Browse Skills

Browser Forensics with Hindsight parses Chromium-based browser databases (Chrome, Edge, Brave, Opera, Vivaldi) to extract and correlate web activity artifacts into a unified timeline for incident response, insider-threat investigations, and criminal cases.

C2 Communication Analysis examines malware command-and-control traffic over HTTP, HTTPS, DNS, and custom protocols to identify beaconing patterns, decode message structure, map infrastructure, and attribute threat actors.

Campaign Attribution Analysis evaluates cyber-campaign evidence to attribute an operation to a threat actor using the Diamond Model and Analysis of Competing Hypotheses. Use it when an incident investigation needs a defensible attribution confidence level.

Cobalt Strike Beacon Config Analysis extracts and decodes Cobalt Strike beacon configurations from PE files, shellcode, or memory dumps to reveal C2 servers, sleep intervals, jitter, watermark, and malleable C2 profile settings. Use it during incident response, threat hunting, or detection rule building.

CT Log Phishing Detection monitors Certificate Transparency logs with crt.sh and Certstream to flag suspicious certificates and phishing domains. Use it for threat hunting, security monitoring, and early detection of lookalike domains.

Disk Image Acquisition creates forensically sound bit-for-bit disk images with dd or dcfldd on Linux, preserving evidence integrity through hash verification. Use when imaging suspect drives, USB devices, or memory cards for incident response or legal proceedings.

Docker Container Forensics provides a workflow to preserve and analyze compromised Docker containers, including image layer inspection, host artifact examination, and security configuration auditing. Use it during incident response or container security investigations.

Email Header Phishing Analysis parses raw email headers to trace delivery paths, verify sender authenticity, and detect spoofing or phishing indicators. Use it during incident response or phishing investigations to validate SPF, DKIM, and DMARC records and assess domain reputation.

Ethereum Smart Contract Security Analysis performs static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect vulnerabilities like reentrancy and integer overflows. Use it to audit contracts before deployment, investigate security incidents, or build detection rules for threat hunting.

Security Skill Improvement provides a structured way to submit improvement requests for existing cybersecurity skills. Use it to identify issues in agent code, API references, frontmatter, or ATT&CK mappings and propose specific changes.

Shadow Credentials Privilege Escalation abuses the msDS-KeyCredentialLink attribute to append an attacker-controlled key and recover the target's NT hash via PKINIT, enabling account takeover without resetting passwords when BloodHound shows write access over the attribute.

Frontend Slides creates animation-rich, zero-dependency HTML presentations from scratch or by converting PowerPoint files. Use it when building a talk, pitch, or web-based deck and you want visual style discovery instead of abstract choices.