain":"cloud-security","domainTags":["container-security","supply-chain-security","vulnerability-management","access-control"],"capabilityTags":["vulnerability-scanning","image-signing","content-trust","rbac","retention-policy","oidc-integration"],"capabilityDetails":["Explains how to configure Harbor's integrated Trivy vulnerability scanning and prevent vulnerable images from being pulled.","Covers enabling content trust with Notary/Cosign and verifying image signatures.","Describes project-level RBAC roles and member management for access control.","Demonstrates configuring immutable tag rules and retention policies to manage image lifecycle."],"techniqueTags":["trivy-scanning","cosign-signing","harbor-rest-api","helm-deployment","oidc-authentication"],"techniqueDetails":["Uses Trivy for automated vulnerability scanning with severity thresholds and auto-scan on push.","Uses Cosign for signing and verifying container images to enforce content trust.","Configures Harbor security settings via REST API calls with curl.","Deploys Harbor via Helm with security-focused values.","Integrates OIDC for authentication and group-based authorization."],"tools":["harbor","trivy","cosign","helm","docker","curl"],"targetTypes":["container","kubernetes","cloud"],"role":"specialist-playbook","workflowFocus":["remediation","validation","analysis"],"distinctiveFeatures":["Focuses specifically on hardening a Harbor container registry rather than generic container or Kubernetes security.","Covers a comprehensive set of Harbor-specific security features (Trivy, Cosign, RBAC, immutable tags, retention, OIDC) in one workflow.","Includes practical validation commands to verify that vulnerability prevention and content trust are enforced."],"familyIds":["container-image-hardening-and-provenance"]},{"id":"securing-github-actions-workflows","summary":"A practical hardening guide for GitHub Actions workflows that mitigates supply chain attacks, reduces token privileges, prevents script injection, and enforces change controls, including an audit report template.","primaryDomain":"cloud-security","domainTags":["ci-cd-security","supply-chain-security","workflow-security"],"capabilityTags":["workflow-hardening","script-injection-prevention","token-permission-minimization","secret-protection","change-control-enforcement"],"capabilityDetails":["Pins all third-party actions to immutable SHA digests to prevent dependency tampering.","Minimizes GITHUB_TOKEN permissions to least privilege per job and workflow.","Prevents script injection by routing untrusted PR metadata through environment variables or actions/github-script.","Protects secrets by using GitHub Environments for approval and avoiding direct exposure in logs.","Enforces CODEOWNERS approval for changes to workflow files to maintain audit trails."],"techniqueTags":["sha-pinning","least-privilege-token","untrusted-input-escaping","environment-protection","codeowners-approval","oidc-federation"],"techniqueDetails":["References actions by immutable commit SHA to avoid mutable tag overwrite attacks.","Restricts GITHUB_TOKEN to read-only or specific scopes using workflow-level and job-level permissions blocks.","Uses environment variables or javascript actions to safely handle untrusted pull request content.","Leverages GitHub Environments to require manual approval before jobs access production secrets.","Relies on CODEOWNERS rules to require security team review for workflow modifications.","Uses OIDC tokens for authenticating to cloud providers, eliminating long-lived credentials."],"tools":["dependabot","stepsecurity-harden-runner","actionlint","allstar","scorecard"],"targetTypes":["cloud","source-code"],"role":"specialist-playbook","workflowFocus":["detection","remediation","reporting"],"distinctiveFeatures":["Focuses exclusively on GitHub Actions workflow hardening, not generic CI/CD security.","Provides concrete YAML examples contrasting insecure and secure patterns, including high-risk pull_request_target handling.","Includes a reusable GitHub Actions Security Audit report template for assessing workflow hygiene."],"familyIds":["ci-cd-workflow-security"]},{"id":"securing-helm-chart-deployments","summary":"Practical guide for securing Helm chart deployments: verifies chart signatures and provenance, renders and scans templates for misconfigurations, enforces pod security contexts, externalizes secret management, and scopes Helm RBAC in CI/CD pipelines.","primaryDomain":"cloud-security","domainTags":["container-security","kubernetes-security","supply-chain-security","configuration-security"],"capabilityTags":["helm-chart-signing","chart-provenance-verification","helm-template-scanning","security-context-enforcement","external-secrets-management","helm-rbac-scoping","ci-cd-security-pipeline"],"capabilityDetails":["Provides a workflow for signing and verifying Helm chart provenance with GPG.","Renders Helm templates and scans them for misconfigurations using kubesec, checkov, trivy, kube-linter, and helm lint.","Shows how to enforce hardened pod security contexts and resource limits in values.yaml.","Demonstrates external secrets management with ExternalSecret CRDs and helm-secrets instead of storing secrets in Helm values.","Includes RBAC Role and RoleBinding examples to scope Helm deployer permissions in a namespace.","Provides a CI/CD pipeline example that lints and scans charts on pull requests."],"techniqueTags":["gpg-signing","chart-verification","template-rendering","static-configuration-scanning","least-privilege-rbac","secrets-externalization","pod-security-context"],"techniqueDetails":["Uses GPG keys to sign Helm charts and verifies signatures before install.","Renders chart templates with helm template then scans generated YAML with multiple security tools.","Encodes security defaults in Helm values for runAsNonRoot, read-only root filesystem, dropped capabilities, and seccomp profiles.","Uses ExternalSecret or helm-secrets to keep sensitive values out of Helm values and version control.","Scopes RBAC to specific namespaces and resource verbs for Helm operations."],"tools":["helm","gpg","kubectl","kubesec","checkov","trivy","kube-linter","helm-secrets"],"targetTypes":["kubernetes","container","cloud"],"role":"specialist-playbook","workflowFocus":["validation","detection","analysis","remediation"],"distinctiveFeatures":["Focuses specifically on securing Helm chart deployments, not general Kubernetes security.","Covers the full Helm supply chain: chart provenance, template scanning, secure values, secrets management, and RBAC.","Provides actionable commands, configuration snippets, and a CI/CD pipeline example.","Defensive hardening and remediation oriented, unlike offensive Kubernetes exploitation playbooks."],"familyIds":["kubernetes-security-hardening"]},{"id":"securing-historian-server-in-ot-environment","summary":"Audits and hardens OT process historian servers by checking network exposure and authentication, applying vendor-specific hardening (PI Trust removal, firewall rules), and designing secure unidirectional DMZ replication with data diodes or PI-to-PI connectors.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","historian-security","industrial-control"],"capabilityTags":["security-audit","server-hardening","secure-replication-design"],"capabilityDetails":["Provides a workflow for auditing historian server security configuration including network exposure, authentication, and data integrity protections.","Provides PowerShell commands and PI SMT guidance for hardening PI Server by disabling insecure authentication and configuring firewall rules.","Provides architecture guidance for secure unidirectional data replication from OT to DMZ using data diodes or PI-to-PI connectors."],"techniqueTags":["port-scanning","firewall-configuration","authentication-migration","unidirectional-data-replication"],"techniqueDetails":["Uses TCP socket connections to check for exposed historian services and flag unnecessary ports.","Applies Windows Firewall rules to restrict access to OT zones and DMZ, and block HTTP.","Migrates legacy PI Trust authentication to Windows Integrated Security and disables default accounts.","Deploys data diodes or PI-to-PI replication for one-way data flow from OT historian to DMZ historian."],"tools":["python","powershell","PI SMT","Waterfall Security"],"targetTypes":["windows-host","database"],"role":"specialist-playbook","workflowFocus":["analysis","remediation","reporting"],"distinctiveFeatures":["Specialized in OT process historian security rather than general network hardening.","Covers unidirectional DMZ replication to protect OT data integrity.","Emphasizes migration from legacy PI Trust to Windows Integrated Security."],"familyIds":["ot-ics-hardening-and-remote-access"]},{"id":"securing-kubernetes-on-cloud","summary":"Delivers a comprehensive hardening playbook for managed Kubernetes clusters (EKS, AKS, GKE), covering Pod Security Standards, cloud workload identity, network policies, RBAC least privilege, image admission controls, and runtime security monitoring with practical configuration examples.","primaryDomain":"cloud-security","domainTags":["cloud-security","kubernetes-security","container-security","managed-kubernetes","eks","aks","gke"],"capabilityTags":["kubernetes-hardening","pod-security-enforcement","network-policy-configuration","workload-identity-setup","rbac-least-privilege","image-admission-control","runtime-security-monitoring"],"capabilityDetails":["Provides a six-step workflow to harden managed Kubernetes clusters, including namespace-level Pod Security Standards, cloud-native workload identity, least-privilege network and RBAC policies, image admission validation, and runtime threat detection."],"techniqueTags":["pod-security-admission-labels","iam-role-for-service-account","gke-workload-identity","aks-managed-identity","kubernetes-network-policy","role-scoped-rbac","kyverno-policy","falco-runtime-detection"],"techniqueDetails":["Applies namespace-level Pod Security Admission labels; binds Kubernetes service accounts to cloud IAM roles (IRSA, GKE Workload Identity, AKS Managed Identity); uses NetworkPolicy for default-deny and explicit allow rules; scopes RBAC with Roles and RoleBindings; enforces image registries and digests via Kyverno; deploys Falco for kernel-level runtime anomaly detection."],"tools":["kubectl","helm","eksctl","gcloud","az","Falco","Kyverno","kube-bench","Trivy","Calico","Cilium"],"targetTypes":["kubernetes","cloud","container"],"role":"specialist-playbook","workflowFocus":["remediation","detection","analysis"],"distinctiveFeatures":["Focuses specifically on managed Kubernetes on EKS, AKS, and GKE with cloud-provider-specific workload identity mechanisms (IRSA, GKE Workload Identity, AKS Managed Identity).","Provides concrete YAML and CLI examples for Pod Security Standards, Network Policies, RBAC scoping, Kyverno admission controls, and Falco runtime monitoring.","Includes both hardening steps and an assessment output template (kube-bench report), plus a cryptominer incident scenario with remediation approach."],"familyIds":["kubernetes-security-hardening"]},{"id":"securing-remote-access-to-ot-environment","summary":"Provides a design and configuration workflow for securing remote access to OT/ICS environments using DMZ jump servers, PAM, MFA, session recording, and vendor access controls, with alignment to IEC 62443 and NERC CIP-005.","primaryDomain":"network-security","domainTags":["ot-security","ics-security","remote-access","dmz-security"],"capabilityTags":["ot-remote-access-design","jump-server-configuration","privileged-access-management","multi-factor-authentication","session-recording","vendor-access-control"],"capabilityDetails":["Provides a step-by-step design workflow for OT/ICS remote access architecture using DMZ intermediate systems and jump servers.","Includes a Python reference implementation for managing remote access sessions with role-based access policies, MFA verification, and session recording.","Covers integration with PAM solutions such as CyberArk and BeyondTrust, and MFA with Duo Security.","Implements vendor-specific controls including approval workflows, co-attendance, time-limited access, and session monitoring."],"techniqueTags":["defense-in-depth","dmz-intermediate-system","session-brokering","role-based-access-control","time-limited-access","co-attendance"],"techniqueDetails":["Uses a DMZ intermediate system (Level 3.5) to terminate external connections and broker new sessions to OT systems, preventing direct network access.","Enforces role-based access policies per user role with allowed targets, protocols, and maximum session durations.","Implements vendor-specific controls including time-limited access windows, co-attendance, and real-time session monitoring.","Requires MFA verification for session activation and records all session activity for audit trails."],"tools":["CyberArk Privileged Access Security","BeyondTrust Privileged Remote Access","Claroty Secure Remote Access","Duo Security"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["remediation","reporting"],"distinctiveFeatures":["OT-specific remote access security design with DMZ intermediate system (Level 3.5) and jump server brokering, rather than general IT VPN or remote access.","Includes vendor access governance controls such as approval workflows, co-attendance, and time-limited sessions.","Aligns with IEC 62443 and NERC CIP-005 compliance frameworks and provides a Python reference implementation for session management and policy enforcement."],"familyIds":["ot-ics-hardening-and-remote-access"]},{"id":"securing-serverless-functions","summary":"Provides a multi-cloud hardening workflow for serverless functions covering least-privilege IAM, secrets management, dependency scanning, input validation, endpoint authentication, and runtime monitoring, with practical commands and a reporting template.","primaryDomain":"cloud-security","domainTags":["serverless-security","aws-lambda","azure-functions","google-cloud-functions"],"capabilityTags":["least-privilege-iam","secrets-management","dependency-vulnerability-scanning","input-validation","runtime-monitoring"],"capabilityDetails":["Provides a six-step hardening workflow for serverless functions, covering IAM role least privilege, secrets management integration, dependency scanning, input validation, function endpoint authentication, and runtime monitoring."],"techniqueTags":["iam-policy-hardening","secret-remediation","software-composition-analysis","static-analysis","json-schema-validation","parameterized-queries"],"techniqueDetails":["Uses scoped IAM policies instead of broad managed policies.","Retrieves secrets via AWS Secrets Manager with caching rather than plaintext environment variables.","Integrates Snyk, npm audit, and pip-audit for dependency scanning.","Uses JSON Schema validation and parameterized queries to prevent injection.","Configures GuardDuty Lambda protection and structured logging for runtime monitoring."],"tools":["aws-cli","boto3","snyk","npm-audit","pip-audit","trivy","semgrep","guardduty"],"targetTypes":["cloud","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","remediation"],"distinctiveFeatures":["Focused specifically on securing serverless compute platforms across AWS, Azure, and GCP, including IAM roles, secrets, dependencies, input validation, endpoint auth, and monitoring in a single workflow.","Includes a concrete serverless security assessment report template with findings and remediation examples."],"familyIds":["serverless-security"]},{"id":"security_reporter","summary":"A report-generation assistant that converts vulnerability identifiers, names, or scanner outputs into professional, standardized vulnerability analysis reports with CVSS scoring, remediation guidance, and industry-specific templates.","primaryDomain":"reporting","domainTags":["vulnerability-reporting","security-report-generation","cvss-scoring","vulnerability-management"],"capabilityTags":["vulnerability-report-generation","template-based-reporting","cvss-calculation","remediation-suggestion","scan-data-parsing"],"capabilityDetails":["Parses vulnerability identifiers (CVE IDs), vulnerability names, and scanner exports to extract key information.","Generates standardized vulnerability analysis reports with background, description, principle, exploit conditions, and remediation requirements.","Supports multiple industry-specific report templates including finance, healthcare, government, manufacturing, education, energy, transportation, and penetration testing.","Automatically computes CVSS 3.1 scores and provides risk prioritization recommendations.","Supports batch generation of aggregate reports for multiple vulnerabilities with an executive summary."],"techniqueTags":["cve-enrichment","cvss-3-1-scoring","template-matching","standardized-description","remediation-mapping"],"techniqueDetails":["Uses predefined templates located in the templates directory to structure reports consistently.","Maps vulnerability types to standardized descriptions and remediation recommendations.","Calculates CVSS scores using CVSS 3.1 rules based on vulnerability characteristics and impact.","Applies a data import to one-click report generation workflow for semi-automation."],"tools":["Nessus","AWVS","Burp Suite"],"targetTypes":["other"],"role":"reporting","workflowFocus":["analysis","reporting","remediation"],"distinctiveFeatures":["Focuses exclusively on the report-writing phase of vulnerability management, not on vulnerability discovery or exploitation.","Provides industry-specific report templates (finance, healthcare, government, etc.) that are absent from general pentesting methodologies.","Automates CVSS 3.1 scoring and standardizes vulnerability descriptions for consistent professional reports.","Supports generating aggregate multi-vulnerability reports with prioritized remediation timelines."],"familyIds":["pentest-vulnerability-report-generation"]},{"id":"session-reliability","summary":"Durable task tracking for non-trivial, multi-step project work. Use proactively for any software project, feature, bug fix, refactor, migration, investigation, or automation that touches files, runs commands or tools, modifies external state, spans multiple turns, or may be interrupted. Also use when starting or continuing multi-step work, and when the user asks to continue, resume, recover, pick up, or check progress on prior work — meaning unfinished work from an earlier session, not a conversational thread. Do not wait for the user to explicitly ask for persistence. Not for a single one-off file conversion, a one-line question, or small talk.","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"skill-creator","summary":"Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"smart-contract-vulnerabilities","summary":"Expert playbook for auditing Solidity/EVM smart contracts, covering major vulnerability classes with attack patterns, mitigations, tooling, and a decision tree.","primaryDomain":"source-code-security","domainTags":["smart-contract","evm","solidity"],"capabilityTags":["smart-contract-auditing","vulnerability-detection","attack-pattern-analysis","secure-code-review"],"capabilityDetails":["Provides an expert playbook for auditing Solidity/EVM smart contracts, detailing attack techniques and mitigations for reentrancy, integer overflow, access control, delegatecall, randomness manipulation, flash loans, signature replay, front-running/MEV, and CREATE2 exploitation."],"techniqueTags":["reentrancy","integer-overflow","delegatecall","signature-replay","front-running","create2"],"techniqueDetails":["Covers classic, cross-function, cross-contract, and read-only reentrancy; integer overflow/underflow including SafeMath bypass; delegatecall storage layout and selector collisions; signature replay including cross-chain and EIP-712 issues; front-running/MEV sandwich attacks; CREATE2 and metamorphic contract exploitation."],"tools":["slither","mythril","echidna","foundry","hardhat","certora","4naly3er"],"targetTypes":["source-code"],"role":"specialist-playbook","workflowFocus":["detection","analysis","exploitation","remediation"],"distinctiveFeatures":["Covers a comprehensive set of EVM-specific attack patterns (reentrancy variants, storage collisions, CREATE2, MEV) beyond typical source code audits","Includes a practical decision tree and toolchain recommendations tailored to smart contract auditing"],"familyIds":["smart-contract-security-auditing"]},{"id":"solve-challenge","summary":"First-pass CTF challenge triage and dispatcher that categorizes challenges by file type, description keywords, and service behavior, then routes to specialized ctf-* skills; includes CTFd API integration and multi-category pivot guidance.","primaryDomain":"ctf","domainTags":["ctf","challenge-orchestration"],"capabilityTags":["ctf-triage","challenge-categorization","skill-routing","flag-validation","ctf-recon"],"capabilityDetails":["Provides first-pass triage for CTF challenges, identifying the dominant category and routing to specialized ctf-* skills.","Includes reconnaissance techniques for files, remote services, URLs, and challenge descriptions.","Supports CTFd API-driven navigation when the platform is detected.","Provides multi-category pivoting guidance and flag validation heuristics."],"techniqueTags":["file-type-analysis","keyword-categorization","service-behavior-analysis","ctfd-api-detection","cross-category-pivoting"],"techniqueDetails":["Uses file extensions and magic bytes to infer challenge category.","Matches challenge description keywords against category keyword lists.","Probes remote services to distinguish pwn/web/crypto/misc categories.","Detects CTFd platform via /api/v1/ and /themes/core/ endpoints.","Suggests re-examining assumptions and invoking alternate category skills when stuck."],"tools":["bash","file","strings","xxd","binwalk","checksec","curl","netcat","python3","pwntools","grep"],"targetTypes":["ctf"],"role":"router","workflowFocus":["reconnaissance","analysis","detection","navigation"],"distinctiveFeatures":["Acts as a dispatcher/router that classifies any CTF challenge and delegates to specialized ctf-* skills rather than solving one category directly.","Includes CTFd platform detection and API-token-driven challenge navigation.","Provides explicit multi-category pivot patterns (e.g., forensics+crypto, web+reverse)."],"familyIds":["ctf-challenge-triage-orchestration"]},{"id":"sqli-sql-injection","summary":"Advanced SQL injection playbook for detecting, validating, and exploiting SQLi across MySQL, MSSQL, Oracle, and PostgreSQL, including blind inference, OOB exfiltration, second-order injection, filter/WAF bypass, and escalation to OS-level execution.","primaryDomain":"injection","domainTags":["sql-injection","database-security","web-security"],"capabilityTags":["sql-injection-testing","database-fingerprinting","blind-injection-validation","out-of-band-exfiltration","waf-bypass","second-order-injection"],"capabilityDetails":["Provides a database-specific SQL injection exploitation playbook covering detection, UNION extraction, blind inference, OOB exfiltration, second-order injection, filter/WAF bypass, and escalation to OS-level execution."],"techniqueTags":["boolean-based-sqli","time-based-sqli","union-based-sqli","error-based-sqli","out-of-band-sqli","second-order-sqli","filter-evasion","parameterized-query-bypass"],"techniqueDetails":["Covers boolean and time-based blind inference, UNION-based data extraction, OOB exfiltration via DNS/HTTP/SMB, second-order injection, and filter/WAF evasion; includes DB-specific payloads for MySQL, MSSQL, Oracle, and PostgreSQL."],"tools":["sqlmap"],"targetTypes":["web-application","api","database"],"role":"specialist-playbook","workflowFocus":["detection","enumeration","validation","exploitation"],"distinctiveFeatures":["Unlike generic SQLi scanners, this playbook provides DB-specific advanced exploitation paths (OOB, second-order, stored procedures, WAF bypass) and explicitly routes to companion scenario and SQLMap guides; it assumes baseline SQLi knowledge and covers parameterized query bypass scenarios."],"familyIds":["sql-injection"]},{"id":"src-6k-hunting","summary":"Chinese-ecosystem SRC vulnerability hunting workflow with seed-queue asset expansion, a fingerprint short-table routing into 49 technique modules, enforcement-grade minimal-harm validation rules, and a gated Chinese vulnerability report format; complementary to payload-library-driven hunting skills.","primaryDomain":"general-pentesting","domainTags":["web-security","api-security","source-code-security"],"capabilityTags":["src-hunting-workflow","chinese-src-reporting","minimal-harm-validation","short-table-technique-routing","seed-queue-asset-expansion","white-box-audit-pointer"],"capabilityDetails":["Provides a Chinese-ecosystem SRC hunting workflow: seed-queue asset expansion with one-seed-at-a-time closure, an entry short-table that fingerprints target features and routes to 49 knowledge modules, minimal-harm validation rules for write-IDOR (add-then-delete-own), and a strict two-table Chinese vulnerability report format (severity gate, anonymous-gate, key-verification-gate).","Bundles agent-tool-execution testing (unauthenticated chat endpoints with command tools), cloud-IDE/Codex RPC RCE chains, object-storage STS/policy abuse, and JS reverse-engineering for encrypted-parameter interface discovery as load-bearing technique modules."],"techniqueTags":["seed-queue-loop","short-table-fingerprint-routing","object-graph-id-swap","read-differential-first","add-then-delete-own-write-testing","key-verification-gate","js-key-extraction"],"techniqueDetails":["Enumerates brand/business/subsidiary seed domains into a persisted queue, then for each seed searches, deduplicates, prunes dead surfaces and exhausts live assets before moving on; on entry, matches target features (user systems, file upload, GraphQL, OAuth, payment logic) against a technique short-table that points into per-class knowledge modules; write-authorization testing follows an add-own-then-delete-own sequence with explicit bans on logout/asset-loss/batch operations.","Cryptographic-ID endpoints are attacked by extracting RSA public keys from JS and encrypting adjacent sequence numbers; leaked cloud keys must pass a fake-value-then-identity proof gate before being reportable."],"tools":["fofa","nuclei","js-reverse","burp-suite"],"targetTypes":["web-application","api","cloud","source-code"],"role":"workflow","workflowFocus":["reconnaissance","enumeration","detection","validation","exploitation","reporting"],"distinctiveFeatures":["Chinese SRC ecosystem specialization: domestic enterprise/government/education/medical targets, Chinese-language report format with severity/anonymity/key gates, and FOFA-based asset测绘 rhythm; technique short-table of 'recognize A → strike B → what counts as hit → false-positive' rows distilled from real engagements; minimal-harm rules are enforcement-grade (never log out user sessions, never batch-modify, restore what you changed); includes conversation-endpoint tool-execution and cloud-IDE RPC chains absent from most Western bug-bounty skills."],"familyIds":["security-test-routing-and-orchestration","attack-surface-discovery"]},{"id":"src-hunter","summary":"A workflow skill for SRC/bug bounty hunting that guides users through intake, passive recon, active enumeration, vulnerability hunting, and reporting, with checkpoint gates, signal-based routing to 19 specialized playbooks, and a large curated payload/case library.","primaryDomain":"general-pentesting","domainTags":["web-security","api-security","injection","reconnaissance","post-exploitation"],"capabilityTags":["bug-bounty-workflow","src-hunting","vulnerability-playbook-routing","checkpoint-gated-methodology","waf-bypass-guidance","evidence-preservation"],"capabilityDetails":["Provides a checkpoint-gated workflow for SRC/bug bounty engagements, covering intake, passive recon, active enumeration, vulnerability hunting, and reporting.","Routes to specialized playbooks for 19 vulnerability classes based on observed target signals, with mandatory reads to avoid hallucinated payloads."],"techniqueTags":["phase-based-methodology","signal-based-playbook-routing","passive-recon","active-enumeration","waf-bypass-decision-tree","evidence-chain-validation"],"techniqueDetails":["Uses target fingerprints and entry-point signals to select a specific attack playbook, with conditional reads to methodology files on WAF/EDR encounters.","Enforces evidence discipline by requiring saved HTTP traffic/screenshots before a finding can enter reporting."],"tools":["burp-suite","frida","adb"],"targetTypes":["web-application","api","mobile","database","network","other"],"role":"workflow","workflowFocus":["reconnaissance","enumeration","detection","validation","exploitation","reporting"],"distinctiveFeatures":["Checkpoint-gated 5-phase workflow with mandatory outputs before advancing, unlike freeform methodology playbooks.","Anti-hallucination hard constraints: payloads and HackerOne/WooYun case citations must be read from local files before use.","Signal-based routing to 19 specialized vulnerability playbooks, including verticals for Chinese OA products and banking/telecom industries.","Includes a large empirical case library (2887 HackerOne reports and WooYun statistics) for prioritization and reporting."],"familyIds":["security-test-routing-and-orchestration"]},{"id":"ssrf-server-side-request-forgery","summary":"Expert playbook for discovering, confirming, and exploiting SSRF vulnerabilities, including URL filter bypasses, cloud metadata access, internal service attack (Redis, Docker, Elasticsearch), and blind SSRF detection.","primaryDomain":"web-security","domainTags":["ssrf","cloud-security","internal-network"],"capabilityTags":["ssrf-detection","filter-bypass","cloud-metadata-access","internal-service-exploitation","blind-ssrf-testing"],"capabilityDetails":["Provides a comprehensive workflow for identifying SSRF-prone parameters, confirming SSRF via out-of-band or timing, bypassing URL filters, accessing cloud metadata, exploiting internal services, and detecting blind SSRF."],"techniqueTags":["url-filter-bypass","dns-rebinding","ip-obfuscation","gopher-protocol","dict-protocol","cloud-metadata-endpoint","blind-ssrf-detection"],"techniqueDetails":["Uses alternative IP representations, IPv6, DNS rebinding, and redirect chains to bypass host allowlists.","Leverages gopher:// and dict:// schemes to interact with internal TCP services like Redis, Elasticsearch, and Docker.","Targets cloud metadata endpoints (AWS, GCP, Azure, Alibaba, Kubernetes) to retrieve credentials and tokens.","Detects blind SSRF through external callbacks and timing analysis."],"tools":["burp-collaborator","interactsh","gopherus"],"targetTypes":["web-application","api","network","cloud","database","container","kubernetes"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","exploitation"],"distinctiveFeatures":["Comprehensive collection of URL parser bypass and IP obfuscation techniques","Extensive cloud metadata endpoint catalog across major cloud providers","Detailed gopher/dict payloads for exploiting internal services (Redis, Docker, Elasticsearch)","Includes blind SSRF detection methodology and decision tree","References companion scenario files for real-world CVE chains (WebLogic, Kubernetes) and DNS rebinding deep dives"],"familyIds":["ssrf-exploitation"]},{"id":"ssti-server-side-template-injection","summary":"Expert SSTI playbook covering polyglot detection, engine fingerprinting, RCE chains for multiple template engines, sandbox bypasses, blind SSTI testing, and Flask debug PIN calculation.","primaryDomain":"injection","domainTags":["template-injection","web-security","server-side-rendering"],"capabilityTags":["ssti-detection","template-engine-fingerprinting","ssti-exploitation","sandbox-bypass","blind-ssti-testing"],"capabilityDetails":["Provides polyglot probes to distinguish SSTI from XSS, mathematical probes for engine fingerprinting, and RCE chains for Jinja2, FreeMarker, Twig, Velocity, ERB, Thymeleaf, and AngularJS client-side template injection, including sandbox