Skill UI

A comprehensive runbook designed for on-call engineers to manage Databricks incidents, outages, and major job failures. It provides structured procedures for immediate triage, decision tree guidance (covering cluster failures, code errors, and data quality issues), and steps for evidence collection and postmortem documentation, ensuring rapid and systematic incident resolution.

Hindsight is an open-source tool designed for digital forensics, parsing artifacts from various Chromium-based browsers (Chrome, Edge, Brave, etc.). It extracts and correlates all web activity data, including browsing history, cookies, cached content, downloads, and saved credentials, into a unified timeline. This tool is essential for incident response, insider threat investigations, and reconstructing user web activity in security and legal contexts.

Systematically evaluates cyber-campaign evidence to attribute a cyber operation to a specific threat actor. This skill utilizes advanced analytical frameworks like the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh multiple indicators, including infrastructure overlaps, TTP consistency, malware similarity, and operational patterns, providing confidence-weighted attribution assessments for incident response.

This skill analyzes Indicators of Compromise (IOCs)—such as IP addresses, domains, and file hashes—by querying multiple threat intelligence platforms (VirusTotal, AbuseIPDB, MISP). It determines maliciousness confidence, assigns blocking priorities, and attributes threats to campaigns, crucial for incident response, threat triage, and making informed security decisions.

This skill details the forensic analysis of Windows LNK shortcut files and Jump Lists. These artifacts record critical user activity, including file access and program execution, even after the original source files have been deleted. It covers using specialized tools (LECmd, JLECmd) and Python parsing techniques to reconstruct user timelines, making it essential for incident response and deep digital forensics examinations.

A comprehensive toolset for digital forensics investigators, enabling the parsing of proprietary Microsoft Outlook PST and OST files. It extracts critical evidence including full message content, detailed email headers (for message routing/tracing), attachments, and deleted items from the Recoverable Items folder. Essential for e-discovery, legal investigations, and security incident response to reconstruct communication patterns and analyze message metadata.

This skill parses Windows Prefetch (.pf) files to reconstruct detailed application execution history. It is crucial for digital forensics, allowing analysts to track execution timelines, identify suspicious or renamed binaries, and investigate potential malware activity or lateral movement during incident response. It uses Python to extract run counts and accessed file details.

A comprehensive toolkit designed to automatically extract Indicators of Compromise (IOCs) from malware samples. It harvests critical artifacts including file hashes (MD5, SHA256), network indicators (IPs, domains, URLs), and host artifacts (registry keys, mutexes) using static, dynamic, and PCAP analysis. Essential for threat intelligence, building defense rules (YARA, Snort), and incident response.

This capability provides advanced threat hunting by analyzing network telemetry (DNS, proxy, connection logs) to detect Command and Control (C2) beaconing patterns. It uses statistical analysis, frequency detection, and jitter analysis to identify compromised endpoints communicating with adversary infrastructure, crucial for proactive threat detection and incident response.

This guide details a structured threat hunting methodology designed to proactively detect sophisticated spearphishing campaigns. It instructs users on correlating indicators across email logs, endpoint telemetry (EDR), and network data (SIEM) to identify targeted threats, supporting incident response and security posture improvement.

This skill guides security analysts through detecting MITRE ATT&CK T1098 account manipulation techniques. It analyzes Windows Security Event Logs (e.g., 4738, 4728) to find signs of unauthorized privilege escalation, group membership changes, or shadow admin account creation. It is essential for proactive threat hunting, incident response, and validating Active Directory security posture.

This skill performs threat hunting for persistence mechanisms by parsing Windows System event logs (Event ID 7045). It specifically detects suspicious service installations, analyzing service binary paths, and correlating these events with advanced telemetry (Sysmon/EDR) to identify indicators of compromise (MITRE ATT&CK T1543.003). Ideal for incident response and security validation.