20 skills · sorted by relevance
Build detection rules for suspicious Windows scheduled tasks by correlating Sysmon and Windows Security logs. Examine parent processes, file paths, encoded commands, and remote task creation to uncover persistent access and movement between systems.
Hunts for malicious scheduled task persistence by analyzing task registration events (4698) and schtasks process creation for suspicious actions, triggers, and hidden tasks. Activates for requests to hunt scheduled task abuse, detect malicious schtasks usage, or find persistence via the Task Scheduler.
The English summary is being prepared. Showing the original description.
Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.
The English summary is being prepared. Showing the original description.
Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.
The English summary is being prepared. Showing the original description.
Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.
The English summary is being prepared. Showing the original description.
Set up one-time reminders and recurring tasks, then inspect, edit, delete, or run saved tasks on request. Supports specific execution dates, time zones, and cron-style schedules that define recurring times.
Set up a privacy legal plugin through an interview and existing documents. Capture applicable regulations, data processing agreement positions, and privacy impact assessment formats in shared settings, with options to resume setup or recheck integrations.
Turns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop (baseline snapshot -> interval sleep -> re-scan -> asset/finding delta -> threshold-gated webhook alert), the scan-to-scan diff engine (new/removed/changed assets by a tracked-attribute table, new/resolved findings by a stable cross-scan fingerprint), adversary CTI / chatter monitoring across six public feeds (ransomwatch, ransomware.live, HackerNews Algolia search, Reddit security-subreddit RSS, GitHub Gist code-search, public Telegram channel scraping) with a source-kind-aware severity engine (leak-site/forum/telegram/paste tiers, CRITICAL through INFO), literal/glob/regex watchlist pattern matching, full-corpus capture with retroactive rescan on new watchlist entries, infrastructure-tracking-over-time discipline (certificate-transparency, passive-DNS, port/service, and typosquat re-enumeration cadence, and what a genuine 'perimeter drift' event looks like in the diff output), a five-state finding-lifecycle state machine (open/triaged/risk_accepted/resolved/false_positive) with per-severity SLA and fingerprint-based cross-scan dedup and auto-resolve/reopen rules, the alert-fatigue trap where a lifecycle-unaware rule re-fires on an already-accepted finding, a durable retry/backoff alert-outbox pattern ('queued is not delivered'), and copy-paste bash-cron plus PowerShell-Scheduled-Task recipes for a re-scan+diff loop with the Slack-compatible webhook payload shape. Passive OSINT and analysis only -- no new active-intrusion technique. Use when setting up ongoing monitoring for a retainer or MSSP engagement, tuning alert thresholds to avoid fatigue, triaging a finding's lifecycle status, investigating adversary chatter about a brand, building a 'what changed on the perimeter since last week' report, or deciding whether a persisting finding should re-alert.
The English summary is being prepared. Showing the original description.
Immediately trigger scheduled task without waiting for scheduled time. When you need to test task execution or run task ahead of schedule.
The English summary is being prepared. Showing the original description.
List all scheduled tasks with their ID, name, type, status, and next execution time. When you need to check existing tasks, find task ID for cancel/update, or verify task creation.
The English summary is being prepared. Showing the original description.
Modify scheduled task settings WITHOUT deleting. Can modify notify_on_start, notify_on_complete, enabled. Common uses - (1) 'Turn off notification' = notify=false, (2) 'Pause task' = enabled=false, (3) 'Resume task' = enabled=true.
The English summary is being prepared. Showing the original description.
PERMANENTLY DELETE scheduled task. When user says 'cancel/delete task' use this. When user says 'turn off notification' use update_scheduled_task with notify=false. When user says 'pause task' use update_scheduled_task with enabled=false.
The English summary is being prepared. Showing the original description.
Manage Agentara scheduled tasks (cronjobs). Use when the user wants to create, list, update, or delete recurring scheduled tasks — triggered by phrases like "add a cronjob", "schedule a task", "remind me to do something after 10 minutes", "list my scheduled tasks", "remove cronjob", "update the schedule", etc.
The English summary is being prepared. Showing the original description.
Local Windows privilege escalation on a STANDALONE / workgroup host, or a local shell on a domain member - foothold to SYSTEM. Token privileges (SeImpersonate/Potato), service misconfig (weak perms / unquoted path / writable binary), registry autologon creds, scheduled-task + writable-script abuse, DLL hijack, AlwaysInstallElevated, UAC bypass, credential loot. For DOMAIN escalation (kerberoast/DCSync/ADCS/BloodHound) use hunt-ad instead. Wiki-first, FIND schema output.
The English summary is being prepared. Showing the original description.
Windows local privilege escalation from a low-privilege shell to Administrator or SYSTEM. Covers quiet vs loud enumeration, SeImpersonate/Potato family including LocalPotato, token privileges (SeBackup/SeRestore/SeManageVolume/SeLoadDriver/SeDebug), service/DLL/COM/scheduled-task abuse, AlwaysInstallElevated and UAC boundary, KrbRelayUp-style domain-joined local admin, and version-gated kernel LPE. Use when the operator already has a Windows foothold and needs local SYSTEM. Endpoint blocks hand off to /edr-bypass then return here.
The English summary is being prepared. Showing the original description.
Schedule recurring tasks and heartbeat monitoring using Claude Code's cron system (CronCreate/CronList/CronDelete). Implements the Agentic Heartbeat Pattern for ecosystem health monitoring.
The English summary is being prepared. Showing the original description.
Guides you through setting up your first automatic task in Cowork — picking the right one, configuring the schedule, and making sure it runs correctly. For enabling background automation while you focus on other work, when setting up recurring morning briefings or end-of-day summaries, or during an automation setup session. Use when the user says "schedule a task", "automate something", "run this every day", "recurring task", "first scheduled task", "daily automation", or "can cowork do something automatically".
The English summary is being prepared. Showing the original description.
Hunts for Windows persistence across autostart locations: Run keys, services, scheduled tasks, WMI event subscriptions, and startup folders, baselining them to surface anomalous or recently added entries. Activates for requests to hunt persistence, audit autostart extensibility points, or find malware autoruns on Windows.
The English summary is being prepared. Showing the original description.
Registry of reusable agent sessions and slot allocation: claim a free scheduled-task slot instead of creating a new session, set its prompt and fire time, and release it when done. Use when you need to spawn or reuse a visible background session.
The English summary is being prepared. Showing the original description.
ALWAYS use this skill when the user asks to schedule, automate, set up recurring tasks, create a cron job, or anything involving timed / periodic execution. Do NOT use the local system crontab — scheduled tasks are stored on the Unique AI Platform and executed by a Kubernetes CronJob, not locally. Scheduled tasks always run on the current assistant (`$UNIQUE_ASSISTANT_ID`); never ask the user which assistant to use, neither in chat nor via `unique-cli elicit ask`. This skill covers creating, listing, updating, enabling, disabling, and deleting scheduled tasks via the unique-cli schedule command.
The English summary is being prepared. Showing the original description.