Skill UI

This framework detects NTLM relay attacks across Active Directory environments by correlating Windows Security Event 4624 (LogonType 3). It identifies key indicators such as IP-to-hostname mismatches, Responder/LLMNR poisoning artifacts, and non-enforced SMB/LDAP signing, providing comprehensive threat detection for T1557.001.

This skill detects stealthy lateral movement by monitoring the abuse of DCOM objects (MMC20.Application, ShellBrowserWindow, ShellWindows). It correlates Sysmon telemetry (Process Creation, Network Connections), WMI analysis, and RPC traffic to identify unauthorized remote command execution, aiding threat hunters and red teams.

A comprehensive guide to hardening Windows Active Directory environments using Group Policy Objects (GPO). This skill configures multiple layers of defense, including AppLocker, Controlled Folder Access, and Attack Surface Reduction (ASR) rules, to prevent ransomware execution paths, block unauthorized file modifications, and restrict lateral movement across the domain.

This guide provides a comprehensive blueprint for implementing robust Data Loss Prevention (DLP) policies using Microsoft Purview. It covers the configuration of sensitivity labels (encryption, content marking) and the creation of custom DLP rules using regex patterns. The workflow extends to endpoint DLP deployment for controlling file operations on Windows and macOS devices, ensuring sensitive data protection across SharePoint, Exchange, and OneDrive. It leverages PowerShell and the Microsoft Graph API for advanced, programmatic compliance management.

Tmux is a powerful terminal multiplexer that enables users to manage multiple sessions, windows, and panes within a single terminal connection. It is essential for maintaining persistent connections on remote servers (surviving SSH disconnects), running long-term background jobs, and automating complex, multi-pane workflows directly from shell scripts, significantly enhancing remote development efficiency.

Query authoritative Microsoft documentation to explain Azure, .NET, M365, Windows, and Power Platform concepts, tutorials, limits, configurations, or best practices whenever a user wants to understand how something works.

Comprehensive reference for red teamers and penetration testers on executing Active Directory attacks, covering reconnaissance, credential harvesting, Kerberos abuses, lateral movement, and domain persistence techniques against Windows domains.

Guides configuring HTTP/HTTPS, SNMP, and SMB services plus verification and log review for penetration testing labs using Windows or Linux hosts.

A comprehensive guide for resolving complex timezone issues in .NET and C# applications. It provides production-safe patterns for handling location lookups, converting between Windows and IANA timezone IDs, managing Daylight Saving Time (DST), and ensuring cross-platform compatibility. Includes ready-to-use code snippets for TimeZoneInfo, NodaTime, and DateTimeOffset.

Helps produce Dockerfiles and a detailed containerization plan for ASP.NET .NET Framework projects running in Windows containers, covering configuration settings, IIS, dependencies, and deployment steps.

Process and resize images using ImageMagick across Windows, Linux, and macOS, including metadata inspection, format conversion, thumbnail creation, and batch workflows for wallpapers or mass photo adjustments.

Cross-platform Microsoft Store Developer CLI for configuring Partner Center credentials, managing applications and submissions, automating publishing workflows, and integrating with CI/CD for Windows, MAUI, Flutter, Electron, React Native, and PWA apps.