Skill UI

A comprehensive tool for security analysts to hunt for malicious PowerShell activity. It analyzes Windows Event Log (EVTX) files by parsing Script Block Logging (Event 4104), Module Logging (4103), and process creation events. Detects obfuscated commands, AMSI bypass attempts, encoded payloads, and credential dumping techniques crucial for incident response and threat hunting.

This tool analyzes Windows Event Logs (ID 4688, Sysmon ID 1) and WMI-Activity Operational events to detect suspicious lateral movement. It specifically hunts for WmiPrvSE.exe spawning child processes (like cmd.exe or powershell.exe) or identifying WMI event subscriptions, which are common indicators of remote code execution and persistence.

This guide details a threat hunting technique for detecting persistence mechanisms utilizing Windows Registry Run keys (T1547.001). By analyzing Sysmon Event ID 13 logs, it identifies suspicious auto-start entries pointing to temporary directories, encoded PowerShell commands, or abused LOLBins. Essential for SOC analysts and security engineers investigating incidents and developing robust detection rules.

A comprehensive guide for security professionals to proactively hunt for Indicators of Compromise related to Volume Shadow Copy deletion (T1490). This technique is critical for detecting ransomware preparation and anti-forensics activity. It details using SIEM/EDR platforms to query for specific commands (vssadmin, wmic, PowerShell) associated with deleting system recovery points and shadow copies.

This skill guides the implementation of full disk encryption using Microsoft BitLocker on Windows endpoints. It covers best practices for deploying encryption via GPO, Intune, and command line, ensuring data-at-rest protection. Use this when meeting compliance requirements (PCI, HIPAA) or securing mobile workstations against physical loss or theft.

A comprehensive guide detailing best practices for executing commands on Windows using PowerShell and CMD. It addresses critical pitfalls such as handling spaces in file paths, ensuring correct character encoding (UTF-8), using native cmdlets, and managing long path limits. Essential for developers building robust, cross-platform Windows automation scripts.

A comprehensive guide for implementing Data Loss Prevention (DLP) policies across the Microsoft 365 ecosystem using Microsoft Purview. It details how to protect PII, PHI, and PCI data across Exchange Online, SharePoint, OneDrive, and endpoints. Key features include configuring custom sensitivity labels, regex-based sensitive information types, and endpoint DLP rules via PowerShell, ensuring robust compliance and data governance.

This guide details the process of creating and managing 'Agent Users' within Microsoft Entra ID. Agent Users are specialized identities that allow AI agents to function as digital workers, giving them user-level capabilities (e.g., accessing Exchange mailboxes or Teams) while maintaining robust security boundaries. It covers using the Microsoft Graph API and PowerShell to provision and configure these agents.

This guide provides comprehensive instructions for integrating TechSmith's screen capture (Snagit) and video editing (Camtasia) tools using the COM API. It covers advanced scripting techniques in a Windows environment, primarily utilizing PowerShell and Python interop (`pywin32`). Use it to automate complex content creation workflows, such as batch rendering, programmatic screen region capture, and structured file handling for professional video assets.

This guide provides comprehensive solutions for common automation errors encountered when utilizing the TechSmith Snagit COM API and Camtasia. It covers critical topics such as COM server registration, elevated permissions, and file locking issues, making it essential for developers writing automation scripts in PowerShell or Python.

This workflow automates the creation of step-by-step documentation guides using the TechSmith Snagit COM API and PowerShell. It first captures a series of sequential screenshots for a guide, and then uses a batch process to open and annotate these images within the Snagit Editor, ensuring consistency and efficiency in creating professional tutorials.

This workflow automates complex video production tasks using the TechSmith Camtasia Producer COM API via PowerShell. It enables users to perform batch rendering, manage various output presets, apply custom watermarks/branding, and export projects in multiple formats (e.g., MP4, M4A) without manual intervention. It is ideal for content creators, educators, and businesses managing a large volume of video content efficiently.