by mukul975
configuring-host-based-intrusion-detection guide for setting up HIDS with Wazuh, OSSEC, or AIDE to monitor file integrity, system changes, and compliance-focused endpoint security for Security Audit workflows.
by mukul975
The detecting-wmi-persistence skill helps threat hunters and DFIR analysts detect WMI event subscription persistence in Windows telemetry using Sysmon Event IDs 19, 20, and 21. Use it to identify malicious EventFilter, EventConsumer, and FilterToConsumerBinding activity, validate findings, and separate attacker persistence from benign admin automation.
by mukul975
The detecting-evasion-techniques-in-endpoint-logs skill helps hunt defense evasion in Windows endpoint logs, including log clearing, timestomping, process injection, and security tool disabling. Use it for threat hunting, detection engineering, and incident triage with Sysmon, Windows Security, or EDR telemetry.
by mukul975
detecting-fileless-attacks-on-endpoints helps build detections for memory-only attacks on Windows endpoints, including PowerShell abuse, WMI persistence, reflective loading, and process injection. Use it for Security Audit, threat hunting, and detection engineering with Sysmon, AMSI, and PowerShell logging.
by mukul975
deploying-osquery-for-endpoint-monitoring guide for deploying and configuring osquery for endpoint visibility, fleet-wide monitoring, and SQL-driven threat hunting. Use it to plan installation, read the workflow and API references, and operationalize scheduled queries, log collection, and centralized review across Windows, macOS, and Linux endpoints.
by mukul975
configuring-windows-defender-advanced-settings skill for Microsoft Defender for Endpoint hardening. Covers ASR rules, controlled folder access, network protection, exploit protection, deployment planning, and audit-first rollout guidance for security engineers, IT admins, and Security Audit workflows.
