Skill UI

This skill manages the strategic distribution of a single core idea across various social media platforms, including X, LinkedIn, Threads, and Bluesky. Instead of simply cross-posting the same content, it uses advanced content adaptation techniques to adjust the tone, format, and focus for each specific platform. This ensures the message remains consistent while optimizing for native platform constraints, preventing duplication and maximizing engagement.

This skill generates a comprehensive daily digest summarizing all critical pending items into a single summary. It aggregates stalled scheduling threads, unanswered emails, pending introductions/follow-ups, open Todoist tasks, and upcoming calendar events from multiple sources. It is essential for running a daily summary cron job or when the user requires a quick status check on their workload and commitments.

A comprehensive design specification detailing 98 rules for building Command Line Interface (CLI) tools that are safe, reliable, and easily consumable by AI agents. It covers structured JSON output formats, standardized error handling (to stderr), robust input contracts, safety guardrails (e.g., preventing path traversal), and tiered compliance levels (Agent-Friendly, Agent-Ready, Agent-Native) for seamless integration into AI workflows.

This tool is designed for advanced threat hunting and digital forensics. It analyzes Windows Event Logs (specifically Script Block Logging 4104 and Module Logging 4103) to detect artifacts left by the PowerShell Empire post-exploitation framework. Detection patterns include default launchers, Base64 payloads (WebClient, FromBase64String), known module invocations (e.g., Invoke-Mimikatz), and staging URL patterns, helping confirm C2 activity and lateral movement.

A dedicated tool for forensic analysis of Windows PowerShell Script Block Logs (Event ID 4104) captured in EVTX files. It reconstructs multi-block scripts, applying advanced detection heuristics such as entropy analysis and pattern matching to identify obfuscated commands, encoded payloads (Base64), download cradles, and AMSI bypass attempts, crucial for threat hunting and incident response.

A comprehensive guide utilizing Splunk Enterprise Security and SPL to conduct deep forensic analysis of security incidents. This skill covers correlating disparate sources like Windows event logs, firewall records, proxy data, and Sysmon logs to detect TTPs, reconstruct timelines, and identify anomalies, making it essential for incident response and threat hunting.

This tool queries a MISP (Malware Information Sharing Platform) instance via PyMISP to compute detailed event statistics, IOC type breakdowns, threat actor galaxy clusters, and tag trends. It generates comprehensive threat landscape reports, visualizing temporal trends. Use it when investigating security incidents, summarizing top threat actors or malware families, or producing a formal Cyber Threat Intelligence (CTI) report.

This tool correlates multiple system artifacts, including Windows registry keys (USBSTOR, MountedDevices), Event Logs, and SetupAPI logs, to reconstruct a detailed timeline of USB device usage. It determines first/last connection timestamps, tracks device provenance, and maps drive letter assignments. Essential for digital forensics investigations, insider threat detection, and verifying compliance regarding removable media usage.

A comprehensive toolkit using Splunk's SPL language to analyze Windows Security, System, and Sysmon event logs. It maps advanced detection queries to specific MITRE ATT&CK techniques, enabling SOC analysts to investigate authentication attacks (e.g., brute force, password spraying), detect privilege escalation, locate persistence mechanisms, and trace lateral movement for detailed forensic timeline analysis.

Timesketch is a powerful, open-source tool for security teams to build collaborative forensic timelines. It ingests, normalizes, and analyzes multi-source event data—including logs, artifacts, and Plaso outputs—to reconstruct complex attack chains and document incident investigations. Ideal for joint analysis and deep dive DFIR work.

This pipeline provides an automated solution for processing raw Indicators of Compromise (IOCs) from various sources, including IPs, domains, URLs, and emails. It performs crucial steps such as normalization, deduplication, and defanging (modifying indicators to prevent accidental execution while preserving readability). The final, processed data is converted into the standardized STIX 2.1 format and can be securely distributed via TAXII servers or MISP instances, streamlining threat intelligence sharing.

A comprehensive guide to building automated Indicator of Compromise (IOC) enrichment pipelines within Splunk Enterprise Security. This process integrates multiple external threat feeds (STIX/TAXII, CSV, APIs) into normalized KV Store collections. By correlating these enriched threat indicators against live security events using advanced lookup searches, SOC teams can significantly reduce manual triage time and automatically identify potential security incidents.