Skill UI

This skill provides a comprehensive method for querying advanced threat intelligence using ATT&CK data. It maps the Tactics, Techniques, and Procedures (TTPs) of specific APT groups into MITRE ATT&CK Navigator layers. Users can build multi-layer heatmaps to identify detection gaps, compare threat coverage, and create structured threat-intel reports for defense engineering.

This skill provides a systematic method to map observed Indicators of Compromise (IOCs) and threat actor TTPs to the global MITRE ATT&CK framework. It guides users in building technique coverage heatmaps using the ATT&CK Navigator, identifying critical detection gaps, and generating actionable threat intelligence reports across Enterprise, Mobile, and ICS domains. Ideal for SOC analysts, threat hunters, and security researchers seeking structured threat analysis.

This skill guides security analysts through detecting MITRE ATT&CK T1098 account manipulation techniques. It analyzes Windows Security Event Logs (e.g., 4738, 4728) to find signs of unauthorized privilege escalation, group membership changes, or shadow admin account creation. It is essential for proactive threat hunting, incident response, and validating Active Directory security posture.

This skill performs threat hunting for persistence mechanisms by parsing Windows System event logs (Event ID 7045). It specifically detects suspicious service installations, analyzing service binary paths, and correlating these events with advanced telemetry (Sysmon/EDR) to identify indicators of compromise (MITRE ATT&CK T1543.003). Ideal for incident response and security validation.

Conducts comprehensive, sector-specific threat landscape assessments by profiling key threat actors, mapping attack vectors, and detailing associated MITRE ATT&CK TTPs (covering financial, healthcare, energy, etc.). Utilizing sophisticated data analysis via Python stacks and integrating real-time threat intelligence feeds (ISAC, CVEs), this tool generates highly actionable intelligence for risk management, security investment prioritization, and high-level board-level reporting on industry exposure.

Hayabusa is a specialized threat-hunting and fast-forensics tool designed to analyze Windows EVTX event logs. It applies a comprehensive library of Sigma detection rules to raw log data, generating a single, prioritized, chronological timeline. The output includes severity levels, MITRE ATT&CK mappings, and detailed metrics, enabling analysts to perform rapid, SIEM-free incident triage and export results for collaborative analysis.