Skill UI

This skill provides structured methods for detecting credential stuffing attacks by analyzing authentication logs. It focuses on identifying complex patterns such as login velocity anomalies, high IP diversity, password spray techniques, and suspicious geographical distributions of failed logins. It is essential for SOC analysts conducting threat hunting or building robust detection rules against account takeover attempts.

Detects data-staging activity (MITRE ATT&CK T1074) by analyzing EDR/Sysmon process-creation and file-system telemetry. This skill monitors for archive creation (7-Zip, RAR, tar), unusual file consolidation from multiple directories, and suspicious activity in temporary or hidden paths. It is essential for threat hunting, building robust detection rules, and validating security monitoring coverage against data exfiltration attempts.

This tool analyzes Windows Event Logs (ID 4688, Sysmon ID 1) and WMI-Activity Operational events to detect suspicious lateral movement. It specifically hunts for WmiPrvSE.exe spawning child processes (like cmd.exe or powershell.exe) or identifying WMI event subscriptions, which are common indicators of remote code execution and persistence.

This method targets fileless and trigger-based persistence mechanisms on Windows hosts by monitoring WMI event subscriptions (MITRE T1546.003). It hunts for suspicious activity involving WMI Event Filters, Consumers, and Bindings, which are critical indicators during advanced threat hunting and incident response when standard persistence locations are clean.

This guide details a threat hunting technique for detecting persistence mechanisms utilizing Windows Registry Run keys (T1547.001). By analyzing Sysmon Event ID 13 logs, it identifies suspicious auto-start entries pointing to temporary directories, encoded PowerShell commands, or abused LOLBins. Essential for SOC analysts and security engineers investigating incidents and developing robust detection rules.

A comprehensive guide for hypothesis-driven threat hunting focusing on Windows Scheduled Task persistence (T1053). This methodology guides the creation of advanced SIEM/EDR queries against critical events like task creation (Event ID 4698), suspicious actions, and unusual scheduling patterns. Essential for incident response, proactive threat hunting, and security assessments.

This skill detects persistence mechanisms by monitoring Windows startup directories for suspicious file creation (T1547.001). It utilizes real-time file system monitoring via Python watchdog, cross-references Autoruns entries, and analyzes file metadata to identify implants that survive system reboots. Essential for threat hunting and validating security monitoring coverage.

A comprehensive guide for conducting hypothesis-driven threat hunting against supply chain compromises (T1195). This skill focuses on querying SIEM/EDR logs to detect indicators of trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. It is crucial when investigating suspected vendor compromises or scoping a build pipeline breach, requiring advanced knowledge of logging systems and threat intelligence.

A comprehensive threat hunting guide designed to detect adversary persistence and execution mechanisms hidden within Windows scheduled tasks (T1053.005). This skill analyzes Security Event ID 4698, suspicious task properties, and unusual execution patterns from tools like schtasks.exe. It is vital for incident response, proactive threat hunting, and enumerating persistence on compromised endpoints.

This skill performs threat hunting for persistence mechanisms by parsing Windows System event logs (Event ID 7045). It specifically detects suspicious service installations, analyzing service binary paths, and correlating these events with advanced telemetry (Sysmon/EDR) to identify indicators of compromise (MITRE ATT&CK T1543.003). Ideal for incident response and security validation.

This guide provides a structured methodology for hypothesis-driven threat hunting focused on detecting web shell deployment (T1505.003) on internet-facing servers. It analyzes file creation in web directories, suspicious child-process generation from web server processes, and anomalous HTTP request patterns. Use this during incident response, proactive security assessments, or when EDR/SIEM alerts indicate web server process anomalies.

Scans web server roots for high-entropy files, suspicious PHP/JSP/ASP payloads, and recent modifications to flag obfuscated webshells via entropy thresholds, regex signatures, and file metadata.