Skill UI

This skill provides structured procedures for detecting Golden Ticket attacks, a severe threat involving forging Kerberos Tickets in Active Directory. It analyzes Windows Event ID 4769 for indicators such as RC4 encryption downgrades, abnormal ticket lifetimes, and inconsistencies in TGS/TGT requests. Designed for SOC analysts and threat hunters using SIEM platforms (Splunk/Elastic) to enhance security monitoring coverage against credential theft.

This advanced technique allows users to identify an obscure actor by linking indirect clues across three domains: the director, the film's characteristics, and the actor's biographical details. It is essential when direct searches fail, using the director's work or a film's context as the primary entry point to resolve the actor's identity.

This skill automates the complex process of transforming raw research papers (PDF or URL) into structured, knowledge graph-ready resources for OpenViking. It executes a rigorous workflow: reading the entire paper, compiling an ARA-style artifact directory, validating the content against established schemas, and finally ingesting the structured data into the OpenViking knowledge base using the `ov add-resource` command. It ensures all evidence, claims, and logical relationships are captured systematically.