Skill UI

This skill guides developers on integrating CommunityToolkit.Mvvm ViewModels with Microsoft's Dependency Injection system. It covers setting up the composition root using the .NET Generic Host, managing service lifetimes (Singleton, Transient, Scoped), implementing constructor injection, and correctly registering messaging services (IMessenger) for robust, cross-platform XAML applications (WPF, MAUI, Uno, Avalonia).

This skill provides comprehensive capabilities for working with Microsoft Word documents (.docx). It supports full document lifecycle management, including text extraction (via pandoc), raw XML manipulation, creating new documents, and complex editing. Specialized workflows are available for redlining, handling tracked changes, managing comments, and preserving intricate formatting, making it ideal for professional, academic, and business document processing.

A comprehensive guide for integrating Microsoft Graph SDK into applications. It covers accessing Microsoft 365 data (users, mail, calendar, Teams, SharePoint) from various languages (.NET, Python, TypeScript). Key topics include robust authentication patterns (Managed Identity, OBO), advanced data retrieval techniques like pagination, delta queries, batch requests, and setting up change notifications via webhooks. Learn best practices for secure and efficient API interaction.

This skill guides the architecture and implementation of SAML 2.0 identity federation between on-premises Active Directory and Microsoft Entra ID (Azure AD). It covers establishing seamless Single Sign-On (SSO) capabilities, eliminating the need for separate credentials and ensuring secure, cross-domain authentication for cloud applications.

Microsoft Entra PIM enforces Just-in-Time (JIT) access by replacing standing (permanent) privileges with time-bound, eligible assignments. This workflow mandates explicit role activation, justification, Multi-Factor Authentication (MFA), and optional approval workflows, significantly reducing the attack surface and ensuring adherence to Zero Trust principles for critical Azure and Entra roles.

A comprehensive guide for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically focusing on Microsoft Entra ID (Azure AD). This covers advanced threats like Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Adversary-in-the-Middle (AitM) phishing. Use it for investigating anomalous sign-in behavior, configuring risk-based conditional access policies, and enforcing token protection to secure cloud identities.

ROADtools is a comprehensive offensive toolkit for Microsoft Entra ID (Azure AD). It consists of ROADrecon for offline directory enumeration (users, groups, roles, policies) and roadtx for advanced token acquisition and exchange. It is designed for authorized red-teaming and penetration testing to discover attack paths and pivot tokens across various Microsoft resources.

This skill simulates advanced red-teaming techniques targeting Microsoft Entra ID's OAuth 2.0 device-code flow and illicit consent mechanisms. It demonstrates how attackers can steal access and refresh tokens, bypass Multi-Factor Authentication (MFA), and pivot across various Microsoft 365 services. It is designed for authorized security testing to validate token protection and conditional access policies.

This toolkit provides comprehensive offensive and administrative capabilities for Microsoft Entra ID, Azure AD, and AD FS. It allows authorized penetration testers to perform unauthenticated reconnaissance, acquire various access tokens, and critically, test for federation backdoors (Golden SAML). It is essential for validating identity-attack resilience and producing detailed hardening recommendations during red-team engagements.

This skill provides advanced threat hunting logic for Microsoft Sentinel/Log Analytics. It analyzes both AADGraphActivityLogs and MicrosoftGraphActivityLogs to detect the unique fingerprints and behavioral patterns left by offensive Entra ID tools (like ROADtools, AADInternals, and AzureHound). It detects specific User-Agent strings and characteristic endpoint-sweep patterns, even when tool authors attempt to spoof headers, helping SOC teams identify valid account-based adversary activity (MITRE T1078.004).

This PowerShell toolset performs advanced post-exploitation, reconnaissance, persistence, and data exfiltration against Microsoft 365/Entra ID tenants using the Microsoft Graph API. It operationalizes stolen Graph tokens to enumerate users, dump policies, escalate privileges, and search sensitive data across mailboxes, SharePoint, and Teams. Essential for authorized red teaming engagements.

This skill enhances SEO visibility specifically for non-Google engines like Bing, Yandex, Seznam, and Naver. It utilizes Bing Webmaster Tools and the IndexNow protocol to ensure fresh content and links are indexed quickly. It is crucial for maximizing citation eligibility in Microsoft Copilot and gaining access to unique link data beyond Google's reach.