Skill UI

This skill provides advanced threat hunting logic for Microsoft Sentinel/Log Analytics. It analyzes both AADGraphActivityLogs and MicrosoftGraphActivityLogs to detect the unique fingerprints and behavioral patterns left by offensive Entra ID tools (like ROADtools, AADInternals, and AzureHound). It detects specific User-Agent strings and characteristic endpoint-sweep patterns, even when tool authors attempt to spoof headers, helping SOC teams identify valid account-based adversary activity (MITRE T1078.004).

Velociraptor is an open-source platform providing deep endpoint visibility and digital forensics capabilities. It enables security teams to deploy VQL-based 'Hunts' across large fleets of endpoints, allowing for remote threat hunting, incident response, and continuous monitoring of system artifacts.

Hayabusa is a Sigma-based tool for fast digital forensics and incident response. It analyzes multiple Windows EVTX event logs, applying a comprehensive library of Sigma rules to detect suspicious activity. The output is a single, chronologically ordered timeline, complete with severity levels, MITRE ATT&CK mapping, and evidence summaries, streamlining the triage process for security analysts.

This skill is designed for proactive firmware forensics and advanced threat hunting. It analyzes the EFI System Partition (ESP) to detect sophisticated, pre-OS persistence mechanisms, such as UEFI bootkits (e.g., BlackLotus, ESPecter). Detection methods include verifying file hashes against a trusted golden baseline, checking Secure Boot signatures, scanning with YARA, and flagging structural anomalies within the ESP.

Chainsaw is a fast, Rust-based tool for digital forensics and threat hunting. It enables analysts to rapidly perform Sigma rule checks and keyword searches across collected Windows Event Logs (.evtx) and specialized artifacts (like shimcache and SRUM). Ideal for first-response and offline analysis, it provides detection capabilities without needing a SIEM ingestion pipeline, allowing quick hypothesis testing in the field or air-gapped environments.

This comprehensive tool suite provides high-fidelity parsers for key Windows artifacts, including MFT, Registry hives, Prefetch files, and ShellBags. Designed for digital forensics and incident response, it converts raw system evidence into structured CSV/JSON formats. The output is optimized for feeding into Timeline Explorer, enabling analysts to build comprehensive, correlated timelines and establish a clear chain of events.

KAPE is a powerful, Windows-native triage tool used for Digital Forensics and Incident Response (DFIR). It executes in two phases: 'Targets' collect raw forensic artifacts (like registry hives, event logs, and prefetch files) from live systems, while 'Modules' parse this collected data into normalized, analyst-ready CSV/JSON formats. It enables fast, defensible, and scalable artifact collection, especially when full disk imaging is impractical.

Provides comprehensive architectural guidelines and code patterns for developing high-end, immersive 3D web experiences. This skill covers advanced topics such as custom WebGL shaders, post-processing effects (Bloom, Depth of Field), realistic physics interactions, and crucial performance optimization techniques, ensuring a premium, polished user experience across devices.

This tool diagnoses and validates complex cron expressions (e.g., crontab, Kubernetes CronJob) to prevent silent scheduling failures. It identifies five common pitfalls: impossible dates, misunderstood OR semantics, resource spikes, uneven step drift, and leap year issues. Users can check the syntax, understand the true meaning, and calculate future execution times reliably.

A portable CI gate designed to enforce Core Web Vitals (LCP, CLS, INP) budgets and category score floors on production frontend builds. It integrates into CI pipelines to automatically block pull requests if the performance metrics fall below defined Google standards, ensuring consistently fast and reliable user experiences.