[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HEDSXPWZCSS2PGTA40A0ZT":3,"skill-same:01M6HEDSXPWZCSS2PGTA40A0ZT":124},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":6,"ownerHtmlUrl":72,"ownerBlogUrl":6,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6HEDSXPWZCSS2PGTA40A0ZT","detecting-t1548-abuse-elevation-control-mechanism",null,"Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid\u002Fsetgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-t1548-abuse-elevation-control-mechanism\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"detecting","control","detecting t1548 abuse elevation control mechanism","access","sudo","hunting","de","isolation","flags","cm","threat","security","windows-security","escalation","threat-hunting","monitoring","registry","authentication","windows","cybersecurity","2026-11-10 10:12:30",false,"---\nname: detecting-t1548-abuse-elevation-control-mechanism\ndescription: Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid\u002Fsetgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- uac-bypass\n- privilege-escalation\n- mitre-t1548\n- elevation-control\n- windows-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Restore Access\n- Password Authentication\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmitre_attack:\n- T1548.002\n- T1548.001\n- T1548.003\n- T1548.004\ncategory: detecting-t1548-abuse-elevation-control-mechanism\n---\n# Detecting T1548 Abuse Elevation Control Mechanism\n\n## When to Use\n\n- When hunting for privilege escalation via UAC bypass in Windows environments\n- After threat intelligence indicates use of UAC bypass exploits by active threat groups\n- When investigating how attackers achieved administrative access without triggering UAC prompts\n- During security assessments to validate UAC bypass detection coverage\n- When monitoring for setuid\u002Fsetgid abuse on Linux systems\n\n## Prerequisites\n\n- Sysmon Event ID 1 with command-line and parent process logging\n- Windows Security Event ID 4688 with process tracking\n- Registry auditing for UAC-related keys (HKCU\\Software\\Classes)\n- Sysmon Event ID 12\u002F13 (Registry key\u002Fvalue modification)\n- EDR with elevation monitoring capabilities\n\n## Workflow\n\n1. **Monitor UAC Registry Modifications**: Many UAC bypasses modify registry keys under `HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command` or `HKCU\\Software\\Classes\\mscfile\\shell\\open\\command`. Track Sysmon Events 12\u002F13 for these changes.\n2. **Detect Auto-Elevating Process Abuse**: Certain Windows binaries auto-elevate without UAC prompts (fodhelper.exe, computerdefaults.exe, eventvwr.exe). Hunt for these being launched by non-standard parent processes.\n3. **Track Process Integrity Level Changes**: Monitor for processes escalating from medium to high integrity level without corresponding UAC consent events.\n4. **Hunt for Elevated Process Spawning**: Detect when auto-elevating processes spawn unexpected children (cmd.exe, powershell.exe) -- indicating UAC bypass exploitation.\n5. **Monitor Linux Elevation Abuse**: Track sudo misconfiguration exploitation, setuid binary abuse, and capability manipulation.\n6. **Correlate with Privilege Escalation Chain**: Map elevation abuse to the broader attack chain, identifying what was done with escalated privileges.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1548.002 | Bypass User Account Control |\n| T1548.001 | Setuid and Setgid (Linux) |\n| T1548.003 | Sudo and Sudo Caching |\n| T1548.004 | Elevated Execution with Prompt (macOS) |\n| UAC Auto-Elevation | Windows binaries that elevate without prompt |\n| fodhelper.exe | Common UAC bypass vector via registry hijack |\n| eventvwr.exe | MSC file handler UAC bypass |\n| Integrity Level | Windows process trust level (Low\u002FMedium\u002FHigh\u002FSystem) |\n\n## Detection Queries\n\n### Splunk -- UAC Bypass via Registry Modification\n```spl\nindex=sysmon (EventCode=12 OR EventCode=13)\n| where match(TargetObject, \"(?i)HKCU\\\\\\\\Software\\\\\\\\Classes\\\\\\\\(ms-settings|mscfile|exefile|Folder)\\\\\\\\shell\\\\\\\\open\\\\\\\\command\")\n| table _time Computer User EventCode TargetObject Details Image\n```\n\n### Splunk -- Auto-Elevating Process Abuse\n```spl\nindex=sysmon EventCode=1\n| where match(Image, \"(?i)(fodhelper|computerdefaults|eventvwr|sdclt|slui|cmstp)\\.exe$\")\n| where NOT match(ParentImage, \"(?i)(explorer|svchost|services)\\.exe$\")\n| table _time Computer User Image CommandLine ParentImage ParentCommandLine\n```\n\n### KQL -- UAC Bypass Detection\n```kql\nDeviceRegistryEvents\n| where