Results for “edr”

Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboarding endpoints to EDR coverage, configuring detection policies, or integrating Falcon telemetry with SIEM platforms. Activates for requests involving CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or endpoint detection and response.

The English summary is being prepared. Showing the original description.

Agent fallback for CCSPlayerPawn_HandleDropWeapon (auto-generated, category: func). Locate CCSPlayerPawn::HandleDropWeapon in the CS2 server module via IDA Pro MCP and emit a fresh, minimal-unique artifact. The deterministic preprocessor could not resolve this symbol on the current gamever - your job is the re-sign. Trigger: CCSPlayerPawn_HandleDropWeapon, CCSPlayerPawn::HandleDropWeapon

The English summary is being prepared. Showing the original description.

Agent fallback for CCSPlayer_WeaponServices_HandleDropWeapon (auto-generated, category: func). Locate CCSPlayer_WeaponServices::HandleDropWeapon in the CS2 server module via IDA Pro MCP and emit a fresh, minimal-unique artifact. The deterministic preprocessor could not resolve this symbol on the current gamever - your job is the re-sign. Trigger: CCSPlayer_WeaponServices_HandleDropWeapon, CCSPlayer_WeaponServices::HandleDropWeapon

The English summary is being prepared. Showing the original description.

Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboarding endpoints to EDR coverage, configuring detection policies, or integrating Falcon telemetry with SIEM platforms. Activates for requests involving CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or endpoint detection and response.

The English summary is being prepared. Showing the original description.

Generate and edit images and videos through Atlas Cloud using one API key across multiple model families. Choose supported models for each task, download the results, and retain details about the model, inputs, and estimated cost.

• Generate images and videos through one service
• Edit product images using reference materials
• Create videos from images, video, or audio references

Examine Windows endpoint logs for attempts to avoid security detection, including log clearing, altered file timestamps, injected code, and disabled protection. Correlate events to investigate suspicious behavior and develop detection rules with context for legitimate activity.

• Investigating cleared logs and altered file timestamps
• Checking suspected attempts to disable security tools
• Finding abuse of legitimate Windows utilities

Turn threat intelligence and detection gaps into testable investigation hypotheses. Use endpoint monitoring and security log queries to examine evidence, validate findings, connect related activity, and document risks and recommended actions in a consistent hunt report.

• Planning a hunt based on threat intelligence
• Investigating gaps in ATT&CK coverage
• Testing hypotheses prompted by unusual activity

Prepare a proposed policy revision to address a specific regulatory gap. Show deletions, additions, reasons, and verification flags in a separate review memo, keeping edits limited to affected sections for the policy owner's review.

• Drafting a policy fix for an identified regulatory gap
• Preparing a minimal redline of affected sections
• Documenting change reasons and unverified requirements

Guide authorized testing of security defenses, including web application firewalls, antivirus, and endpoint detection tools. The skill defines scope, alternative testing directions, evidence requirements, and completion criteria for reporting successful bypasses or unsuccessful attempts.

• Define scope for authorized security defense testing
• Choose another direction when testing stalls
• Organize evidence for a successful bypass

Develop healthcare prediction models from electronic health records and physiological signals. Use PyHealth to prepare data, train models for tasks such as mortality or readmission prediction, and evaluate accuracy, fairness, and how predictions can be explained.

• Building mortality prediction models with MIMIC-IV
• Training and evaluating hospital readmission models
• Developing medication recommendation models with SafeDrug

Use when a newly mined VoiceDrop article needs automated post-processing — invoked headless by the 5-minute poller (launchd com.jianshuo.voicedrop-postprocess) with the article stem as argument. Triggers — "/wjs-voicedrop-post-processing <stem>".

The English summary is being prepared. Showing the original description.

Use when 王建硕 wants to turn his uploaded VoiceDrop voice memos into 微信公众号 article drafts — pulling the unprocessed recordings sitting on jianshuo.dev/files (the R2 inbox), transcribing them, and mining articles from each. Triggers — "处理 VoiceDrop 录音", "把新录音挖成文章", "口述备忘变文章", "处理一下我的录音", "/wjs-mining-voicedrop".

