56 skills · sorted by relevance
"Apply Lean and Six Sigma principles to eliminate waste and reduce process variation. Use this skill when the user needs to improve operational efficiency, identify the seven wastes (TIMWOOD), run DMAIC improvement projects, or streamline workflows — even if they say 'our process is too slow', 'where are we wasting resources', or 'how do we reduce defects'.".
The English summary is being prepared. Showing the original description.
Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis
The English summary is being prepared. Showing the original description.
Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis
The English summary is being prepared. Showing the original description.
Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis
The English summary is being prepared. Showing the original description.
Identify individual sessions with unusually high or low spending using the median and MAD, a measure of spread around it. Filter by time period, adjust detection thresholds, and optionally return a failure exit code for automated checks.
Investigate Windows credential theft by correlating endpoint monitoring data, Sysmon events, and security logs. The skill provides detection queries and a reporting format to identify suspicious access and assess which credentials may be compromised.
Investigate suspicious privilege increases, including Windows UAC approval bypasses and Linux sudo or setuid abuse. Use registry changes, process relationships, and permission changes to identify possible abuse and document affected hosts, methods, and risk levels.
Investigate service account misuse by examining unexpected interactive logons, privilege changes, and movement between systems. Correlate endpoint and security logs, distinguish suspicious activity from legitimate operations, and document evidence, risk, and recommended responses.
Analyze Sysmon logs to investigate process injection, where malicious code hides inside legitimate processes. Correlate remote thread creation, cross-process access, and unusual DLL loading, then organize findings by injection type, risk level, and ATT&CK technique.
Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.
Investigate DCSync attacks, which abuse Active Directory replication to steal password hashes. Use audit events and network traffic to identify suspicious replication requests, examine their sources, and check for subsequent credential misuse.
Turn threat intelligence and detection gaps into testable investigation hypotheses. Use endpoint monitoring and security log queries to examine evidence, validate findings, connect related activity, and document risks and recommended actions in a consistent hunt report.
Apply over 240 reusable prompt templates to summarize content, extract insights, improve writing, review code, or analyze security threats. It reads each template directly and returns results in the format defined for that task.
Create interactive views of dense datasets, spatial paths, and flows using WebGL, which uses the GPU for rendering. Choose suitable libraries and design navigation, labels, animation, and static alternatives around the analytical task.
Operations management across process optimization, efficiency, and continuous improvement. Use when designing workflows, building capacity plans, evaluating vendors, running Lean Six Sigma DMAIC projects, or optimizing cost-per-unit.
The English summary is being prepared. Showing the original description.
Use when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior.
The English summary is being prepared. Showing the original description.
Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.
The English summary is being prepared. Showing the original description.
IOC extraction, threat intelligence correlation, MITRE ATT&CK mapping, hunt hypothesis generation, and detection rule creation
The English summary is being prepared. Showing the original description.
Use when hunting threats or engineering detections — ATT&CK Detection-Strategies, Sigma + correlation with Detection-as-Code CI, Windows endpoint hunting (Sysmon/ETW/LSASS/LOLBins), network C2 hunting (JA4+, beaconing, DNS tunneling), cloud-identity hunting, Atomic Red Team purple-team validation
The English summary is being prepared. Showing the original description.
OSS-only security for OWASP Top 10, pentest, vuln testing (XSS, SSRF, CSRF, business-logic, Host header), threat modeling (STRIDE, ATT&CK), Sigma rules, SAST, code audit, AI/LLM red-team, or replacing paid tools (Burp, Nessus, Splunk) with OSS.
The English summary is being prepared. Showing the original description.
Think and work like an expert Clinical Laboratory Scientist. Use when a task calls for Clinical Laboratory Scientist judgment. Reasons from pre-analytical–analytical–post-analytical total testing process; EP15/EP09/EP28 validation, Westgard/Sigma IQC, HIL indices (C56), EP23/IQCP, critical-value read-back, type-and-screen/crossmatch, CLSI M100 direct AST, LC-MS/MS C62, and AUTO10 autoverification.
The English summary is being prepared. Showing the original description.
Think and work like an expert Animal Geneticist & Breeder. Use when a task calls for Animal Geneticist & Breeder judgment. Reasons from additive genetic variance, response to selection (R = i h sigma_A), accuracy, and inbreeding depression through REML/BLUP and ssGBLUP pipelines (BLUPF90, ASReml, WOMBAT), economic selection indices, optimum-contribution mate allocation, and Interbull MACE while treating confounded contemporary groups, prediction bias/dispersion, popular-sire inbreeding and rising deleterious haplotypes, GxE reranking, and pedigree or genotype-calling errors as first-class failure modes.
The English summary is being prepared. Showing the original description.
Convenes expert panels for problem-solving. Use when user mentions panel, experts, multiple perspectives, MECE, DMAIC, RAPID, Six Sigma, root cause analysis, strategic decisions, process improvement, or asks for philosophers/ancients (Socratic, Aristotelian, Stoic method experts).
The English summary is being prepared. Showing the original description.
Engineering detection rules (Sigma/YARA), detection coverage mapping, threat hunting hypotheses, Purple Team Blue side, Detection-as-Code CI/CD. Use when defensive verification is needed.
The English summary is being prepared. Showing the original description.