Skill UI

Programmatically query ChEMBL bioactive molecules, targets, and approved drugs via the Python client; filter by structure, properties, activities, and indications to support inhibitor hunting or SAR studies for medicinal chemistry.

This skill guides users on querying Azure Monitor activity and sign-in logs using KQL to detect sophisticated security threats. It covers identifying suspicious administrative activities, impossible travel scenarios, privilege escalation attempts, and unauthorized resource modifications. Ideal for Security Operations Center (SOC) analysts building advanced threat hunting rules or developing cloud SIEM detections.

A comprehensive guide to deploying and configuring osquery across diverse endpoints (Windows, macOS, Linux). This tool allows security teams to gather deep, SQL-based insights into endpoint state, including running processes, network connections, system configuration, and installed software. It is essential for threat hunting, compliance auditing, and building centralized fleet visibility.

This script performs statistical analysis on Zeek connection logs (conn.log) to detect Command and Control (C2) beaconing patterns. It leverages the ZAT library to load data into Pandas DataFrames, calculates inter-arrival time statistics, and flags connections with low standard deviation relative to the mean. This technique is crucial for network threat hunting and security incident investigation when identifying malicious, periodic callbacks.

This skill provides methods for detecting covert data exfiltration channels using DNS tunneling. It analyzes DNS query patterns, including subdomain entropy, query volume anomalies, oversized TXT/CNAME records, and unusual query types, to identify potential data leakage attempts from compromised networks. Ideal for threat hunting and building advanced passive DNS monitoring capabilities.

This skill detects advanced cyber-physical attacks mimicking the Stuxnet pattern. It monitors for unauthorized modifications to PLC logic and detects discrepancies between reported sensor readings and actual physical process behavior. Ideal for high-security OT/ICS environments when hunting for APT lateral movement or validating process integrity against sophisticated threats.

This skill provides structured methods for detecting credential stuffing attacks by analyzing authentication logs. It focuses on identifying complex patterns such as login velocity anomalies, high IP diversity, password spray techniques, and suspicious geographical distributions of failed logins. It is essential for SOC analysts conducting threat hunting or building robust detection rules against account takeover attempts.

This capability provides advanced threat hunting by analyzing network telemetry (DNS, proxy, connection logs) to detect Command and Control (C2) beaconing patterns. It uses statistical analysis, frequency detection, and jitter analysis to identify compromised endpoints communicating with adversary infrastructure, crucial for proactive threat detection and incident response.

This guide details a structured threat hunting methodology designed to proactively detect sophisticated spearphishing campaigns. It instructs users on correlating indicators across email logs, endpoint telemetry (EDR), and network data (SIEM) to identify targeted threats, supporting incident response and security posture improvement.

This skill guides security analysts through detecting MITRE ATT&CK T1098 account manipulation techniques. It analyzes Windows Security Event Logs (e.g., 4738, 4728) to find signs of unauthorized privilege escalation, group membership changes, or shadow admin account creation. It is essential for proactive threat hunting, incident response, and validating Active Directory security posture.

This skill performs threat hunting for persistence mechanisms by parsing Windows System event logs (Event ID 7045). It specifically detects suspicious service installations, analyzing service binary paths, and correlating these events with advanced telemetry (Sysmon/EDR) to identify indicators of compromise (MITRE ATT&CK T1543.003). Ideal for incident response and security validation.

This skill detects covert data exfiltration occurring over DNS tunnels. It analyzes DNS query names by computing Shannon entropy, examining query length distributions, and identifying high subdomain cardinality. It is essential for security operations, incident response, and proactive threat hunting when suspicious or encoded DNS activity is suspected.