Skill UI

This guide details how to detect WMI event subscription persistence, a common attacker technique (T1546.003). It focuses on analyzing suspicious Sysmon Event IDs 19, 20, and 21 to identify malicious EventFilters, EventConsumers, and Bindings. Essential for incident response and threat hunting in Windows environments.

A comprehensive workflow for extracting, parsing, and analyzing Windows Event Logs (EVTX). It guides security professionals in using advanced tools like Chainsaw and Hayabusa, combined with Sigma rules, to detect critical security incidents such as lateral movement, privilege escalation, and persistence mechanisms during incident response and digital forensic investigations.

This skill detects WMI-based lateral movement by analyzing key Windows Security Event ID 4688 and Sysmon Event ID 1 logs. It focuses on identifying suspicious process execution patterns, such as WmiPrvSE.exe spawning unauthorized child processes (cmd.exe, powershell.exe), suspicious command lines, and WMI event subscriptions used for persistence. Ideal for security incident response and threat detection.

This skill provides a structured methodology for detecting process injection techniques (MITRE ATT&CK T1055), which adversaries use for defense evasion and privilege escalation. It analyzes granular security logs, specifically utilizing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess), alongside source-target process relationship mapping to identify suspicious malicious behavior over general system activity.

This skill implements the Diamond Model framework, providing a structured approach to analyzing complex cyber intrusions. It allows users to programmatically classify and correlate events based on four core elements: Adversary, Capability, Infrastructure, and Victim. Key functionalities include building activity threads, identifying pivot points, and generating comprehensive, pivot-ready threat intelligence reports.

Systematically optimizes Security Information and Event Management (SIEM) detection rules in platforms like Splunk and Elastic. This process involves analyzing historical alert volumes, establishing environmental baselines, creating context-aware whitelists, and statistically adjusting detection thresholds to significantly reduce false positives, improving overall security efficacy.

This skill provides a systematic framework for managing Indicators of Compromise (IOCs) throughout their entire life cycle—from initial discovery and validation to enrichment, deployment, monitoring, and eventual retirement. It emphasizes implementing confidence decay functions, tracking hit rates, and managing false positives to maintain a high-quality, actionable threat intelligence database, thereby minimizing analyst fatigue and maximizing detection efficacy.

This guide demonstrates how to build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across diverse sources. It covers the entire workflow, from processing disk images and various logs (MFT, registry, browser history) to generating standardized CSV, JSONL exports, and visualizing the results in tools like Timesketch for deep investigative analysis.

A comprehensive automation toolkit for Mixpanel product analytics, accessible via Rube MCP. Automate key data tasks including event aggregation, detailed segmentation, conversion funnel analysis, user profile management, cohort tracking, and running custom JQL queries. Ideal for data analysts and product managers needing to deeply analyze user behavior patterns.

A powerful toolset for automating core PostHog product analytics tasks via Rube MCP. It enables developers and analysts to capture user events, list and filter event data, manage feature flags (creation, retrieval, listing), and inspect user profiles. Ideal for integrating advanced product tracking and A/B testing workflows directly into development pipelines.

Automates GA4 reporting and property management via Composio’s Rube MCP, covering account/property discovery, standard/batch/pivot/funnel reports, and key event workflows so analysts can run repeatable queries without manual UI steps.

Surfaces Monte Carlo data observability insights—health, lineage, alerts, and monitors-as-code—before developers edit dbt models or SQL pipelines, ensuring risk-aware code changes.