Skill UI

Guides security analysts through endpoint log use cases for detecting defense evasion tactics such as log tampering, timestomping, process injection, masquerading, LOLBin abuse, and security tool disabling to support hunting, rule development, and investigation aligned with MITRE ATT&CK TA0005.

Detect MITRE T1070.006 timestamp manipulation by comparing NTFS $STANDARD_INFORMATION and $FILE_NAME entries in the MFT, leveraging analyzeMFT and Python to flag anomalous temporal patterns indicative of anti-forensic timestomping activity during threat hunts.

Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) by analyzing EDR/SIEM telemetry, correlating network activity, and documenting findings to inform detections for defense-evasion scenarios.