bypass techniques and blind SSTI testing via boolean/time/OOB methods, plus Flask debug PIN calculation."],"techniqueTags":["polyglot-probing","mro-subclass-traversal","attr-filter-bypass","angular-sandbox-escape","flask-pin-calculation","blind-ssti","time-based-detection","dns-oob"],"techniqueDetails":["Uses server-side evaluation of arithmetic expressions to confirm template injection, engine-specific payloads to achieve RCE, MRO subclass traversal to escape Jinja2 sandboxes, hex/unicode encoding to bypass attribute filters, AngularJS prototype manipulation to escape client-side sandboxes, and boolean/time/DNS side channels for blind detection."],"tools":[],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","post-exploitation"],"distinctiveFeatures":["Specializes entirely in server-side template injection across a broad set of templating engines, including polyglot detection, sandbox escape chains, client-side AngularJS injection, and Flask debug PIN calculation, distinguishing it from generic injection or XSS playbooks."],"familyIds":["server-side-template-injection-testing"]},{"id":"stack-overflow-and-rop","summary":"Expert playbook for exploiting stack buffer overflows on Linux userland binaries, covering ret2libc, ROP chain construction, ret2csu, ret2dlresolve, SROP, stack pivoting, and canary bypass with a tool reference and decision tree.","primaryDomain":"binary-exploitation","domainTags":["stack-overflow","return-oriented-programming","linux-binary-exploitation"],"capabilityTags":["stack-buffer-overflow-exploitation","rop-chain-construction","return-address-overwrite","stack-pivoting","canary-bypass"],"capabilityDetails":["Exploits stack buffer overflows to overwrite return addresses and hijack control flow.","Constructs ROP chains using gadgets to bypass NX, ASLR, and PIE protections.","Executes advanced code-reuse techniques including ret2libc, ret2csu, ret2dlresolve, and SROP.","Performs stack pivoting to redirect execution when overflow space is limited.","Bypasses stack canaries using brute-force, format string leaks, or TLS overwrite."],"techniqueTags":["return-to-libc","return-to-csu","return-to-dl-resolve","sigreturn-oriented-programming","one-gadget","partial-overwrite","leave-ret-pivot","canary-brute-force"],"techniqueDetails":["Return-to-libc redirects execution to libc functions like system, using pop rdi gadgets on x86-64.","Ret2csu leverages __libc_csu_init to call functions with up to three arguments when pop rdx is unavailable.","Ret2dlresolve forges ELF dynamic linking structures to resolve arbitrary functions without a libc leak.","SROP uses the sigreturn syscall to set all registers from a fake signal frame, enabling execve with limited gadgets.","Stack pivoting moves the stack pointer to attacker-controlled memory using leave;ret, xchg rsp, or pop rsp.","Canary bypass methods include brute-forcing fork servers, leaking via format strings, and overwriting TLS stack_guard."],"tools":["pwntools","ROPgadget","ropper","one_gadget","checksec","xrop"],"targetTypes":["binary","linux-host"],"role":"specialist-playbook","workflowFocus":["analysis","exploitation"],"distinctiveFeatures":["Comprehensive stack overflow and ROP playbook covering advanced code-reuse techniques beyond basic ret2libc, including ret2csu, ret2dlresolve, SROP, and stack pivoting.","Provides a decision tree guiding technique selection based on protections, available gadgets, and leak capabilities.","Includes detailed gadget patterns and concrete pwntools exploit snippets for each technique.","Distinct from heap exploitation, format string exploitation, and arbitrary write skills by focusing specifically on stack-based control flow hijacking."],"familyIds":["stack-overflow-and-code-reuse"]},{"id":"steganography-techniques","summary":"Provides a file-type-driven steganography detection and extraction playbook covering images, audio, files, and text, with tool-specific commands and a decision tree for recovering hidden data.","primaryDomain":"forensics","domainTags":["steganography","data-hiding","media-forensics","file-analysis"],"capabilityTags":["steganography-detection","hidden-data-extraction","media-file-analysis","metadata-forensics"],"capabilityDetails":["Provides a systematic workflow for detecting and extracting hidden data from images, audio, files, and text using file-type-specific tools and techniques."],"techniqueTags":["lsb-steganography","png-chunk-analysis","jpeg-dct-steganography","exif-metadata-analysis","spectrogram-analysis","polyglot-file-analysis","ntfs-alternate-data-streams","unicode-steganography"],"techniqueDetails":["Covers LSB bit-plane extraction, PNG hidden chunk and dimension/CRC correction, JPEG DCT coefficient steganography, EXIF metadata extraction, spectrogram/DTMF/morse audio analysis, polyglot and appended-data detection, NTFS ADS, and whitespace/zero-width/homoglyph text encoding."],"tools":["zsteg","StegSolve","stegoveritas","pngcheck","steghide","stegcracker","stegseek","exiftool","binwalk","foremost","WavSteg","stegsnow","sox","multimon-ng"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","analysis"],"distinctiveFeatures":["File-type-driven decision tree and tool-specific extraction workflows spanning image, audio, file, and text stego; includes PNG dimension/CRC correction, JPEG DCT, NTFS ADS, and Unicode zero-width/homoglyph detection."],"familyIds":["steganography-detection-and-analysis"]},{"id":"subdomain-takeover","summary":"Playbook that walks through detecting and exploiting subdomain takeover via dangling CNAME/NS/MX records, including provider-specific fingerprinting, claim procedures for AWS S3/GitHub Pages/Heroku, and post-takeover impact assessment.","primaryDomain":"web-security","domainTags":["subdomain-takeover","dns-misconfiguration","cloud-security"],"capabilityTags":["subdomain-takeover-detection","subdomain-takeover-exploitation","dangling-dns-detection","dns-record-claim"],"capabilityDetails":["Provides a workflow for detecting and exploiting subdomain takeover via dangling CNAME, NS, and MX records, including service provider fingerprinting and resource claim procedures."],"techniqueTags":["cname-takeover","ns-takeover","mx-takeover","dns-reconnaissance","provider-fingerprinting"],"techniqueDetails":["Uses DNS record inspection and HTTP fingerprint matching to identify unclaimed external resources, then registers or claims the resource to gain control of the subdomain."],"tools":["subjack","nuclei","dnsreaper","subzy","dig","curl","amass","subfinder"],"targetTypes":["web-application","cloud","other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","exploitation","remediation"],"distinctiveFeatures":["Covers CNAME, NS, and MX takeover with a provider-specific fingerprint table and step-by-step claim procedures; emphasizes distinguishing mere CNAME existence from actual takeover potential through resource claimability."],"familyIds":["subdomain-takeover-testing"]},{"id":"symbolic-execution-tools","summary":"Expert-level playbook for using angr, Z3, and Unicorn to symbolically execute and constrain-solve binary programs, enabling automated CTF reversing, key recovery, and check bypassing.","primaryDomain":"reverse-engineering","domainTags":["symbolic-execution","constraint-solving","binary-analysis","ctf-reversing"],"capabilityTags":["binary-symbolic-execution","constraint-solving","code-emulation","angr-automation","z3-modeling"],"capabilityDetails":["Provides end-to-end workflows for using angr, Z3, and Unicorn in CTF binary solving.","Includes reusable code patterns for symbolic input, function hooking, and path exploration."],"techniqueTags":["angr-exploration","simprocedure-hooking","symbolic-variables","z3-bitvector-solving","unicorn-emulation","path-explosion-management","hybrid-execution"],"techniqueDetails":["Uses angr's explore(find=, avoid=) to automatically discover success paths.","Replaces library functions with SimProcedures to avoid symbolic complexity.","Models inputs as claripy bitvectors and constrains them for solver evaluation.","Uses Z3 bitvector arithmetic and optimization for key/equation recovery.","Emulates code regions with Unicorn to observe register/memory state.","Manages path explosion via constraints, avoids, hooking, and veritesting."],"tools":["angr","z3","unicorn","qiling"],"targetTypes":["binary","ctf"],"role":"specialist-playbook","workflowFocus":["analysis","exploitation"],"distinctiveFeatures":["Unified decision tree for selecting angr, Z3, or Unicorn based on challenge type.","Includes practical path-explosion management and function-hooking patterns.","Provides both theoretical concepts and ready-to-use script patterns for CTF challenges."],"familyIds":["runtime-instrumentation-and-emulation"]},{"id":"symmetric-cipher-attacks","summary":"An advanced playbook for attacking symmetric encryption, with practical Python implementations and decision guidance for CBC padding oracle, CBC bit flipping, ECB cut-and-paste/byte-at-a-time, stream cipher key reuse, LFSR recovery, RC4 biases, and meet-in-the-middle attacks.","primaryDomain":"ctf","domainTags":["cryptography","symmetric-encryption","block-cipher","stream-cipher"],"capabilityTags":["padding-oracle-exploitation","ecb-cut-and-paste","cbc-bit-flipping","stream-cipher-key-reuse","meet-in-the-middle","lfsr-state-recovery","rc4-bias-analysis"],"capabilityDetails":["Provides a decision-tree-driven playbook for attacking symmetric ciphers, including CBC padding oracle exploitation, CBC bit flipping, ECB cut-and-paste and byte-at-a-time decryption, stream cipher key reuse, LFSR/LCG state recovery, RC4 bias exploitation, and meet-in-the-middle attacks on double encryption.","Includes reusable Python implementations for padding oracle attacks, ECB byte-at-a-time decryption, CBC bit flipping, two-time pad analysis, single-byte and repeating-key XOR cracking, Berlekamp-Massey LFSR recovery, and meet-in-the-middle key recovery.","Offers a quick-selection table mapping observable ciphertext behaviors to the appropriate attack, plus a detailed decision tree for choosing among ECB, CBC, stream cipher, PRNG, double encryption, and RC4 attack paths."],"techniqueTags":["cbc-padding-oracle","ecb-detection","cbc-bit-flipping","two-time-pad","single-byte-xor","repeating-key-xor","berlekamp-massey","meet-in-the-middle"],"techniqueDetails":["CBC padding oracle attack decrypts ciphertext by modifying the previous ciphertext block and detecting valid PKCS#7 padding via an oracle.","CBC bit flipping flips plaintext bits by altering the previous ciphertext block, leveraging the XOR relationship in CBC decryption.","ECB attacks include detecting identical ciphertext blocks, reordering blocks for cut-and-paste, and performing byte-at-a-time decryption when an oracle encrypts user-controlled input appended with a secret.","Stream cipher attacks cover two-time pad key reuse (crib dragging), single-byte XOR brute force with frequency analysis, repeating-key XOR key-length detection via Hamming distance, and Berlekamp-Massey LFSR state/polynomial recovery.","RC4 attacks rely on statistical keystream biases for plaintext recovery, including initial byte bias, FMS, NOMORE, and invariance weaknesses.","Meet-in-the-middle attack on double encryption trades memory for time: encrypt known plaintext under all possible keys, then decrypt ciphertext under all possible second keys and match intermediates."],"tools":["PadBuster","xortool","CyberChef","SageMath","pycryptodome","hashcat","custom-python"],"targetTypes":["ctf","web-application","other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","exploitation"],"distinctiveFeatures":["Covers the full spectrum of symmetric cipher attacks in one expert playbook, unlike skills focused on RSA, hashes, or lattice crypto.","Includes both a quick-selection table and a detailed decision tree that maps observable ciphertext behaviors to specific attacks.","Provides copy-paste-ready Python implementations for padding oracle, byte-at-a-time ECB, bit flipping, stream cipher key reuse, LFSR recovery, and meet-in-the-middle.","Explicitly distinguishes between ECB and CBC attack strategies, addressing a common weakness in base-model responses."],"familyIds":["ctf-cryptanalysis"]},{"id":"testing-android-intents-for-vulnerabilities","summary":"A specialist playbook for testing Android app inter-process communication via intents, covering enumeration and exploitation of exported activities, services, broadcast receivers, and content providers using Drozer, ADB, and Frida, with focus on intent injection, unauthorized access, broadcast sniffing, pending intent hijacking, and provider data leakage.","primaryDomain":"mobile-security","domainTags":["android","ipc-security","intent-security"],"capabilityTags":["android-ipc-testing","exported-component-testing","intent-injection-testing","content-provider-testing","pending-intent-testing"],"capabilityDetails":["Provides a workflow for enumerating exported Android components and testing them for IPC vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage."],"techniqueTags":["component-enumeration","intent-injection","broadcast-receiver-attacks","content-provider-injection","pending-intent-hijacking"],"techniqueDetails":["Uses Drozer modules to enumerate an app's attack surface and invoke activities, services, and receivers.","Uses ADB commands to launch activities with crafted intents and send broadcasts.","Uses Frida hooks to detect mutable PendingIntents and log intent data.","Uses content provider query injection and path traversal to test for data leakage."],"tools":["drozer","adb","frida","apktool","intent-fuzzer"],"targetTypes":["mobile"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","exploitation"],"distinctiveFeatures":["Covers all four exported Android component types (activities, services, receivers, providers) in a single IPC-focused workflow.","Uses Drozer as the primary assessment framework alongside Frida for PendingIntent mutability checks.","Includes concrete content provider SQL injection and path traversal commands specific to Android IPC.","Distinct from general Android app analysis by concentrating on inter-process communication attack surface rather than static or network security."],"familyIds":["mobile-app-entry-point-security-testing"]},{"id":"testing-api-authentication-weaknesses","summary":"Provides a hands-on workflow to discover and validate broken authentication in REST APIs, including JWT attacks, unauthenticated endpoint discovery, token lifecycle tests, and credential policy checks (OWASP API2:2023).","primaryDomain":"api-security","domainTags":["authentication","jwt","session-management","api-security"],"capabilityTags":["api-authentication-testing","jwt-security-testing","unauthorized-endpoint-detection","token-lifecycle-testing","password-policy-testing"],"capabilityDetails":["Provides a structured workflow for identifying and testing API authentication mechanisms, including JWT, API keys, session cookies, and OAuth.","Includes executable Python scripts for detecting unauthenticated endpoints and testing JWT weaknesses such as alg:none, claim modification, and weak HMAC secrets.","Covers token lifecycle testing including post-logout validity, refresh token reuse, and token leakage in URLs.","Includes password policy enforcement checks and account enumeration tests via login response differences."],"techniqueTags":["jwt-alg-none","jwt-claim-manipulation","jwt-secret-bruteforce","token-in-url-leakage","refresh-token-reuse","account-enumeration","weak-password-enforcement"],"techniqueDetails":["Tests JWT with alg:none and modified payloads to see if the server accepts unsigned or tampered tokens.","Attempts to brute-force weak HMAC JWT secrets using common secret wordlists.","Checks if tokens are accepted in query parameters, potentially leaking into logs or referrer headers.","Validates refresh token rotation by reusing the same refresh token.","Identifies account enumeration by comparing login responses for valid and invalid usernames.","Tests password policy by submitting weak passwords to registration/change endpoints."],"tools":["Burp Suite","Python","jwt_tool","hashcat","Hydra","Nuclei"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","analysis"],"distinctiveFeatures":["End-to-end workflow specifically for API authentication weaknesses, covering JWT attacks, unauthenticated endpoint discovery, token lifecycle, and password policy in one skill.","Includes detailed Python scripts for each test phase, making it directly executable rather than just conceptual.","Distinct from general API security scanning by focusing on the OWASP API2:2023 Broken Authentication category with practical bypass testing."],"familyIds":["api-authentication-and-token-security"]},{"id":"testing-api-for-broken-object-level-authorization","summary":"Systematic REST/GraphQL API testing playbook for Broken Object Level Authorization (BOLA/IDOR), using two-account token switching, object ID substitution, and automated replay to detect missing per-object authorization.","primaryDomain":"api-security","domainTags":["api-security","authorization","access-control","owasp-api"],"capabilityTags":["bola-testing","idor-testing","api-authorization-testing"],"capabilityDetails":["Provides a workflow for systematically testing REST and GraphQL APIs for broken object level authorization by substituting object identifiers across user accounts and validating per-object access controls."],"techniqueTags":["id-substitution","sequential-id-enumeration","parameter-pollution","method-switching","graphql-node-query","automated-replay"],"techniqueDetails":["Uses two test accounts with distinct data sets, swaps object IDs in requests to detect missing authorization, includes ID format classification, numeric ID scanning, batch ID inclusion, nested resource path manipulation, HTTP method switching, relay-style GraphQL node queries, and automated replay via Burp Autorize."],"tools":["burp-suite","autorize","owasp-zap","postman","ffuf","python-requests"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["reconnaissance","enumeration","detection","validation","exploitation"],"distinctiveFeatures":["Dedicated playbook for OWASP API1:2023 BOLA/IDOR testing, covering REST and GraphQL, with manual Python scripting, Burp Autorize automation, sequential ID enumeration, parameter pollution, batch/nested vectors, and explicit reporting format."],"familyIds":["api-authorization-and-data-exposure-testing"]},{"id":"testing-api-for-mass-assignment-vulnerability","summary":"Automated, code-driven workflow for discovering and confirming mass assignment vulnerabilities in APIs by injecting privileged fields, verifying database persistence, and exploiting privilege/price manipulation, with framework-specific payloads.","primaryDomain":"api-security","domainTags":["mass-assignment","auto-binding","owasp-api3","parameter-binding"],"capabilityTags":["mass-assignment-testing","api-parameter-injection","privileged-field-injection","auto-binding-detection"],"capabilityDetails":["Provides an automated workflow to test API endpoints for mass assignment by injecting privileged fields (role, isAdmin, balance, price, etc.) and verifying whether the server binds them to the data model.","Includes state-change verification to confirm persistence and framework-specific payloads for Rails, Django, Express, and Spring."],"techniqueTags":["undocumented-field-injection","parameter-tampering","state-change-verification","framework-specific-payload-testing"],"techniqueDetails":["Injects fields not present in API documentation to see if they are accepted.","Uses repeated GET/PUT calls to verify that injected fields persist in the database.","Applies framework-specific payload formats (e.g., nested model attributes, MongoDB operator injection) to bypass filters."],"tools":["python-requests","burp-suite","param-miner","arjun","owasp-zap","postman"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Specialized for mass assignment rather than generic API security scanning.","Provides Python automation scripts for systematic injection of multiple privilege/field categories.","Includes framework-specific payloads and verification of actual state persistence to reduce false positives."],"familyIds":["api-authentication-and-authorization-testing"]},{"id":"testing-api-security-with-owasp-top-10","summary":"A comprehensive, OWASP API Security Top 10-aligned testing playbook that provides concrete curl/ffuf commands, Burp/Postman workflows, and a reporting template for security assessments of REST, GraphQL, and gRPC APIs.","primaryDomain":"api-security","domainTags":["owasp","rest-api","graphql","grpc"],"capabilityTags":["api-security-assessment","bola-testing","broken-authentication-testing","mass-assignment-testing","rate-limit-testing","ssrf-testing","misconfiguration-testing","graphql-testing"],"capabilityDetails":["Provides a systematic workflow for assessing REST, GraphQL, and gRPC APIs against the OWASP API Security Top 10 (2023) using Burp Suite and Postman, covering automated fuzzing and manual verification."],"techniqueTags":["endpoint-fuzzing","idor-testing","jwt-manipulation","mass-assignment","rate-limit-abuse","graphql-depth-attack","ssrf-cloud-metadata","deprecated-version-testing"],"techniqueDetails":["Uses ffuf for API endpoint enumeration and IDOR testing via sequential object IDs.","Tests JWT tampering (e.g., alg:none) for authentication bypass.","Crafts payloads with extra fields to detect mass assignment and excessive data exposure.","Checks rate limiting with repeated requests and GraphQL depth/complexity attacks.","Exploits SSRF by pointing URL parameters to cloud metadata endpoints.","Probes for misconfigurations via CORS headers, verbose errors, and missing security headers."],"tools":["burp-suite","postman","ffuf","curl","httpie","jq","kiterunner","jwt_tool","graphql-voyager","arjun"],"targetTypes":["api","web-application"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","exploitation","reporting"],"distinctiveFeatures":["Maps each test step directly to the 2023 OWASP API Security Top 10 categories.","Covers REST, GraphQL, and gRPC API assessment with protocol-specific attacks.","Includes both an operational testing workflow and a structured final assessment report template."],"familyIds":["api-security-assessment-and-protocol-testing"]},{"id":"testing-cors-misconfiguration","summary":"Provides a structured playbook for detecting, validating, and exploiting CORS misconfigurations, including origin reflection, null origin, preflight issues, and PoC development.","primaryDomain":"web-security","domainTags":["cors","same-origin-policy","api-security"],"capabilityTags":["cors-testing","origin-reflection-detection","preflight-analysis","exploit-poc-development"],"capabilityDetails":["Provides a structured workflow for identifying and exploiting CORS misconfigurations, including origin reflection, null origin, preflight issues, and credential theft."],"techniqueTags":["origin-reflection-testing","null-origin-exploitation","preflight-request-analysis","sandboxed-iframe-exploit"],"techniqueDetails":["Uses crafted Origin headers, preflight OPTIONS requests, and sandboxed iframes to test and exploit CORS flaws."],"tools":["curl","burp-suite","corscanner","owasp-zap"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","reporting"],"distinctiveFeatures":["Focuses specifically on CORS misconfiguration testing rather than general web security","Covers multiple bypass techniques (origin reflection, null origin, subdomain trust, regex bypass) and exploitation workflows","Includes practical PoC examples and integration with common testing tools"],"familyIds":["cors-misconfiguration-testing"]},{"id":"testing-for-broken-access-control","summary":"Systematic testing methodology for OWASP A01 Broken Access Control in web applications and APIs, using Burp Suite Authorize for automated role-based replay and manual curl/ffuf techniques to identify vertical/horizontal privilege escalation, IDOR, missing function-level checks, and multi-tenant data leakage.","primaryDomain":"web-security","domainTags":["access-control","authorization","web-application-security"],"capabilityTags":["broken-access-control-testing","privilege-escalation-testing","idor-testing","multi-tenant-isolation-testing","rbac-testing"],"capabilityDetails":["Provides a systematic workflow to identify and validate broken access control vulnerabilities including vertical/horizontal privilege escalation, missing function-level checks, IDOR, and multi-tenant data leakage."],"techniqueTags":["access-control-matrix","role-based-request-replay","endpoint-enumeration","http-method-override-testing","mass-assignment-testing","tenant-id-manipulation"],"techniqueDetails":["Builds an endpoint-to-role access control matrix to compare expected vs actual responses.","Uses Burp Authorize extension to automatically replay admin requests under low-privilege and unauthenticated sessions.","Uses ffuf to discover hidden endpoints and API paths that may lack access controls.","Tests HTTP method override headers and alternative methods to bypass function-level restrictions.","Attempts role manipulation via JSON body fields (mass assignment) and registration parameters.","Manipulates tenant identifiers in headers, body, or URL to test cross-tenant data isolation."],"tools":["Burp Suite Professional","Authorize (Burp Extension)","AutoRepeater","Postman","ffuf","OWASP ZAP","curl"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Dedicated to OWASP A01 Broken Access Control with a full matrix-driven methodology rather than generic web scanning.","Leverages Burp Authorize for automated multi-role replay, covering vertical, horizontal, function-level, and multi-tenant tests in one workflow.","Includes concrete curl and ffuf command templates for each escalation category, plus an assessment report format."],"familyIds":["broken-access-control-testing"]},{"id":"testing-for-business-logic-vulnerabilities","summary":"Manual testing playbook for discovering and validating business logic flaws in web applications and APIs, including price/quantity manipulation, workflow bypass, race conditions, referral/reward abuse, and privilege escalation, using Burp Suite and custom requests.","primaryDomain":"web-security","domainTags":["web-application-security","business-logic","owasp"],"capabilityTags":["business-logic-testing","price-manipulation-testing","workflow-bypass-testing","race-condition-testing","privilege-escalation-testing","manual-testing"],"capabilityDetails":["Provides a manual workflow for identifying business logic flaws including price manipulation, multi-step workflow bypass, and race conditions, using Burp Suite to intercept and modify requests beyond automated scanner coverage."],"techniqueTags":["request-interception-and-modification","client-side-parameter-tampering","concurrent-request-race-condition","workflow-step-skipping","role-parameter-manipulation","referral-reward-abuse"],"techniqueDetails":["Uses Burp Suite to intercept requests and modify price, quantity, total values.","Sends concurrent requests with curl/Turbo Intruder to exploit race conditions.","Attempts to skip required workflow steps like email verification, payment, MFA, and approval.","Tests privilege escalation by injecting role parameters in registration and invitation requests."],"tools":["burp-suite-professional","burp-turbo-intruder","burp-sequencer","owasp-zap","postman","curl","custom-scripts"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on business logic vulnerabilities rather than technical vulnerabilities, covering price manipulation, workflow bypass, race conditions, referral abuse, and role logic; explicitly positions itself as going beyond automated vulnerability scanners."],"familyIds":["business-logic-vulnerabilities"]},{"id":"testing-for-email-header-injection","summary":"A practical workflow for testing web application email functionality for CRLF/SMTP header injection, including payload crafting, validation, and impact scenarios such as spam relay and phishing.","primaryDomain":"injection","domainTags":["email-security","web-application-security","smtp-injection"],"capabilityTags":["email-header-injection-testing","crlf-injection-validation","smtp-injection-testing","spam-relay-detection"],"capabilityDetails":["Provides a step-by-step workflow for identifying and testing email header injection vulnerabilities in web forms and APIs.","Covers validation of injected headers through raw email inspection and local SMTP capture tools."],"techniqueTags":["crlf-injection","smtp-command-injection","imap-injection","mime-injection","header-injection","email-spoofing"],"techniqueDetails":["Uses CRLF and alternative newline encodings (%0A, %0D, %0D%0A, double-encoding) to inject additional email headers such as Cc, Bcc, From, and Reply-To.","Includes IMAP/SMTP command injection payloads and JSON API-specific injection techniques."],"tools":["Burp Suite","OWASP ZAP","swaks","mailhog","smtp4dev","Nuclei"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on email header injection (CRLF/SMTP/IMAP) rather than generic web injection vulnerabilities.","Includes practical payload encoding variants and validation via raw email headers and local SMTP mail capture tools.","Covers impact scenarios such as spam relay, phishing via contact forms, and password reset hijacking."],"familyIds":["header-injection"]},{"id":"testing-for-host-header-injection","summary":"Provides a practical workflow for identifying and exploiting Host header injection, including password reset token theft, web cache poisoning, SSRF to cloud metadata, virtual host enumeration, and connection-state attacks, with curl and Burp Suite techniques and remediation guidance.","primaryDomain":"web-security","domainTags":["host-header-injection","password-reset-poisoning","web-cache-poisoning","virtual-host-security","ssrf","header-manipulation"],"capabilityTags":["host-header-injection-testing","password-reset-poisoning-testing","web-cache-poisoning-testing","ssrf-testing","virtual-host-enumeration"],"capabilityDetails":["Provides a structured workflow for detecting and exploiting HTTP Host header injection, covering password reset poisoning, web cache poisoning, SSRF, virtual host routing manipulation, and connection-state attacks."],"techniqueTags":["host-header-manipulation","x-forwarded-host-injection","double-host-header","absolute-url-request","connection-state-attack","virtual-host-bruteforcing"],"techniqueDetails":["Uses modified Host headers and alternative forwarding headers (X-Forwarded-Host, X-Host, etc.) to observe application behavior.","Uses out-of-band detection (Burp Collaborator) and cache response analysis to confirm poisoning.","Enumerates virtual hosts and internal endpoints via Host header manipulation."],"tools":["curl","Burp Suite","Burp Collaborator","ffuf","gobuster","Nuclei","param-miner"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","enumeration"],"distinctiveFeatures":["Focuses specifically on Host header injection across multiple impact chains (password reset poisoning, cache poisoning, SSRF, virtual host access) and includes connection-state attack testing, distinguishing it from generic header injection checks."],"familyIds":["host-header-and-web-cache-attacks"]},{"id":"testing-for-json-web-token-vulnerabilities","summary":"Practical workflow to test JWT implementations for algorithm confusion, 'none' algorithm bypass, kid/jku header injection, and weak-secret brute-force, resulting in authentication bypass and privilege escalation.","primaryDomain":"authentication","domainTags":["jwt-security","authentication-bypass","token-forgery","web-application-security"],"capabilityTags":["jwt-vulnerability-assessment","token-forgery","algorithm-confusion-testing","weak-secret-cracking"],"capabilityDetails":["Provides a step-by-step workflow for testing JWT implementations for algorithm confusion, 'none' algorithm bypass, kid/jku parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation."],"techniqueTags":["none-algorithm-attack","algorithm-confusion","kid-injection","jku-injection","x5u-injection","hmac-secret-bruteforce","claim-tampering"],"techniqueDetails":["Switches