Skill UI

Catalogs proven n8n workflow architectural patterns for webhook handling, APIs, database syncing, AI agents, and scheduled tasks, helping teams pick structures, plan nodes, and handle triggers, data paths, and error strategies during workflow design and troubleshooting.

Provides a catalog of Linux and Windows post-exploitation privilege escalation techniques, covering sudo/capability abuse, scheduled tasks, token impersonation, AD kerberoasting, credential harvesting, and tool recommendations for red teamers.

Manage scheduled tasks by querying existing jobs, confirming replacements, deleting when permitted, and creating new cron-triggered automations with precise scheduling and messaging instructions.

Uses Sysmon and Windows security logs to spot malicious scheduled task creation by correlating Event IDs 1, 11 and 4698/4702, filtering on suspicious parents, public paths, encoded commands or remote creation, supporting detection rule development and hunting T1053.005 persistence.

Hunt for adversary persistence via Windows Scheduled Tasks by analyzing creation events, suspicious task actions, and unusual scheduling patterns across EDR and SIEM telemetry to validate detections and inform incident response.

Hunt for persistence via Windows scheduled tasks by analyzing creation events, suspicious properties, and execution anomalies to catch T1053.005 abuse during threat hunting or incident response.

Systematically audit Windows and Linux autostart mechanisms, registry hives, scheduled tasks, and WMI entries to map how malware survives reboots and maintain access during incident response or threat hunting.