Skill UI

Guides Windows users how to download and run a BusyBox binary to access familiar Unix commands from PowerShell, including CPU/OS checks, download options, and invocation tips.

Detects PowerShell Empire artifacts inside Windows event logs by scanning Script Block and Module Logging for known launcher strings, Base64 payloads, module invocations, user agents, and staging URLs to support incident response and hunting.

Detect adversarial persistence by monitoring WMI subscription creation, analyzing event filters/consumers, and correlating Sysmon, Windows events, and PowerShell activity to spot fileless threats.

Parses Windows System event logs for Event ID 7045 to spot unusual service installations, flag suspicious binary paths (temp dirs, PowerShell/cmd abuse, encoded commands), and produce JSON reports linking findings to MITRE ATT&CK T1543.003 for threat hunters and SOCs.

Documented guidelines for running PowerShell and CMD commands reliably on Windows, covering encoding handling, path quoting, cmdlet substitutions, dotnet CLI best practices, environment variables, long paths, and troubleshooting common shell errors.