Windows skills

Zoom Meeting SDK

anthropics

Integrate Zoom meetings into Windows applications with C++.

Hunting for WMI Persistence

mukul975

Detect and analyze WMI-based persistence mechanisms.

Hunting for Suspicious Scheduled Tasks

mukul975

Identify and analyze potential persistence threats in Windows.

Screenshot Capture

openai

Capture screenshots across different platforms easily.

Storage Analyzer

kkkkhazix

Efficiently analyze and manage disk space usage.

Hunting For Registry Persistence

mukul975

Proactively detect Windows registry persistence mechanisms.

W

Windows Desktop E2E Testing

affaan-m

Automate end-to-end testing for Windows desktop applications.

Access local system resources including Calendar on macOS and Windows. Use this skill when you need to manage user's schedule directly on their device.

Configures Windows Group Policy Objects to block ransomware execution and lateral spread, covering AppLocker rules, Software Restriction Policies, Controlled Folder Access, attack surface reduction rules, and network protection settings. Use when hardening Windows endpoints against ransomware via GPO, configuring AppLocker or Controlled Folder Access, or building endpoint protection policies through Group Policy.

Systematically hunts for adversary persistence mechanisms across Windows endpoints, covering registry Run/RunOnce keys, services, startup folders, scheduled tasks, and WMI event subscriptions. Use when performing a broad persistence sweep during incident response or building SIEM detections that cover the full range of Windows persistence techniques (MITRE T1547).

Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution history, run counts, and accessed file/volume lists. Use when investigating renamed or masquerading binaries, verifying program execution timelines, or hunting for suspicious execution patterns in incident response.

Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations. Use when hunting for persistence during Windows incident response, triaging a compromised endpoint, or validating that malware autostart entries have been fully identified and removed.