Skill UI

This skill detects WMI-based lateral movement by analyzing key Windows Security Event ID 4688 and Sysmon Event ID 1 logs. It focuses on identifying suspicious process execution patterns, such as WmiPrvSE.exe spawning unauthorized child processes (cmd.exe, powershell.exe), suspicious command lines, and WMI event subscriptions used for persistence. Ideal for security incident response and threat detection.

Provides expert guidance for connecting to Power BI Desktop's local tabular model using the Tabular Object Model (TOM) and ADOMD.NET via PowerShell. This skill covers model enumeration, executing DAX queries, metadata modification (tables, measures, relationships), query tracing, and model refreshing. It is specifically designed for managing the underlying data model structure when external tools like Tabular Editor CLI are unavailable.