RS256 to HS256 and signs with the public key when the server trusts it.","Sets the alg header to 'none' (with case variations) to forge unsigned tokens.","Exploits the kid header for SQL injection, path traversal, or SSRF to influence key retrieval.","Points jku/x5u headers to an attacker-controlled JWKS or certificate endpoint.","Brute-forces weak HMAC secrets using hashcat or john for token forgery.","Modifies payload claims such as role or sub once signature validation is bypassed."],"tools":["jwt_tool","burp-jwt-editor","hashcat","john-the-ripper","jwt.io","pyjwt"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Targets JWT-specific implementation flaws rather than generic web authentication testing.","Covers both automated exploitation with jwt_tool and manual forging with PyJWT/hashcat.","Includes crafted header/payload injection scenarios (kid, jku, x5u) not found in broad authentication playbooks."],"familyIds":["token-authentication-security"]},{"id":"testing-for-open-redirect-vulnerabilities","summary":"Provides a comprehensive open redirect testing workflow, including discovery of redirect parameters, manual and automated payload testing, validation bypass techniques, and chaining into OAuth token theft, phishing, and XSS, with supporting tools and reporting guidance.","primaryDomain":"web-security","domainTags":["open-redirect","url-redirection","unvalidated-redirects","oauth-redirect-handling"],"capabilityTags":["open-redirect-testing","redirect-bypass-techniques","oauth-token-theft","phishing-chain","automated-redirect-scanning"],"capabilityDetails":["Provides a structured workflow to identify and exploit open redirect vulnerabilities by testing common redirect parameters and applying a wide range of bypass techniques.","Covers chaining open redirects into OAuth token theft, phishing, SSO bypass, and XSS scenarios, and includes automation with dedicated tools."],"techniqueTags":["protocol-relative-url","userinfo-abuse","url-encoding-bypass","crlf-injection","javascript-protocol","path-based-redirect","parameter-pollution"],"techniqueDetails":["Uses URL parsing inconsistencies (e.g., @ symbol, backslashes, encoding schemes) to bypass validation.","Leverages protocol-relative URLs, null bytes, mixed-case protocols, and fragment tricks to achieve redirects.","Chains javascript: protocol and data URIs for XSS, and OAuth redirect_uri manipulation for token theft."],"tools":["OpenRedireX","Burp Suite","OWASP ZAP","gf","nuclei","ffuf"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focused exclusively on open redirect vulnerabilities with an extensive catalog of bypass payloads and chaining scenarios, unlike general web vulnerability scanning playbooks.","Includes both manual curl-based testing and automation via OpenRedireX, nuclei, ffuf, and gf, plus a structured reporting output."],"familyIds":["open-redirect-testing"]},{"id":"testing-for-sensitive-data-exposure","summary":"A specialist web application and API assessment playbook for identifying sensitive data exposure, covering exposed secrets in client-side code and git repositories, API data over-exposure, insecure data transmission, browser storage risks, and insufficient data masking, with a built-in reporting template.","primaryDomain":"web-security","domainTags":["sensitive-data-exposure","api-security","secrets-management","owasp-top-10"],"capabilityTags":["sensitive-data-exposure-testing","secrets-scanning","data-over-exposure-validation","tls-testing","data-masking-validation","browser-storage-analysis"],"capabilityDetails":["Provides a step-by-step assessment workflow for finding exposed secrets in client-side code and configuration files.","Checks API endpoints for response data over-exposure, including password hashes, PII, and financial data.","Verifies TLS/HTTPS enforcement, redirects, mixed content, and sensitive data in URL parameters.","Inspects browser storage, cookies, and cached responses for insecure sensitive data handling.","Scans exposed .git repositories and source code using trufflehog and gitleaks.","Validates data masking and redaction in API responses, exports, logs, and error messages."],"techniqueTags":["client-side-secret-scanning","api-response-analysis","tls-configuration-checking","browser-storage-review","git-repository-secret-scanning","data-masking-validation","error-message-information-leak-testing"],"techniqueDetails":["Uses curl and grep pattern matching to locate API keys, tokens, and secrets in JavaScript and HTML.","Uses jq to enumerate API response fields and compare public vs authenticated responses.","Uses testssl.sh and curl to assess TLS versions, cipher configuration, and mixed content.","Examines localStorage, sessionStorage, IndexedDB, cookies, and cache storage via browser DevTools.","Uses git-dumper to download exposed .git directories and runs trufflehog/gitleaks on the repository.","Checks whether credit card numbers, SSNs, and password hashes are masked or entirely omitted.","Sends malformed requests to detect stack traces, internal paths, and verbose error messages."],"tools":["Burp Suite Professional","trufflehog","gitleaks","testssl.sh","git-dumper","curl","httpie","SecretFinder","Retire.js"],"targetTypes":["web-application","api","source-code"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis","reporting"],"distinctiveFeatures":["Focuses specifically on OWASP A02 sensitive data exposure rather than general web vulnerability discovery.","Combines client-side secret scanning, API over-exposure testing, TLS checks, browser storage review, git history scanning, and data masking validation into one playbook.","Includes a structured report template with findings and recommendations for sensitive data exposure assessments."],"familyIds":["sensitive-data-exposure-testing"]},{"id":"testing-for-system-prompt-leakage","summary":"Extracts hidden LLM system prompts via direct, override, encoding, and completion attacks, using manual payloads plus garak and Promptfoo scanners, then triages leaked secrets and authorization logic to remediate OWASP LLM07.","primaryDomain":"injection","domainTags":["llm-security","system-prompt-leakage","prompt-injection","data-leakage"],"capabilityTags":["system-prompt-extraction","system-prompt-leak-testing","llm-red-team","secrets-exposure-check"],"capabilityDetails":["Provides a workflow for extracting hidden LLM system prompts via direct, override, encoding, and completion attacks, combined with automated garak and Promptfoo scanning, and triage of leaked secrets and authorization logic."],"techniqueTags":["direct-extraction","instruction-override","role-play-framing","completion-delimiter-attack","encoding-obfuscation","automated-probing"],"techniqueDetails":["Direct requests to repeat instructions verbatim","Jailbreak/instruction-override framing such as developer debugging or maintenance mode","Delimiter and completion attacks to spill the preamble","Encoding and format-shift attacks using base64, JSON, and poetry","Automated probing with garak leakreplay and promptinject probes","Promptfoo red-team prompt-extraction plugin with configured system prompt"],"tools":["garak","promptfoo"],"targetTypes":["api"],"role":"specialist-playbook","workflowFocus":["detection","exploitation","validation","remediation"],"distinctiveFeatures":["Dedicated to OWASP LLM07 System Prompt Leakage rather than general web or API testing","Combines manual extraction payloads with automated garak and Promptfoo scanners","Includes triage of leaked content into credentials, authorization logic, tool definitions, and content policies","Covers remediation and re-testing with output guardrails and server-side enforcement"],"familyIds":["llm-prompt-injection-red-teaming"]},{"id":"testing-for-xml-injection-vulnerabilities","summary":"Specialist playbook for testing XML injection vulnerabilities in web applications and APIs, covering XXE file disclosure, blind XXE with out-of-band exfiltration, SSRF to cloud metadata, XPath injection, and XML denial-of-service, with concrete payloads and remediation guidance.","primaryDomain":"web-security","domainTags":["xml-injection","xxe","xpath-injection","xml-parsing","web-application-security"],"capabilityTags":["xml-injection-testing","xxe-detection","blind-xxe-validation","xpath-injection-testing","ssrf-via-xxe"],"capabilityDetails":["Provides a step-by-step workflow for testing XML injection vulnerabilities including XXE, blind XXE with out-of-band exfiltration, SSRF via XXE, XPath injection, and XML DoS attacks.","Includes practical payloads for file disclosure, cloud metadata access, internal port scanning, XPath authentication bypass, and entity expansion bombs."],"techniqueTags":["xxe","blind-xxe","xpath-injection","external-entity","parameter-entities","ssrf","billion-laughs","out-of-band"],"techniqueDetails":["Uses external DTDs for out-of-band data exfiltration in blind XXE.","Uses boolean-based XPath queries for blind data extraction.","Demonstrates SSRF via XXE to access cloud metadata endpoints (e.g., AWS 169.254.169.254)."],"tools":["Burp Suite","XXEinjector","OXML_XXE","xmllint","interact.sh","Content Type Converter","curl"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","exploitation"],"distinctiveFeatures":["Covers a comprehensive range of XML-specific injection classes: classic XXE, blind XXE via OOB, SSRF through XXE, XPath injection, and XML denial-of-service.","Includes specialized scenarios like SAML XXE and SVG file upload XXE, with both manual payloads and tooling recommendations."],"familyIds":["xml-injection-and-xxe-testing"]},{"id":"testing-for-xss-vulnerabilities","summary":"Provides a comprehensive XSS testing workflow covering reflected, stored, and DOM-based injection, CSP bypass, and impact demonstration, suitable for advanced penetration testers.","primaryDomain":"web-security","domainTags":["xss","client-side-security","injection","owasp-wstg"],"capabilityTags":["reflected-xss-testing","stored-xss-testing","dom-xss-testing","csp-bypass","input-output-mapping"],"capabilityDetails":["Maps all user input entry points and output rendering contexts across the application.","Tests reflected XSS with context-appropriate payloads for HTML, attribute, JavaScript, URL, and comment contexts.","Tests stored XSS including blind payloads via XSS Hunter for admin panels and internal tools.","Analyzes client-side JavaScript sources and sinks to identify DOM-based XSS.","Evaluates Content Security Policy and demonstrates bypass techniques using unsafe-inline, JSONP endpoints, and base-uri manipulation.","Demonstrates real-world impact through session hijacking, credential phishing, and keylogging."],"techniqueTags":["context-aware-payloads","source-sink-analysis","blind-xss","csp-analysis","payload-encoding","event-handler-injection"],"techniqueDetails":["Uses unique payload identifiers to track which stored input triggers on which page.","Exploits JavaScript framework-specific sinks like dangerouslySetInnerHTML and v-html.","Uses XSS Hunter for blind stored XSS verification with callbacks containing session cookies and DOM content."],"tools":["burp-suite","xss-hunter","browser-developer-tools","dompurify"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","reporting"],"distinctiveFeatures":["Covers all three XSS types (reflected, stored, DOM) in a single integrated workflow.","Includes advanced CSP bypass and JSONP exploitation techniques.","Provides concrete impact demonstration and remediation guidance for reporting.","Addresses blind stored XSS using external callback services like XSS Hunter."],"familyIds":["cross-site-scripting-testing"]},{"id":"testing-for-xss-vulnerabilities-with-burpsuite","summary":"A specialist playbook for testing and validating reflected, stored, and DOM-based XSS vulnerabilities using Burp Suite, including context-specific payload crafting, Intruder-based testing, DOM Invader source/sink tracing, CSP and filter bypass techniques, and detailed vulnerability reporting.","primaryDomain":"web-security","domainTags":["xss","cross-site-scripting","web-application-security","burpsuite"],"capabilityTags":["xss-testing","xss-validation","reflected-xss-testing","stored-xss-testing","dom-xss-testing","csp-bypass","xss-filter-bypass"],"capabilityDetails":["Provides a comprehensive workflow for identifying, validating, and documenting reflected, stored, and DOM-based XSS vulnerabilities using Burp Suite."],"techniqueTags":["canary-string-reflection-testing","context-specific-payloads","burp-intruder-payload-fuzzing","dom-invader-source-sink-analysis","csp-bypass-techniques","filter-bypass-encoding"],"techniqueDetails":["Uses unique canary strings in Burp Repeater to identify reflection points and response contexts.","Crafts context-specific payloads for HTML body, attributes, JavaScript strings, SVG, and event handlers.","Leverages Burp Intruder with grep matching to test stored XSS across input fields.","Uses Burp's DOM Invader to trace DOM XSS sources and sinks in client-side code.","Covers CSP bypass via whitelisted CDN gadgets and filter bypass via encoding transformations."],"tools":["Burp Suite Professional","DOM Invader","Hackvertor","XSS Hunter","Dalfox","CSP Evaluator"],"targetTypes":["web-application"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","reporting","remediation"],"distinctiveFeatures":["End-to-end XSS testing workflow specifically centered on Burp Suite, combining manual reflection mapping, automated payload injection, DOM source/sink analysis, CSP/filter bypass, and impact PoC documentation in one playbook."],"familyIds":["cross-site-scripting-testing"]},{"id":"testing-for-xxe-injection-vulnerabilities","summary":"A detailed playbook for discovering and exploiting XXE injection in web applications and APIs, covering direct file read, blind out-of-band detection, data exfiltration via malicious DTDs, file upload vectors, and XXE-powered SSRF, with reproduction and reporting guidance.","primaryDomain":"web-security","domainTags":["xxe","xml-injection","web-application-security"],"capabilityTags":["xxe-injection-testing","blind-xxe-detection","data-exfiltration","ssrf-via-xxe"],"capabilityDetails":["Provides a workflow for discovering XML processing endpoints, including JSON-to-XML content-type switching and SOAP probing.","Demonstrates direct XXE file read payloads for Linux, Windows, and application configuration files.","Covers blind XXE detection using OOB callbacks and parameter entities.","Explains external DTD hosting to exfiltrate file contents via HTTP or FTP.","Covers XXE via file uploads (SVG, DOCX, XLSX) and SSRF to cloud metadata and internal services."],"techniqueTags":["external-entity-injection","dtd-injection","parameter-entity","out-of-band-exfiltration","file-upload-xxe","ssrf-via-xxe"],"techniqueDetails":["Uses DOCTYPE declarations with SYSTEM entities to read local files or trigger network requests.","Uses parameter entities for blind XXE when standard entity expansion is blocked.","Hosts a malicious DTD on an attacker-controlled server to chain entity expansion and exfiltrate data via HTTP or FTP.","Injects entities into SVG and Office XML formats to reach server-side parsers via file upload functionality.","Leverages XXE to send SSRF requests against cloud metadata endpoints and internal network services."],"tools":["Burp Suite","XXEinjector","interactsh","curl","OWASP ZAP","DTD-Finder","xxeserv"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on XXE injection across multiple input vectors including REST/XML APIs, SOAP, and file upload formats.","Includes both direct file read and blind OOB exfiltration with detailed DTD hosting and FTP-based exfiltration.","Demonstrates XXE-to-SSRF for cloud metadata access and internal port scanning."],"familyIds":["xml-injection-and-xxe-testing"]},{"id":"testing-jwt-token-security","summary":"A JWT security testing playbook for pentesters covering algorithm none attacks, RS256-to-HS256 confusion, HMAC secret brute-forcing, claim manipulation, KID/JKU injection, and token revocation validation using jwt_tool, Hashcat, and PyJWT.","primaryDomain":"authentication","domainTags":["jwt-security","token-security","web-application-security","authorization"],"capabilityTags":["jwt-security-assessment","algorithm-confusion-testing","hmac-secret-cracking","claim-tampering","token-lifecycle-testing"],"capabilityDetails":["Provides a complete workflow to assess JWT implementations for cryptographic weaknesses, algorithm confusion, and authorization bypasses.","Covers automated attacks with jwt_tool and manual techniques with PyJWT, including HMAC secret brute-forcing and token revocation tests."],"techniqueTags":["algorithm-none-attack","algorithm-confusion","hmac-brute-force","jku-injection","x5u-injection","kid-injection","claim-tampering","token-revocation-testing"],"techniqueDetails":["Decodes JWT header and payload to inspect algorithm, claims, and sensitive data exposure.","Attempts signature bypass by setting the algorithm to none.","Switches from RS256 to HS256 and signs tokens with the RSA public key to exploit algorithm confusion.","Cracks weak HMAC secrets using jwt_tool, hashcat, or John the Ripper.","Injects malicious URLs or key identifiers through jku, x5u, and kid headers to control the signing key.","Modifies claims such as role, sub, and permissions to escalate privileges.","Tests expired tokens, far-future expiration, and token reuse after logout or password change to identify revocation flaws."],"tools":["jwt_tool","Burp Suite","hashcat","John the Ripper","PyJWT"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Dedicated JWT security assessment playbook covering header-algorithm attacks, key-management weaknesses, and token lifecycle flaws.","Combines automated jwt_tool modules with manual PyJWT scripts and provides specific commands for algorithm confusion, HMAC cracking, KID/JKU injection, and revocation testing."],"familyIds":["token-authentication-security"]},{"id":"testing-mobile-api-authentication","summary":"A specialist playbook for penetration testing mobile API authentication and authorization, covering JWT attacks, OAuth/PKCE issues, session management flaws, and BOLA/IDOR through manual API request manipulation with tools like Burp Suite, jwt_tool, and hashcat.","primaryDomain":"api-security","domainTags":["mobile-security","authentication","authorization","session-management"],"capabilityTags":["authentication-testing","authorization-testing","jwt-security-testing","oauth-flow-testing","session-management-testing"],"capabilityDetails":["Provides a workflow for testing authentication and authorization mechanisms in mobile application APIs.","Covers JWT vulnerabilities including none algorithm, algorithm confusion, weak HMAC secret, and expiration bypass.","Includes OAuth 2.0/OIDC mobile flow testing for PKCE enforcement, redirect URI manipulation, and scope escalation.","Tests for IDOR/BOLA and horizontal/vertical privilege escalation via endpoint manipulation."],"techniqueTags":["jwt-header-manipulation","jwt-secret-cracking","oauth-redirect-manipulation","pkce-check","idor-enumeration","session-invalidation-testing"],"techniqueDetails":["Modifies JWT headers to test none algorithm and RS256-to-HS256 algorithm confusion.","Uses hashcat or jwt-cracker to brute-force weak HMAC signing keys.","Attempts to intercept OAuth authorization codes by testing PKCE enforcement and custom URI scheme redirects.","Changes user/object identifiers in API paths and bodies to detect broken object-level authorization.","Verifies token invalidation after logout and password change to identify session management flaws."],"tools":["Burp Suite","mitmproxy","Postman","curl","jwt_tool","hashcat","Autorize"],"targetTypes":["mobile","api"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on mobile application API backends, including mobile-specific OAuth redirect schemes and PKCE requirements.","Combines authentication token attacks (JWT, opaque tokens) with authorization bypass testing (IDOR, privilege escalation) in a single workflow.","Emphasizes session management pitfalls like token reuse after logout and refresh token rotation issues."],"familyIds":["api-authentication-and-authorization-testing"]},{"id":"testing-oauth2-implementation-flaws","summary":"Hands-on specialist playbook for testing OAuth 2.0 and OpenID Connect implementations for redirect URI validation, CSRF/state, PKCE bypass, scope escalation, token leakage, and authorization code replay; includes Python probe scripts, Burp Suite/EsPReSSO integration, and reporting guidance.","primaryDomain":"api-security","domainTags":["oauth2","openid-connect","authentication","token-security"],"capabilityTags":["oauth2-testing","oidc-testing","redirect-uri-validation-testing","state-parameter-testing","pkce-enforcement-testing","scope-escalation-testing","token-leakage-testing"],"capabilityDetails":["Provides a workflow for testing OAuth 2.0 and OpenID Connect implementations for authorization code interception, redirect URI validation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass.","Includes both manual Burp Suite/EsPReSSO guidance and executable Python scripts for probing authorization server and client behavior."],"techniqueTags":["redirect-uri-manipulation","state-parameter-validation","pkce-bypass","authorization-code-replay","token-reuse-across-clients","implicit-flow-detection","scope-escalation"],"techniqueDetails":["Tests redirect_uri validation using a list of bypass payloads including open redirect variants, path traversal, fragment injection, case variations, and protocol downgrades.","Validates CSRF protection by checking missing or reused state parameters in the OAuth authorization flow.","Assesses PKCE enforcement by omitting code_verifier, using a wrong verifier, and attempting downgrade from S256 to plain.","Detects vulnerable token handling through authorization code replay, cross-client token reuse, refresh token theft, and enabled implicit flow."],"tools":["burp-suite-professional","esspresso","oauth2-security-tester","owasp-zap","jwt.io","python-requests","oauthlib"],"targetTypes":["web-application","api","mobile"],"role":"specialist-playbook","workflowFocus":["reconnaissance","detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on OAuth 2.0/OIDC implementation flaws rather than general authentication testing, covering both authorization server and client-side validation gaps.","Provides concrete Python probe scripts for each vulnerability class, complemented by Burp Suite Professional and EsPReSSO extension guidance.","Includes a real-world social login assessment scenario and a structured finding format with CVSS scoring and remediation steps."],"familyIds":["api-authentication-and-authorization-testing"]},{"id":"testing-prompt-injection-in-rag-pipelines","summary":"Executable playbook for security-testing RAG chatbots and document-Q&A systems against indirect prompt injection and embedding poisoning, using garak, Promptfoo, and PyRIT to detect, validate, and demonstrate exploitation.","primaryDomain":"injection","domainTags":["ai-security","prompt-injection","rag-security","llm-red-teaming"],"capabilityTags":["rag-prompt-injection-testing","indirect-prompt-injection","embedding-poisoning","llm-red-teaming"],"capabilityDetails":["Provides a workflow for systematically probing RAG pipelines for indirect prompt injection via poisoned retrieved documents and embedding-space manipulation."],"techniqueTags":["indirect-prompt-injection","latent-injection","embedding-manipulation","multi-turn-injection","retrieval-poisoning"],"techniqueDetails":["Uses automated probes from garak, Promptfoo red-team plugins, and PyRIT orchestrators to test injection through the retrieval channel."],"tools":["garak","promptfoo","pyrit","sentence-transformers"],"targetTypes":["web-application","api","database"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on RAG pipelines and indirect prompt injection via retrieval, including embedding-space poisoning, distinguishing it from general LLM prompt-injection testing."],"familyIds":["llm-prompt-injection-red-teaming"]},{"id":"testing-ransomware-recovery-procedures","summary":"Validates ransomware recovery plans by executing backup restores, measuring RTO/RPO against business targets, verifying data integrity, and confirming security controls are re-established after simulated encryption.","primaryDomain":"security-knowledge","domainTags":["incident-response","ransomware","disaster-recovery","backup","resilience"],"capabilityTags":["backup-restore-testing","rto-rpo-measurement","integrity-validation","recovery-sequencing","security-control-restoration"],"capabilityDetails":["Provides a step-by-step workflow to test and validate ransomware recovery procedures by executing backup restores.","Measures RTO and RPO against documented business targets and calculates gaps.","Verifies data integrity and completeness after restore using file counts, database queries, and hash comparisons.","Emphasizes recovery sequencing based on dependencies and includes post-restore security hardening such as credential rotation and MFA re-enablement."],"techniqueTags":["clean-restore-point-selection","data-integrity-verification","dependency-aware-recovery-sequencing","credential-rotation-after-restore"],"techniqueDetails":["Selects clean restore points by identifying backups verified free of ransomware artifacts.","Uses hashing, file counts, and database consistency checks to validate restored data.","Restores systems in dependency order to avoid cascading failures.","Rotates credentials and re-establishes security controls on restored systems to prevent re-infection."],"tools":["restic","veeam","commvault","rubrik","aws-backup","azure-backup","velero","pg_isready","sha256sum"],"targetTypes":["active-directory","database","windows-host","linux-host","cloud","kubernetes"],"role":"specialist-playbook","workflowFocus":["validation","analysis","reporting","remediation"],"distinctiveFeatures":["Focuses specifically on validating ransomware recovery procedures, not just generic backup restores.","Integrates RTO/RPO measurement against business requirements, recovery sequencing, clean restore point verification, and post-restore security hardening in one workflow."],"familyIds":["ransomware-recovery-validation"]},{"id":"testing-websocket-api-security","summary":"A specialized playbook for penetration testing WebSocket APIs, covering handshake authentication bypass, CSWSH exploitation, message injection, and DoS via message flooding, with concrete Python scripts and PoC code.","primaryDomain":"api-security","domainTags":["websocket-security","cswsh","api-security"],"capabilityTags":["websocket-security-testing","cswsh-testing","authentication-testing","injection-testing","dos-testing"],"capabilityDetails":["Provides a workflow for assessing WebSocket API security, including handshake authentication, Cross-Site WebSocket Hijacking (CSWSH), message injection, and denial-of-service through flooding."],"techniqueTags":["origin-validation-testing","handshake-analysis","message-flooding","token-auth-testing","payload-crafting"],"techniqueDetails":["Uses Python websockets scripts to analyze handshakes, manipulate Origin headers for CSWSH, send injection payloads, and flood messages to test DoS resistance."],"tools":["Burp Suite Professional","wscat","Python websockets","OWASP ZAP","websocat","Autobahn TestSuite"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Focuses exclusively on WebSocket-specific attack surfaces (upgrade handshake, Origin validation, message flooding, real-time message injection) rather than general HTTP API security; includes a ready-to-use CSWSH PoC HTML page and detailed DoS testing scripts."],"familyIds":["api-security-assessment-and-protocol-testing"]},{"id":"tracking-threat-actor-infrastructure","summary":"Operational playbook for CTI analysts to map adversary-controlled infrastructure by pivoting across passive DNS, CT logs, Shodan/Censys, WHOIS, and JARM/JA3S fingerprints, with Python code and STIX export.","primaryDomain":"reconnaissance","domainTags":["threat-intelligence","infrastructure-tracking","passive-dns","certificate-transparency","network-fingerprinting"],"capabilityTags":["infrastructure-pivoting","c2-discovery","osint-correlation","timeline-analysis"],"capabilityDetails":["Provides a workflow to pivot from a known IOC to related adversary infrastructure using passive DNS, certificate transparency logs, Shodan/Censys scans, WHOIS, and network fingerprints (JARM/JA3S)."],"techniqueTags":["passive-dns","certificate-transparency","jarm","ja3s","shodan-search","whois-analysis"],"techniqueDetails":["Uses passive DNS and certificate transparency to discover historical and current domain-IP associations; uses JARM and JA3S for TLS server fingerprinting to identify C2 infrastructure across hosts."],"tools":["shodan","censys","securitytrails","passivetotal","crt.sh","stix2"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["reconnaissance","analysis","detection"],"distinctiveFeatures":["Focuses specifically on threat actor infrastructure tracking and pivoting across multiple OSINT sources, with Python automation and STIX 2.1 export for CTI workflows."],"familyIds":["infrastructure-threat-intelligence"]},{"id":"traffic-analysis-pcap","summary":"Expert playbook for traffic analysis and PCAP forensics covering PCAP repair, protocol-specific analysis (HTTP, DNS, TLS, FTP, SMTP, USB, WiFi, ICMP), data extraction, covert channel detection, and tshark CLI workflows.","primaryDomain":"network-security","domainTags":["traffic-analysis","pcap-forensics","protocol-analysis"],"capabilityTags":["pcap-repair","wireshark-filtering","data-extraction","covert-channel-detection","credential-harvesting","tshark-analysis"],"capabilityDetails":["Provides a comprehensive expert playbook for network traffic analysis and PCAP forensics, including PCAP repair, Wireshark filtering, protocol-specific analysis, data extraction, covert channel detection, and tshark command-line analysis."],"techniqueTags":["wireshark-filters","tshark-cli","dns-tunneling-detection","usb-hid-keyboard-decode","tls-decryption","file-carving"],"techniqueDetails":["Uses protocol-specific Wireshark/tshark filters to isolate HTTP, DNS, FTP, SMTP, USB, WiFi, and ICMP traffic.","Detects DNS tunneling via long subdomain names, large TXT responses, and high query volumes.","Decodes USB HID keyboard captures by extracting usb.capdata and mapping keycodes to characters.","Decrypts HTTPS traffic using SSLKEYLOGFILE or server RSA keys.","Carves files from network streams using Wireshark export objects, binwalk, foremost, and NetworkMiner."],"tools":["wireshark","tshark","networkminer","pcapfix","editcap","mergecap","hashcat","hcxpcapngtool","binwalk","foremost"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation"],"distinctiveFeatures":["Covers a broad range of PCAP forensics topics beyond basic filtering, including PCAP repair, TLS decryption, USB HID keyboard decode, WiFi handshake cracking, and covert channel detection in a single playbook.","Provides concrete tshark commands for statistical analysis, conversation tracking, and automated object export."],"familyIds":["network-packet-analysis-tooling"]},{"id":"triaging-security-alerts-in-splunk","summary":"Provides a SOC-focused workflow for triaging Splunk Enterprise Security notable events: prioritizing the Incident Review queue, investigating with SPL queries, correlating telemetry, enriching with asset/identity and threat intelligence, classifying disposition, and documenting or escalating findings.","primaryDomain":"security-knowledge","domainTags":["soc-operations","siem","alert-triage","splunk","incident-response"],"capabilityTags":["notable-event-investigation","severity-classification","alert-disposition","escalation-decision","splunk-investigation"],"capabilityDetails":["Provides a structured seven-step triage methodology for SOC Tier 1 analysts handling Splunk ES notable events.","Includes SPL examples for queue prioritization, brute force investigation, asset/identity lookup, threat intel matching, status updates, and metric tracking.","Defines disposition criteria and escalation actions for each alert