Skill UI

This skill guides proactive security auditing and threat hunting for registry-based persistence artifacts (MITRE T1547) in Windows environments. It focuses on identifying mechanisms such as Run/RunOnce keys, Winlogon modifications, IFEO debugger injection, and COM hijacking to detect malware autostart techniques and scope compromises during incident response.

This guide details a threat hunting technique for detecting persistence mechanisms utilizing Windows Registry Run keys (T1547.001). By analyzing Sysmon Event ID 13 logs, it identifies suspicious auto-start entries pointing to temporary directories, encoded PowerShell commands, or abused LOLBins. Essential for SOC analysts and security engineers investigating incidents and developing robust detection rules.

A comprehensive guide for hypothesis-driven threat hunting focusing on Windows Scheduled Task persistence (T1053). This methodology guides the creation of advanced SIEM/EDR queries against critical events like task creation (Event ID 4698), suspicious actions, and unusual scheduling patterns. Essential for incident response, proactive threat hunting, and security assessments.

A comprehensive guide for security professionals to proactively hunt for Indicators of Compromise related to Volume Shadow Copy deletion (T1490). This technique is critical for detecting ransomware preparation and anti-forensics activity. It details using SIEM/EDR platforms to query for specific commands (vssadmin, wmic, PowerShell) associated with deleting system recovery points and shadow copies.

This guide details a structured threat hunting methodology designed to proactively detect sophisticated spearphishing campaigns. It instructs users on correlating indicators across email logs, endpoint telemetry (EDR), and network data (SIEM) to identify targeted threats, supporting incident response and security posture improvement.

This skill detects persistence mechanisms by monitoring Windows startup directories for suspicious file creation (T1547.001). It utilizes real-time file system monitoring via Python watchdog, cross-references Autoruns entries, and analyzes file metadata to identify implants that survive system reboots. Essential for threat hunting and validating security monitoring coverage.

A comprehensive guide for conducting hypothesis-driven threat hunting against supply chain compromises (T1195). This skill focuses on querying SIEM/EDR logs to detect indicators of trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. It is crucial when investigating suspected vendor compromises or scoping a build pipeline breach, requiring advanced knowledge of logging systems and threat intelligence.

A comprehensive threat hunting guide designed to detect adversary persistence and execution mechanisms hidden within Windows scheduled tasks (T1053.005). This skill analyzes Security Event ID 4698, suspicious task properties, and unusual execution patterns from tools like schtasks.exe. It is vital for incident response, proactive threat hunting, and enumerating persistence on compromised endpoints.

This skill guides security analysts through detecting MITRE ATT&CK T1098 account manipulation techniques. It analyzes Windows Security Event Logs (e.g., 4738, 4728) to find signs of unauthorized privilege escalation, group membership changes, or shadow admin account creation. It is essential for proactive threat hunting, incident response, and validating Active Directory security posture.

Conduct hypothesis-driven threat hunting for Command-and-Control (C2) activity (T1071). This skill guides the analysis of SIEM/EDR network telemetry to detect anomalous outbound traffic, rare destination IPs, non-standard ports, and unusual connection frequencies, helping identify beaconing or data exfiltration attempts. Essential for proactive defense and incident response.

This skill performs threat hunting for persistence mechanisms by parsing Windows System event logs (Event ID 7045). It specifically detects suspicious service installations, analyzing service binary paths, and correlating these events with advanced telemetry (Sysmon/EDR) to identify indicators of compromise (MITRE ATT&CK T1543.003). Ideal for incident response and security validation.

This guide provides a structured methodology for hypothesis-driven threat hunting focused on detecting web shell deployment (T1505.003) on internet-facing servers. It analyzes file creation in web directories, suspicious child-process generation from web server processes, and anomalous HTTP request patterns. Use this during incident response, proactive security assessments, or when EDR/SIEM alerts indicate web server process anomalies.