Skill UI

Analyzes USB device connection history from Windows registry, event logs, and setupapi logs to trace removable media usage, correlate drive assignments, and support forensic or insider-threat investigations.

Extract and examine Windows Registry hives from forensic images to reveal installed software, autorun entries, USB history, and user activity, supporting incident response or insider threat investigations with RegRipper, python-registry, and hash validation workflows.

Detect Stuxnet-style multi-stage OT attacks by monitoring PLC logic integrity, engineering workstations, USB vectors, IT-to-OT lateral movement, and physics-based process anomalies to thwart nation-state level threats.

Guides deploying endpoint DLP with Microsoft Purview or Symantec to detect and block sensitive data exfiltration via email, USB, cloud uploads, printing, and unauthorized apps while observing compliance requirements.

Implements USB device control policy across GPO, Intune, or EDR to block unauthorized removable media while allowing approved USB devices, preventing data exfiltration and malware introduction while supporting compliance tracking.