Skill UI

A comprehensive guide and toolkit for extracting, parsing, and analyzing Windows Event Logs (EVTX). This method utilizes industry-leading tools like Chainsaw and Hayabusa, along with Sigma rules, to perform deep digital forensics. It is specifically designed to detect critical security indicators such as lateral movement, persistence mechanisms, privilege escalation, and unauthorized access attempts on Windows systems.

This skill guides the security hardening of Windows endpoints (10/11, Server 2019/2022) using established CIS Benchmarks. It provides a comprehensive workflow for establishing secure organizational baselines, configuring Group Policy Objects (GPOs), and enforcing security controls across critical areas like password policies, audit logs, and firewall rules. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This tool analyzes Windows Event Logs (ID 4688, Sysmon ID 1) and WMI-Activity Operational events to detect suspicious lateral movement. It specifically hunts for WmiPrvSE.exe spawning child processes (like cmd.exe or powershell.exe) or identifying WMI event subscriptions, which are common indicators of remote code execution and persistence.

This advanced skill guides users on hunting for Living Off the Land Binaries (LOLBins) abuse by analyzing endpoint process creation logs. It focuses on detecting malicious use of legitimate Windows binaries (like certutil or mshta) for defense evasion or data exfiltration, mapping techniques to MITRE T1218. Ideal for threat hunters and security teams building advanced detection rules.

This guide details a threat hunting technique for detecting persistence mechanisms utilizing Windows Registry Run keys (T1547.001). By analyzing Sysmon Event ID 13 logs, it identifies suspicious auto-start entries pointing to temporary directories, encoded PowerShell commands, or abused LOLBins. Essential for SOC analysts and security engineers investigating incidents and developing robust detection rules.

This skill guides security analysts through detecting MITRE ATT&CK T1098 account manipulation techniques. It analyzes Windows Security Event Logs (e.g., 4738, 4728) to find signs of unauthorized privilege escalation, group membership changes, or shadow admin account creation. It is essential for proactive threat hunting, incident response, and validating Active Directory security posture.

This skill performs threat hunting for persistence mechanisms by parsing Windows System event logs (Event ID 7045). It specifically detects suspicious service installations, analyzing service binary paths, and correlating these events with advanced telemetry (Sysmon/EDR) to identify indicators of compromise (MITRE ATT&CK T1543.003). Ideal for incident response and security validation.

Monitors Windows process creation events to flag Living Off The Land Binary abuse by matching Event ID 4688/Sysmon 1 logs against LOLBAS database entries, supporting threat hunting and SIEM rule creation for fileless attacks.

Utilize Velociraptor, an advanced open-source platform, to collect, query, and monitor forensic artifacts across diverse endpoints (Windows, Linux, macOS). This skill enables incident response teams to perform large-scale, rapid digital forensic investigations by collecting critical data such as event logs, registry entries, prefetch files, and network metadata using VQL queries.

A comprehensive skill for Security Operations Center (SOC) teams and incident responders. It detects advanced lateral movement techniques, including Pass-the-Hash, PsExec, WMI, and RDP pivoting, by correlating Windows Security logs, Sysmon data, and network flow records within a SIEM. This capability is mapped to MITRE ATT&CK TA0008 and is essential for tracking an attacker's internal progression after initial compromise. Not intended for external attack detection.

A comprehensive guide for collecting, parsing, and correlating system, application, and security logs from diverse sources (Windows, Linux, Web). This technique is crucial for reconstructing detailed event timelines, identifying initial access vectors, tracking lateral movement, and establishing evidence of unauthorized activity during post-breach forensic investigations.

This suite provides comprehensive utilities for digital forensic investigations, allowing users to analyze critical Windows artifacts. Tools like KAPE, MFTECmd, PECmd, and RECmd parse registry hives, $MFT records, prefetch files, and event logs. It is essential for building a robust timeline of program execution, file access patterns, and system persistence during DFIR incident response.