958 skills · sorted by relevance
Maintain and validate OpenShell builds for Windows on x64 and ARM64 using MSVC, Microsoft's C++ toolchain. Check compilation, build executables, run tests on native hosts, and report artifacts and unsupported driver behavior.
Set up a Windows sandbox in Daytona to test OpenWork with a simulated corporate certificate authority. Check successful and broken HTTPS connections, the desktop app’s use of Windows trust, and certificate handling in runtimes it launches.
Build end-to-end tests that operate Windows desktop apps through pywinauto and Windows UI Automation, an interface for accessing screen controls. Covers stable element selection, waits, failure screenshots, test isolation, and CI setup for native applications.
Analyze Windows event logs in Splunk to investigate suspicious logins, privilege changes, persistence, and movement between computers. Build detection searches and organize endpoint activity into timelines, with findings linked to MITRE ATT&CK attack techniques.
Build and improve Windows desktop apps with C#, WinUI 3, and the Windows App SDK. Guidance covers development setup, native interface design, implementation, troubleshooting, packaging choices, and verification through both builds and actual app launches.
Configure Windows security logs for threat detection and incident investigation. Covers detailed audit policies, process command line recording, log storage sizing, and centralized forwarding so monitoring systems receive useful authentication and activity records.
Build Zoom meeting integrations in Windows C++ applications, including custom interfaces and bots that run without a visible interface. Guidance covers authentication, audio and video data access, project setup, and troubleshooting callbacks through the Windows message loop.
Develop and test Windows-specific Screenpipe changes on a disposable Azure virtual machine. The workflow verifies native behavior, preserves logs and desktop video, and handles branch and pull request delivery when authorized.
Guide remote Windows app control using UI Automation, which identifies controls by names and roles. Covers text entry, buttons, window management, screenshot checks, and handling desktop session problems when the connected backend supports these features.
Package Python apps as Windows installers using Nuitka and Inno Setup. Review compilation settings, remove unnecessary files, and analyze DLLs, shared library files, to reduce package size and improve startup behavior.
Automate website navigation, form filling, content collection, and Windows desktop interactions. The skill selects browser or desktop tools for the task and guides screenshot capture and desktop network traffic observation when needed.
Guide development of custom Windows video applications with Zoom Video SDK and C++. Covers session setup, video display, screen sharing, and raw media access, meaning direct capture or injection of audio samples and video frames.
Review Windows privilege escalation paths from a standard user session to Administrator or SYSTEM. Examine service permissions, token privileges, library loading, scheduled tasks, and stored credentials, with detection indicators for defensive validation.
Prepare an ASP.NET .NET Framework application for Windows Docker containers. Create project-specific build and runtime files, configure environment-based settings and Windows dependencies, and verify that the Docker image builds successfully.
Configure advanced Microsoft Defender protections on Windows, including rules that block risky behavior, protected folders, network filtering, and exploit defenses. Use audit modes to assess application impact, then deploy policies and monitor detections across an organization.
Analyze Windows Prefetch files, which record application execution data, using Python. Reconstruct execution timelines, review run counts and accessed resources, and identify suspicious programs or signs that an executable has been renamed to disguise its identity.
Prepare and publish Windows apps to the Microsoft Store using msstore. Covers account credentials, application packaging, submission tracking, beta testing groups, gradual releases, and automated publishing through CI/CD pipelines.
Investigate suspicious privilege increases, including Windows UAC approval bypasses and Linux sudo or setuid abuse. Use registry changes, process relationships, and permission changes to identify possible abuse and document affected hosts, methods, and risk levels.
Inspect Windows startup entries with Sysinternals Autoruns to find possible malware persistence, settings that let malware restart automatically. Review signatures, file locations, and changes from a clean baseline to identify entries that need investigation.
Examine Windows shortcuts and Jump Lists, records of recently used files, to reconstruct user activity. Extract paths, timestamps, and device details with LECmd and JLECmd, including traces that remain after target files are deleted.
Analyze Windows identity and host evidence in CTF sandboxes. Connect authentication tickets, credentials, mailbox rules, and host activity to explain which services accept access and how movement between hosts occurs.
Trace movement between Windows hosts in a CTF sandbox using credentials and Kerberos tickets, which carry authentication information. Connect recovered artifacts to the service that accepted them and document the resulting access or privileges.
Create, debug, and maintain Windows batch scripts for file operations, backups, and scheduled tasks. Covers command arguments, variables, loops, and error handling, with starter templates for command-line tools and reusable functions.
Build detection rules for suspicious Windows scheduled tasks by correlating Sysmon and Windows Security logs. Examine parent processes, file paths, encoded commands, and remote task creation to uncover persistent access and movement between systems.