Loading...
Loading...
Found 12 Skills
Reverse-engineer defense implementations → Targeted bypass for red teams. First reverse-engineer the hook tables, ETW providers, and AMSI implementations of EDR / Defender / AV, then develop targeted unhook / indirect syscall / ETW patch / call stack spoof solutions. Align with MITRE ATT&CK T1562 Defense Evasion. Trigger keywords: EDR bypass, AV bypass, evasion, unhook, direct syscall, indirect syscall, Hell's Gate, Halo's Gate, Tartarus Gate, ETW patch, AMSI patch, call stack spoofing, hardware breakpoint Blindside, MITRE T1562, ntdll unhook, kernel callback, CrowdStrike bypass, Defender bypass, Sentinel One bypass, Elastic Defend, Sysmon evasion, PPID spoof, Sleep mask, Process Hollowing, Reflective DLL.
Generate diagrams from natural language using EdrawMax AI APIs. Supports four diagram types: flowchart (流程图), infographic (信息图), Gantt chart (甘特图), and mind map (思维导图). Use when the user wants to create, generate, or draw any of these diagram types. Triggers on: 'generate a flowchart,' 'create a mind map,' 'draw a Gantt chart,' 'make an infographic,' 'visualize a process,' 'project timeline,' 'knowledge map,' or any request to turn a description into a diagram.
Operate the Prelude Security platform CLI for continuous security testing (Detect) and endpoint posture monitoring (SCM). Manages endpoints, schedules tests, evaluates security control policies, integrates with EDR/XDR partners, and generates reports. Use when working with the `prelude` CLI or managing security infrastructure.
Implements security chaos engineering experiments that deliberately disable or degrade security controls to verify detection and response capabilities. Tests WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess. Use when validating SOC detection coverage and resilience.
Edrone integration. Manage data, records, and automate workflows. Use when the user wants to interact with Edrone data.
HarfangLab orb / EDR detection engineering — Sigma rule authoring in CoreTide's validated YAML schema (selections array, modifiers, conditional field validation), RHQL hunt query language, YARA file/memory scanning (CoreTide structure with imports, meta.context, auto-routing), full logsource category catalogue (39 Windows, 12 Linux, 6 macOS), 21 Sigma modifiers, maturity/confidence/action lifecycle, exclusion discipline, and SIEM ingestion patterns. Distilled from CoreTide HarfangLab sub-schema and SigmaHQ (3132 rules). Use for harfanglab-keyed configurations in OpenTide MDR objects.
VMware Carbon Black Cloud Enterprise EDR authoring guidance — distinguishes process search query syntax (CBC search language) from watchlist feeds, scheduled searches, and live response. Covers indicator vs IOC discipline, watchlist subscription model, alert override / interrupt, sensor capability boundaries, and entity identifier alignment for cross-platform correlation. Use for carbon_black_cloud-keyed configurations in OpenTide MDR objects.
Use when the user reports connectivity issues, access failures, DNS resolution problems, or any error with Twingate. Activate for: "can't connect", "not working", "resource not found", "access denied", DEAD connector, DNS not resolving, device trust blocking access, security policy issues, P2P failure, or any Twingate troubleshooting or diagnostic request. Also activate for symptom-shaped and error-string queries: exact client error text ("unknown network name", "too many open files", "setup wizard ended prematurely", "unable to join network"), OS-specific client bugs on Windows, macOS, Linux (Fedora, Ubuntu, NixOS), ChromeOS, or Android Auto; client crashes, freezes, or unresponsiveness; version-specific regressions (e.g. a specific client build number misbehaving); TAP adapter or virtual network adapter issues; device posture / screen lock / disk encryption check failures; third-party AV, EDR, VPN, or DNS-filtering software conflicts (CrowdStrike, Zscaler, Elastic AV, Avast, consumer VPNs); packet capture, system report, or client/connector log collection; and engaging or escalating to Twingate technical support.
Use when the user asks about IdP integration, SCIM provisioning, security policies, device trust, groups, users, or access control in Twingate. Activate for: SAML, SCIM, Okta, Entra ID, Google Workspace, JumpCloud, OneLogin, Keycloak, device trust, device posture, MFA enforcement, groups, JIT access, ephemeral access, auto-lock, offboarding, deprovisioning, multi-IdP deployments, or security policy configuration. Also activate for identity automation tooling: automating device trust from an MDM or EDR inventory (Jamf, Kandji, Intune, CrowdStrike, SentinelOne, FleetDM, Automox, JumpCloud, Mosyle, Datto RMM), migrating group access between IdPs, self-service or Slack-based group access requests, and location-based group switching.
Guides information security engineering—implementing and operating security controls, identity and access systems, encryption and secrets management, security tool integrations (SIEM, EDR, SOAR), cloud guardrails, hardening baselines, and remediation engineering for vulnerabilities. Use when building SSO/RBAC/PAM patterns, configuring KMS or certificate lifecycle, deploying WAF/DLP or EDR connectors, writing security-as-code policies (OPA, SCPs, CIS benchmarks), integrating logging to SIEM, automating security workflows, or validating control fixes—not for SOC triage (soc-analyst), pentesting (penetration-tester, network-pentester, web-pentester), red team (red-team-specialist), CI gates only (devsecops), platform provisioning without security ownership (infrastructure-engineer), CISO/exec program (chief-information-security-officer), security program strategy (cybersecurity), GRC program and audit prep (compliance-specialist), or product tenancy isolation (product-infrastructure-security-engineer).
Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.
Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.