classification.","Covers common alert scenarios such as brute force, malware, data exfiltration, privilege escalation, and lateral movement."],"techniqueTags":["splunk-search-processing-language","incident-review-dashboard","correlation-search-analysis","threat-intelligence-enrichment","asset-identity-enrichment"],"techniqueDetails":["Uses SPL queries to query notable events and raw logs from CIM-normalized sources.","Leverages Splunk ES Incident Review dashboard for queue prioritization and status updates.","Correlates telemetry across proxy, firewall, and endpoint data sources.","Applies asset and identity lookups plus threat intelligence matching to enrich events.","Classifies alerts as true positive, benign true positive, false positive, or undetermined."],"tools":["Splunk Enterprise Security","Splunk SOAR","Asset & Identity Framework","Threat Intelligence Framework"],"targetTypes":["windows-host","network"],"role":"specialist-playbook","workflowFocus":["analysis","validation","reporting"],"distinctiveFeatures":["Specifically targets Splunk Enterprise Security Incident Review workflow rather than generic SIEM triage.","Provides copy-paste SPL queries for each triage step, including queue prioritization, asset/identity enrichment, threat intel lookup, and disposition updates.","Distinguishes alert dispositions with explicit escalation/closure criteria.","Includes SOC performance metric tracking (MTTD/MTTR) via SPL."],"familyIds":["incident-response-triage"]},{"id":"triaging-security-incident","summary":"Provides an actionable SOC triage playbook that classifies alerts using NIST SP 800-61r3, prioritizes by business impact with defined SLAs, enriches with threat intelligence and asset context, and routes to the correct response tier with containment guidance.","primaryDomain":"security-knowledge","domainTags":["incident-response","nist-800-61","sans-picerl","soc-operations","severity-classification"],"capabilityTags":["incident-classification","severity-assessment","alert-triage","incident-enrichment","escalation-routing","containment-initiation"],"capabilityDetails":["Provides a structured workflow for SOC analysts to triage security alerts, classify incident type using NIST SP 800-61r3 categories, assign severity via business impact matrix, enrich with threat intelligence and asset context, and route to appropriate response teams."],"techniqueTags":["nist-sp-800-61r3","sans-picerl","impact-matrix","threat-intelligence-enrichment","ioc-correlation"],"techniqueDetails":["Uses NIST SP 800-61r3 incident categories to map alerts to standard types such as Unauthorized Access, Malicious Code, or Web Application Attack.","Applies a severity matrix that combines asset criticality, threat type, data sensitivity, and lateral movement potential to assign P1-P4 priority levels with SLA targets.","Performs enrichment using threat intelligence platforms, CMDB asset context, identity provider checks, and historical alert correlation."],"tools":["Splunk Enterprise Security","CrowdStrike Falcon","TheHive","MISP","Cortex XSOAR"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting","remediation"],"distinctiveFeatures":["Operational incident triage playbook grounded in NIST SP 800-61r3 and SANS PICERL, including a concrete severity matrix with P1-P4 SLA targets, step-by-step enrichment guidance, and a structured triage record template."],"familyIds":["incident-response-triage"]},{"id":"triaging-security-incident-with-ir-playbook","summary":"Provides a structured SOC triage workflow to classify, prioritize, and route security alerts using SIEM queries, threat intelligence enrichment, and IR playbooks, including automated severity scoring and team assignment.","primaryDomain":"security-knowledge","domainTags":["incident-response","soc-operations","triage","severity-classification"],"capabilityTags":["incident-triage","severity-classification","alert-enrichment","playbook-selection","team-assignment"],"capabilityDetails":["Provides a structured workflow for classifying and prioritizing security incidents using SIEM queries and IR playbooks.","Includes a quantitative severity scoring matrix based on asset criticality, data sensitivity, scope, and threat status."],"techniqueTags":["severity-score-calculation","ioc-reputation-enrichment","siem-query","playbook-mapping"],"techniqueDetails":["Uses a numeric severity scoring matrix to compute priority levels (P1-P4).","Uses SIEM queries and threat intelligence APIs (VirusTotal, AbuseIPDB) to enrich alert data.","Maps alerts to MITRE ATT&CK techniques for playbook selection."],"tools":["Splunk","Elastic","QRadar","TheHive","VirusTotal","AbuseIPDB","PagerDuty","MITRE ATT&CK","curl","jq","python"],"targetTypes":["other"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","reporting"],"distinctiveFeatures":["Focuses on initial triage and prioritization rather than deep investigation or remediation.","Provides concrete SIEM queries (Splunk) and case management API calls (TheHive) for SOC operations.","Includes an automated severity scoring formula with thresholds for P1-P4 classification.","Covers incident enrichment, playbook selection, team assignment, and handoff documentation."],"familyIds":["incident-response-triage"]},{"id":"triaging-vulnerabilities-with-ssvc-framework","summary":"Triage and prioritize vulnerability scan results using CISA's SSVC framework, combining exploitation status from KEV/EPSS, technical impact, automatability, and mission prevalence to produce Track/Track*/Attend/Act remediation decisions.","primaryDomain":"security-knowledge","domainTags":["vulnerability-management","ssvc","cisa","remediation-planning"],"capabilityTags":["vulnerability-triage","ssvc-decision-tree","exploitation-status-assessment","risk-prioritization"],"capabilityDetails":["Provides an automated decision tree workflow for prioritizing vulnerabilities using SSVC outcomes (Track, Track*, Attend, Act).","Integrates CISA KEV catalog and FIRST EPSS API to determine exploitation status."],"techniqueTags":["ssvc","cvss-vector-analysis","kev-catalog-check","epss-scoring","decision-tree-methodology"],"techniqueDetails":["Parses CVSS vectors to estimate technical impact and automatability.","Uses CISA KEV to detect active exploitation and EPSS scores to infer PoC likelihood."],"tools":["python3","curl","nessus","openvas","qualys","cisa-kev-api","first-epss-api"],"targetTypes":["network","other"],"role":"specialist-playbook","workflowFocus":["analysis","reporting","remediation"],"distinctiveFeatures":["Uses the full SSVC decision tree rather than raw CVSS severity scores, incorporating exploitation evidence and mission context.","Automates integration with live CISA KEV and EPSS feeds to update exploitation status dynamically."],"familyIds":["vulnerability-prioritization-and-risk-scoring"]},{"id":"triaging-windows-with-kape","summary":"Practical KAPE workflow to quickly collect and parse a defensible Windows forensic artifact set for incident triage, including at-scale batch collection.","primaryDomain":"forensics","domainTags":["digital-forensics","windows-forensics","incident-response","artifact-collection"],"capabilityTags":["forensic-artifact-collection","artifact-parsing","triage-collection","kape-targets","kape-modules","volume-shadow-copy-collection","batch-deployment"],"capabilityDetails":["Provides a KAPE-based workflow for collecting forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) and parsing them into CSV/JSON using EZ Tools modules."],"techniqueTags":["target-collection","module-parsing","ez-tools","vss-collection","vhdx-packaging","hash-verification","batch-cli-execution"],"techniqueDetails":["Uses KAPE Targets to copy locked files via raw NTFS access and Modules to run EZ Tools parsers.","Supports collecting Volume Shadow Copies for historical artifact states.","Uses _kape.cli batch files for identical collection across many hosts."],"tools":["KAPE","PECmd","MFTECmd","RECmd","gkape.exe","Get-KAPEUpdate.ps1"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["analysis","validation"],"distinctiveFeatures":["KAPE-specific triage collection and parsing using compound Targets/Modules, with VSS support and _kape.cli batch deployment for fleet-wide IR; not generic forensic methodology."],"familyIds":["endpoint-artifact-collection-and-analysis"]},{"id":"tunneling-and-pivoting","summary":"Practical playbook for establishing tunnels and pivoting through compromised hosts using SSH forwarding, Chisel SOCKS, Ligolo-ng TUN routing, socat relays, ProxyChains, Windows netsh/plink, and DNS/ICMP/HTTP tunneling, with egress-based decision guidance.","primaryDomain":"network-security","domainTags":["network-security","post-exploitation","tunneling"],"capabilityTags":["ssh-tunneling","socks-proxy","port-forwarding","pivot-chaining","egress-aware-tool-selection"],"capabilityDetails":["Provides workflows for establishing network tunnels through compromised hosts using SSH forwarding, Chisel reverse SOCKS, Ligolo-ng transparent TUN routing, socat relays, ProxyChains, Windows netsh/plink, and DNS/ICMP/HTTP tunneling. Includes an egress-aware decision matrix and multi-layer pivoting strategies."],"techniqueTags":["ssh-tunneling","reverse-socks","tun-routing","port-forwarding","dns-tunneling","icmp-tunneling","http-tunneling","proxy-chaining"],"techniqueDetails":["Covers SSH local/remote/dynamic forwarding and ProxyJump, Chisel reverse SOCKS, Ligolo-ng TUN interface, socat TCP/UDP relays, ProxyChains multi-hop, Windows netsh/plink, and DNS/ICMP/HTTP tunnels using iodine, dnscat2, icmpsh, ptunnel-ng, Neo-reGeorg, and Tunna."],"tools":["ssh","chisel","ligolo-ng","socat","proxychains","netsh","plink","iodine","dnscat2","icmpsh","ptunnel-ng","neoreg","tunna"],"targetTypes":["network","windows-host","linux-host","web-application"],"role":"specialist-playbook","workflowFocus":["post-exploitation","exploitation","enumeration"],"distinctiveFeatures":["Covers the full spectrum of tunneling tools with an egress-aware decision matrix and decision tree, including transparent routing via Ligolo-ng, Windows-specific pivoting with netsh/plink, and DNS/ICMP/HTTP fallback tunnels—differentiating it from single-tool or single-technique playbooks."],"familyIds":["network-adversary-simulation"]},{"id":"type-juggling","summary":"Skill for finding and exploiting PHP type juggling vulnerabilities in loose comparisons, including magic hash collisions, HMAC zero-hash bypasses, NULL/array coercion, and common CTF patterns like strcmp/intval/json_decode tricks.","primaryDomain":"web-security","domainTags":["php-security","web-application-security"],"capabilityTags":["php-type-juggling","weak-comparison-testing","magic-hash-bypass","authentication-bypass"],"capabilityDetails":["Provides payloads and decision logic to test and exploit PHP loose comparison (==) in authentication, HMAC, token, and hash checks."],"techniqueTags":["loose-comparison","magic-hash","null-juggling","strcmp-bypass","intval-bypass","json-type-confusion"],"techniqueDetails":["Loose numeric-string comparison to coerce unequal values to equal","Magic hashes matching ^0e[0-9]+$ compare equal as floats","Type errors that yield NULL can satisfy NULL == 0 checks","strcmp() with arrays returns NULL and can pass == 0 comparisons","intval() base/prefix parsing allows alternative representations","json_decode with true allows boolean/array confusion in auth logic"],"tools":["php-cli","grep"],"targetTypes":["web-application","api","source-code","ctf"],"role":"specialist-playbook","workflowFocus":["analysis","detection","validation","exploitation"],"distinctiveFeatures":["Focuses on PHP language-level type juggling and magic hash comparison rather than tool-based scanning.","Covers PHP version-specific behavior (5, 7, 8) with a decision tree for selecting the correct bypass technique."],"familyIds":["php-type-juggling-exploitation"]},{"id":"unauthorized-access-common-services","summary":"Expert playbook for exploiting unauthenticated access to common infrastructure services (Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console) to achieve file read, data theft, or remote code execution, with hardening notes and reverse proxy misconfiguration techniques.","primaryDomain":"network-security","domainTags":["exposed-services","unauthenticated-access","redis","rsync","php-fpm","ajp","hadoop-yarn","h2-console"],"capabilityTags":["unauthorized-access-exploitation","redis-rce","rsync-data-exfiltration","php-fpm-code-execution","ghostcat-file-read","yarn-rce","h2-jndi-injection"],"capabilityDetails":["Provides step-by-step exploitation playbooks for unauthenticated or weakly authenticated management services: Redis write-to-RCE, Rsync data theft, PHP-FPM FastCGI code execution, Ghostcat AJP file read, Hadoop YARN application submission for RCE, and H2 Console JNDI/RUNSCRIPT RCE.","Includes detection commands for each service, hardening guidance, and a section on reverse proxy misconfigurations that can expose internal paths or bypass auth."],"techniqueTags":["write-to-file-rce","cron-backdoor","authorized-keys-injection","master-slave-replication","fastcgi-env-injection","ajp-file-read","yarn-rest-api-submission","jndi-injection","path-traversal","header-auth-bypass"],"techniqueDetails":["Redis exploitation uses CONFIG SET to write SSH authorized keys, crontab entries, or webshells, plus master-slave replication to load malicious modules.","Rsync modules can be listed and downloaded anonymously, and writable mappings can be used to place cron backdoors.","PHP-FPM is exploited by crafting FastCGI requests with SCRIPT_FILENAME and PHP_VALUE to inject arbitrary PHP code.","Ghostcat reads arbitrary files under the webapp root via AJP, and can achieve RCE by including uploaded JSP content.","YARN RCE is achieved by submitting a crafted application via the REST API with an arbitrary command in the AM container spec.","H2 Console RCE uses JNDI BeanFactory/EL bypass or creating a Java alias and executing it via SQL."],"tools":["nmap","redis-cli","ssh-keygen","redis-rogue-server","rsync","fcgi_exp","ajpShooter","curl","Gopherus"],"targetTypes":["network","linux-host","database"],"role":"specialist-playbook","workflowFocus":["enumeration","detection","validation","exploitation"],"distinctiveFeatures":["Covers multiple distinct infrastructure-level services with specific unauthenticated RCE/file-read techniques, explicitly separate from web application vulnerabilities.","Includes reverse proxy misconfiguration vectors alongside the main service exploitation workflows."],"familyIds":["network-adversary-simulation"]},{"id":"upload-insecure-files","summary":"Comprehensive insecure file upload playbook covering validation bypass, storage path abuse, processing-chain attacks, polyglot files, and chaining into RCE/XSS/XXE/SSRF, including cloud storage signed URL abuse and server parsing scenarios.","primaryDomain":"web-security","domainTags":["file-upload","command-injection","xml-external-entity","server-side-request-forgery","path-traversal","xss"],"capabilityTags":["file-upload-validation-bypass","storage-abuse-testing","processing-chain-analysis","upload-to-rce-chaining","polyglot-file-construction","cloud-storage-upload-abuse"],"capabilityDetails":["Provides a comprehensive workflow for testing insecure file uploads across validation, storage, processing, and serving boundaries.","Covers extension bypass, MIME confusion, polyglot construction, processor exploitation, and cloud storage signed URL abuse.","Includes chaining playbooks to XSS, XXE, CMDi, path traversal, and business logic vulnerabilities."],"techniqueTags":["extension-bypass","mime-type-confusion","polyglot-files","imagemagick-exploitation","ffmpeg-ssrf","zip-slip","signed-url-abuse","content-type-confusion"],"techniqueDetails":["Uses double extensions, semicolon truncation, null bytes, and trailing characters to bypass extension filters.","Leverages MIME sniffing, content-type mismatches, and response manipulation for client-side validation bypass.","Constructs GIFAR, PNG/PHP, JPEG/JS, and PDF/JS polyglots to pass format validation while delivering payloads.","Exploits ImageMagick delegates, Ghostscript escapes, and FFmpeg HLS/subtitle SSRF for server-side impact.","Abuses predictable storage paths, archive extraction, and cloud presigned URLs for overwrite or unauthorized access."],"tools":["exiftool","ffmpeg","imagemagick","ghostscript","python"],"targetTypes":["web-application","api","cloud"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Treats uploads as four independent trust boundaries (accept/store/process/serve) instead of a single validation check.","Includes deep processor-specific exploitation for ImageMagick, FFmpeg, Ghostscript, and archive extraction.","Covers cloud storage presigned URL and SAS token abuse, not just traditional web upload endpoints.","Contains a chaining map to pivot upload findings into XSS, XXE, CMDi, path traversal, and business logic bugs."],"familyIds":["insecure-file-upload-testing"]},{"id":"validating-backup-integrity-for-recovery","summary":"Workflow for validating that backups are recoverable and free of ransomware artifacts by generating and comparing hash manifests, performing restore tests in isolated environments, and scanning for corruption or tampering.","primaryDomain":"security-knowledge","domainTags":["disaster-recovery","incident-response","backup-integrity","ransomware-readiness"],"capabilityTags":["backup-integrity-validation","restore-testing","hash-verification","corruption-detection","ransomware-artifact-scanning"],"capabilityDetails":["Provides a workflow for validating backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response."],"techniqueTags":["sha-256-hash-manifest","restore-test-isolation","file-entropy-analysis","ransomware-indicator-scanning","archive-integrity-checking"],"techniqueDetails":["Generates baseline SHA-256 manifests and compares them against restored data to detect corruption or tampering.","Uses file entropy analysis near 8.0 bits/byte to identify potentially encrypted/ransomware files in backups.","Performs restore tests to isolated environments to verify recoverability and integrity of full backup chains."],"tools":["restic","borgbackup","rclone","sha256sum","pg_restore","aws-cli","gzip","python"],"targetTypes":["database","cloud","other"],"role":"specialist-playbook","workflowFocus":["validation","detection","analysis"],"distinctiveFeatures":["Focuses on validating backups for ransomware recovery readiness, not just general backup integrity.","Combines baseline hash manifests with restore testing and ransomware artifact detection in a single workflow.","Emphasizes isolated restore environment testing and entropy-based corruption detection.","Includes automated scheduling examples for continuous backup validation."],"familyIds":["ransomware-recovery-validation"]},{"id":"validating-tpm-measured-boot-attestation","summary":"A specialist playbook for validating TPM 2.0 measured boot integrity and remote attestation using tpm2-tools, including PCR reading, event log replay, nonce-bound quote generation and verification, golden baseline comparison, and optional PCR-policy secret sealing.","primaryDomain":"linux-security","domainTags":["tpm","measured-boot","remote-attestation","hardware-firmware-security","pcr-integrity"],"capabilityTags":["measured-boot-validation","remote-attestation-verification","pcr-event-log-replay","golden-baseline-comparison","pcr-policy-sealing"],"capabilityDetails":["Provides a complete workflow for validating TPM 2.0 measured boot integrity and remote attestation using tpm2-tools.","Covers local verification through PCR reads and event log replay, as well as remote attestation with nonce-bound signed quotes.","Includes steps for creating an Attestation Key, building golden PCR baselines, and optionally sealing secrets to PCR policies."],"techniqueTags":["pcr-read","event-log-replay","tpm2-quote","tpm2-checkquote","baseline-diff","pcr-policy-seal"],"techniqueDetails":["Reads PCR banks with tpm2_pcrread and interprets TCG-assigned meanings for firmware, Secure Boot policy, bootloader/kernel, and IMA.","Replays the TPM event log with tpm2_eventlog and compares calculated PCR values to live PCRs to detect tampering or stale logs.","Generates a signed quote with tpm2_quote over selected PCRs using a fresh nonce, and verifies it with tpm2_checkquote using the AK public key.","Compares attested PCRs against golden baselines captured from a trusted reference machine to detect drift.","Optionally seals secrets to a PCR policy using tpm2_createpolicy, tpm2_create, and tpm2_unseal."],"tools":["tpm2-tools","openssl","agent.py"],"targetTypes":["linux-host"],"role":"specialist-playbook","workflowFocus":["detection","validation","analysis"],"distinctiveFeatures":["Specialist TPM 2.0 measured-boot and remote-attestation playbook, distinct from generic Linux hardening or integrity skills.","Covers both local event-log replay against live PCRs and remote quote generation/verification with nonce freshness.","Includes practical golden-baseline building and PCR-policy secret sealing, making it a complete trusted-computing workflow."],"familyIds":["linux-host-integrity-validation"]},{"id":"verifying-build-provenance-with-slsa-sigstore","summary":"Operational workflow to verify container image and release binary supply-chain integrity by checking keyless cosign signatures, SLSA provenance attestations, and builder/source identity against SLSA Build levels, with fail-closed gating for CI/CD.","primaryDomain":"security-knowledge","domainTags":["supply-chain-security","software-provenance","artifact-integrity"],"capabilityTags":["signature-verification","provenance-verification","attestation-verification","build-level-assessment","admission-control-gating"],"capabilityDetails":["Provides a workflow for verifying container image and release binary signatures and SLSA provenance using Sigstore cosign and slsa-verifier, enforcing keyless OIDC builder identity and source repository."],"techniqueTags":["keyless-verification","oidc-identity-pinning","transparency-log-verification","intoto-predicate-inspection","git-tag-pinning"],"techniqueDetails":["Uses short-lived Fulcio certificates bound to OIDC identities instead of long-lived keys.","Pins certificate OIDC issuer and certificate identity SAN to prevent impersonation.","Relies on Rekor transparency log for tamper-evident verification.","Inspects in-toto SLSA provenance predicates to confirm source repo, commit, and builder.","Pins source tags to prevent rollback or substitution."],"tools":["cosign","slsa-verifier","gh","jq"],"targetTypes":["container","binary","other"],"role":"specialist-playbook","workflowFocus":["validation","detection"],"distinctiveFeatures":["Combines cosign signature verification with SLSA provenance attestation and builder identity enforcement, covering both OCI images and release binaries, plus a fail-closed CI gate. Distinct from generic signature verification by requiring OIDC issuer and certificate identity pinning and SLSA Build L3 mapping."],"familyIds":["software-artifact-signing-and-provenance"]},{"id":"vm-and-bytecode-reverse","summary":"Expert playbook for reverse engineering custom virtual machines and bytecode interpreters: identify dispatcher loops, map opcodes, build custom disassemblers, and solve VM-based CTF challenges, including maze challenges and commercial VM protector analysis.","primaryDomain":"reverse-engineering","domainTags":["custom-vm","bytecode","code-obfuscation"],"capabilityTags":["custom-vm-reversing","bytecode-disassembly","opcode-mapping","vm-protector-analysis","maze-challenge-solving"],"capabilityDetails":["Provides a methodology for identifying custom VM dispatchers, mapping opcodes to operations, writing custom disassemblers, and solving VM-based CTF challenges, including maze challenges and commercial VM protector analysis."],"techniqueTags":["dispatcher-identification","handler-analysis","symbolic-execution","dynamic-tracing","custom-disassembler-writing","pathfinding"],"techniqueDetails":["Uses static analysis patterns (switch/table/if-chain dispatchers) to locate VM loops, then extracts bytecode and builds custom disassemblers; dynamic tracing and symbolic execution are used for analysis and solving; BFS/DFS used for maze solving."],"tools":["IDA Pro","Ghidra","angr","Unicorn","Miasm","Pin","DynamoRIO"],"targetTypes":["binary","ctf"],"role":"specialist-playbook","workflowFocus":["analysis","detection","knowledge-reference"],"distinctiveFeatures":["Specialized in custom VM and bytecode interpreters rather than general native binary reversing","Covers both CTF-style VM challenges and commercial VM protectors (VMProtect/Themida/Tigress)","Includes practical workflows for writing custom disassemblers and solving maze challenges"],"familyIds":["custom-vm-and-bytecode-reversing"]},{"id":"waf-bypass-techniques","summary":"Provides a WAF bypass playbook covering WAF identification, generic evasion categories (encoding, protocol abuse, HTTP/2, parameter pollution), payload mutation, IP spoofing, and origin-direct access, with a decision tree and routing to product-specific WAF techniques.","primaryDomain":"web-security","domainTags":["waf-bypass","web-application-firewall","evasion"],"capabilityTags":["waf-fingerprinting","waf-evasion","payload-mutation","protocol-bypass"],"capabilityDetails":["Provides a methodology for identifying WAFs and crafting evasions across payload types (SQLi, XSS, RCE), including encoding, protocol-level tricks, HTTP/2, parameter pollution, path normalization, and payload mutation."],"techniqueTags":["encoding-obfuscation","http-parameter-pollution","chunked-transfer-encoding","http2-bypass","path-normalization","content-type-switching","ip-spoofing","crlf-injection"],"techniqueDetails":["Covers encoding-based bypasses (URL, double URL, Unicode, hex, octal, mixed case, null byte), chunked transfer encoding splitting, HTTP/2 binary framing bypass, HTTP parameter pollution, IP-source spoofing headers, path normalization tricks, content-type switching, multipart boundary abuse, newline/whitespace injection, and keyword splitting/alternative syntax."],"tools":["wafw00f","nmap"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Generic cross-payload WAF bypass methodology that combines WAF fingerprinting, encoding and protocol-level evasion, and a decision tree, while linking to a product-specific WAF matrix and related exploit skills."],"familyIds":["waf-evasion-and-bypass"]},{"id":"web-app-penetration-testing","summary":"End-to-end web application penetration testing workflow using Strix autonomous agents; scans a live URL, validates findings with working PoCs, and supports source-assisted, credentialed, and multi-account testing for real-world access control and business logic flaws.","primaryDomain":"web-security","domainTags":["web-application-security","access-control","authentication"],"capabilityTags":["web-application-pentesting","vulnerability-validation","exploit-poc-generation"],"capabilityDetails":["Provides a complete workflow from authorization scoping through scanning, result review, and fix verification, with all findings backed by working exploits."],"techniqueTags":["black-box-testing","source-assisted-testing","access-control-testing","business-logic-testing","credentialed-scanning"],"techniqueDetails":["Uses autonomous agents to run dynamic scans against a running web app, with optional source-code access to deepen coverage.","Employs two or more test accounts to prove cross-account access-control flaws.","Validates every finding by re-running the provided PoC before reporting."],"tools":["strix"],"targetTypes":["web-application","api","source-code"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["End-to-end autonomous web app pentest workflow that validates each finding with a working PoC, not just a signature match.","Emphasizes two-account testing to prove multi-tenant IDOR and broken access control, and supports source-assisted white-box depth when source is provided.","Covers black-box, staging, localhost, and cloud/CLI execution paths with clear scoping and budget control."],"familyIds":["full-web-application-penetration-testing"]},{"id":"web-cache-deception","summary":"Playbook for detecting and exploiting web cache deception and cache poisoning, using path confusion and unkeyed header manipulation to steal authenticated data or serve malicious cached content.","primaryDomain":"web-security","domainTags":["web-cache-security","cdn-security","http-caching"],"capabilityTags":["web-cache-deception-testing","web-cache-poisoning-testing","cache-key-manipulation"],"capabilityDetails":["Provides a workflow for detecting and exploiting web cache deception and cache poisoning through path confusion and unkeyed header manipulation."],"techniqueTags":["path-confusion","unkeyed-header-injection","x-forwarded-host-injection","path-normalization-differential"],"techniqueDetails":["Uses path extension confusion and normalization differentials between CDN and application to cache authenticated responses; abuses unkeyed headers such as X-Forwarded-Host to poison cached content."],"tools":["curl"],"targetTypes":["web-application","api","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Combines web cache deception (stealing authenticated data) and web cache poisoning (serving malicious content) in a single methodology.","Emphasizes path normalization differences between CDN and application as the root cause of cache deception.","Covers unkeyed header poisoning patterns including X-Forwarded-Host and path separator tricks."],"familyIds":["host-header-and-web-cache-attacks"]},{"id":"websocket-security","summary":"Provides WebSocket security testing methodology and tooling for CSWSH, WebSocket smuggling, message injection, and binary serialization attacks, including step-by-step exploitation procedures.","primaryDomain":"web-security","domainTags":["websocket-security","real-time-communication","cswsh","socket-io"],"capabilityTags":["cswsh-exploitation","websocket-smuggling","message-injection","binary-protocol-testing","socket-io-testing"],"capabilityDetails":["Provides a workflow for identifying and exploiting WebSocket security vulnerabilities, including CSWSH, WebSocket smuggling, message injection, and binary serialization flaws.","Includes decision tree and step-by-step exploitation procedures for confirming and weaponizing WebSocket weaknesses."],"techniqueTags":["origin-validation-bypass","session-hijacking","protocol-smuggling","protobuf-manipulation","messagepack-manipulation","websocket-frame-injection"],"techniqueDetails":["Uses Origin header modification to test for missing validation and confirm CSWSH.","Tunnels raw HTTP or HTTP/2 traffic through WebSocket tunnels to bypass proxy restrictions.","Decodes and modifies binary frames (protobuf, MessagePack) to manipulate application data and trigger IDOR/SQLi.","Injects malicious event names and payloads into Socket.IO namespaces and acknowledgements."],"tools":["wsrepl","ws-harness","Burp Suite","SocketSleuth","WebSocket Turbo Intruder","sqlmap","protobuf-inspector","msgpack-tools","wsdump","Wireshark","websocket-client"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","analysis","validation","exploitation"],"distinctiveFeatures":["Focuses specifically on WebSocket protocol security rather than general web app testing, covering CSWSH, smuggling, Socket.IO, and binary message manipulation in depth.","Provides a bridge between WebSocket traffic and existing HTTP tooling (e.g., ws-harness with sqlmap) while also giving protocol-specific exploitation steps."],"familyIds":["websocket-security-testing"]},{"id":"windows-av-evasion","summary":"Expert playbook for bypassing AV/EDR on Windows, providing detailed techniques for AMSI and ETW bypass, in-memory .NET assembly loading, shellcode execution and process injection, unhooking via direct/indirect syscalls, payload encryption, and signature evasion, along with a decision tree for technique selection.","primaryDomain":"windows-security","domainTags":["av-evasion","edr-evasion","amsi-bypass","process-injection"],"capabilityTags":["amsi-bypass","etw-bypass","process-injection","shellcode-execution","unhooking","payload-obfuscation"],"capabilityDetails":["Provides