Skill UI

This expert skill performs non-intrusive static analysis to thoroughly audit AI skills and bundles. It identifies malicious patterns, data leaks, system stability risks, and obfuscated payloads across major operating systems (Windows, macOS, Linux/Unix) and mobile platforms (Android/iOS). Use it when verifying skill legitimacy or performing deep cross-platform security reviews.

A comprehensive tool for security professionals to enumerate and analyze malware persistence mechanisms across critical Windows Auto-Start Extensibility Points (ASEPs). It systematically scans registry run keys, scheduled tasks, services, drivers, and startup locations. Ideal for incident response, threat hunting, and validating the complete removal of malicious autostart entries.

A comprehensive guide utilizing Splunk Enterprise Security and SPL to conduct deep forensic analysis of security incidents. This skill covers correlating disparate sources like Windows event logs, firewall records, proxy data, and Sysmon logs to detect TTPs, reconstruct timelines, and identify anomalies, making it essential for incident response and threat hunting.

Establishes a repeatable, structured operational process for managing Microsoft Patch Tuesday security updates. The workflow guides users through advisory review, vulnerability triaging (including zero-days), phased testing, and deployment across major platforms (Windows, Azure, Office). Ideal for maturing patch management programs and defining risk-based remediation SLAs.

This skill guides the advanced configuration of Windows Event Logging using Group Policy Objects (GPO) and advanced audit policies. It enables high-fidelity logging for critical security events, including process creation (Event 4688), logon/logoff activities, and object access. The process covers optimizing log sizes and implementing Windows Event Forwarding (WEF) to centralize data into SIEM platforms for effective threat detection and forensic investigation.

A comprehensive guide for deploying and configuring CrowdStrike Falcon EDR agents across diverse endpoints (Windows, macOS, Linux). This skill covers silent installation via SCCM, Intune, GPO, and command-line methods, alongside establishing robust prevention and response policies. Ideal for onboarding endpoints, enhancing threat detection capabilities, and integrating Falcon telemetry into SIEM platforms for advanced security operations.

This skill provides comprehensive detection methods for credential dumping techniques, a critical post-exploitation phase in cyber attacks. It targets the extraction of sensitive credentials from LSASS memory, SAM registry hives, and NTDS.dit using advanced security visibility. Detection relies on analyzing Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and complex SIEM correlation rules, making it essential for SOC analysts and threat hunters investigating advanced persistent threats (APTs).

This skill provides a comprehensive framework for detecting various privilege escalation techniques across Windows and Linux. It covers access token manipulation, UAC bypass, unquoted service path abuse, and kernel exploits. It is essential for threat hunting, scoping compromise during incident response, and validating detection coverage in proactive security assessments.

A comprehensive guide and set of detection rules for identifying OS credential dumping techniques (MITRE T1003). It leverages EDR telemetry, Sysmon process access monitoring, and Windows security event correlation to detect attacks targeting LSASS memory, SAM databases, and NTDS.dit files. Essential for proactive threat hunting and incident response.

This skill guides the security hardening of Windows endpoints (10/11, Server 2019/2022) using established CIS Benchmarks. It provides a comprehensive workflow for establishing secure organizational baselines, configuring Group Policy Objects (GPOs), and enforcing security controls across critical areas like password policies, audit logs, and firewall rules. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This guide details how to hunt for DCSync attacks (MITRE ATT&CK T1003.006) in Active Directory environments. It focuses on analyzing Windows Security Event ID 4662, specifically looking for DS-Replication-Get-Changes requests originating from non-domain-controller accounts. This technique is critical for incident response, purple teaming, and detecting unauthorized credential theft via Active Directory replication abuse.

This advanced skill guides users on hunting for Living Off the Land Binaries (LOLBins) abuse by analyzing endpoint process creation logs. It focuses on detecting malicious use of legitimate Windows binaries (like certutil or mshta) for defense evasion or data exfiltration, mapping techniques to MITRE T1218. Ideal for threat hunters and security teams building advanced detection rules.