Skill UI

This skill provides advanced threat hunting queries for Microsoft Sentinel/Log Analytics. It detects the behavioral and string fingerprints left by popular offensive Entra ID enumeration tools (like ROADtools, AADInternals, and AzureHound) within both MicrosoftGraphActivityLogs and AADGraphActivityLogs. Use this when investigating suspicious Graph API activity, identifying internal reconnaissance, or building detection rules to surface active intrusions.

Hayabusa is a specialized threat-hunting and fast-forensics tool designed to analyze Windows EVTX event logs. It applies a comprehensive library of Sigma detection rules to raw log data, generating a single, prioritized, chronological timeline. The output includes severity levels, MITRE ATT&CK mappings, and detailed metrics, enabling analysts to perform rapid, SIEM-free incident triage and export results for collaborative analysis.

This skill proactively hunts for advanced firmware threats, including UEFI bootkits (e.g., BlackLotus, ESPecter), residing in the EFI System Partition (ESP). It establishes a cryptographic baseline, verifies bootloader signatures, scans for out-of-band changes, and uses YARA rules to detect persistence mechanisms related to pre-OS compromise (MITRE ATT&CK T1542.003). Ideal for forensic investigations and security hardening.

Chainsaw is a fast, Rust-based forensic tool designed for first-response threat hunting. It analyzes collected Windows EVTX files using the comprehensive Sigma rule corpus, built-in detection rules, and high-speed keyword/regex searching. Furthermore, it uniquely analyzes critical artifacts such as shimcache, SRUM, and event-log gaps, providing robust, offline detection capabilities without needing a SIEM pipeline. It is essential for digital forensic triage and hypothesis confirmation.

A comprehensive guide for threat hunters focusing on detecting stolen session cookies and OAuth/PRT token replay (T1550.001). This skill teaches correlation techniques across Microsoft Entra ID SigninLogs and Okta System Logs, enabling the detection of impossible travel, refresh-token reuse, and anomalous lateral movement within federated SaaS environments. Essential for post-phishing or post-compromise investigations.

A comprehensive guide for authorized digital forensics investigation. It covers critical areas including memory dump analysis (using Volatility), disk timeline reconstruction, PCAP network traffic analysis, and system artifact triage (like Event Logs and Prefetch). Essential for incident response, evidence preservation, and threat hunting to maintain a robust chain of custody.

Provides a comprehensive framework for blue-team threat hunting and detection engineering. Users learn hypothesis-driven hunting techniques, optimize SIEM queries, and build robust detection rules using industry standards like Sigma and YARA. Essential for minimizing false positives and validating security controls in a defensive posture.

A specialized skill for conducting authorized Open Source Intelligence (OSINT) and cyber threat intelligence gathering. It enriches Indicators of Compromise (IOCs), tracks malicious campaigns, and analyzes impersonation or scamming narratives from public platforms like X/Twitter. The process mandates rigorous evidence corroboration, source preservation, and structured handoff to digital forensics or threat-hunting pipelines.

Proactive threat hunting and detection engineering using Sigma/YARA rules, SIEM queries, and ATT&CK mapping for blue-team operations. Includes hypothesis-driven workflows, rule validation, and toolchain guidance.