Skill UI

Analyzes Windows Security EVTX logs to detect Kerberos golden ticket assaults by correlating event IDs 4768, 4624, and 4672, flagging long-lived TGTs, privilege escalations without group changes, SID inconsistencies, and outputting a timeline-based report.

Utilizes SIEM platforms (Splunk/Elastic) and Windows Event Log analysis (ID 4769) to detect indicators of Golden Ticket attacks. This skill analyzes Kerberos logs for specific anomalies such as RC4 encryption downgrades, abnormal ticket lifetimes, and correlation failures between TGT and TGS requests, crucial for advanced threat hunting in Active Directory environments.

This skill detects persistence mechanisms by monitoring Windows startup directories for suspicious file creation (T1547.001). It utilizes real-time file system monitoring via Python watchdog, cross-references Autoruns entries, and analyzes file metadata to identify implants that survive system reboots. Essential for threat hunting and validating security monitoring coverage.

This guide focuses on developing multi-event correlation rules using Splunk SPL and Sigma format. It teaches how to detect Advanced Persistent Threats (APT) and lateral movement by chaining multiple Windows authentication, process execution, and network connection events across hosts within specified time windows. Use this to surface complex, multi-stage attack sequences that single-event detection rules typically miss.

A comprehensive guide for collecting, parsing, and correlating system, application, and security logs from diverse sources (Windows, Linux, Web). This technique is crucial for reconstructing detailed event timelines, identifying initial access vectors, tracking lateral movement, and establishing evidence of unauthorized activity during post-breach forensic investigations.

This automated toolkit streamlines memory forensics using the Volatility3 framework. It is designed to analyze raw memory dumps from Windows, Linux, and macOS, revealing complex threats such as process injection, hidden rootkits, malicious code artifacts, and illicit network connections that traditional disk-based methods cannot detect. Essential for real-time incident response and deep security auditing.

This suite provides comprehensive utilities for digital forensic investigations, allowing users to analyze critical Windows artifacts. Tools like KAPE, MFTECmd, PECmd, and RECmd parse registry hives, $MFT records, prefetch files, and event logs. It is essential for building a robust timeline of program execution, file access patterns, and system persistence during DFIR incident response.

This guide details the process of parsing Windows LNK shortcut files to extract crucial forensic artifacts. It gathers information such as target paths, MAC timestamps, volume serial numbers, and machine identifiers. This technique is invaluable in digital forensics, helping investigators reconstruct user activity timelines, track accessed files on removable media, or build comprehensive evidence from compromised systems.

A comprehensive guide for resolving complex timezone issues in .NET and C# applications. It provides production-safe patterns for handling location lookups, converting between Windows and IANA timezone IDs, managing Daylight Saving Time (DST), and ensuring cross-platform compatibility. Includes ready-to-use code snippets for TimeZoneInfo, NodaTime, and DateTimeOffset.

This guide provides comprehensive strategies for scaling datasets that exceed the capacity of a single node. It covers various architectural patterns, including multi-tenancy with payload partitioning and sliding time window management. We detail the full scaling progression, from optimizing a single node (Vertical Scaling) to distributing data across multiple nodes via sharding (Horizontal Scaling), ensuring reliable handling of massive, growing datasets.

This comprehensive guide details advanced strategies for managing time-series data and data retention in vector databases (like Qdrant). It is designed for scenarios where only recent data is relevant (e.g., social media feeds, news articles). Three core methods are presented: Shard Rotation (recommended for natural time boundaries), Collection Rotation (for per-period configuration needs), and Filter-and-Delete (for simple cleanup). The guide also covers hot/cold tiering to optimize performance.

Provides comprehensive guidelines for integrating the Wispr Flow voice-to-text API into development environments. This skill covers both low-latency WebSocket streaming and simpler REST endpoint usage. It is essential for building voice-powered applications, including real-time dictation, command-line interactions, and context-aware code transcription across multiple platforms (Mac, Windows, iOS).