Loading...
Loading...
Found 45 Skills
Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.
Cyber Threat Intelligence gathering, IOC extraction, threat analysis, and intelligence reporting. Process threat data and produce actionable intelligence. Use for CTI work, threat research, and intelligence dissemination.
This skill applies to authorized OSINT and cyber threat intelligence work, which enriches information related to IOCs, malicious campaigns, impersonation incidents, scams, and threat actors from public sources. It includes bounded X/Twitter search via Xquik, source preservation, information corroboration, and evidence handoff functions.
Build out a full CTI program around the six-phase threat intelligence lifecycle (direction, collection, processing, analysis, dissemination, feedback), including defining intelligence requirements, building a collection pipeline, normalizing data, and tracking dissemination feedback. Use when standing up or maturing a threat intelligence program, defining intelligence requirements, or designing collection-to-dissemination workflows for a CTI team.
Hunt threat-intelligence indicators of compromise (IoCs) across Dynatrace logs and spans and produce a 0-100 threat-exposure score. Extracts and normalizes IoCs — IPs, Domains (hostnames included), URLs, Emails, CVEs, File hashes (md5/sha1/sha256), MITRE TTPs — from unstructured reports, advisories, advisory URLs, pasted text, or STIX, then hunts them in fetch logs and fetch spans. Trigger: hunt these IoCs, am I exposed to this threat, check these indicators in my logs and traces, threat exposure report, extract IoCs from this advisory URL, search these hashes/domains/IPs in my environment. Routes CVE-to-vulnerability and IP/MITRE-to-detection legs to dt-sec-insights. Do NOT use for: querying security.events directly (vulnerabilities, detections, compliance, THREAT_REPORT — use dt-sec-insights); general log queries not tied to an IoC hunt (use dt-obs-logs); general span/trace analysis (use dt-obs-tracing); explaining DQL syntax (use dt-dql-essentials).
End-to-end passive reconnaissance workflow for a domain, website, or IP — builds an asset inventory covering registration, DNS, subdomains, infrastructure, tech stack, history and ownership without sending traffic to the target.
Find internet-exposed hosts, ports, services and devices using third-party internet-scan data. Use when searching Shodan or Censys, writing Shodan filter queries, reading service banners, checking open ports on an IP or netblock, pivoting on favicon hashes or TLS certificate fingerprints, hunting origin IPs behind Cloudflare or a CDN, or looking for exposed databases, dashboards, cameras and ICS devices without scanning the target.
Detect and analyze potentially malicious repositories disguising as legitimate software cracks or pirated tools
WARNING - This repository distributes malware disguised as pirated Bitdefender antivirus software
Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.
Identify and report potentially malicious software repositories masquerading as legitimate security tools
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.