step-by-step techniques for bypassing AMSI in PowerShell and .NET.","Covers ETW patching to disable telemetry.","Includes methods for in-memory .NET assembly loading and conversion to shellcode with Donut.","Details multiple process injection and shellcode execution techniques with code examples.","Explains direct/indirect syscall approaches and fresh ntdll copy to bypass EDR hooks.","Describes payload encryption, sleep obfuscation, and signature evasion methods."],"techniqueTags":["amsi-memory-patching","amsi-reflection","etw-eventwrite-patching","in-memory-assembly-loading","callback-shellcode-execution","apc-injection","process-hollowing","module-stomping","direct-syscalls","indirect-syscalls","sleep-obfuscation","api-hashing"],"techniqueDetails":["Memory patching and reflection-based modifications to AMSI to disable scanning.","Patching EtwEventWrite to stop ETW telemetry.","In-memory .NET assembly loading and conversion to shellcode with Donut.","Process injection via APC, CreateRemoteThread, process hollowing, and module stomping.","Direct and indirect syscall techniques to bypass EDR hooks.","Payload encryption (AES/XOR) and sleep obfuscation to evade memory scanners."],"tools":["powershell","donut","cobalt-strike","sliver","havoc","brute-ratel","syswhispers","hellsgate","confuserex"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["post-exploitation","exploitation"],"distinctiveFeatures":["Comprehensive expert playbook covering the full spectrum of Windows AV/EDR evasion: AMSI, ETW, .NET loading, injection, unhooking, encryption, and signature evasion.","Includes a decision tree for optimal technique selection based on the scenario.","Provides both low-level code examples and operational trade-off analysis."],"familyIds":["windows-av-edr-evasion"]},{"id":"windows-lateral-movement","summary":"Expert Windows lateral movement playbook covering PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, pass-the-ticket, and pivoting with OPSEC trade-offs and a decision tree.","primaryDomain":"windows-security","domainTags":["windows-security","lateral-movement","active-directory"],"capabilityTags":["lateral-movement-execution","pass-the-hash","pass-the-ticket","pivoting"],"capabilityDetails":["Provides execution playbooks for multiple Windows remote execution methods with credential requirements and OPSEC trade-offs."],"techniqueTags":["psexec","wmi","winrm","dcom","rdp","overpass-the-hash","pass-the-ticket","ssh-tunneling"],"techniqueDetails":["Compares execution methods by port, credential type, service creation, file-on-disk, and OPSEC."],"tools":["impacket","psexec","smbexec","atexec","wmiexec","evil-winrm","dcomexec","crackmapexec","mimikatz","rubeus","xfreerdp","chisel","ligolo-ng"],"targetTypes":["windows-host","active-directory","network"],"role":"specialist-playbook","workflowFocus":["exploitation","post-exploitation"],"distinctiveFeatures":["Covers both credential-based methods (PTH, overpass-the-hash, pass-the-ticket) and stealth comparison; includes pivoting techniques and a decision tree."],"familyIds":["windows-lateral-movement"]},{"id":"windows-privilege-escalation","summary":"Expert Windows local privilege escalation playbook covering enumeration, token/Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, scheduled tasks, registry autoruns, and named pipe impersonation, with a decision tree to guide vector selection.","primaryDomain":"windows-security","domainTags":["windows-privilege-escalation","token-abuse","service-misconfiguration","dll-hijacking","uac-bypass"],"capabilityTags":["local-privilege-escalation","windows-enumeration","token-abuse","potato-exploitation","service-misconfiguration-exploitation","dll-hijacking","uac-bypass","scheduled-task-abuse","registry-autorun-abuse"],"capabilityDetails":["Provides a comprehensive Windows local privilege escalation playbook covering enumeration, token and Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, scheduled task abuse, registry autoruns, and named pipe impersonation."],"techniqueTags":["seimpersonate-privilege-abuse","sebackup-privilege-abuse","potato-techniques","unquoted-service-path","weak-service-permission","dll-search-order-hijack","alwaysinstallelevated","scheduled-task-tampering","registry-run-key-abuse","named-pipe-impersonation"],"techniqueDetails":["Includes OS-version-specific tool selection for Potato variants, service ACL checks, DLL search order hijacking, registry key checks for AlwaysInstallElevated, and named pipe coercion."],"tools":["PrintSpoofer","GodPotato","JuicyPotato","RoguePotato","SweetPotato","winPEAS","PowerUp","Seatbelt","SharpUp","PrivescCheck","BeRoot","accesschk","procdump","msfvenom","sc","wmic","schtasks","reg","icacls","netstat","cmdkey"],"targetTypes":["windows-host"],"role":"specialist-playbook","workflowFocus":["enumeration","exploitation","analysis"],"distinctiveFeatures":["Covers token manipulation, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, registry autoruns, and named pipe impersonation with OS-version-specific tool selection; includes decision tree for path selection and references to detailed sub-guides."],"familyIds":["windows-privilege-escalation"]},{"id":"wxmini-security-audit","summary":"微信小程序全自动安全审计 Skill。使用 Agent Teams 编排 Agent，分阶段完成从反编译到报告生成的全流程静态安全分析。覆盖敏感信息泄露、API接口提取、加解密算法分析、漏洞分析四大维度。采用\"脚本预扫描 + LLM智能分析\"双层架构，脚本保证覆盖率，LLM保证准确率。","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"xlsx","summary":"Use this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .xltx, .csv, or .tsv file (e.g., adding columns, computing formulas, formatting, charting, cleaning messy data); create a new spreadsheet from scratch or from other data sources; or convert between tabular file formats. Trigger especially when the user references a spreadsheet file by name or path — even casually (like \\\"the xlsx in my downloads\\\") — and wants something done to it or produced from it. Also trigger for cleaning or restructuring messy tabular data files (malformed rows, misplaced headers, junk data) into proper spreadsheets. The deliverable must be a spreadsheet file. Do NOT trigger when the primary deliver","domainTags":[],"capabilityTags":[],"capabilityDetails":[],"techniqueTags":[],"techniqueDetails":[],"tools":[],"targetTypes":[],"workflowFocus":[],"distinctiveFeatures":[],"familyIds":[]},{"id":"xslt-injection","summary":"Provides a structured playbook for testing XSLT injection, from processor fingerprinting to file read/write and remote code execution via platform-specific extensions, with a decision tree for escalation.","primaryDomain":"injection","domainTags":["xslt-injection","xml-security"],"capabilityTags":["xslt-injection-testing","processor-fingerprinting","xxe-exploitation","file-read-write","rce-exploitation"],"capabilityDetails":["Provides a structured workflow for identifying XSLT processing endpoints, fingerprinting the underlying XSLT processor, and escalating to file read/write or remote code execution via XXE, document(), EXSLT, and platform-specific extension functions."],"techniqueTags":["system-property-fingerprinting","dtd-xxe","document-file-read","exslt-document-write","extension-function-rce"],"techniqueDetails":["Uses system-property() to determine the XSLT engine vendor and version, enabling targeted payload selection.","Leverages DTD entities within the stylesheet to read local files via XXE when external DTDs are permitted.","Uses document() to load local or remote resources, enabling file reads and SSRF.","Exploits EXSLT document extension to write arbitrary files to the filesystem, often leading to RCE.","Invokes language-specific extension functions such as php:function, Java Runtime.exec, and msxsl:script to achieve command execution."],"tools":["burp-suite","owasp-zap","collaborator"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Processor-first methodology that maps XSLT engine to specific escalation paths (libxslt, Java, .NET, PHP).","Covers multiple escalation primitives in one playbook: XXE, document() SSRF, EXSLT write, and extension-based RCE.","Provides clear routing to adjacent skills (xxe-xml-external-entity, ssrf-server-side-request-forgery) for out-of-scope scenarios."],"familyIds":["xslt-injection-testing"]},{"id":"xss-cross-site-scripting","summary":"Expert XSS attack playbook covering context-specific injection, multi-reflection attacks, CSP/WAF bypass, blind and second-order XSS, and post-exploitation chains such as cookie theft, CSRF, and WordPress RCE.","primaryDomain":"web-security","domainTags":["cross-site-scripting","web-application-security"],"capabilityTags":["xss-testing","context-aware-payload-selection","waf-bypass","csp-bypass","blind-xss","second-order-xss"],"capabilityDetails":["Provides an expert-level playbook for identifying XSS injection contexts, selecting effective payloads, bypassing filters and CSP, and escalating XSS to data theft, CSRF, or RCE."],"techniqueTags":["reflected-xss","stored-xss","dom-xss","blind-xss","second-order-xss","csp-bypass","waf-bypass","postmessage-xss"],"techniqueDetails":["Covers injection context matrix, multi-reflection payloads, DOM insert injection, PHP_SELF path injection, file upload XSS, postMessage attacks, encoding chains, tag mutation, JSONP/AngularJS CSP bypasses, blind XSS callbacks, and XSS exploitation chains."],"tools":["exiftool","netcat","xss-hunter"],"targetTypes":["web-application","api","other"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation","post-exploitation"],"distinctiveFeatures":["Assumes prior XSS knowledge and focuses on non-obvious techniques that general XSS skills omit, including multi-reflection attacks, second-order and blind XSS, advanced WAF/CSP bypasses, and full exploitation chains to cookie theft, CSRF, and WordPress RCE."],"familyIds":["cross-site-scripting-testing"]},{"id":"xxe-xml-external-entity","summary":"Expert XXE attack playbook covering detection and exploitation in direct XML, API, file upload, SOAP, SAML, and JSON-to-XML contexts, with blind OOB exfiltration, error-based leaks, local DTD bypasses, and SSRF/RCE chains.","primaryDomain":"web-security","domainTags":["xml-injection","file-read","ssrf","api-security"],"capabilityTags":["xxe-detection","blind-xxe-validation","oob-exfiltration","file-read-exploitation","xxe-to-ssrf"],"capabilityDetails":["Provides an expert playbook for detecting and exploiting XML External Entity injection across direct XML, SOAP, JSON-to-XML, SVG, OOXML, and SAML contexts, including out-of-band and error-based blind exfiltration, local DTD injection, and chaining to SSRF/XSLT."],"techniqueTags":["classic-xxe","oob-xxe","error-based-xxe","xinclude-injection","local-dtd-injection","parameter-entity-chaining","svg-xxe","ooxml-xxe","soap-xxe","xslt-injection"],"techniqueDetails":["Details attacker-hosted DTD OOB exfiltration, error-based file-content leakage, XInclude when DOCTYPE is blocked, local DTD entity overrides, parameter entity chaining to evade WAFs, and XSLT-based file read/RCE."],"tools":["Burp Collaborator","xxeserv"],"targetTypes":["web-application","api"],"role":"specialist-playbook","workflowFocus":["detection","validation","exploitation"],"distinctiveFeatures":["Covers the full XXE lifecycle beyond simple file read, including non-obvious XML contexts (SVG, Office files, SOAP, SAML, RSS, XMPP), blind OOB exfiltration, local DTD injection, parameter entity chaining, and XXE-to-SSRF/XSLT escalation."],"familyIds":["xml-injection-and-xxe-testing"]}],"relations":[{"source":"hack","target":"api-sec","relationship":"specializes"},{"source":"hack","target":"application-security-testing","relationship":"complementary"},{"source":"api-sec","target":"application-security-testing","relationship":"complementary"},{"source":"src-hunter","target":"intercepting-mobile-traffic-with-burpsuite","relationship":"generalizes"},{"source":"src-hunter","target":"mobile-ssl-pinning-bypass","relationship":"generalizes"},{"source":"intercepting-mobile-traffic-with-burpsuite","target":"mobile-ssl-pinning-bypass","relationship":"complementary"},{"source":"analyzing-android-malware-with-apktool","target":"reverse-engineering-android-malware-with-jadx","relationship":"workflow-variant"},{"source":"performing-mobile-app-certificate-pinning-bypass","target":"reverse-engineering-android-malware-with-jadx","relationship":"complementary"},{"source":"performing-mobile-app-certificate-pinning-bypass","target":"analyzing-android-malware-with-apktool","relationship":"complementary"},{"source":"detecting-mobile-malware-behavior","target":"performing-android-app-static-analysis-with-mobsf","relationship":"overlap"},{"source":"detecting-mobile-malware-behavior","target":"rev-dex-dumper","relationship":"complementary"},{"source":"rev-dex-dumper","target":"performing-android-app-static-analysis-with-mobsf","relationship":"complementary"},{"source":"analyzing-ios-app-security-with-objection","target":"performing-ios-app-security-assessment","relationship":"complementary"},{"source":"analyzing-ios-app-security-with-objection","target":"reverse-engineering-ios-app-with-frida","relationship":"complementary"},{"source":"performing-ios-app-security-assessment","target":"reverse-engineering-ios-app-with-frida","relationship":"complementary"},{"source":"performing-dynamic-analysis-of-android-app","target":"rev-frida","relationship":"complementary"},{"source":"performing-dynamic-analysis-of-android-app","target":"rev-unicorn-debug","relationship":"complementary"},{"source":"rev-frida","target":"rev-unicorn-debug","relationship":"complementary"},{"source":"conducting-mobile-app-penetration-test","target":"android-pentesting-tricks","relationship":"complementary"},{"source":"ios-pentesting-tricks","target":"exploiting-deeplink-vulnerabilities","relationship":"complementary"},{"source":"exploiting-deeplink-vulnerabilities","target":"testing-android-intents-for-vulnerabilities","relationship":"complementary"},{"source":"analyzing-cobalt-strike-beacon-configuration","target":"analyzing-cobaltstrike-malleable-c2-profiles","relationship":"complementary"},{"source":"extracting-config-from-agent-tesla-rat","target":"reverse-engineering-dotnet-malware-with-dnspy","relationship":"specializes"},{"source":"reverse-engineering-malware-with-ghidra","target":"reverse-engineering-ransomware-encryption-routine","relationship":"complementary"},{"source":"reverse-engineering-rust-malware","target":"reverse-engineering-malware-with-ghidra","relationship":"specializes"},{"source":"reverse-engineering-malware-with-ghidra","target":"vm-and-bytecode-reverse","relationship":"complementary"},{"source":"reverse-engineering-ransomware-encryption-routine","target":"reverse-engineering-rust-malware","relationship":"complementary"},{"source":"reverse-engineering-ransomware-encryption-routine","target":"vm-and-bytecode-reverse","relationship":"complementary"},{"source":"reverse-engineering-rust-malware","target":"vm-and-bytecode-reverse","relationship":"complementary"},{"source":"analyzing-ransomware-encryption-mechanisms","target":"analyzing-golang-malware-with-ghidra","relationship":"complementary"},{"source":"analyzing-ransomware-encryption-mechanisms","target":"analyzing-linux-elf-malware","relationship":"complementary"},{"source":"analyzing-ransomware-encryption-mechanisms","target":"analyzing-packed-malware-with-upx-unpacker","relationship":"complementary"},{"source":"analyzing-golang-malware-with-ghidra","target":"analyzing-linux-elf-malware","relationship":"complementary"},{"source":"analyzing-golang-malware-with-ghidra","target":"analyzing-packed-malware-with-upx-unpacker","relationship":"complementary"},{"source":"analyzing-linux-elf-malware","target":"analyzing-packed-malware-with-upx-unpacker","relationship":"complementary"},{"source":"anti-debugging-techniques","target":"code-obfuscation-deobfuscation","relationship":"complementary"},{"source":"code-obfuscation-deobfuscation","target":"analyzing-supply-chain-malware-artifacts","relationship":"complementary"},{"source":"code-obfuscation-deobfuscation","target":"performing-malware-ioc-extraction","relationship":"complementary"},{"source":"analyzing-supply-chain-malware-artifacts","target":"performing-malware-ioc-extraction","relationship":"complementary"},{"source":"performing-malware-triage-with-yara","target":"performing-static-malware-analysis-with-pe-studio","relationship":"complementary"},{"source":"auditing-aws-s3-bucket-permissions","target":"auditing-cloud-with-cis-benchmarks","relationship":"specializes"},{"source":"auditing-azure-active-directory-configuration","target":"auditing-cloud-with-cis-benchmarks","relationship":"specializes"},{"source":"auditing-gcp-iam-permissions","target":"auditing-cloud-with-cis-benchmarks","relationship":"specializes"},{"source":"auditing-aws-s3-bucket-permissions","target":"auditing-gcp-iam-permissions","relationship":"overlap"},{"source":"auditing-azure-active-directory-configuration","target":"auditing-gcp-iam-permissions","relationship":"complementary"},{"source":"auditing-terraform-infrastructure-for-security","target":"performing-aws-account-enumeration-with-scout-suite","relationship":"complementary"},{"source":"auditing-terraform-infrastructure-for-security","target":"performing-cloud-asset-inventory-with-cartography","relationship":"complementary"},{"source":"auditing-terraform-infrastructure-for-security","target":"performing-gcp-security-assessment-with-forseti","relationship":"complementary"},{"source":"performing-aws-account-enumeration-with-scout-suite","target":"performing-cloud-asset-inventory-with-cartography","relationship":"complementary"},{"source":"performing-aws-account-enumeration-with-scout-suite","target":"performing-gcp-security-assessment-with-forseti","relationship":"tool-specific"},{"source":"performing-cloud-asset-inventory-with-cartography","target":"performing-gcp-security-assessment-with-forseti","relationship":"complementary"},{"source":"implementing-aws-config-rules-for-compliance","target":"implementing-aws-security-hub","relationship":"complementary"},{"source":"implementing-aws-config-rules-for-compliance","target":"implementing-aws-security-hub-compliance","relationship":"complementary"},{"source":"implementing-aws-security-hub","target":"implementing-aws-security-hub-compliance","relationship":"overlap"},{"source":"implementing-azure-defender-for-cloud","target":"implementing-cloud-security-posture-management","relationship":"specializes"},{"source":"implementing-azure-defender-for-cloud","target":"implementing-cloud-vulnerability-posture-management","relationship":"specializes"},{"source":"implementing-cloud-vulnerability-posture-management","target":"implementing-cloud-security-posture-management","relationship":"specializes"},{"source":"implementing-gcp-organization-policy-constraints","target":"implementing-cloud-security-posture-management","relationship":"specializes"},{"source":"implementing-infrastructure-as-code-security-scanning","target":"securing-azure-with-microsoft-defender","relationship":"complementary"},{"source":"implementing-diamond-model-analysis","target":"building-threat-feed-aggregation-with-misp","relationship":"complementary"},{"source":"implementing-diamond-model-analysis","target":"building-threat-intelligence-feed-integration","relationship":"complementary"},{"source":"implementing-diamond-model-analysis","target":"building-threat-intelligence-platform","relationship":"complementary"},{"source":"building-threat-feed-aggregation-with-misp","target":"building-threat-intelligence-feed-integration","relationship":"complementary"},{"source":"building-threat-feed-aggregation-with-misp","target":"building-threat-intelligence-platform","relationship":"specializes"},{"source":"building-threat-intelligence-feed-integration","target":"building-threat-intelligence-platform","relationship":"specializes"},{"source":"collecting-indicators-of-compromise","target":"collecting-threat-intelligence-with-misp","relationship":"tool-specific"},{"source":"collecting-indicators-of-compromise","target":"correlating-threat-campaigns","relationship":"complementary"},{"source":"implementing-threat-intelligence-lifecycle-management","target":"collecting-indicators-of-compromise","relationship":"generalizes"},{"source":"collecting-threat-intelligence-with-misp","target":"correlating-threat-campaigns","relationship":"complementary"},{"source":"implementing-threat-intelligence-lifecycle-management","target":"collecting-threat-intelligence-with-misp","relationship":"tool-specific"},{"source":"implementing-threat-intelligence-lifecycle-management","target":"correlating-threat-campaigns","relationship":"generalizes"},{"source":"managing-intelligence-lifecycle","target":"analyzing-threat-intelligence-feeds","relationship":"generalizes"},{"source":"managing-intelligence-lifecycle","target":"automating-ioc-enrichment","relationship":"complementary"},{"source":"managing-intelligence-lifecycle","target":"building-ioc-defanging-and-sharing-pipeline","relationship":"generalizes"},{"source":"analyzing-threat-intelligence-feeds","target":"automating-ioc-enrichment","relationship":"complementary"},{"source":"analyzing-threat-intelligence-feeds","target":"building-ioc-defanging-and-sharing-pipeline","relationship":"complementary"},{"source":"automating-ioc-enrichment","target":"building-ioc-defanging-and-sharing-pipeline","relationship":"complementary"},{"source":"building-ioc-enrichment-pipeline-with-opencti","target":"modeling-threats-with-opencti","relationship":"complementary"},{"source":"performing-indicator-lifecycle-management","target":"building-ioc-enrichment-pipeline-with-opencti","relationship":"generalizes"},{"source":"building-ioc-enrichment-pipeline-with-opencti","target":"performing-ioc-enrichment-automation","relationship":"tool-specific"},{"source":"modeling-threats-with-opencti","target":"performing-indicator-lifecycle-management","relationship":"complementary"},{"source":"performing-indicator-lifecycle-management","target":"performing-ioc-enrichment-automation","relationship":"complementary"},{"source":"analyzing-cloud-storage-access-patterns","target":"detecting-s3-data-exfiltration-attempts","relationship":"generalizes"},{"source":"analyzing-azure-activity-logs-for-threats","target":"analyzing-office365-audit-logs-for-compromise","relationship":"complementary"},{"source":"detecting-serverless-function-injection","target":"detecting-shadow-it-cloud-usage","relationship":"complementary"},{"source":"detecting-serverless-function-injection","target":"detecting-suspicious-oauth-application-consent","relationship":"complementary"},{"source":"detecting-serverless-function-injection","target":"hunting-for-living-off-the-cloud-techniques","relationship":"complementary"},{"source":"detecting-shadow-it-cloud-usage","target":"detecting-suspicious-oauth-application-consent","relationship":"complementary"},{"source":"detecting-shadow-it-cloud-usage","target":"hunting-for-living-off-the-cloud-techniques","relationship":"complementary"},{"source":"detecting-suspicious-oauth-application-consent","target":"hunting-for-living-off-the-cloud-techniques","relationship":"complementary"},{"source":"implementing-cloud-trail-log-analysis","target":"implementing-cloud-workload-protection","relationship":"complementary"},{"source":"implementing-cloud-trail-log-analysis","target":"implementing-runtime-security-with-tetragon","relationship":"complementary"},{"source":"implementing-cloud-trail-log-analysis","target":"implementing-security-chaos-engineering","relationship":"complementary"},{"source":"implementing-cloud-workload-protection","target":"implementing-runtime-security-with-tetragon","relationship":"complementary"},{"source":"implementing-cloud-workload-protection","target":"implementing-security-chaos-engineering","relationship":"complementary"},{"source":"detecting-beaconing-patterns-with-zeek","target":"detecting-command-and-control-over-dns","relationship":"complementary"},{"source":"detecting-network-anomalies-with-zeek","target":"detecting-beaconing-patterns-with-zeek","relationship":"generalizes"},{"source":"detecting-network-anomalies-with-zeek","target":"detecting-command-and-control-over-dns","relationship":"generalizes"},{"source":"implementing-network-traffic-analysis-with-arkime","target":"implementing-network-traffic-baselining","relationship":"complementary"},{"source":"implementing-network-traffic-analysis-with-arkime","target":"implementing-ot-network-traffic-analysis-with-nozomi","relationship":"complementary"},{"source":"implementing-network-traffic-analysis-with-arkime","target":"monitoring-scada-modbus-traffic-anomalies","relationship":"complementary"},{"source":"implementing-network-traffic-baselining","target":"implementing-ot-network-traffic-analysis-with-nozomi","relationship":"complementary"},{"source":"implementing-network-traffic-baselining","target":"monitoring-scada-modbus-traffic-anomalies","relationship":"complementary"},{"source":"implementing-ot-network-traffic-analysis-with-nozomi","target":"monitoring-scada-modbus-traffic-anomalies","relationship":"complementary"},{"source":"performing-dns-tunneling-detection","target":"performing-network-packet-capture-analysis","relationship":"complementary"},{"source":"performing-dns-tunneling-detection","target":"performing-network-traffic-analysis-with-tshark","relationship":"specializes"},{"source":"performing-dns-tunneling-detection","target":"performing-network-traffic-analysis-with-zeek","relationship":"complementary"},{"source":"performing-network-packet-capture-analysis","target":"performing-network-traffic-analysis-with-tshark","relationship":"workflow-variant"},{"source":"performing-network-packet-capture-analysis","target":"performing-network-traffic-analysis-with-zeek","relationship":"complementary"},{"source":"performing-network-traffic-analysis-with-tshark","target":"performing-network-traffic-analysis-with-zeek","relationship":"complementary"},{"source":"analyzing-lnk-file-and-jump-list-artifacts","target":"analyzing-windows-lnk-files-for-artifacts","relationship":"overlap"},{"source":"analyzing-lnk-file-and-jump-list-artifacts","target":"analyzing-prefetch-files-for-execution-history","relationship":"complementary"},{"source":"analyzing-lnk-file-and-jump-list-artifacts","target":"analyzing-windows-amcache-artifacts","relationship":"complementary"},{"source":"analyzing-prefetch-files-for-execution-history","target":"analyzing-windows-amcache-artifacts","relationship":"complementary"},{"source":"analyzing-prefetch-files-for-execution-history","target":"analyzing-windows-lnk-files-for-artifacts","relationship":"complementary"},{"source":"analyzing-windows-amcache-artifacts","target":"analyzing-windows-lnk-files-for-artifacts","relationship":"complementary"},{"source":"analyzing-windows-prefetch-with-python","target":"performing-windows-artifact-analysis-with-eric-zimmerman-tools","relationship":"overlap"},{"source":"analyzing-windows-prefetch-with-python","target":"triaging-windows-with-kape","relationship":"complementary"},{"source":"performing-malware-persistence-investigation","target":"performing-windows-artifact-analysis-with-eric-zimmerman-tools","relationship":"complementary"},{"source":"performing-malware-persistence-investigation","target":"triaging-windows-with-kape","relationship":"complementary"},{"source":"performing-windows-artifact-analysis-with-eric-zimmerman-tools","target":"triaging-windows-with-kape","relationship":"complementary"},{"source":"analyzing-usb-device-connection-history","target":"analyzing-windows-registry-for-artifacts","relationship":"complementary"},{"source":"analyzing-usb-device-connection-history","target":"analyzing-windows-shellbag-artifacts","relationship":"complementary"},{"source":"analyzing-windows-registry-for-artifacts","target":"analyzing-windows-shellbag-artifacts","relationship":"generalizes"},{"source":"detecting-golden-ticket-attacks-in-kerberos-logs","target":"detecting-golden-ticket-forgery","relationship":"overlap"},{"source":"detecting-golden-ticket-attacks-in-kerberos-logs","target":"active-directory-kerberos-attacks","relationship":"complementary"},{"source":"detecting-golden-ticket-forgery","target":"active-directory-kerberos-attacks","relationship":"complementary"},{"source":"detecting-kerberoasting-attacks","target":"active-directory-kerberos-attacks","relationship":"complementary"},{"source":"detecting-pass-the-ticket-attacks","target":"active-directory-kerberos-attacks","relationship":"complementary"},{"source":"conducting-pass-the-ticket-attack","target":"windows-lateral-movement","relationship":"specializes"},{"source":"exploiting-kerberoasting-with-impacket","target":"performing-kerberoasting-attack","relationship":"overlap"},{"source":"conducting-pass-the-ticket-attack","target":"exploiting-constrained-delegation-abuse","relationship":"complementary"},{"source":"exploiting-constrained-delegation-abuse","target":"windows-lateral-movement","relationship":"complementary"},{"source":"exploiting-kerberoasting-with-impacket","target":"windows-lateral-movement","relationship":"complementary"},{"source":"performing-kerberoasting-attack","target":"windows-lateral-movement","relationship":"complementary"},{"source":"building-detection-rule-with-splunk-spl","target":"building-detection-rules-with-sigma","relationship":"complementary"},{"source":"building-detection-rule-with-splunk-spl","target":"implementing-mitre-attack-coverage-mapping","relationship":"complementary"},{"source":"building-detection-rule-with-splunk-spl","target":"implementing-siem-correlation-rules-for-apt","relationship":"technique-specific"},{"source":"building-detection-rule-with-splunk-spl","target":"implementing-siem-use-case-tuning","relationship":"complementary"},{"source":"building-detection-rules-with-sigma","target":"implementing-mitre-attack-coverage-mapping","relationship":"complementary"},{"source":"building-detection-rules-with-sigma","target":"implementing-siem-correlation-rules-for-apt","relationship":"technique-specific"},{"source":"building-detection-rules-with-sigma","target":"implementing-siem-use-case-tuning","relationship":"complementary"},{"source":"implementing-mitre-attack-coverage-mapping","target":"implementing-siem-correlation-rules-for-apt","relationship":"complementary"},{"source":"implementing-mitre-attack-coverage-mapping","target":"implementing-siem-use-case-tuning","relationship":"complementary"},{"source":"implementing-siem-correlation-rules-for-apt","target":"implementing-siem-use-case-tuning","relationship":"complementary"},{"source":"implementing-siem-use-cases-for-detection","target":"implementing-alert-fatigue-reduction","relationship":"overlap"},{"source":"implementing-siem-use-cases-for-detection","target":"performing-false-positive-reduction-in-siem","relationship":"complementary"},{"source":"implementing-siem-use-cases-for-detection","target":"performing-alert-triage-with-elastic-siem","relationship":"complementary"},{"source":"implementing-siem-use-cases-for-detection","target":"performing-log-source-onboarding-in-siem","relationship":"complementary"},{"source":"performing-false-positive-reduction-in-siem","target":"implementing-alert-fatigue-reduction","relationship":"specializes"},{"source":"implementing-alert-fatigue-reduction","target":"performing-alert-triage-with-elastic-siem","relationship":"complementary"},{"source":"performing-false-positive-reduction-in-siem","target":"performing-alert-triage-with-elastic-siem","relationship":"complementary"},{"source":"performing-false-positive-reduction-in-siem","target":"performing-log-source-onboarding-in-siem","relationship":"complementary"},{"source":"performing-alert-triage-with-elastic-siem","target":"performing-log-source-onboarding-in-siem","relationship":"complementary"},{"source":"implementing-alert-fatigue-reduction","target":"performing-log-source-onboarding-in-siem","relationship":"knowledge-support"},{"source":"api-authorization-and-bola","target":"detecting-api-enumeration-attacks","relationship":"workflow-variant"},{"source":"detecting-broken-object-property-level-authorization","target":"api-authorization-and-bola","relationship":"specializes"},{"source":"exploiting-broken-function-level-authorization