Skill UI

This skill performs threat hunting for persistence mechanisms by parsing Windows System event logs (Event ID 7045). It specifically detects suspicious service installations, analyzing service binary paths, and correlating these events with advanced telemetry (Sysmon/EDR) to identify indicators of compromise (MITRE ATT&CK T1543.003). Ideal for incident response and security validation.