Skill UI

Detect and investigate suspicious Windows scheduled tasks by analyzing creation events, task properties, triggers, and execution correlations to expose persistence mechanisms, unusual activity, and MITRE T1053.005 abuse during proactive hunts or incident response.

Analyzes Windows Security Event Logs to hunt for MITRE ATT&CK T1098 account manipulation, flagging shadow admins, SID history injection, and privileged group changes for SOC investigations.

This skill orchestrates a sophisticated, multi-phase workflow for generating novel, feasible, and benchmark-grounded concepts for robotics and embodied AI applications. The pipeline guides users from a broad research direction to concrete, testable ideas, critically considering constraints like hardware availability, simulation requirements (sim-first), and established benchmarks. Ideal for researchers seeking next-generation project topics in manipulation, locomotion, or navigation.

Analyzes CloudTrail logs via Athena, CloudWatch Logs Insights, and SIEM feeds to monitor AWS security, detect threats, and support forensic investigations by identifying unauthorized access, privilege escalations, and anomalous API activity.

Configure Cloudflare DDoS protection across network, protocol, and application layers via managed rulesets, WAF overrides, rate limiting, Bot Management, and origin hardening to stop volumetric, protocol, and HTTP flood attacks.

Implement Just-In-Time access provisioning to remove standing privileges by granting temporary, scoped permissions with approval workflows, PAM/IGA integration, automated revocation, monitoring, and zero-trust controls.

Walks through enabling system and per-app DEP, ASLR, CFG, and related mitigations via ProcessMitigation cmdlets, exporting configs for Intune or GPO deployment, and noting compatibility pitfalls.

Automates phishing incident response by parsing suspicious emails, creating Splunk SOAR containers and artifacts via the REST API, and triggering investigation playbooks while polling for results to deliver summarized verdicts.

Defines and operationalizes vulnerability remediation SLAs so teams patch or mitigate issues within severity-based timeframes, align escalation and exception workflows, and report KPIs to demonstrate continuous improvement in vulnerability management.

Guides SOC analysts through SIEM, DLP, UEBA, and HR data correlation to investigate data exfiltration, unauthorized access, and pre-departure anomalies for insider threats.

Guides SOC teams through full phishing email investigations, from header and link analysis to attachment detonation, user impact mapping, and containment using tools such as Splunk, Microsoft Defender, URLScan, and sandboxes.

Guide to collecting and analyzing ransomware artifacts—notes, encrypted samples, logs—to identify variants, trace the attack chain, and support recovery or legal follow-up.