Skill UI

This skill parses Windows Prefetch (.pf) files to reconstruct detailed application execution history. It is crucial for digital forensics, allowing analysts to track execution timelines, identify suspicious or renamed binaries, and investigate potential malware activity or lateral movement during incident response. It uses Python to extract run counts and accessed file details.

This comprehensive guide details the systematic extraction and analysis of Windows Registry hives (SAM, SYSTEM, SOFTWARE, NTUSER.DAT) from forensic images. It demonstrates how to use specialized tools like RegRipper and Python scripts to uncover critical artifacts, including user activity history, persistence mechanisms (autorun keys), installed software records, and evidence of system compromise, which is crucial for digital forensics investigations.

Shellbags are registry artifacts that track user folder browsing activity (view settings, access path) via Windows Explorer. This method reconstructs a user's interaction history with local drives, network shares, and removable media, providing definitive evidence of folder access even when the directories are deleted. Essential for digital forensics and incident response.

A comprehensive guide detailing how to integrate DevSecOps best practices into a GitLab CI/CD pipeline. It automates multiple security checks, including Static Analysis (SAST), Dynamic Analysis (DAST), container scanning, dependency scanning, and secret detection. This approach enforces 'shift-left' security, finding and fixing vulnerabilities early in the development lifecycle to ensure compliance and robust security.

A robust framework for orchestrating complex, multi-step coding tasks using multiple AI agents. It functions by first planning the entire project into a mission dependency graph (DAG), then dispatching specialized agents to isolated Git worktrees for parallel development. The system automatically monitors progress, handles merges, and generates structured, comprehensive reports detailing changes, completed tasks, and next steps.

This guide outlines the process of passive external reconnaissance using Open Source Intelligence (OSINT) techniques. Users can map an organization's digital footprint by gathering comprehensive data, including DNS records, subdomains, certificate transparency logs, social media profiles, and leaked credentials. It is critical for the planning phase of penetration testing, asset mapping, or preparing for social engineering, all without actively interacting with target systems.

Build a production-ready, AI-powered data collection agent for any public source (job boards, prices, news, etc.). This agent automatically scrapes data, enriches it using free LLMs (like Gemini Flash), and stores the results in databases such as Notion, Sheets, or Supabase. It runs on a free schedule using GitHub Actions and learns from user feedback, making it ideal for continuous data monitoring and tracking.

A comprehensive solution for identifying and preventing the accidental commitment of exposed AWS credentials, API keys, and session tokens within source code, configuration files, and git history. It integrates TruffleHog and git-secrets into CI/CD pipelines and pre-commit hooks, providing critical protection against credential theft and unauthorized cloud access in a DevSecOps environment. Essential for security auditing and compliance.

This guide details comprehensive detection methods for DCSync attacks (MITRE T1003.006) in Active Directory. Attackers abuse legitimate directory replication protocols to extract sensitive password hashes. Detection relies on auditing Windows Event ID 4662 for unauthorized access attempts to critical Directory Service GUIDs, specifically flagging non-domain-controller accounts attempting replication calls. Essential for threat hunting and incident response.

This skill focuses on advanced threat detection techniques used to identify the abuse of legitimate Windows binaries (LOLBins) for malicious purposes. It requires monitoring process creation, command-line arguments, and network activity to pinpoint fileless and living-off-the-land attacks. Ideal for building SIEM/EDR detection rules, threat hunting, and hardening endpoint security policies.

This skill provides a comprehensive methodology for detecting Living Off the Land Binaries (LOLBAS) abuse. It analyzes process telemetry (Sysmon, Windows Logs) and parent-child relationships to identify when attackers misuse legitimate Windows utilities (like certutil, mshta, rundll32) to execute malicious code while bypassing traditional security detection. Essential for threat hunting and advanced incident response.

This comprehensive guide details the methodology for detecting Process Hollowing (MITRE T1055.012), a critical defense evasion technique used by fileless malware. It involves analyzing memory-mapped sections, correlating EDR telemetry (Sysmon, ETW), and identifying memory mismatches between the running process and its on-disk binary image. Use this skill when investigating sophisticated, in-memory threats that masquerade as legitimate system processes.