Skill UI

A guide for security professionals and threat hunters to proactively detect advanced privilege escalation techniques across Windows and Linux environments. It covers critical attack methods including token manipulation, UAC bypass, unquoted service paths, and kernel exploits, utilizing EDR and SIEM data sources for comprehensive incident response and security assessments.

This skill provides a comprehensive workflow for verifying the integrity of a system's boot chain using Trusted Platform Module (TPM 2.0). It covers local validation (event log replay against PCRs) and remote attestation (generating signed, nonce-bound quotes). Use this to detect bootkits, unauthorized firmware changes, or establish device posture for Zero Trust architectures.