The English summary is being prepared. Showing the original description.

Troubleshoot local AWS Bedrock authentication and region configuration for the Cline CLI as Dr. Bedrock. Use when users report Bedrock CLI errors, AWS profile/default-chain issues, credential_process/SSO/IAM credential failures, missing region, AccessDenied, model access, or provider config problems.

The English summary is being prepared. Showing the original description.

Redraw the Nobodies Vitruvian Man mark with the current model, derive every icon asset from it, archive the previous round, wire it into the site, open the PR. Peter runs this every 2-3 months when a new first-class model ships, to watch the brand evolve. Triggers: 'redraw the logo', 'logo round', 'give the logo a go', '/redraw-logo'.

The English summary is being prepared. Showing the original description.

EDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques.

The English summary is being prepared. Showing the original description.

Migrate code and API calls from Claude Sonnet 4.0, Sonnet 4.5, or Opus 4.1 to Opus 4.5. Update platform-specific model identifiers and address reported prompt behavior issues, such as excessive tool use or unnecessary code complexity.

• Updating model identifiers in existing code
• Migrating API settings for a specific platform
• Adjusting prompts that trigger excessive tool use

Integrate Microsoft Graph SDK into .NET, TypeScript/JavaScript, or Python applications to access Microsoft 365 data. Covers authentication, permissions, paginated results, incremental synchronization, change notifications, and retries when requests hit service limits.

• Building apps that access Microsoft 365 mail and calendars
• Integrating Teams, OneDrive, and SharePoint data
• Synchronizing only data changed since the previous run

Investigate attempts to gain higher privileges on Windows and Linux using endpoint and security logs. Guide hypothesis testing, evidence analysis, false-positive checks, and reporting to help assess suspicious privilege changes and the scope of a compromise.

• Hunting for signs of privilege escalation
• Investigating alerts about suspicious privilege changes
• Assessing compromise scope during incident response

Investigate service account misuse by examining unexpected interactive logons, privilege changes, and movement between systems. Correlate endpoint and security logs, distinguish suspicious activity from legitimate operations, and document evidence, risk, and recommended responses.

• Investigating unexpected interactive logons by service accounts
• Checking service account access outside its assigned scope
• Tracing suspicious movement between systems after hours

Investigate Pass-the-Hash attacks, where stolen password hashes are reused for authentication. Examine unusual NTLM logins alongside credential theft indicators, validate suspicious findings across security logs, and document evidence, affected hosts, confidence, and recommended responses.

• Hunting for movement using stolen password hashes
• Triaging suspicious NTLM login alerts
• Assessing the scope of a compromise

Assess an authorized Active Directory environment by simulating attacks against credentials, permissions, and trust relationships. Use BloodHound and related testing tools to identify paths to administrator access, evaluate detection capabilities, and document findings with remediation recommendations.

• Assessing Active Directory security with written authorization
• Finding paths from ordinary users to administrator access
• Reviewing Kerberos and delegation settings

Build detections for fileless attacks on Windows using process activity, script logs, and endpoint monitoring. Investigate suspicious PowerShell, code injected into running processes, WMI persistence, and registry-based execution with logging guidance and detection query examples.

• Building detections for suspicious PowerShell activity
• Hunting for code injection into running processes
• Monitoring WMI persistence and registry-based execution

Examine Windows and Active Directory logs for attempts to extract passwords and other credentials. Identify suspicious memory access and database exports, correlate events with user and host context, and produce findings with severity ratings and detection queries.

• Investigating alerts about suspicious LSASS access
• Finding signs of SAM or NTDS.dit extraction
• Creating detection queries for Splunk or Elastic

Contain an active security breach by isolating endpoints, blocking attacker communications, and revoking compromised access. Follow procedures to limit spread between systems, preserve evidence, verify containment, and report remaining risks and business impact.

• Contain ransomware spreading between servers
• Revoke access through compromised accounts
• Isolate hosts communicating with attacker infrastructure