128 skills · sorted by relevance
Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.
The English summary is being prepared. Showing the original description.
Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.
The English summary is being prepared. Showing the original description.
Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.
The English summary is being prepared. Showing the original description.
Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.
The English summary is being prepared. Showing the original description.
Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.
The English summary is being prepared. Showing the original description.
Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.
The English summary is being prepared. Showing the original description.
Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.
The English summary is being prepared. Showing the original description.
Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.
The English summary is being prepared. Showing the original description.
Check shell commands before they run and warn about destructive actions such as file deletion, database removal, and Git history changes. Users can approve ordinary warnings, while certain catastrophic command patterns are denied.
Analyze executable files and libraries with IDA Pro. Inspect pseudocode, strings, function calls, and data flow, then add meaningful names and comments and produce a Markdown report documenting findings and analysis steps.
Convert Simplicité text logs into structured JSON while keeping only the fields needed for troubleshooting. Preserve multiline errors and stack traces, and reduce the amount of log content passed to an AI agent for analysis.
Create an agent user in Microsoft Entra ID so an AI agent can access services requiring a user identity. Covers validating the parent agent identity, creating the account, assigning a manager and licenses, and troubleshooting setup errors.
Create and update prompt-based agents in Azure AI Foundry from a local JSON manifest, a file listing agent definitions. The skill prepares synchronization scripts, pushes instructions to the service, and verifies registered agents.
Audit Azure Storage settings for public containers, encryption, access permissions, network restrictions, and logging gaps. Use command-line checks and monitoring alerts to produce findings and remediation guidance across subscriptions.
Build security detection rules in Splunk using SPL, its search language. Use examples for suspicious logins, network traffic, and PowerShell activity to develop searches, add context and severity, test historical logs, and measure false alerts.
Investigate security incidents in Splunk by connecting authentication, endpoint, and network logs. Use SPL, Splunk’s search language, to identify suspicious activity, reconstruct event timelines, document findings, and develop detection rules.
Use when writing or running PowerShell on Windows, especially native programs, quoted paths, escaping, pwsh, Start-Process, file operations, or shell troubleshooting.
The English summary is being prepared. Showing the original description.
AAD アプリ登録を行わずに、Microsoft Graph API 経由で SharePoint を包括的に操作する。リスト（ドキュメントライブラリ）・列・リスト項目の作成、ファイルアップロード、ページ作成、M365 グループ経由のサイト作成に対応。Microsoft Graph PowerShell の well-known パブリッククライアントで委任認証し、auth_helper.py のキャッシュを再利用する。
The English summary is being prepared. Showing the original description.
PowerShell Windows patterns. Critical pitfalls, operator syntax, error handling.
The English summary is being prepared. Showing the original description.
Bypass the Windows Antimalware Scan Interface (AMSI) using memory patching, reflection, and obfuscation techniques. Execute undetected PowerShell, VBScript, JScript, and .NET assemblies in-memory without triggering Microsoft Defender or third-party AV/EDR solutions. Use this skill during Red Team engagements when loading offensive tools (Mimikatz, Rubeus, SharpHound) in memory on defended Windows endpoints.
The English summary is being prepared. Showing the original description.
Hunts for fileless and in-memory threats by correlating PowerShell script-block logs, encoded-command usage, in-memory loading patterns, and registry-resident payloads from Windows telemetry. Activates for requests to hunt fileless malware, detect in-memory execution, or find registry-resident and reflective-loading activity.
The English summary is being prepared. Showing the original description.
PowerShell Windows patterns. Critical pitfalls, operator syntax, error handling.
The English summary is being prepared. Showing the original description.
Creates and reviews agent skills safely by enforcing deletion-prevention harness rules: no fixed absolute temp paths, no cwd-dependent cleanup, no wildcard deletes, no workspace-external file operations, no silent cleanup failures, and mandatory temp-root validation before any destructive command. Use when creating a new skill, updating an existing SKILL.md, or reviewing prompts/runbooks that include temp files, extraction, cleanup, PowerShell, bash, rm, del, Remove-Item, or archive expansion.
The English summary is being prepared. Showing the original description.
PowerShell Windows patterns. Critical pitfalls, operator syntax, error handling.
The English summary is being prepared. Showing the original description.