","target":"api-authorization-and-bola","relationship":"specializes"},{"source":"exploiting-excessive-data-exposure-in-api","target":"detecting-broken-object-property-level-authorization","relationship":"specializes"},{"source":"exploiting-mass-assignment-in-rest-apis","target":"idor-broken-object-authorization","relationship":"specializes"},{"source":"idor-broken-object-authorization","target":"testing-api-for-broken-object-level-authorization","relationship":"overlap"},{"source":"hunting-for-registry-persistence-mechanisms","target":"hunting-for-registry-run-key-persistence","relationship":"specializes"},{"source":"hunting-for-registry-persistence-mechanisms","target":"hunting-for-scheduled-task-persistence","relationship":"complementary"},{"source":"hunting-for-registry-persistence-mechanisms","target":"hunting-for-shadow-copy-deletion","relationship":"complementary"},{"source":"hunting-for-registry-run-key-persistence","target":"hunting-for-scheduled-task-persistence","relationship":"complementary"},{"source":"hunting-for-registry-run-key-persistence","target":"hunting-for-shadow-copy-deletion","relationship":"complementary"},{"source":"hunting-for-scheduled-task-persistence","target":"hunting-for-shadow-copy-deletion","relationship":"complementary"},{"source":"hunting-for-startup-folder-persistence","target":"hunting-for-suspicious-scheduled-tasks","relationship":"complementary"},{"source":"hunting-for-startup-folder-persistence","target":"hunting-for-unusual-service-installations","relationship":"complementary"},{"source":"hunting-for-suspicious-scheduled-tasks","target":"hunting-for-unusual-service-installations","relationship":"technique-specific"},{"source":"building-incident-timeline-with-timesketch","target":"building-super-timelines-with-plaso","relationship":"complementary"},{"source":"building-incident-timeline-with-timesketch","target":"performing-linux-log-forensics-investigation","relationship":"complementary"},{"source":"building-incident-timeline-with-timesketch","target":"performing-log-analysis-for-forensic-investigation","relationship":"complementary"},{"source":"building-super-timelines-with-plaso","target":"performing-linux-log-forensics-investigation","relationship":"complementary"},{"source":"building-super-timelines-with-plaso","target":"performing-log-analysis-for-forensic-investigation","relationship":"complementary"},{"source":"performing-linux-log-forensics-investigation","target":"performing-log-analysis-for-forensic-investigation","relationship":"specializes"},{"source":"performing-timeline-reconstruction-with-plaso","target":"generating-forensic-timelines-with-hayabusa","relationship":"complementary"},{"source":"performing-timeline-reconstruction-with-plaso","target":"extracting-windows-event-logs-artifacts","relationship":"complementary"},{"source":"performing-timeline-reconstruction-with-plaso","target":"hunting-evtx-with-chainsaw","relationship":"complementary"},{"source":"extracting-windows-event-logs-artifacts","target":"generating-forensic-timelines-with-hayabusa","relationship":"specializes"},{"source":"extracting-windows-event-logs-artifacts","target":"hunting-evtx-with-chainsaw","relationship":"complementary"},{"source":"generating-forensic-timelines-with-hayabusa","target":"hunting-evtx-with-chainsaw","relationship":"tool-specific"},{"source":"exploiting-server-side-request-forgery","target":"performing-blind-ssrf-exploitation","relationship":"generalizes"},{"source":"performing-ssrf-vulnerability-exploitation","target":"exploiting-server-side-request-forgery","relationship":"tool-specific"},{"source":"exploiting-server-side-request-forgery","target":"open-redirect","relationship":"complementary"},{"source":"open-redirect","target":"performing-blind-ssrf-exploitation","relationship":"complementary"},{"source":"open-redirect","target":"performing-ssrf-vulnerability-exploitation","relationship":"complementary"},{"source":"performing-blind-ssrf-exploitation","target":"performing-ssrf-vulnerability-exploitation","relationship":"complementary"},{"source":"ssrf-server-side-request-forgery","target":"testing-for-xml-injection-vulnerabilities","relationship":"complementary"},{"source":"ssrf-server-side-request-forgery","target":"testing-for-xxe-injection-vulnerabilities","relationship":"complementary"},{"source":"ssrf-server-side-request-forgery","target":"xxe-xml-external-entity","relationship":"complementary"},{"source":"testing-for-xml-injection-vulnerabilities","target":"testing-for-xxe-injection-vulnerabilities","relationship":"generalizes"},{"source":"testing-for-xml-injection-vulnerabilities","target":"xxe-xml-external-entity","relationship":"generalizes"},{"source":"testing-for-xxe-injection-vulnerabilities","target":"xxe-xml-external-entity","relationship":"complementary"},{"source":"conducting-social-engineering-penetration-test","target":"conducting-social-engineering-pretext-call","relationship":"generalizes"},{"source":"conducting-social-engineering-penetration-test","target":"conducting-spearphishing-simulation-campaign","relationship":"generalizes"},{"source":"conducting-social-engineering-penetration-test","target":"executing-phishing-simulation-campaign","relationship":"generalizes"},{"source":"conducting-social-engineering-penetration-test","target":"performing-phishing-simulation-with-gophish","relationship":"tool-specific"},{"source":"conducting-social-engineering-pretext-call","target":"conducting-spearphishing-simulation-campaign","relationship":"complementary"},{"source":"conducting-social-engineering-pretext-call","target":"executing-phishing-simulation-campaign","relationship":"complementary"},{"source":"conducting-social-engineering-pretext-call","target":"performing-phishing-simulation-with-gophish","relationship":"complementary"},{"source":"conducting-spearphishing-simulation-campaign","target":"executing-phishing-simulation-campaign","relationship":"overlap"},{"source":"conducting-spearphishing-simulation-campaign","target":"performing-phishing-simulation-with-gophish","relationship":"tool-specific"},{"source":"executing-phishing-simulation-campaign","target":"performing-phishing-simulation-with-gophish","relationship":"tool-specific"},{"source":"performing-red-team-phishing-with-gophish","target":"implementing-anti-phishing-training-program","relationship":"complementary"},{"source":"analyzing-command-and-control-communication","target":"analyzing-dns-logs-for-exfiltration","relationship":"complementary"},{"source":"analyzing-command-and-control-communication","target":"analyzing-network-covert-channels-in-malware","relationship":"complementary"},{"source":"analyzing-command-and-control-communication","target":"analyzing-network-traffic-of-malware","relationship":"specializes"},{"source":"analyzing-dns-logs-for-exfiltration","target":"analyzing-network-covert-channels-in-malware","relationship":"complementary"},{"source":"analyzing-dns-logs-for-exfiltration","target":"analyzing-network-traffic-of-malware","relationship":"complementary"},{"source":"analyzing-network-covert-channels-in-malware","target":"analyzing-network-traffic-of-malware","relationship":"specializes"},{"source":"analyzing-ransomware-network-indicators","target":"detecting-ransomware-precursors-in-network","relationship":"complementary"},{"source":"deserialization-insecure","target":"exploiting-insecure-deserialization","relationship":"overlap"},{"source":"exploiting-prototype-pollution-in-javascript","target":"exploiting-template-injection-vulnerabilities","relationship":"complementary"},{"source":"ssti-server-side-template-injection","target":"jndi-injection","relationship":"overlap"},{"source":"clickjacking","target":"csrf-cross-site-request-forgery","relationship":"complementary"},{"source":"cors-cross-origin-misconfiguration","target":"csrf-cross-site-request-forgery","relationship":"complementary"},{"source":"cors-cross-origin-misconfiguration","target":"dns-rebinding-attacks","relationship":"complementary"},{"source":"performing-clickjacking-attack-test","target":"performing-csrf-attack-simulation","relationship":"overlap"},{"source":"active-directory-certificate-services","target":"exploiting-active-directory-certificate-services-esc1","relationship":"generalizes"},{"source":"active-directory-certificate-services","target":"exploiting-adcs-with-certipy","relationship":"complementary"},{"source":"active-directory-certificate-services","target":"relaying-ntlm-for-adcs-esc8","relationship":"generalizes"},{"source":"exploiting-active-directory-certificate-services-esc1","target":"exploiting-adcs-with-certipy","relationship":"specializes"},{"source":"exploiting-active-directory-certificate-services-esc1","target":"relaying-ntlm-for-adcs-esc8","relationship":"complementary"},{"source":"exploiting-adcs-with-certipy","target":"relaying-ntlm-for-adcs-esc8","relationship":"generalizes"},{"source":"detecting-lateral-movement-in-network","target":"detecting-lateral-movement-with-zeek","relationship":"generalizes"},{"source":"detecting-lateral-movement-in-network","target":"hunting-for-dcom-lateral-movement","relationship":"complementary"},{"source":"detecting-lateral-movement-in-network","target":"hunting-for-lateral-movement-via-wmi","relationship":"complementary"},{"source":"detecting-lateral-movement-with-zeek","target":"hunting-for-dcom-lateral-movement","relationship":"complementary"},{"source":"hunting-for-dcom-lateral-movement","target":"hunting-for-lateral-movement-via-wmi","relationship":"complementary"},{"source":"implementing-security-information-sharing-with-stix2","target":"implementing-stix-taxii-feed-integration","relationship":"complementary"},{"source":"implementing-security-information-sharing-with-stix2","target":"implementing-taxii-server-with-opentaxii","relationship":"complementary"},{"source":"implementing-security-information-sharing-with-stix2","target":"performing-threat-intelligence-sharing-with-misp","relationship":"complementary"},{"source":"implementing-stix-taxii-feed-integration","target":"implementing-taxii-server-with-opentaxii","relationship":"complementary"},{"source":"implementing-stix-taxii-feed-integration","target":"performing-threat-intelligence-sharing-with-misp","relationship":"complementary"},{"source":"implementing-taxii-server-with-opentaxii","target":"performing-threat-intelligence-sharing-with-misp","relationship":"complementary"},{"source":"abusing-dpapi-for-credential-access","target":"detecting-credential-dumping-techniques","relationship":"complementary"},{"source":"abusing-dpapi-for-credential-access","target":"detecting-mimikatz-execution-patterns","relationship":"tool-specific"},{"source":"detecting-credential-dumping-techniques","target":"detecting-mimikatz-execution-patterns","relationship":"complementary"},{"source":"detecting-credential-dumping-techniques","target":"detecting-t1003-credential-dumping-with-edr","relationship":"overlap"},{"source":"detecting-mimikatz-execution-patterns","target":"detecting-t1003-credential-dumping-with-edr","relationship":"complementary"},{"source":"detecting-process-hollowing-technique","target":"detecting-process-injection-techniques","relationship":"specializes"},{"source":"detecting-process-hollowing-technique","target":"detecting-t1055-process-injection-with-sysmon","relationship":"complementary"},{"source":"detecting-process-hollowing-technique","target":"hunting-for-process-injection-techniques","relationship":"complementary"},{"source":"detecting-process-injection-techniques","target":"detecting-t1055-process-injection-with-sysmon","relationship":"complementary"},{"source":"detecting-process-injection-techniques","target":"hunting-for-process-injection-techniques","relationship":"complementary"},{"source":"detecting-t1055-process-injection-with-sysmon","target":"hunting-for-process-injection-techniques","relationship":"workflow-variant"},{"source":"performing-wifi-password-cracking-with-aircrack","target":"performing-wireless-network-penetration-test","relationship":"specializes"},{"source":"performing-wireless-security-assessment-with-kismet","target":"performing-wireless-network-penetration-test","relationship":"specializes"},{"source":"performing-wifi-password-cracking-with-aircrack","target":"performing-wireless-security-assessment-with-kismet","relationship":"complementary"},{"source":"detecting-azure-lateral-movement","target":"detecting-azure-service-principal-abuse","relationship":"generalizes"},{"source":"detecting-azure-lateral-movement","target":"detecting-entra-offensive-tools-in-graph-logs","relationship":"complementary"},{"source":"detecting-azure-lateral-movement","target":"detecting-oauth-token-theft","relationship":"generalizes"},{"source":"detecting-azure-service-principal-abuse","target":"detecting-entra-offensive-tools-in-graph-logs","relationship":"complementary"},{"source":"detecting-azure-service-principal-abuse","target":"detecting-oauth-token-theft","relationship":"complementary"},{"source":"detecting-entra-offensive-tools-in-graph-logs","target":"detecting-oauth-token-theft","relationship":"complementary"},{"source":"conducting-full-scope-red-team-engagement","target":"executing-red-team-exercise","relationship":"overlap"},{"source":"conducting-full-scope-red-team-engagement","target":"executing-red-team-engagement-planning","relationship":"generalizes"},{"source":"executing-red-team-engagement-planning","target":"executing-red-team-exercise","relationship":"complementary"},{"source":"performing-hash-cracking-with-hashcat","target":"conducting-full-scope-red-team-engagement","relationship":"complementary"},{"source":"performing-hash-cracking-with-hashcat","target":"executing-red-team-exercise","relationship":"complementary"},{"source":"analyzing-linux-system-artifacts","target":"analyzing-linux-audit-logs-for-intrusion","relationship":"generalizes"},{"source":"analyzing-linux-system-artifacts","target":"analyzing-linux-kernel-rootkits","relationship":"generalizes"},{"source":"analyzing-linux-system-artifacts","target":"analyzing-persistence-mechanisms-in-linux","relationship":"generalizes"},{"source":"analyzing-linux-audit-logs-for-intrusion","target":"analyzing-linux-kernel-rootkits","relationship":"complementary"},{"source":"analyzing-linux-audit-logs-for-intrusion","target":"analyzing-persistence-mechanisms-in-linux","relationship":"complementary"},{"source":"analyzing-linux-kernel-rootkits","target":"analyzing-persistence-mechanisms-in-linux","relationship":"complementary"},{"source":"configuring-multi-factor-authentication-with-duo","target":"implementing-hardware-security-key-authentication","relationship":"complementary"},{"source":"configuring-multi-factor-authentication-with-duo","target":"implementing-passwordless-auth-with-microsoft-entra","relationship":"tool-specific"},{"source":"configuring-multi-factor-authentication-with-duo","target":"implementing-passwordless-authentication-with-fido2","relationship":"complementary"},{"source":"implementing-hardware-security-key-authentication","target":"implementing-passwordless-auth-with-microsoft-entra","relationship":"complementary"},{"source":"implementing-hardware-security-key-authentication","target":"implementing-passwordless-authentication-with-fido2","relationship":"specializes"},{"source":"implementing-passwordless-auth-with-microsoft-entra","target":"implementing-passwordless-authentication-with-fido2","relationship":"specializes"},{"source":"building-automated-malware-submission-pipeline","target":"conducting-malware-incident-response","relationship":"complementary"},{"source":"building-automated-malware-submission-pipeline","target":"eradicating-malware-from-infected-systems","relationship":"complementary"},{"source":"conducting-malware-incident-response","target":"eradicating-malware-from-infected-systems","relationship":"specializes"},{"source":"implementing-google-workspace-phishing-protection","target":"implementing-mimecast-targeted-attack-protection","relationship":"complementary"},{"source":"implementing-google-workspace-phishing-protection","target":"implementing-proofpoint-email-security-gateway","relationship":"complementary"},{"source":"implementing-mimecast-targeted-attack-protection","target":"implementing-proofpoint-email-security-gateway","relationship":"tool-specific"},{"source":"implementing-sigstore-for-software-signing","target":"verifying-build-provenance-with-slsa-sigstore","relationship":"complementary"},{"source":"implementing-sigstore-for-software-signing","target":"implementing-code-signing-for-artifacts","relationship":"specializes"},{"source":"verifying-build-provenance-with-slsa-sigstore","target":"implementing-code-signing-for-artifacts","relationship":"complementary"},{"source":"fix-security-vulnerabilities-with-strix","target":"penetration-testing-with-strix","relationship":"complementary"},{"source":"fix-security-vulnerabilities-with-strix","target":"managed-pentesting-with-strix","relationship":"complementary"},{"source":"penetration-testing-with-strix","target":"managed-pentesting-with-strix","relationship":"generalizes"},{"source":"exploiting-bgp-hijacking-vulnerabilities","target":"implementing-bgp-security-with-rpki","relationship":"complementary"},{"source":"monitoring-darkweb-sources","target":"performing-dark-web-monitoring-for-threats","relationship":"complementary"},{"source":"monitoring-darkweb-sources","target":"performing-paste-site-monitoring-for-credentials","relationship":"generalizes"},{"source":"performing-dark-web-monitoring-for-threats","target":"performing-paste-site-monitoring-for-credentials","relationship":"generalizes"},{"source":"implementing-soar-automation-with-phantom","target":"implementing-soar-playbook-for-phishing","relationship":"complementary"},{"source":"implementing-soar-automation-with-phantom","target":"implementing-soar-playbook-with-palo-alto-xsoar","relationship":"tool-specific"},{"source":"implementing-soar-playbook-for-phishing","target":"implementing-soar-playbook-with-palo-alto-xsoar","relationship":"tool-specific"},{"source":"business-logic-vuln","target":"business-logic-vulnerabilities","relationship":"router-of"},{"source":"business-logic-vuln","target":"testing-for-business-logic-vulnerabilities","relationship":"router-of"},{"source":"business-logic-vulnerabilities","target":"testing-for-business-logic-vulnerabilities","relationship":"overlap"},{"source":"executing-active-directory-attack-simulation","target":"performing-active-directory-penetration-test","relationship":"overlap"},{"source":"analyzing-network-flow-data-with-netflow","target":"analyzing-network-traffic-for-incidents","relationship":"complementary"},{"source":"performing-cloud-forensics-investigation","target":"performing-cloud-storage-forensic-acquisition","relationship":"independent"},{"source":"testing-api-security-with-owasp-top-10","target":"testing-websocket-api-security","relationship":"complementary"},{"source":"performing-threat-landscape-assessment-for-sector","target":"profiling-threat-actor-groups","relationship":"complementary"},{"source":"performing-privilege-escalation-assessment","target":"windows-privilege-escalation","relationship":"complementary"},{"source":"api-recon-and-docs","target":"detecting-shadow-api-endpoints","relationship":"complementary"},{"source":"implementing-llm-guardrails-for-security","target":"securing-agentic-ai-tool-invocation","relationship":"complementary"},{"source":"performing-adversary-in-the-middle-phishing-detection","target":"performing-initial-access-with-evilginx3","relationship":"complementary"},{"source":"detecting-aws-credential-exposure-with-trufflehog","target":"detecting-aws-iam-privilege-escalation","relationship":"complementary"},{"source":"implementing-aws-iam-permission-boundaries","target":"implementing-azure-ad-privileged-identity-management","relationship":"complementary"},{"source":"analyzing-email-headers-for-phishing-investigation","target":"analyzing-outlook-pst-for-email-forensics","relationship":"complementary"},{"source":"implementing-attack-path-analysis-with-xm-cyber","target":"implementing-continuous-security-validation-with-bas","relationship":"complementary"},{"source":"linux-privilege-escalation","target":"performing-privilege-escalation-on-linux","relationship":"overlap"},{"source":"hunting-for-dns-based-persistence","target":"hunting-for-dns-tunneling-with-zeek","relationship":"complementary"},{"source":"implementing-network-access-control","target":"implementing-network-access-control-with-cisco-ise","relationship":"generalizes"},{"source":"pentest-report","target":"security_reporter","relationship":"overlap"},{"source":"deobfuscating-javascript-malware","target":"deobfuscating-powershell-obfuscated-malware","relationship":"complementary"},{"source":"implementing-aes-encryption-for-data-at-rest","target":"implementing-end-to-end-encryption-for-messaging","relationship":"complementary"},{"source":"performing-ransomware-tabletop-exercise","target":"performing-soc-tabletop-exercise","relationship":"specializes"},{"source":"implementing-secret-scanning-with-gitleaks","target":"implementing-secrets-scanning-in-ci-cd","relationship":"complementary"},{"source":"integrating-dast-with-owasp-zap-in-pipeline","target":"owasp-top-10-testing","relationship":"complementary"},{"source":"analyzing-kubernetes-audit-logs","target":"auditing-kubernetes-cluster-rbac","relationship":"complementary"},{"source":"analyzing-kubernetes-audit-logs","target":"auditing-kubernetes-rbac-privilege-escalation","relationship":"complementary"},{"source":"auditing-kubernetes-cluster-rbac","target":"auditing-kubernetes-rbac-privilege-escalation","relationship":"specializes"},{"source":"benchmarking-kubernetes-with-kube-bench","target":"performing-docker-bench-security-assessment","relationship":"complementary"},{"source":"benchmarking-kubernetes-with-kube-bench","target":"performing-container-escape-detection","relationship":"complementary"},{"source":"performing-container-escape-detection","target":"performing-docker-bench-security-assessment","relationship":"complementary"},{"source":"performing-kubernetes-cis-benchmark-with-kube-bench","target":"performing-kubernetes-etcd-security-assessment","relationship":"specializes"},{"source":"performing-kubernetes-cis-benchmark-with-kube-bench","target":"scanning-kubernetes-manifests-with-kubesec","relationship":"complementary"},{"source":"securing-helm-chart-deployments","target":"securing-kubernetes-on-cloud","relationship":"complementary"},{"source":"securing-helm-chart-deployments","target":"implementing-kubernetes-pod-security-standards","relationship":"complementary"},{"source":"securing-kubernetes-on-cloud","target":"implementing-kubernetes-pod-security-standards","relationship":"specializes"},{"source":"implementing-opa-gatekeeper-for-policy-enforcement","target":"implementing-pod-security-admission-controller","relationship":"complementary"},{"source":"implementing-opa-gatekeeper-for-policy-enforcement","target":"implementing-policy-as-code-with-open-policy-agent","relationship":"specializes"},{"source":"implementing-pod-security-admission-controller","target":"implementing-policy-as-code-with-open-policy-agent","relationship":"complementary"},{"source":"implementing-rbac-hardening-for-kubernetes","target":"implementing-supply-chain-security-with-in-toto","relationship":"complementary"},{"source":"implementing-rbac-hardening-for-kubernetes","target":"performing-container-image-hardening","relationship":"complementary"},{"source":"implementing-supply-chain-security-with-in-toto","target":"performing-container-image-hardening","relationship":"complementary"},{"source":"hardening-docker-daemon-configuration","target":"hardening-linux-endpoint-with-cis-benchmark","relationship":"complementary"},{"source":"exploiting-websocket-vulnerabilities","target":"websocket-security","relationship":"complementary"},{"source":"ctf-web","target":"exploiting-websocket-vulnerabilities","relationship":"router-of"},{"source":"ctf-web","target":"websocket-security","relationship":"router-of"},{"source":"ctf-web","target":"testing-for-sensitive-data-exposure","relationship":"router-of"},{"source":"exploiting-idor-vulnerabilities","target":"testing-for-broken-access-control","relationship":"specializes"},{"source":"exploiting-idor-vulnerabilities","target":"performing-web-application-penetration-test","relationship":"specializes"},{"source":"exploiting-idor-vulnerabilities","target":"web-app-penetration-testing","relationship":"specializes"},{"source":"testing-for-broken-access-control","target":"performing-web-application-penetration-test","relationship":"specializes"},{"source":"testing-for-broken-access-control","target":"web-app-penetration-testing","relationship":"complementary"},{"source":"performing-web-application-penetration-test","target":"web-app-penetration-testing","relationship":"workflow-variant"},{"source":"401-403-bypass-techniques","target":"bypassing-authentication-with-forced-browsing","relationship":"complementary"},{"source":"401-403-bypass-techniques","target":"http-host-header-attacks","relationship":"overlap"},{"source":"http-parameter-pollution","target":"performing-http-parameter-pollution-attack","relationship":"overlap"},{"source":"http2-specific-attacks","target":"request-smuggling","relationship":"overlap"},{"source":"subdomain-takeover","target":"exploiting-broken-link-hijacking","relationship":"overlap"},{"source":"conducting-internal-network-penetration-test","target":"conducting-network-penetration-test","relationship":"specializes"},{"source":"conducting-man-in-the-middle-attack-simulation","target":"conducting-network-penetration-test","relationship":"specializes"},{"source":"conducting-internal-network-penetration-test","target":"conducting-man-in-the-middle-attack-simulation","relationship":"complementary"},{"source":"building-c2-redirector-infrastructure","target":"conducting-network-penetration-test","relationship":"complementary"},{"source":"building-c2-redirector-infrastructure","target":"conducting-internal-network-penetration-test","relationship":"complementary"},{"source":"exploiting-smb-vulnerabilities-with-metasploit","target":"network-protocol-attacks","relationship":"complementary"},{"source":"network-protocol-attacks","target":"performing-arp-spoofing-attack-simulation","relationship":"generalizes"},{"source":"performing-bandwidth-throttling-attack-simulation","target":"performing-packet-injection-attack","relationship":"complementary"},{"source":"performing-bandwidth-throttling-attack-simulation","target":"performing-external-network-penetration-test","relationship":"complementary"},{"source":"performing-packet-injection-attack","target":"performing-external-network-penetration-test","relationship":"complementary"},{"source":"performing-dns-enumeration-and-zone-transfer","target":"performing-external-network-penetration-test","relationship":"specializes"},{"source":"scanning-network-with-nmap-advanced","target":"tunneling-and-pivoting","relationship":"complementary"},{"source":"scanning-network-with-nmap-advanced","target":"unauthorized-access-common-services","relationship":"complementary"},{"source":"scanning-network-with-nmap-advanced","target":"performing-vlan-hopping-attack","relationship":"complementary"},{"source":"tunneling-and-pivoting","target":"unauthorized-access-common-services","relationship":"complementary"},{"source":"tunneling-and-pivoting","target":"performing-vlan-hopping-attack","relationship":"complementary"},{"source":"abusing-shadow-credentials-for-privesc","target":"active-directory-acl-abuse","relationship":"specializes"},{"source":"abusing-shadow-credentials-for-privesc","target":"analyzing-active-directory-acl-abuse","relationship":"complementary"},{"source":"abusing-shadow-credentials-for-privesc","target":"conducting-internal-reconnaissance-with-bloodhound-ce","relationship":"complementary"},{"source":"active-directory-acl-abuse","target":"analyzing-active-directory-acl-abuse","relationship":"complementary"},{"source":"active-directory-acl-abuse","target":"conducting-internal-reconnaissance-with-bloodhound-ce","relationship":"complementary"},{"source":"analyzing-active-directory-acl-abuse","target":"conducting-internal-reconnaissance-with-bloodhound-ce","relationship":"complementary"},{"source":"exploiting-active-directory-with-bloodhound","target":"mapping-attack-paths-with-bloodhound-ce","relationship":"overlap"},{"source":"exploiting-active-directory-with-bloodhound","target":"performing-active-directory-bloodhound-analysis","relationship":"workflow-variant"},{"source":"mapping-attack-paths-with-bloodhound-ce","target":"performing-active-directory-bloodhound-analysis","relationship":"overlap"},{"source":"exploiting-active-directory-with-bloodhound","target":"moving-laterally-with-netexec","relationship":"complementary"},{"source":"mapping-attack-paths-with-bloodhound-ce","target":"moving-laterally-with-netexec","relationship":"complementary"},{"source":"performing-active-directory-bloodhound-analysis","target":"moving-laterally-with-netexec","relationship":"complementary"},{"source":"ntlm-relay-coercion","target":"hunting-for-ntlm-relay-attacks","relationship":"complementary"},{"source":"hunting-for-dcsync-attacks","target":"hunting-for-ntlm-relay-attacks","relationship":"workflow-variant"},{"source":"hunting-for-ntlm-relay-attacks","target":"hunting-for-t1098-account-manipulation","relationship":"workflow-variant"},{"source":"hunting-for-dcsync-attacks","target":"hunting-for-t1098-account-manipulation","relationship":"workflow-variant"},{"source":"performing-active-directory-compromise-investigation","target":"performing-active-directory-vulnerability-assessment","relationship":"complementary"},{"source":"performing-active-directory-compromise-investigation","target":"detecting-dcsync-attack-in-active-directory","relationship":"generalizes"},{"source":"performing-active-directory-vulnerability-assessment","target":"detecting-dcsync-attack-in-active-directory","relationship":"complementary"},{"source":"ctf-ai-ml","target":"ai-ml-security","relationship":"specializes"},{"source":"ctf-ai-ml","target":"assessing-vector-and-embedding-weaknesses","relationship":"complementary"},{"source":"ctf-ai-ml","target":"red-teaming-llms-with-garak","relationship":"tool-specific"},{"source":"assessing-vector-and-embedding-weaknesses","target":"ai-ml-security","relationship":"specializes"},{"source":"red-teaming-llms-with-garak","target":"ai-ml-security","relationship":"specializes"},{"source":"assessing-vector-and-embedding-weaknesses","target":"red-teaming-llms-with-garak","relationship":"complementary"},{"source":"auditing-mcp-servers-for-tool-poisoning","target":"continuous-llm-red-teaming-with-promptfoo","relationship":"complementary"},{"source":"auditing-mcp-servers-for-tool-poisoning","target":"llm-prompt-injection","relationship":"complementary"},{"source":"continuous-llm-red-teaming-with-promptfoo","target":"llm-prompt-injection","relationship":"complementary"},{"source":"continuous-llm-red-teaming-with-promptfoo","target":"orchestrating-llm-attacks-with-pyrit","relationship":"tool-specific"},{"source":"llm-prompt-injection","target":"orchestrating-llm-attacks-with-pyrit","relationship":"complementary"},{"source":"testing-for-system-prompt-leakage","target":"testing-prompt-injection-in-rag-pipelines","relationship":"complementary"},{"source":"testing-prompt-injection-in-rag-pipelines","target":"detecting-ai-model-prompt-injection-attacks","relationship":"complementary"},{"source":"testing-prompt-injection-in-rag-pipelines","target":"detecting-indirect-prompt-injection","relationship":"complementary"},{"source":"detecting-ai-model-prompt-injection-attacks","target":"detecting-indirect-prompt-injection","relationship":"overlap"},{"source":"analyzing-heap-spray-exploitation","target":"analyzing-memory-dumps-with-volatility","relationship":"specializes"},{"source":"analyzing-heap-spray-exploitation","target":"analyzing-memory-forensics-with-lime-and-volatility","relationship":"complementary"},{"source":"analyzing-heap-spray-exploitation","target":"collecting-volatile-evidence-from-compromised-host","relationship":"complementary"},{"source":"analyzing-memory-dumps-with-volatility","target":"analyzing-memory-forensics-with-lime-and