Skill UI

This skill details advanced digital forensics techniques for recovering metadata and content of deleted files by analyzing the NTFS Master File Table ($MFT). It covers examining key system artifacts like $LogFile and $UsnJrnl, and analyzing MFT slack space. Use this when reconstructing file system timelines, investigating data loss, or detecting anti-forensic techniques like timestomping during a Windows forensic examination.

A comprehensive guide utilizing Splunk Enterprise Security and SPL to conduct deep forensic analysis of security incidents. This skill covers correlating disparate sources like Windows event logs, firewall records, proxy data, and Sysmon logs to detect TTPs, reconstruct timelines, and identify anomalies, making it essential for incident response and threat hunting.

This skill detects persistence mechanisms by monitoring Windows startup directories for suspicious file creation (T1547.001). It utilizes real-time file system monitoring via Python watchdog, cross-references Autoruns entries, and analyzes file metadata to identify implants that survive system reboots. Essential for threat hunting and validating security monitoring coverage.

This guide focuses on developing multi-event correlation rules using Splunk SPL and Sigma format. It teaches how to detect Advanced Persistent Threats (APT) and lateral movement by chaining multiple Windows authentication, process execution, and network connection events across hosts within specified time windows. Use this to surface complex, multi-stage attack sequences that single-event detection rules typically miss.

This guide provides comprehensive strategies for scaling datasets that exceed the capacity of a single node. It covers various architectural patterns, including multi-tenancy with payload partitioning and sliding time window management. We detail the full scaling progression, from optimizing a single node (Vertical Scaling) to distributing data across multiple nodes via sharding (Horizontal Scaling), ensuring reliable handling of massive, growing datasets.

A comprehensive model detailing the entire academic review pipeline for microarchitecture papers, anchored to major conferences like MICRO. It outlines the timeline, from initial submission and double-blind review through the rebuttal/revision window, to final notification. The guide details what expert reviewers focus on—including mechanism novelty, methodology credibility, and cost honesty—providing authors with actionable strategies for strengthening their work through the academic publication lifecycle.