Skill UI

This skill provides a structured methodology for detecting process injection techniques (MITRE ATT&CK T1055), which adversaries use for defense evasion and privilege escalation. It analyzes granular security logs, specifically utilizing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess), alongside source-target process relationship mapping to identify suspicious malicious behavior over general system activity.

This guide details the process of creating advanced, static visualizations in Power BI using Python libraries like matplotlib and seaborn. It covers the full workflow, from script writing and data injection to best practices and limitations, enabling users to render complex, custom charts not supported by native Power BI visuals.