-volatility","relationship":"generalizes"},{"source":"analyzing-memory-dumps-with-volatility","target":"collecting-volatile-evidence-from-compromised-host","relationship":"complementary"},{"source":"analyzing-memory-forensics-with-lime-and-volatility","target":"collecting-volatile-evidence-from-compromised-host","relationship":"complementary"},{"source":"conducting-memory-forensics-with-volatility","target":"extracting-credentials-from-memory-dump","relationship":"generalizes"},{"source":"conducting-memory-forensics-with-volatility","target":"extracting-memory-artifacts-with-rekall","relationship":"tool-specific"},{"source":"conducting-memory-forensics-with-volatility","target":"memory-forensics-volatility","relationship":"overlap"},{"source":"memory-forensics-volatility","target":"extracting-credentials-from-memory-dump","relationship":"generalizes"},{"source":"memory-forensics-volatility","target":"extracting-memory-artifacts-with-rekall","relationship":"tool-specific"},{"source":"performing-memory-forensics-with-volatility3","target":"performing-memory-forensics-with-volatility3-plugins","relationship":"complementary"},{"source":"performing-memory-forensics-with-volatility3","target":"detecting-rootkit-activity","relationship":"specializes"},{"source":"performing-memory-forensics-with-volatility3-plugins","target":"detecting-rootkit-activity","relationship":"complementary"},{"source":"performing-agentless-vulnerability-scanning","target":"performing-authenticated-vulnerability-scan","relationship":"complementary"},{"source":"performing-agentless-vulnerability-scanning","target":"scanning-container-images-with-grype","relationship":"complementary"},{"source":"performing-agentless-vulnerability-scanning","target":"building-vulnerability-scanning-workflow","relationship":"complementary"},{"source":"performing-authenticated-vulnerability-scan","target":"scanning-container-images-with-grype","relationship":"complementary"},{"source":"performing-authenticated-vulnerability-scan","target":"building-vulnerability-scanning-workflow","relationship":"complementary"},{"source":"scanning-container-images-with-grype","target":"building-vulnerability-scanning-workflow","relationship":"complementary"},{"source":"implementing-rapid7-insightvm-for-scanning","target":"implementing-vulnerability-management-with-greenbone","relationship":"tool-specific"},{"source":"implementing-rapid7-insightvm-for-scanning","target":"performing-authenticated-scan-with-openvas","relationship":"tool-specific"},{"source":"implementing-rapid7-insightvm-for-scanning","target":"performing-vulnerability-scanning-with-nessus","relationship":"tool-specific"},{"source":"implementing-vulnerability-management-with-greenbone","target":"performing-authenticated-scan-with-openvas","relationship":"complementary"},{"source":"implementing-vulnerability-management-with-greenbone","target":"performing-vulnerability-scanning-with-nessus","relationship":"tool-specific"},{"source":"performing-authenticated-scan-with-openvas","target":"performing-vulnerability-scanning-with-nessus","relationship":"tool-specific"},{"source":"scanning-infrastructure-with-nessus","target":"building-vulnerability-aging-and-sla-tracking","relationship":"complementary"},{"source":"scanning-infrastructure-with-nessus","target":"building-vulnerability-dashboard-with-defectdojo","relationship":"complementary"},{"source":"building-vulnerability-aging-and-sla-tracking","target":"building-vulnerability-dashboard-with-defectdojo","relationship":"overlap"},{"source":"building-cloud-siem-with-sentinel","target":"building-phishing-reporting-button-workflow","relationship":"complementary"},{"source":"building-cloud-siem-with-sentinel","target":"conducting-cloud-incident-response","relationship":"complementary"},{"source":"building-cloud-siem-with-sentinel","target":"detecting-compromised-cloud-credentials","relationship":"complementary"},{"source":"building-cloud-siem-with-sentinel","target":"performing-cloud-forensics-with-aws-cloudtrail","relationship":"complementary"},{"source":"conducting-cloud-incident-response","target":"detecting-compromised-cloud-credentials","relationship":"generalizes"},{"source":"conducting-cloud-incident-response","target":"performing-cloud-forensics-with-aws-cloudtrail","relationship":"specializes"},{"source":"detecting-compromised-cloud-credentials","target":"performing-cloud-forensics-with-aws-cloudtrail","relationship":"complementary"},{"source":"performing-cloud-incident-containment-procedures","target":"containing-active-breach","relationship":"complementary"},{"source":"performing-cloud-incident-containment-procedures","target":"performing-cloud-log-forensics-with-athena","relationship":"complementary"},{"source":"performing-cloud-incident-containment-procedures","target":"performing-cloud-native-forensics-with-falco","relationship":"complementary"},{"source":"performing-cloud-incident-containment-procedures","target":"performing-cloud-native-threat-hunting-with-aws-detective","relationship":"complementary"},{"source":"performing-cloud-log-forensics-with-athena","target":"containing-active-breach","relationship":"complementary"},{"source":"performing-cloud-log-forensics-with-athena","target":"performing-cloud-native-forensics-with-falco","relationship":"complementary"},{"source":"performing-cloud-log-forensics-with-athena","target":"performing-cloud-native-threat-hunting-with-aws-detective","relationship":"complementary"},{"source":"performing-cloud-native-forensics-with-falco","target":"performing-cloud-native-threat-hunting-with-aws-detective","relationship":"complementary"},{"source":"performing-cloud-native-threat-hunting-with-aws-detective","target":"containing-active-breach","relationship":"complementary"},{"source":"csp-bypass-advanced","target":"dangling-markup-injection","relationship":"generalizes"},{"source":"csp-bypass-advanced","target":"exploit-xss","relationship":"specializes"},{"source":"csp-bypass-advanced","target":"testing-for-xss-vulnerabilities","relationship":"specializes"},{"source":"dangling-markup-injection","target":"exploit-xss","relationship":"specializes"},{"source":"dangling-markup-injection","target":"testing-for-xss-vulnerabilities","relationship":"specializes"},{"source":"exploit-xss","target":"testing-for-xss-vulnerabilities","relationship":"overlap"},{"source":"testing-for-xss-vulnerabilities-with-burpsuite","target":"xss-cross-site-scripting","relationship":"complementary"},{"source":"testing-for-xss-vulnerabilities-with-burpsuite","target":"performing-web-application-firewall-bypass","relationship":"complementary"},{"source":"testing-for-xss-vulnerabilities-with-burpsuite","target":"waf-bypass-techniques","relationship":"complementary"},{"source":"xss-cross-site-scripting","target":"performing-web-application-firewall-bypass","relationship":"complementary"},{"source":"xss-cross-site-scripting","target":"waf-bypass-techniques","relationship":"complementary"},{"source":"performing-web-application-firewall-bypass","target":"waf-bypass-techniques","relationship":"complementary"},{"source":"recon-fingerprint","target":"performing-content-security-policy-bypass","relationship":"complementary"},{"source":"detecting-container-drift-at-runtime","target":"detecting-container-runtime-threats-with-falco","relationship":"complementary"},{"source":"detecting-container-drift-at-runtime","target":"detecting-privilege-escalation-in-kubernetes-pods","relationship":"complementary"},{"source":"detecting-container-drift-at-runtime","target":"escaping-containers-to-host","relationship":"complementary"},{"source":"detecting-container-runtime-threats-with-falco","target":"detecting-privilege-escalation-in-kubernetes-pods","relationship":"overlap"},{"source":"detecting-container-runtime-threats-with-falco","target":"escaping-containers-to-host","relationship":"complementary"},{"source":"detecting-privilege-escalation-in-kubernetes-pods","target":"escaping-containers-to-host","relationship":"complementary"},{"source":"detecting-container-escape-attempts","target":"detecting-container-escape-with-falco-rules","relationship":"overlap"},{"source":"detecting-container-escape-attempts","target":"implementing-ebpf-security-monitoring","relationship":"complementary"},{"source":"detecting-container-escape-with-falco-rules","target":"implementing-ebpf-security-monitoring","relationship":"complementary"},{"source":"api-auth-and-jwt-abuse","target":"testing-api-for-mass-assignment-vulnerability","relationship":"generalizes"},{"source":"api-auth-and-jwt-abuse","target":"testing-oauth2-implementation-flaws","relationship":"router-of"},{"source":"api-auth-and-jwt-abuse","target":"exploiting-jwt-algorithm-confusion-attack","relationship":"generalizes"},{"source":"api-auth-and-jwt-abuse","target":"testing-mobile-api-authentication","relationship":"complementary"},{"source":"testing-mobile-api-authentication","target":"testing-oauth2-implementation-flaws","relationship":"complementary"},{"source":"testing-mobile-api-authentication","target":"exploiting-jwt-algorithm-confusion-attack","relationship":"complementary"},{"source":"performing-jwt-none-algorithm-attack","target":"testing-api-authentication-weaknesses","relationship":"specializes"},{"source":"implementing-api-key-security-controls","target":"testing-api-authentication-weaknesses","relationship":"complementary"},{"source":"configuring-microsegmentation-for-zero-trust","target":"configuring-network-segmentation-with-vlans","relationship":"complementary"},{"source":"configuring-microsegmentation-for-zero-trust","target":"configuring-pfsense-firewall-rules","relationship":"complementary"},{"source":"configuring-microsegmentation-for-zero-trust","target":"implementing-container-network-policies-with-calico","relationship":"generalizes"},{"source":"configuring-microsegmentation-for-zero-trust","target":"implementing-kubernetes-network-policy-with-calico","relationship":"generalizes"},{"source":"configuring-network-segmentation-with-vlans","target":"configuring-pfsense-firewall-rules","relationship":"complementary"},{"source":"implementing-container-network-policies-with-calico","target":"implementing-kubernetes-network-policy-with-calico","relationship":"complementary"},{"source":"implementing-microsegmentation-with-guardicore","target":"implementing-network-policies-for-kubernetes","relationship":"complementary"},{"source":"implementing-microsegmentation-with-guardicore","target":"implementing-network-segmentation-with-firewall-zones","relationship":"complementary"},{"source":"implementing-network-policies-for-kubernetes","target":"implementing-network-segmentation-with-firewall-zones","relationship":"complementary"},{"source":"analyzing-mft-for-deleted-file-recovery","target":"analyzing-disk-image-with-autopsy","relationship":"specializes"},{"source":"analyzing-slack-space-and-file-system-artifacts","target":"analyzing-disk-image-with-autopsy","relationship":"specializes"},{"source":"analyzing-disk-image-with-autopsy","target":"parsing-artifacts-with-eric-zimmerman-tools","relationship":"complementary"},{"source":"analyzing-mft-for-deleted-file-recovery","target":"analyzing-slack-space-and-file-system-artifacts","relationship":"overlap"},{"source":"analyzing-mft-for-deleted-file-recovery","target":"parsing-artifacts-with-eric-zimmerman-tools","relationship":"specializes"},{"source":"analyzing-slack-space-and-file-system-artifacts","target":"parsing-artifacts-with-eric-zimmerman-tools","relationship":"specializes"},{"source":"performing-disk-forensics-investigation","target":"performing-endpoint-forensics-investigation","relationship":"specializes"},{"source":"performing-disk-forensics-investigation","target":"acquiring-disk-image-with-dd-and-dcfldd","relationship":"tool-specific"},{"source":"performing-endpoint-forensics-investigation","target":"acquiring-disk-image-with-dd-and-dcfldd","relationship":"tool-specific"},{"source":"detecting-anomalies-in-industrial-control-systems","target":"detecting-attacks-on-scada-systems","relationship":"complementary"},{"source":"detecting-dnp3-protocol-anomalies","target":"detecting-anomalies-in-industrial-control-systems","relationship":"specializes"},{"source":"detecting-attacks-on-historian-servers","target":"detecting-anomalies-in-industrial-control-systems","relationship":"specializes"},{"source":"detecting-dnp3-protocol-anomalies","target":"detecting-attacks-on-scada-systems","relationship":"specializes"},{"source":"detecting-attacks-on-historian-servers","target":"detecting-attacks-on-scada-systems","relationship":"specializes"},{"source":"detecting-modbus-command-injection-attacks","target":"detecting-modbus-protocol-anomalies","relationship":"specializes"},{"source":"detecting-modbus-command-injection-attacks","target":"detecting-stuxnet-style-attacks","relationship":"complementary"},{"source":"detecting-modbus-protocol-anomalies","target":"detecting-stuxnet-style-attacks","relationship":"complementary"},{"source":"implementing-threat-modeling-with-mitre-attack","target":"mapping-mitre-attack-techniques","relationship":"complementary"},{"source":"implementing-threat-modeling-with-mitre-attack","target":"analyzing-apt-group-with-mitre-navigator","relationship":"complementary"},{"source":"implementing-threat-modeling-with-mitre-attack","target":"analyzing-threat-actor-ttps-with-mitre-attack","relationship":"complementary"},{"source":"mapping-mitre-attack-techniques","target":"analyzing-apt-group-with-mitre-navigator","relationship":"complementary"},{"source":"mapping-mitre-attack-techniques","target":"analyzing-threat-actor-ttps-with-mitre-attack","relationship":"complementary"},{"source":"analyzing-apt-group-with-mitre-navigator","target":"analyzing-threat-actor-ttps-with-mitre-attack","relationship":"overlap"},{"source":"analyzing-threat-actor-ttps-with-mitre-navigator","target":"building-attack-pattern-library-from-cti-reports","relationship":"complementary"},{"source":"implementing-conduit-security-for-ot-remote-access","target":"implementing-iec-62443-security-zones","relationship":"specializes"},{"source":"implementing-ics-firewall-with-tofino","target":"implementing-iec-62443-security-zones","relationship":"tool-specific"},{"source":"implementing-conduit-security-for-ot-remote-access","target":"implementing-ics-firewall-with-tofino","relationship":"complementary"},{"source":"implementing-nerc-cip-compliance-controls","target":"implementing-iec-62443-security-zones","relationship":"complementary"},{"source":"implementing-nerc-cip-compliance-controls","target":"implementing-conduit-security-for-ot-remote-access","relationship":"complementary"},{"source":"implementing-nerc-cip-compliance-controls","target":"implementing-ics-firewall-with-tofino","relationship":"complementary"},{"source":"implementing-network-segmentation-for-ot","target":"implementing-purdue-model-network-segmentation","relationship":"complementary"},{"source":"implementing-aws-macie-for-data-classification","target":"implementing-cloud-dlp-for-data-protection","relationship":"specializes"},{"source":"implementing-data-loss-prevention-with-microsoft-purview","target":"implementing-cloud-dlp-for-data-protection","relationship":"specializes"},{"source":"implementing-aws-macie-for-data-classification","target":"implementing-data-loss-prevention-with-microsoft-purview","relationship":"tool-specific"},{"source":"analyzing-network-packets-with-scapy","target":"analyzing-network-traffic-with-wireshark","relationship":"tool-specific"},{"source":"analyzing-network-packets-with-scapy","target":"traffic-analysis-pcap","relationship":"complementary"},{"source":"analyzing-network-packets-with-scapy","target":"exploiting-ipv6-vulnerabilities","relationship":"complementary"},{"source":"analyzing-network-traffic-with-wireshark","target":"traffic-analysis-pcap","relationship":"overlap"},{"source":"analyzing-certificate-transparency-for-phishing","target":"analyzing-tls-certificate-transparency-logs","relationship":"overlap"},{"source":"analyzing-certificate-transparency-for-phishing","target":"auditing-tls-certificate-transparency-logs","relationship":"complementary"},{"source":"analyzing-certificate-transparency-for-phishing","target":"analyzing-typosquatting-domains-with-dnstwist","relationship":"complementary"},{"source":"analyzing-tls-certificate-transparency-logs","target":"auditing-tls-certificate-transparency-logs","relationship":"specializes"},{"source":"analyzing-tls-certificate-transparency-logs","target":"analyzing-typosquatting-domains-with-dnstwist","relationship":"complementary"},{"source":"auditing-tls-certificate-transparency-logs","target":"analyzing-typosquatting-domains-with-dnstwist","relationship":"complementary"},{"source":"building-devsecops-pipeline-with-gitlab-ci","target":"ci-security-scanning-with-strix","relationship":"tool-specific"},{"source":"building-devsecops-pipeline-with-gitlab-ci","target":"implementing-devsecops-security-scanning","relationship":"workflow-variant"},{"source":"building-devsecops-pipeline-with-gitlab-ci","target":"implementing-github-advanced-security-for-code-scanning","relationship":"tool-specific"},{"source":"ci-security-scanning-with-strix","target":"implementing-devsecops-security-scanning","relationship":"complementary"},{"source":"ci-security-scanning-with-strix","target":"implementing-github-advanced-security-for-code-scanning","relationship":"complementary"},{"source":"implementing-devsecops-security-scanning","target":"implementing-github-advanced-security-for-code-scanning","relationship":"workflow-variant"},{"source":"detecting-living-off-the-land-attacks","target":"detecting-living-off-the-land-with-lolbas","relationship":"generalizes"},{"source":"detecting-living-off-the-land-attacks","target":"hunting-for-living-off-the-land-binaries","relationship":"complementary"},{"source":"detecting-living-off-the-land-attacks","target":"hunting-for-lolbins-execution-in-endpoint-logs","relationship":"complementary"},{"source":"detecting-living-off-the-land-with-lolbas","target":"hunting-for-living-off-the-land-binaries","relationship":"complementary"},{"source":"detecting-living-off-the-land-with-lolbas","target":"hunting-for-lolbins-execution-in-endpoint-logs","relationship":"complementary"},{"source":"hunting-for-living-off-the-land-binaries","target":"hunting-for-lolbins-execution-in-endpoint-logs","relationship":"complementary"},{"source":"analyzing-powershell-empire-artifacts","target":"analyzing-powershell-script-block-logging","relationship":"specializes"},{"source":"analyzing-powershell-empire-artifacts","target":"detecting-suspicious-powershell-execution","relationship":"complementary"},{"source":"analyzing-powershell-empire-artifacts","target":"hunting-for-anomalous-powershell-execution","relationship":"specializes"},{"source":"analyzing-powershell-script-block-logging","target":"detecting-suspicious-powershell-execution","relationship":"complementary"},{"source":"analyzing-powershell-script-block-logging","target":"hunting-for-anomalous-powershell-execution","relationship":"complementary"},{"source":"detecting-suspicious-powershell-execution","target":"hunting-for-anomalous-powershell-execution","relationship":"complementary"},{"source":"hunting-for-spearphishing-indicators","target":"investigating-phishing-email-incident","relationship":"complementary"},{"source":"hunting-for-spearphishing-indicators","target":"investigating-ransomware-attack-artifacts","relationship":"complementary"},{"source":"investigating-phishing-email-incident","target":"investigating-ransomware-attack-artifacts","relationship":"complementary"},{"source":"graphql-and-hidden-parameters","target":"performing-graphql-depth-limit-attack","relationship":"complementary"},{"source":"graphql-and-hidden-parameters","target":"performing-graphql-introspection-attack","relationship":"overlap"},{"source":"graphql-and-hidden-parameters","target":"performing-graphql-security-assessment","relationship":"overlap"},{"source":"performing-graphql-depth-limit-attack","target":"performing-graphql-introspection-attack","relationship":"technique-specific"},{"source":"performing-graphql-depth-limit-attack","target":"performing-graphql-security-assessment","relationship":"specializes"},{"source":"performing-graphql-introspection-attack","target":"performing-graphql-security-assessment","relationship":"specializes"},{"source":"implementing-api-abuse-detection-with-rate-limiting","target":"implementing-api-gateway-security-controls","relationship":"specializes"},{"source":"implementing-api-abuse-detection-with-rate-limiting","target":"implementing-api-rate-limiting-and-throttling","relationship":"overlap"},{"source":"implementing-api-abuse-detection-with-rate-limiting","target":"performing-api-rate-limiting-bypass","relationship":"complementary"},{"source":"implementing-api-gateway-security-controls","target":"implementing-api-rate-limiting-and-throttling","relationship":"generalizes"},{"source":"implementing-api-gateway-security-controls","target":"performing-api-rate-limiting-bypass","relationship":"complementary"},{"source":"implementing-api-rate-limiting-and-throttling","target":"performing-api-rate-limiting-bypass","relationship":"complementary"},{"source":"detecting-qr-code-phishing-with-email-security","target":"detecting-spearphishing-with-email-gateway","relationship":"specializes"},{"source":"detecting-qr-code-phishing-with-email-security","target":"detecting-business-email-compromise","relationship":"complementary"},{"source":"detecting-spearphishing-with-email-gateway","target":"detecting-business-email-compromise","relationship":"overlap"},{"source":"detecting-spearphishing-with-email-gateway","target":"detecting-business-email-compromise-with-ai","relationship":"complementary"},{"source":"detecting-business-email-compromise","target":"detecting-business-email-compromise-with-ai","relationship":"generalizes"},{"source":"analyzing-ethereum-smart-contract-vulnerabilities","target":"auditing-foundry-smart-contract-security","relationship":"workflow-variant"},{"source":"analyzing-ethereum-smart-contract-vulnerabilities","target":"defi-attack-patterns","relationship":"complementary"},{"source":"analyzing-ethereum-smart-contract-vulnerabilities","target":"smart-contract-vulnerabilities","relationship":"specializes"},{"source":"auditing-foundry-smart-contract-security","target":"defi-attack-patterns","relationship":"complementary"},{"source":"auditing-foundry-smart-contract-security","target":"smart-contract-vulnerabilities","relationship":"complementary"},{"source":"defi-attack-patterns","target":"smart-contract-vulnerabilities","relationship":"specializes"},{"source":"extracting-iocs-from-malware-samples","target":"performing-automated-malware-analysis-with-cape","relationship":"complementary"},{"source":"extracting-iocs-from-malware-samples","target":"performing-dynamic-analysis-with-any-run","relationship":"complementary"},{"source":"performing-automated-malware-analysis-with-cape","target":"performing-dynamic-analysis-with-any-run","relationship":"tool-specific"},{"source":"analyzing-browser-forensics-with-hindsight","target":"extracting-browser-history-artifacts","relationship":"complementary"},{"source":"analyzing-browser-forensics-with-hindsight","target":"performing-sqlite-database-forensics","relationship":"complementary"},{"source":"extracting-browser-history-artifacts","target":"performing-sqlite-database-forensics","relationship":"complementary"},{"source":"performing-dmarc-policy-enforcement-rollout","target":"implementing-dmarc-dkim-spf-email-security","relationship":"complementary"},{"source":"crlf-injection","target":"email-header-injection","relationship":"complementary"},{"source":"crlf-injection","target":"testing-for-email-header-injection","relationship":"complementary"},{"source":"email-header-injection","target":"testing-for-email-header-injection","relationship":"complementary"},{"source":"performing-ssl-stripping-attack","target":"performing-ssl-tls-inspection-configuration","relationship":"complementary"},{"source":"performing-ssl-stripping-attack","target":"performing-ssl-tls-security-assessment","relationship":"overlap"},{"source":"performing-ssl-tls-inspection-configuration","target":"performing-ssl-tls-security-assessment","relationship":"complementary"},{"source":"rev-idapython","target":"rev-struct","relationship":"complementary"},{"source":"rev-idapython","target":"rev-symbol","relationship":"complementary"},{"source":"rev-struct","target":"rev-symbol","relationship":"complementary"},{"source":"triaging-security-alerts-in-splunk","target":"triaging-security-incident","relationship":"specializes"},{"source":"triaging-security-alerts-in-splunk","target":"triaging-security-incident-with-ir-playbook","relationship":"complementary"},{"source":"triaging-security-incident","target":"triaging-security-incident-with-ir-playbook","relationship":"complementary"},{"source":"analyzing-web-server-logs-for-intrusion","target":"detecting-sql-injection-via-waf-logs","relationship":"complementary"},{"source":"exploiting-nopac-cve-2021-42278-42287","target":"exploiting-zerologon-vulnerability-cve-2020-1472","relationship":"complementary"},{"source":"performing-file-carving-with-foremost","target":"recovering-deleted-files-with-photorec","relationship":"tool-specific"},{"source":"ctf-forensics","target":"ctf-malware","relationship":"complementary"},{"source":"implementing-api-security-posture-management","target":"performing-api-inventory-and-discovery","relationship":"complementary"},{"source":"analyzing-campaign-attribution-evidence","target":"analyzing-cyber-kill-chain","relationship":"complementary"},{"source":"implementing-patch-management-workflow","target":"performing-endpoint-vulnerability-remediation","relationship":"complementary"},{"source":"analyzing-api-gateway-access-logs","target":"detecting-model-extraction-attacks","relationship":"complementary"},{"source":"auth-sec","target":"authbypass-authentication-flaws","relationship":"router-of"},{"source":"implementing-mtls-for-zero-trust-services","target":"implementing-zero-knowledge-proof-for-authentication","relationship":"complementary"},{"source":"detecting-azure-storage-account-misconfigurations","target":"detecting-misconfigured-azure-storage","relationship":"tool-specific"},{"source":"implementing-cloud-waf-rules","target":"implementing-gcp-vpc-firewall-rules","relationship":"complementary"},{"source":"fleet-hunting-with-velociraptor","target":"implementing-velociraptor-for-ir-collection","relationship":"specializes"},{"source":"analyzing-indicators-of-compromise","target":"building-threat-intelligence-enrichment-in-splunk","relationship":"complementary"},{"source":"implementing-browser-isolation-for-zero-trust","target":"implementing-email-sandboxing-with-proofpoint","relationship":"complementary"},{"source":"securing-historian-server-in-ot-environment","target":"securing-remote-access-to-ot-environment","relationship":"complementary"},{"source":"building-malware-incident-communication-template","target":"conducting-post-incident-lessons-learned","relationship":"complementary"},{"source":"rev-ios-dump","target":"rev-u3d-dump","relationship":"complementary"},{"source":"implementing-immutable-backup-with-restic","target":"implementing-ransomware-backup-strategy","relationship":"complementary"},{"source":"testing-ransomware-recovery-procedures","target":"validating-backup-integrity-for-recovery","relationship":"complementary"},{"source":"exploiting-race-condition-vulnerabilities","target":"race-condition","relationship":"overlap"},{"source":"prototype-pollution","target":"prototype-pollution-advanced","relationship":"complementary"},{"source":"deploying-cloud-deception-with-decoy-resources","target":"deploying-decoy-files-for-ransomware-detection","relationship":"complementary"},{"source":"deploying-cloud-deception-with-decoy-resources","target":"deploying-honeytokens-and-canarytokens","relationship":"overlap"},{"source":"deploying-cloud-deception-with-decoy-resources","target":"implementing-canary-tokens-for-network-intrusion","relationship":"complementary"},{"source":"deploying-decoy-files-for-ransomware-detection","target":"deploying-honeytokens-and-canarytokens","relationship":"specializes"},{"source":"deploying-honeytokens-and-canarytokens","target":"implementing-canary-tokens-for-network-intrusion","relationship":"generalizes"},{"source":"implementing-deception-based-detection-with-canarytoken","target":"implementing-network-deception-with-honeypots","relationship":"overlap"},{"source":"implementing-deception-based-detection-with-canarytoken","target":"performing-deception-technology-deployment","relationship":"specializes"},{"source":"implementing-network-deception-with-honeypots","target":"performing-deception-technology-deployment","relationship":"overlap"},{"source":"implementing-network-deception-with-honeypots","target":"implementing-anti-ransomware-group-policy","relationship":"complementary"},{"source":"performing-deception-technology-deployment","target":"implementing-anti-ransomware-group-policy","relationship":"complementary"},{"source":"implementing-honeypot-for-ransomware-detection","target":"implementing-ransomware-kill-switch-detection","relationship":"complementary"},{"source":"implementing-honeypot-for-ransomware-detection","target":"implementing-application-whitelisting-with-applocker","relationship":"complementary"},{"source":"implementing-ransomware-kill-switch-detection","target":"implementing-application-whitelisting-with-applocker","relationship":"complementary"},{"source":"hardening-windows-endpoint-with-cis-benchmark","target":"implementing-application-whitelisting-with-applocker","relationship":"generalizes"},{"source":"implementing-memory-protection-with-dep-aslr","target":"configuring-windows-defender-advanced-settings","relationship":"overlap"},{"source":"configuring-windows-event-logging-for-detection","target":"configuring-host-based-intrusion-detection","relationship":"complementary"},{"source":"configuring-windows-event-logging-for-detection","target":"deploying-edr-agent-with-crowdstrike","relationship":"complementary"},{"source":"configuring-windows-event-logging-for-detection","target":"designing-adversary-engagement-with-mitre-engage","relationship":"complementary"},{"source":"configuring-host-based-intrusion-detection","target":"deploying-edr-agent-with-crowdstrike","relationship":"complementary"},{"source":"configuring-host-based-intrusion-detection","target":"designing-adversary-engagement-with-mitre-engage","relationship":"complementary"},{"source":"deploying-edr-agent-with-crowdstrike","target":"designing-adversary-engagement-with-mitre-engage","relationship":"complementary"},{"source":"implementing-beyondcorp-zero-trust-access-model","target":"implementing-conditional-access-policies-azure-ad","relationship":"complementary"},{"source":"implementing-beyondcorp-zero-trust-access-model","target":"implementing-identity-verification-for-zero-trust","relationship":"complementary"},{"source":"implementing-beyondcorp-zero-trust-access-model","target":"configuring-aws-verified-access-for-ztna","relationship":"technique-specific"},{"source":"implementing-conditional-access-policies-azure-ad","target":"implementing-identity-verification-for-zero-trust","relationship":"specializes"},{"source":"implementing-conditional-access-policies-azure-ad","target":"configuring-aws-verified-access-for-ztna","relationship":"complementary"},{"source":"implementing-identity-verification-for-zero-trust","target":"configuring-aws-verified-access-for-ztna","relationship":"complementary"},{"source":"configuring-identity-aware-proxy-with-google-iap","target":"implementing-zero-trust-in-cloud","relationship":"specializes"},{"source":"configuring-identity-aware-proxy-with-google-iap","target":"deploying-cloudflare-access-for-zero-trust","relationship":"tool-specific"},{"source":"deploying-cloudflare-access-for-zero-trust","target":"implementing-zero-trust-in-cloud","relationship":"complementary"},{"source":"deploying-cloudflare-access-for-zero-trust","target":"implementing-zero-trust-for-saas-applications","relationship":"complementary"},{"source":"implementing-zero-trust-for-saas-applications","target":"implementing-zero-trust-in