Skill UI

This skill guides the advanced configuration of Windows Event Logging using Group Policy Objects (GPO) and advanced audit policies. It enables high-fidelity logging for critical security events, including process creation (Event 4688), logon/logoff activities, and object access. The process covers optimizing log sizes and implementing Windows Event Forwarding (WEF) to centralize data into SIEM platforms for effective threat detection and forensic investigation.

This guide details how to hunt for adversary lateral movement (MITRE ATT&CK TA0008) using Splunk's advanced SPL querying capabilities. It focuses on analyzing Windows authentication logs (e.g., Type 3/10 logons), correlating event IDs (4624, 4648) with process creation data (Sysmon), and identifying unusual source-destination relationships across the network to scope the breadth of a compromise.

This skill provides a structured methodology for detecting persistence and lateral movement via malicious scheduled tasks. It utilizes Sysmon Event IDs (1, 11) and Windows Security Events (4698/4702) to correlate process creation, task file writes, and task registration details. Ideal for threat hunting and building robust detection rules for T1053.005.

This guide details how to detect T1055 process injection techniques, including DLL injection, process hollowing, and remote thread creation. By analyzing specific Sysmon Event IDs (1, 7, 8, 10, 25) that track cross-process memory operations and handle access, security teams can proactively hunt for defense-evasion activities, investigate EDR alerts, or validate security monitoring coverage.

A comprehensive tool for security analysts to hunt for malicious PowerShell activity. It analyzes Windows Event Log (EVTX) files by parsing Script Block Logging (Event 4104), Module Logging (4103), and process creation events. Detects obfuscated commands, AMSI bypass attempts, encoded payloads, and credential dumping techniques crucial for incident response and threat hunting.

A comprehensive guide for hypothesis-driven threat hunting focusing on Windows Scheduled Task persistence (T1053). This methodology guides the creation of advanced SIEM/EDR queries against critical events like task creation (Event ID 4698), suspicious actions, and unusual scheduling patterns. Essential for incident response, proactive threat hunting, and security assessments.

This skill guides security analysts through detecting MITRE ATT&CK T1098 account manipulation techniques. It analyzes Windows Security Event Logs (e.g., 4738, 4728) to find signs of unauthorized privilege escalation, group membership changes, or shadow admin account creation. It is essential for proactive threat hunting, incident response, and validating Active Directory security posture.

Monitors Windows process creation events to flag Living Off The Land Binary abuse by matching Event ID 4688/Sysmon 1 logs against LOLBAS database entries, supporting threat hunting and SIEM rule creation for fileless attacks.

This skill provides comprehensive detection strategies for adversaries abusing DCOM objects (e.g., MMC20.Application) to perform stealthy lateral movement (MITRE ATT&CK T1021.003). It details how to correlate Sysmon Event IDs (Process Creation, Network Connection), analyze WMI activity, and monitor RPC traffic on port 135 to identify unauthorized remote command execution chains. Ideal for advanced threat hunting, red teaming, and purple team exercises.

This guide outlines how to build new API connectors or providers that strictly adhere to the existing integration architecture and patterns of a target repository. It is designed for adding integrations while maintaining architectural consistency (e.g., layout, configuration schema, authentication model, and testing style), preventing the creation of novel, unsupported patterns.

Command-line interface for managing Google Calendar resources via the gws tool, covering calendars, events, ACLs, settings, free/busy lookups, and helper commands for quick event creation or agenda views.

Generate a Google Form tailored for event or session feedback and quickly distribute it to participants through Gmail, automating the survey creation and invitation process for productivity boosts.