Skill UI

Enables regression modeling via the regression-analysis-tool plugin by analyzing datasets, choosing linear or polynomial fits, validating models, and reporting metrics so users can predict outcomes or explore variable relationships.

This guide details how to detect WMI event subscription persistence, a common attacker technique (T1546.003). It focuses on analyzing suspicious Sysmon Event IDs 19, 20, and 21 to identify malicious EventFilters, EventConsumers, and Bindings. Essential for incident response and threat hunting in Windows environments.

This skill performs a deep, cross-model audit of experimental results to ensure integrity before claiming findings. It systematically checks for common fraud patterns, such as generating fake ground truths, misleading score normalization, or citing phantom results. Use it when evaluating reported experimental outcomes to ensure methodological rigor and trustworthiness.