Skill UI

This skill provides a comprehensive framework for detecting Living Off the Land Binaries (LOLBAS) abuse, such as misuse of certutil, regsvr32, and mshta. It leverages process telemetry from Sysmon and Windows Event Logs, combined with advanced Sigma rule-based detection and parent-child process anomaly analysis. Ideal for SOC analysts and threat hunters investigating sophisticated adversaries aiming to evade traditional security controls.

This skill analyzes Windows Security Event Logs (EVTX) to detect RDP brute force attacks. It parses failed logon events (ID 4625) and correlates them with successful logons (ID 4624), performing source IP frequency analysis to identify attack patterns, username spraying, and potential account compromises. This is critical for SOC analysts and threat hunters investigating lateral movement or credential stuffing attempts.

A comprehensive workflow for extracting, parsing, and analyzing Windows Event Logs (EVTX). It guides security professionals in using advanced tools like Chainsaw and Hayabusa, combined with Sigma rules, to detect critical security incidents such as lateral movement, privilege escalation, and persistence mechanisms during incident response and digital forensic investigations.

This skill detects WMI-based lateral movement by analyzing key Windows Security Event ID 4688 and Sysmon Event ID 1 logs. It focuses on identifying suspicious process execution patterns, such as WmiPrvSE.exe spawning unauthorized child processes (cmd.exe, powershell.exe), suspicious command lines, and WMI event subscriptions used for persistence. Ideal for security incident response and threat detection.

KAPE is a powerful, Windows-native triage tool used for Digital Forensics and Incident Response (DFIR). It executes in two phases: 'Targets' collect raw forensic artifacts (like registry hives, event logs, and prefetch files) from live systems, while 'Modules' parse this collected data into normalized, analyst-ready CSV/JSON formats. It enables fast, defensible, and scalable artifact collection, especially when full disk imaging is impractical.