-cloud","relationship":"complementary"},{"source":"implementing-zero-trust-network-access","target":"implementing-zero-trust-with-beyondcorp","relationship":"generalizes"},{"source":"implementing-zero-trust-network-access","target":"implementing-device-posture-assessment-in-zero-trust","relationship":"complementary"},{"source":"implementing-zero-trust-network-access","target":"implementing-google-workspace-admin-security","relationship":"complementary"},{"source":"implementing-zero-trust-with-beyondcorp","target":"implementing-device-posture-assessment-in-zero-trust","relationship":"complementary"},{"source":"implementing-zero-trust-with-beyondcorp","target":"implementing-google-workspace-admin-security","relationship":"complementary"},{"source":"implementing-device-posture-assessment-in-zero-trust","target":"implementing-google-workspace-admin-security","relationship":"complementary"},{"source":"configuring-zscaler-private-access-for-ztna","target":"deploying-palo-alto-prisma-access-zero-trust","relationship":"tool-specific"},{"source":"configuring-zscaler-private-access-for-ztna","target":"deploying-software-defined-perimeter","relationship":"technique-specific"},{"source":"configuring-zscaler-private-access-for-ztna","target":"deploying-tailscale-for-zero-trust-vpn","relationship":"tool-specific"},{"source":"deploying-palo-alto-prisma-access-zero-trust","target":"deploying-software-defined-perimeter","relationship":"technique-specific"},{"source":"deploying-palo-alto-prisma-access-zero-trust","target":"deploying-tailscale-for-zero-trust-vpn","relationship":"tool-specific"},{"source":"deploying-software-defined-perimeter","target":"deploying-tailscale-for-zero-trust-vpn","relationship":"technique-specific"},{"source":"implementing-zero-trust-network-access-with-zscaler","target":"implementing-zero-trust-with-hashicorp-boundary","relationship":"tool-specific"},{"source":"attacking-oauth-with-device-code-phishing","target":"auditing-entra-id-with-aadinternals","relationship":"complementary"},{"source":"attacking-oauth-with-device-code-phishing","target":"exploiting-oauth-misconfiguration","relationship":"complementary"},{"source":"auditing-entra-id-with-aadinternals","target":"exploiting-oauth-misconfiguration","relationship":"complementary"},{"source":"jwt-oauth-token-attacks","target":"testing-for-json-web-token-vulnerabilities","relationship":"complementary"},{"source":"jwt-oauth-token-attacks","target":"testing-jwt-token-security","relationship":"complementary"},{"source":"jwt-oauth-token-attacks","target":"oauth-oidc-misconfiguration","relationship":"complementary"},{"source":"oauth-oidc-misconfiguration","target":"testing-for-json-web-token-vulnerabilities","relationship":"complementary"},{"source":"oauth-oidc-misconfiguration","target":"testing-jwt-token-security","relationship":"complementary"},{"source":"testing-for-json-web-token-vulnerabilities","target":"testing-jwt-token-security","relationship":"overlap"},{"source":"building-identity-federation-with-saml-azure-ad","target":"implementing-google-workspace-sso-configuration","relationship":"complementary"},{"source":"building-identity-federation-with-saml-azure-ad","target":"implementing-saml-sso-with-okta","relationship":"tool-specific"},{"source":"implementing-google-workspace-sso-configuration","target":"implementing-saml-sso-with-okta","relationship":"complementary"},{"source":"detecting-anomalous-authentication-patterns","target":"hunting-credential-stuffing-attacks","relationship":"complementary"},{"source":"detecting-anomalous-authentication-patterns","target":"hunting-saas-sso-token-abuse","relationship":"complementary"},{"source":"hunting-credential-stuffing-attacks","target":"hunting-saas-sso-token-abuse","relationship":"complementary"},{"source":"saml-sso-assertion-attacks","target":"hunting-saas-sso-token-abuse","relationship":"complementary"},{"source":"analyzing-uefi-bootkit-persistence","target":"hunting-bootkits-in-efi-system-partition","relationship":"complementary"},{"source":"analyzing-uefi-bootkit-persistence","target":"analyzing-bootkit-and-rootkit-samples","relationship":"specializes"},{"source":"hunting-bootkits-in-efi-system-partition","target":"analyzing-bootkit-and-rootkit-samples","relationship":"complementary"},{"source":"performing-firmware-malware-analysis","target":"performing-plc-firmware-security-analysis","relationship":"complementary"},{"source":"performing-firmware-malware-analysis","target":"performing-iot-security-assessment","relationship":"complementary"},{"source":"performing-plc-firmware-security-analysis","target":"performing-iot-security-assessment","relationship":"complementary"},{"source":"performing-plc-firmware-security-analysis","target":"performing-oil-gas-cybersecurity-assessment","relationship":"complementary"},{"source":"performing-ot-network-security-assessment","target":"performing-ot-vulnerability-assessment-with-claroty","relationship":"complementary"},{"source":"performing-ot-network-security-assessment","target":"performing-ot-vulnerability-scanning-safely","relationship":"complementary"},{"source":"performing-ot-network-security-assessment","target":"performing-power-grid-cybersecurity-assessment","relationship":"generalizes"},{"source":"performing-ot-vulnerability-assessment-with-claroty","target":"performing-ot-vulnerability-scanning-safely","relationship":"tool-specific"},{"source":"performing-ot-vulnerability-assessment-with-claroty","target":"performing-power-grid-cybersecurity-assessment","relationship":"complementary"},{"source":"performing-ot-vulnerability-scanning-safely","target":"performing-power-grid-cybersecurity-assessment","relationship":"complementary"},{"source":"performing-s7comm-protocol-security-analysis","target":"performing-scada-hmi-security-assessment","relationship":"complementary"},{"source":"achieving-cmmc-level-2-compliance","target":"executing-nist-rmf-authorization-to-operate","relationship":"complementary"},{"source":"building-identity-governance-lifecycle-process","target":"implementing-cisa-zero-trust-maturity-model","relationship":"complementary"},{"source":"implementing-gdpr-data-protection-controls","target":"implementing-gdpr-data-subject-access-request","relationship":"generalizes"},{"source":"implementing-gdpr-data-protection-controls","target":"implementing-hipaa-security-rule-safeguards","relationship":"overlap"},{"source":"implementing-gdpr-data-protection-controls","target":"implementing-iso-27001-information-security-management","relationship":"complementary"},{"source":"implementing-hipaa-security-rule-safeguards","target":"implementing-iso-27001-information-security-management","relationship":"complementary"},{"source":"implementing-pci-dss-compliance-controls","target":"managing-third-party-vendor-risk","relationship":"complementary"},{"source":"implementing-pci-dss-compliance-controls","target":"performing-access-recertification-with-saviynt","relationship":"complementary"},{"source":"implementing-pci-dss-compliance-controls","target":"performing-nist-csf-maturity-assessment","relationship":"complementary"},{"source":"managing-third-party-vendor-risk","target":"performing-nist-csf-maturity-assessment","relationship":"complementary"},{"source":"performing-access-recertification-with-saviynt","target":"performing-nist-csf-maturity-assessment","relationship":"complementary"},{"source":"collecting-open-source-intelligence","target":"conducting-external-reconnaissance-with-osint","relationship":"overlap"},{"source":"collecting-open-source-intelligence","target":"performing-open-source-intelligence-gathering","relationship":"overlap"},{"source":"collecting-open-source-intelligence","target":"performing-osint-with-spiderfoot","relationship":"tool-specific"},{"source":"conducting-external-reconnaissance-with-osint","target":"performing-open-source-intelligence-gathering","relationship":"complementary"},{"source":"conducting-external-reconnaissance-with-osint","target":"performing-osint-with-spiderfoot","relationship":"tool-specific"},{"source":"performing-open-source-intelligence-gathering","target":"performing-osint-with-spiderfoot","relationship":"tool-specific"},{"source":"implementing-attack-surface-management","target":"performing-subdomain-enumeration-with-subfinder","relationship":"tool-specific"},{"source":"implementing-attack-surface-management","target":"recon-and-methodology","relationship":"specializes"},{"source":"implementing-attack-surface-management","target":"recon-dir-scan","relationship":"complementary"},{"source":"performing-subdomain-enumeration-with-subfinder","target":"recon-and-methodology","relationship":"tool-specific"},{"source":"performing-subdomain-enumeration-with-subfinder","target":"recon-dir-scan","relationship":"complementary"},{"source":"recon-and-methodology","target":"recon-dir-scan","relationship":"specializes"},{"source":"recon-for-sec","target":"recon-port-scan","relationship":"router-of"},{"source":"recon-for-sec","target":"recon-subdomain","relationship":"router-of"},{"source":"recon-port-scan","target":"recon-subdomain","relationship":"complementary"},{"source":"attacking-entra-id-with-roadtools","target":"conducting-cloud-penetration-testing","relationship":"specializes"},{"source":"attacking-entra-id-with-roadtools","target":"emulating-cloud-attacks-with-stratus-red-team","relationship":"complementary"},{"source":"conducting-cloud-penetration-testing","target":"container-escape-techniques","relationship":"generalizes"},{"source":"conducting-cloud-penetration-testing","target":"emulating-cloud-attacks-with-stratus-red-team","relationship":"complementary"},{"source":"container-escape-techniques","target":"emulating-cloud-attacks-with-stratus-red-team","relationship":"complementary"},{"source":"enumerating-cloud-with-cloudfox","target":"exploiting-aws-with-pacu","relationship":"complementary"},{"source":"enumerating-cloud-with-cloudfox","target":"performing-aws-privilege-escalation-assessment","relationship":"complementary"},{"source":"exploiting-aws-with-pacu","target":"performing-aws-privilege-escalation-assessment","relationship":"complementary"},{"source":"performing-cloud-penetration-testing-with-pacu","target":"performing-gcp-penetration-testing-with-gcpbucketbrute","relationship":"complementary"},{"source":"performing-cloud-penetration-testing-with-pacu","target":"performing-kubernetes-penetration-testing","relationship":"complementary"},{"source":"performing-gcp-penetration-testing-with-gcpbucketbrute","target":"performing-kubernetes-penetration-testing","relationship":"complementary"},{"source":"implementing-delinea-secret-server-for-pam","target":"implementing-privileged-access-management-with-cyberark","relationship":"tool-specific"},{"source":"implementing-delinea-secret-server-for-pam","target":"implementing-just-in-time-access-provisioning","relationship":"complementary"},{"source":"implementing-just-in-time-access-provisioning","target":"implementing-privileged-access-management-with-cyberark","relationship":"overlap"},{"source":"performing-privileged-account-discovery","target":"performing-privileged-account-access-review","relationship":"complementary"},{"source":"performing-privileged-account-discovery","target":"performing-service-account-credential-rotation","relationship":"complementary"},{"source":"performing-service-account-credential-rotation","target":"performing-privileged-account-access-review","relationship":"complementary"},{"source":"performing-service-account-credential-rotation","target":"implementing-secrets-management-with-vault","relationship":"complementary"},{"source":"implementing-zero-standing-privilege-with-cyberark","target":"managing-cloud-identity-with-okta","relationship":"complementary"},{"source":"performing-credential-access-with-lazagne","target":"performing-lateral-movement-with-wmiexec","relationship":"complementary"},{"source":"building-c2-infrastructure-with-sliver-framework","target":"building-red-team-c2-infrastructure-with-havoc","relationship":"tool-specific"},{"source":"operating-havoc-c2","target":"operating-sliver-c2","relationship":"tool-specific"},{"source":"operating-havoc-c2","target":"performing-red-team-with-covenant","relationship":"tool-specific"},{"source":"operating-havoc-c2","target":"windows-av-evasion","relationship":"complementary"},{"source":"operating-sliver-c2","target":"performing-red-team-with-covenant","relationship":"tool-specific"},{"source":"operating-sliver-c2","target":"windows-av-evasion","relationship":"complementary"},{"source":"performing-red-team-with-covenant","target":"windows-av-evasion","relationship":"knowledge-support"},{"source":"implementing-gcp-binary-authorization","target":"implementing-image-provenance-verification-with-cosign","relationship":"complementary"},{"source":"performing-container-security-scanning-with-trivy","target":"scanning-containers-with-trivy-in-cicd","relationship":"generalizes"},{"source":"scanning-docker-images-with-trivy","target":"scanning-iac-and-images-with-trivy","relationship":"specializes"},{"source":"scanning-docker-images-with-trivy","target":"securing-container-registry-images","relationship":"complementary"},{"source":"scanning-docker-images-with-trivy","target":"securing-container-registry-with-harbor","relationship":"complementary"},{"source":"scanning-iac-and-images-with-trivy","target":"securing-container-registry-images","relationship":"complementary"},{"source":"scanning-iac-and-images-with-trivy","target":"securing-container-registry-with-harbor","relationship":"complementary"},{"source":"securing-container-registry-images","target":"securing-container-registry-with-harbor","relationship":"complementary"},{"source":"exploiting-api-injection-vulnerabilities","target":"exploiting-nosql-injection-vulnerabilities","relationship":"complementary"},{"source":"exploiting-api-injection-vulnerabilities","target":"exploit-sqli","relationship":"complementary"},{"source":"exploiting-api-injection-vulnerabilities","target":"performing-second-order-sql-injection","relationship":"complementary"},{"source":"exploiting-api-injection-vulnerabilities","target":"sqli-sql-injection","relationship":"complementary"},{"source":"exploit-sqli","target":"sqli-sql-injection","relationship":"independent"},{"source":"performing-second-order-sql-injection","target":"exploit-sqli","relationship":"specializes"},{"source":"performing-second-order-sql-injection","target":"sqli-sql-injection","relationship":"specializes"},{"source":"nosql-injection","target":"exploiting-sql-injection-vulnerabilities","relationship":"technique-specific"},{"source":"nosql-injection","target":"exploiting-sql-injection-with-sqlmap","relationship":"technique-specific"},{"source":"exploiting-sql-injection-vulnerabilities","target":"exploiting-sql-injection-with-sqlmap","relationship":"specializes"},{"source":"building-incident-response-playbook","target":"building-ransomware-playbook-with-cisa-framework","relationship":"generalizes"},{"source":"building-incident-response-playbook","target":"building-soc-escalation-matrix","relationship":"generalizes"},{"source":"building-ransomware-playbook-with-cisa-framework","target":"building-soc-escalation-matrix","relationship":"complementary"},{"source":"building-soc-playbook-for-ransomware","target":"implementing-ticketing-system-for-incidents","relationship":"complementary"},{"source":"implementing-ticketing-system-for-incidents","target":"implementing-vulnerability-remediation-sla","relationship":"complementary"},{"source":"implementing-ticketing-system-for-incidents","target":"implementing-vulnerability-sla-breach-alerting","relationship":"complementary"},{"source":"implementing-vulnerability-remediation-sla","target":"implementing-vulnerability-sla-breach-alerting","relationship":"complementary"},{"source":"detecting-privilege-escalation-attempts","target":"hunting-advanced-persistent-threats","relationship":"complementary"},{"source":"detecting-privilege-escalation-attempts","target":"building-threat-hunt-hypothesis-framework","relationship":"specializes"},{"source":"detecting-privilege-escalation-attempts","target":"detecting-insider-threat-behaviors","relationship":"complementary"},{"source":"hunting-advanced-persistent-threats","target":"building-threat-hunt-hypothesis-framework","relationship":"specializes"},{"source":"hunting-advanced-persistent-threats","target":"detecting-insider-threat-behaviors","relationship":"complementary"},{"source":"detecting-insider-threat-behaviors","target":"building-threat-hunt-hypothesis-framework","relationship":"specializes"},{"source":"performing-threat-hunting-with-elastic-siem","target":"detecting-insider-threat-with-ueba","relationship":"complementary"},{"source":"performing-threat-hunting-with-elastic-siem","target":"detecting-service-account-abuse","relationship":"overlap"},{"source":"detecting-insider-threat-with-ueba","target":"detecting-service-account-abuse","relationship":"complementary"},{"source":"analyzing-malware-persistence-with-autoruns","target":"detecting-dll-sideloading-attacks","relationship":"generalizes"},{"source":"analyzing-malware-persistence-with-autoruns","target":"detecting-malicious-scheduled-tasks-with-sysmon","relationship":"generalizes"},{"source":"analyzing-malware-persistence-with-autoruns","target":"detecting-wmi-persistence","relationship":"generalizes"},{"source":"detecting-dll-sideloading-attacks","target":"detecting-malicious-scheduled-tasks-with-sysmon","relationship":"complementary"},{"source":"detecting-dll-sideloading-attacks","target":"detecting-wmi-persistence","relationship":"complementary"},{"source":"detecting-malicious-scheduled-tasks-with-sysmon","target":"detecting-wmi-persistence","relationship":"complementary"},{"source":"hunting-for-persistence-via-wmi-subscriptions","target":"hunting-for-persistence-mechanisms-in-windows","relationship":"specializes"},{"source":"performing-supply-chain-attack-simulation","target":"dependency-confusion","relationship":"complementary"},{"source":"performing-supply-chain-attack-simulation","target":"detecting-dependency-confusion","relationship":"overlap"},{"source":"performing-supply-chain-attack-simulation","target":"detecting-malicious-npm-packages","relationship":"complementary"},{"source":"dependency-confusion","target":"detecting-dependency-confusion","relationship":"complementary"},{"source":"dependency-confusion","target":"detecting-malicious-npm-packages","relationship":"complementary"},{"source":"detecting-dependency-confusion","target":"detecting-malicious-npm-packages","relationship":"complementary"},{"source":"detecting-typosquatting-packages","target":"detecting-typosquatting-packages-in-npm-pypi","relationship":"complementary"},{"source":"implementing-epss-score-for-vulnerability-prioritization","target":"performing-asset-criticality-scoring-for-vulns","relationship":"complementary"},{"source":"implementing-epss-score-for-vulnerability-prioritization","target":"performing-cve-prioritization-with-kev-catalog","relationship":"complementary"},{"source":"implementing-epss-score-for-vulnerability-prioritization","target":"prioritizing-vulnerabilities-with-cvss-scoring","relationship":"complementary"},{"source":"performing-asset-criticality-scoring-for-vulns","target":"performing-cve-prioritization-with-kev-catalog","relationship":"complementary"},{"source":"performing-asset-criticality-scoring-for-vulns","target":"prioritizing-vulnerabilities-with-cvss-scoring","relationship":"complementary"},{"source":"performing-cve-prioritization-with-kev-catalog","target":"prioritizing-vulnerabilities-with-cvss-scoring","relationship":"workflow-variant"},{"source":"triaging-vulnerabilities-with-ssvc-framework","target":"performing-web-application-vulnerability-triage","relationship":"complementary"},{"source":"ctf-crypto","target":"classical-cipher-analysis","relationship":"generalizes"},{"source":"ctf-crypto","target":"hash-attack-techniques","relationship":"generalizes"},{"source":"ctf-crypto","target":"lattice-crypto-attacks","relationship":"generalizes"},{"source":"rsa-attack-techniques","target":"symmetric-cipher-attacks","relationship":"complementary"},{"source":"hunting-for-beaconing-with-frequency-analysis","target":"hunting-for-command-and-control-beaconing","relationship":"overlap"},{"source":"hunting-for-cobalt-strike-beacons","target":"hunting-for-command-and-control-beaconing","relationship":"specializes"},{"source":"hunting-for-beaconing-with-frequency-analysis","target":"hunting-for-cobalt-strike-beacons","relationship":"complementary"},{"source":"hunting-for-cobalt-strike-beacons","target":"hunting-for-domain-fronting-c2-traffic","relationship":"complementary"},{"source":"hunting-for-command-and-control-beaconing","target":"hunting-for-domain-fronting-c2-traffic","relationship":"complementary"},{"source":"hunting-for-beaconing-with-frequency-analysis","target":"hunting-for-domain-fronting-c2-traffic","relationship":"complementary"},{"source":"configuring-certificate-authority-with-openssl","target":"configuring-hsm-for-key-storage","relationship":"complementary"},{"source":"configuring-certificate-authority-with-openssl","target":"performing-hardware-security-module-integration","relationship":"complementary"},{"source":"configuring-certificate-authority-with-openssl","target":"performing-post-quantum-cryptography-migration","relationship":"knowledge-support"},{"source":"configuring-hsm-for-key-storage","target":"performing-hardware-security-module-integration","relationship":"overlap"},{"source":"exploit-file-download","target":"exploit-lfi","relationship":"overlap"},{"source":"file-access-vuln","target":"exploit-file-download","relationship":"router-of"},{"source":"exploit-file-download","target":"path-traversal-lfi","relationship":"complementary"},{"source":"file-access-vuln","target":"exploit-lfi","relationship":"router-of"},{"source":"exploit-lfi","target":"path-traversal-lfi","relationship":"overlap"},{"source":"file-access-vuln","target":"path-traversal-lfi","relationship":"router-of"},{"source":"detecting-evasion-techniques-in-endpoint-logs","target":"hunting-for-defense-evasion-via-timestomping","relationship":"generalizes"},{"source":"detecting-evasion-techniques-in-endpoint-logs","target":"detecting-fileless-attacks-on-endpoints","relationship":"complementary"},{"source":"detecting-evasion-techniques-in-endpoint-logs","target":"detecting-fileless-malware-techniques","relationship":"complementary"},{"source":"detecting-fileless-attacks-on-endpoints","target":"detecting-fileless-malware-techniques","relationship":"overlap"},{"source":"detecting-dns-exfiltration-with-dns-query-analysis","target":"detecting-exfiltration-over-dns-with-zeek","relationship":"tool-specific"},{"source":"detecting-dns-exfiltration-with-dns-query-analysis","target":"hunting-for-data-exfiltration-indicators","relationship":"generalizes"},{"source":"detecting-exfiltration-over-dns-with-zeek","target":"hunting-for-data-exfiltration-indicators","relationship":"generalizes"},{"source":"detecting-insider-data-exfiltration-via-dlp","target":"hunting-for-data-exfiltration-indicators","relationship":"complementary"},{"source":"detecting-aws-cloudtrail-anomalies","target":"detecting-cloud-threats-with-guardduty","relationship":"complementary"},{"source":"detecting-aws-cloudtrail-anomalies","target":"detecting-cryptomining-in-cloud","relationship":"complementary"},{"source":"detecting-aws-guardduty-findings-automation","target":"detecting-cloud-threats-with-guardduty","relationship":"specializes"},{"source":"detecting-aws-guardduty-findings-automation","target":"detecting-cryptomining-in-cloud","relationship":"complementary"},{"source":"detecting-cloud-threats-with-guardduty","target":"detecting-cryptomining-in-cloud","relationship":"complementary"},{"source":"implementing-api-security-testing-with-42crunch","target":"performing-api-fuzzing-with-restler","relationship":"complementary"},{"source":"implementing-api-security-testing-with-42crunch","target":"performing-api-security-testing-with-postman","relationship":"complementary"},{"source":"implementing-api-security-testing-with-42crunch","target":"performing-soap-web-service-security-testing","relationship":"complementary"},{"source":"performing-api-fuzzing-with-restler","target":"performing-api-security-testing-with-postman","relationship":"complementary"},{"source":"performing-api-fuzzing-with-restler","target":"performing-soap-web-service-security-testing","relationship":"complementary"},{"source":"performing-api-security-testing-with-postman","target":"performing-soap-web-service-security-testing","relationship":"complementary"},{"source":"performing-binary-exploitation-analysis","target":"stack-overflow-and-rop","relationship":"generalizes"},{"source":"performing-binary-exploitation-analysis","target":"binary-protection-bypass","relationship":"complementary"},{"source":"stack-overflow-and-rop","target":"binary-protection-bypass","relationship":"complementary"},{"source":"heap-exploitation","target":"binary-protection-bypass","relationship":"complementary"},{"source":"performing-web-cache-deception-attack","target":"performing-web-cache-poisoning-attack","relationship":"complementary"},{"source":"performing-web-cache-deception-attack","target":"testing-for-host-header-injection","relationship":"complementary"},{"source":"performing-web-cache-deception-attack","target":"web-cache-deception","relationship":"generalizes"},{"source":"performing-web-cache-poisoning-attack","target":"testing-for-host-header-injection","relationship":"complementary"},{"source":"performing-web-cache-poisoning-attack","target":"web-cache-deception","relationship":"overlap"},{"source":"testing-for-host-header-injection","target":"web-cache-deception","relationship":"complementary"},{"source":"analyzing-windows-event-logs-in-splunk","target":"detecting-lateral-movement-with-splunk","relationship":"overlap"},{"source":"analyzing-windows-event-logs-in-splunk","target":"detecting-rdp-brute-force-attacks","relationship":"complementary"},{"source":"detecting-lateral-movement-with-splunk","target":"detecting-rdp-brute-force-attacks","relationship":"complementary"},{"source":"analyzing-malicious-pdf-with-peepdf","target":"analyzing-pdf-malware-with-pdfid","relationship":"tool-specific"},{"source":"performing-purple-team-atomic-testing","target":"performing-purple-team-exercise","relationship":"complementary"},{"source":"performing-purple-team-atomic-testing","target":"performing-threat-emulation-with-atomic-red-team","relationship":"tool-specific"},{"source":"performing-purple-team-exercise","target":"performing-threat-emulation-with-atomic-red-team","relationship":"generalizes"},{"source":"performing-threat-hunting-with-yara-rules","target":"performing-yara-rule-development-for-detection","relationship":"complementary"},{"source":"performing-malware-hash-enrichment-with-virustotal","target":"performing-threat-hunting-with-yara-rules","relationship":"complementary"},{"source":"performing-malware-hash-enrichment-with-virustotal","target":"performing-yara-rule-development-for-detection","relationship":"knowledge-support"},{"source":"configuring-snort-ids-for-intrusion-detection","target":"configuring-suricata-for-network-monitoring","relationship":"tool-specific"},{"source":"configuring-snort-ids-for-intrusion-detection","target":"implementing-network-intrusion-prevention-with-suricata","relationship":"tool-specific"},{"source":"building-adversary-infrastructure-tracking-system","target":"tracking-threat-actor-infrastructure","relationship":"overlap"},{"source":"building-adversary-infrastructure-tracking-system","target":"performing-ip-reputation-analysis-with-shodan","relationship":"complementary"},{"source":"performing-ip-reputation-analysis-with-shodan","target":"tracking-threat-actor-infrastructure","relationship":"complementary"},{"source":"analyzing-malware-family-relationships-with-malpedia","target":"analyzing-ransomware-leak-site-intelligence","relationship":"complementary"},{"source":"analyzing-malware-family-relationships-with-malpedia","target":"analyzing-threat-landscape-with-misp","relationship":"complementary"},{"source":"analyzing-ransomware-leak-site-intelligence","target":"analyzing-threat-landscape-with-misp","relationship":"complementary"},{"source":"analyzing-sbom-for-supply-chain-vulnerabilities","target":"generating-and-analyzing-sboms","relationship":"complementary"},{"source":"analyzing-sbom-for-supply-chain-vulnerabilities","target":"performing-sca-dependency-scanning-with-snyk","relationship":"overlap"},{"source":"generating-and-analyzing-sboms","target":"performing-sca-dependency-scanning-with-snyk","relationship":"workflow-variant"},{"source":"hunting-for-webshell-activity","target":"implementing-runtime-application-self-protection","relationship":"complementary"},{"source":"hunting-for-webshell-activity","target":"implementing-web-application-logging-with-modsecurity","relationship":"complementary"},{"source":"implementing-runtime-application-self-protection","target":"implementing-web-application-logging-with-modsecurity","relationship":"complementary"},{"source":"detecting-ntlm-relay-with-event-correlation","target":"detecting-pass-the-hash-attacks","relationship":"complementary"},{"source":"performing-insider-threat-investigation","target":"performing-ransomware-response","relationship":"overlap"},{"source":"api-security-testing","target":"conducting-api-security-testing","relationship":"tool-specific"},{"source":"solve-challenge","target":"ctf-misc","relationship":"router-of"},{"source":"building-threat-actor-profile-from-osint","target":"performing-ai-driven-osint-correlation","relationship":"complementary"},{"source":"configuring-active-directory-tiered-model","target":"configuring-ldap-security-hardening","relationship":"complementary"},{"source":"implementing-api-schema-validation-security","target":"implementing-api-threat-protection-with-apigee","relationship":"complementary"},{"source":"performing-access-review-and-certification","target":"performing-entitlement-review-with-sailpoint-iiq","relationship":"tool-specific"},{"source":"implementing-fuzz-testing-in-cicd-with-aflplusplus","target":"performing-fuzzing-with-aflplusplus","relationship":"specializes"},{"source":"detecting-email-account-compromise","target":"detecting-email-forwarding-rules-attack","relationship":"complementary"},{"source":"securing-aws-iam-permissions","target":"securing-aws-lambda-execution-roles","relationship":"specializes"},{"source":"performing-steganography-detection","target":"steganography-techniques","relationship":"complementary"},{"source":"implementing-file-integrity-monitoring-with-aide","target":"validating-tpm-measured-boot-attestation","relationship":"complementary"},{"source":"detecting-network-scanning-with-ids-signatures","target":"detecting-port-scanning-with-fail2ban","relationship":"complementary"},{"source":"implementing-dragos-platform-for-ot-monitoring","target":"implementing-endpoint-detection-with-wazuh","relationship":"complementary"},{"source":"building-incident-response-dashboard","target":"building-soc-metrics-and-kpi-tracking","relationship":"complementary"},{"source":"analyzing-malware-behavior-with-cuckoo-sandbox","target":"analyzing-malware-sandbox-evasion-techniques","relationship":"complementary"},{"source":"building-vulnerability-exception-tracking-system","target":"conducting-cyber-risk-assessment-with-nist-800-30","relationship":"complementary"},{"source":"implementing-pam-for-database-access","target":"implementing-privileged-session-monitoring","relationship":"complementary"},{"source":"find-security-vulnerabilities-in-code","target":"implementing-semgrep-for-custom-sast-rules","relationship":"complementary"},{"source":"exploiting-type-juggling-vulnerabilities","target":"type-juggling","relationship":"complementary"},{"source":"src-6k-hunting","target":"src-hunter","relationship":"complements"},{"source":"src-6k-hunting","target":"recon-and-methodology","relationship":"complements"},{"source":"src-6k-hunting","target":"waf-bypass-techniques","relationship":"related"},{"source":"src-6k-hunting","target":"hack","relationship":"related"},{"source":"src-6k-hunting","target":"hello_js_reverse_skill","relationship":"related"}]}