Skill UI

Catalogs proven n8n workflow architectural patterns for webhook handling, APIs, database syncing, AI agents, and scheduled tasks, helping teams pick structures, plan nodes, and handle triggers, data paths, and error strategies during workflow design and troubleshooting.

Provides a catalog of Linux and Windows post-exploitation privilege escalation techniques, covering sudo/capability abuse, scheduled tasks, token impersonation, AD kerberoasting, credential harvesting, and tool recommendations for red teamers.

Manage scheduled tasks by querying existing jobs, confirming replacements, deleting when permitted, and creating new cron-triggered automations with precise scheduling and messaging instructions.

Guides SOC analysts through systematic persistence analysis with Sysinternals Autoruns, extracting ASEPs, flagging unsigned or malformed entries, comparing baselines, and enriching reputations to triage malware persistence across registry, services, scheduled tasks, and drivers.

Detects malicious scheduled task creation by correlating Sysmon Event IDs 1 and 11 with Windows Security Events 4698/4702, matching suspicious parent processes, public directories, encoded commands, and remote creation attempts to spot persistence and lateral movement.

Guides analysts through hunting malicious Windows scheduled tasks by correlating Event IDs, task definitions, and execution data to spot persistence or obfuscation attempts.

Systematically enumerate Windows and Linux persistence mechanisms, including registry run keys, services, scheduled tasks, WMI, autoruns, and rootkits, to understand how malware survives reboots and ensure incident response clean-up.