Timestamp > ago(7d)\n| where RegistryKey has_any (\"ms-settings\\\\shell\\\\open\\\\command\", \"mscfile\\\\shell\\\\open\\\\command\")\n| where ActionType == \"RegistryValueSet\"\n| project Timestamp, DeviceName, RegistryKey, RegistryValueData, InitiatingProcessFileName\n```\n\n### Sigma Rule\n```yaml\ntitle: UAC Bypass via Registry Modification\nstatus: stable\nlogsource:\n    product: windows\n    category: registry_set\ndetection:\n    selection:\n        TargetObject|contains:\n            - '\\ms-settings\\shell\\open\\command'\n            - '\\mscfile\\shell\\open\\command'\n            - '\\exefile\\shell\\open\\command'\n    condition: selection\nlevel: high\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n```\n\n## Common Scenarios\n\n1. **fodhelper.exe Registry Hijack**: Attacker sets `HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command` to a malicious executable, then launches fodhelper.exe which auto-elevates and executes the hijacked command.\n2. **eventvwr.exe MSC Bypass**: Modifying `HKCU\\Software\\Classes\\mscfile\\shell\\open\\command` to intercept Event Viewer's auto-elevation behavior.\n3. **sdclt.exe Bypass**: Leveraging the Windows Backup utility's auto-elevation to execute arbitrary commands.\n4. **CMSTP.exe INF Bypass**: Using Connection Manager Profile Installer with a malicious INF file to bypass UAC via `\u002Fs \u002Fni` flags.\n5. **DLL Hijacking in Auto-Elevate**: Placing malicious DLLs in search paths of auto-elevating executables.\n\n## Output Format\n\n```\nHunt ID: TH-UAC-[DATE]-[SEQ]\nHost: [Hostname]\nBypass Method: [Registry hijack\u002FDLL hijack\u002FToken manipulation]\nAuto-Elevate Binary: [fodhelper.exe\u002Feventvwr.exe\u002Fetc.]\nRegistry Key Modified: [Full registry path]\nPayload Executed: [Command or binary path]\nUser Context: [Account]\nRisk Level: [Critical\u002FHigh\u002FMedium]\nATT&CK Technique: [T1548.00x]\n```\n","# Detecting T1548 Abuse Elevation Control Mechanism\n\n## When to Use\n\n- When hunting for privilege escalation via UAC bypass in Windows environments\n- After threat intelligence indicates use of UAC bypass exploits by active threat groups\n- When investigating how attackers achieved administrative access without triggering UAC prompts\n- During security assessments to validate UAC bypass detection coverage\n- When monitoring for setuid\u002Fsetgid abuse on Linux systems\n\n## Prerequisites\n\n- Sysmon Event ID 1 with command-line and parent process logging\n- Windows Security Event ID 4688 with process tracking\n- Registry auditing for UAC-related keys (HKCU\\Software\\Classes)\n- Sysmon Event ID 12\u002F13 (Registry key\u002Fvalue modification)\n- EDR with elevation monitoring capabilities\n\n## Workflow\n\n1. **Monitor UAC Registry Modifications**: Many UAC bypasses modify registry keys under `HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command` or `HKCU\\Software\\Classes\\mscfile\\shell\\open\\command`. Track Sysmon Events 12\u002F13 for these changes.\n2. **Detect Auto-Elevating Process Abuse**: Certain Windows binaries auto-elevate without UAC prompts (fodhelper.exe, computerdefaults.exe, eventvwr.exe). Hunt for these being launched by non-standard parent processes.\n3. **Track Process Integrity Level Changes**: Monitor for processes escalating from medium to high integrity level without corresponding UAC consent events.\n4. **Hunt for Elevated Process Spawning**: Detect when auto-elevating processes spawn unexpected children (cmd.exe, powershell.exe) -- indicating UAC bypass exploitation.\n5. **Monitor Linux Elevation Abuse**: Track sudo misconfiguration exploitation, setuid binary abuse, and capability manipulation.\n6. **Correlate with Privilege Escalation Chain**: Map elevation abuse to the broader attack chain, identifying what was done with escalated privileges.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1548.002 | Bypass User Account Control |\n| T1548.001 | Setuid and Setgid (Linux) |\n| T1548.003 | Sudo and Sudo Caching |\n| T1548.004 | Elevated Execution with Prompt (macOS) |\n| UAC Auto-Elevation | Windows binaries that elevate without prompt |\n| fodhelper.exe | Common UAC bypass vector via registry hijack |\n| eventvwr.exe | MSC file handler UAC bypass |\n| Integrity Level | Windows process trust level (Low\u002FMedium\u002FHigh\u002FSystem) |\n\n## Detection Queries\n\n### Splunk -- UAC Bypass via Registry Modification\n```spl\nindex=sysmon (EventCode=12 OR EventCode=13)\n| where match(TargetObject, \"(?i)HKCU\\\\\\\\Software\\\\\\\\Classes\\\\\\\\(ms-settings|mscfile|exefile|Folder)\\\\\\\\shell\\\\\\\\open\\\\\\\\command\")\n| table _time Computer User EventCode TargetObject Details Image\n```\n\n### Splunk -- Auto-Elevating Process Abuse\n```spl\nindex=sysmon EventCode=1\n| where match(Image, \"(?i)(fodhelper|computerdefaults|eventvwr|sdclt|slui|cmstp)\\.exe$\")\n| where NOT match(ParentImage, \"(?i)(explorer|svchost|services)\\.exe$\")\n| table _time Computer User Image CommandLine ParentImage ParentCommandLine\n```\n\n### KQL -- UAC Bypass Detection\n```kql\nDeviceRegistryEvents\n| where Timestamp > ago(7d)\n| where RegistryKey has_any (\"ms-settings\\\\shell\\\\open\\\\command\", \"mscfile\\\\shell\\\\open\\\\command\")\n| where ActionType == \"RegistryValueSet\"\n| project Timestamp, DeviceName, RegistryKey, RegistryValueData, InitiatingProcessFileName\n```\n\n### Sigma Rule\n```yaml\ntitle: UAC Bypass via Registry Modification\nstatus: stable\nlogsource:\n    product: windows\n    category: registry_set\ndetection:\n    selection:\n        TargetObject|contains:\n            - '\\ms-settings\\shell\\open\\command'\n            - '\\mscfile\\shell\\open\\command'\n            - '\\exefile\\shell\\open\\command'\n    condition: selection\nlevel: high\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n```\n\n## Common Scenarios\n\n1. **fodhelper.exe Registry Hijack**: Attacker sets `HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command` to a malicious executable, then launches fodhelper.exe which auto-elevates and executes the hijacked command.\n2. **eventvwr.exe MSC Bypass**: Modifying `HKCU\\Software\\Classes\\mscfile\\shell\\open\\command` to intercept Event Viewer's auto-elevation behavior.\n3. **sdclt.exe Bypass**: Leveraging the Windows Backup utility's auto-elevation to execute arbitrary commands.\n4. **CMSTP.exe INF Bypass**: Using Connection Manager Profile Installer with a malicious INF file to bypass UAC via `\u002Fs \u002Fni` flags.\n5. **DLL Hijacking in Auto-Elevate**: Placing malicious DLLs in search paths of auto-elevating executables.\n\n## Output Format\n\n```\nHunt ID: TH-UAC-[DATE]-[SEQ]\nHost: [Hostname]\nBypass Method: [Registry hijack\u002FDLL hijack\u002FToken manipulation]\nAuto-Elevate Binary: [fodhelper.exe\u002Feventvwr.exe\u002Fetc.]\nRegistry Key Modified: [Full registry path]\nPayload Executed: [Command or binary path]\nUser Context: [Account]\nRisk Level: [Critical\u002FHigh\u002FMedium]\nATT&CK Technique: [T1548.00x]\n```\n",{"name":5,"tags":44,"author":49,"domain":38,"license":15,"version":50,"category":5,"nist_csf":51,"subdomain":33,"description":7,"mitre_attack":56,"d3fend_techniques":61},[33,45,46,47,48,31],"uac-bypass","privilege-escalation","mitre-t1548","elevation-control","mahipal","1.0",[52,53,54,55],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[57,58,59,60],"T1548.002","T1548.001","T1548.003","T1548.004",[62,63,64,65,66],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Restore Access","Password Authentication","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fdetecting-t1548-abuse-elevation-control-mechanism",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill detecting-t1548-abuse-elevation-control-mechanism",{"tool":81,"command":82},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill detecting-t1548-abuse-elevation-control-mechanism",{"tool":84,"command":85},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill detecting-t1548-abuse-elevation-control-mechanism","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-t1548-abuse-elevation-control-mechanism\u002FSKILL.md",true,[89,95,100,106,110,114,120],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"assets\u002Ftemplate.md","ASSET","资产文件",1066,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-t1548-abuse-elevation-control-mechanism\u002Fassets\u002Ftemplate.md",{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-t1548-abuse-elevation-control-mechanism\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",2513,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-t1548-abuse-elevation-control-mechanism\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fstandards.md",2094,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-t1548-abuse-elevation-control-mechanism\u002Freferences\u002Fstandards.md",{"path":111,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fworkflows.md",1875,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-t1548-abuse-elevation-control-mechanism\u002Freferences\u002Fworkflows.md",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fagent.py","SCRIPT","脚本",6903,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-t1548-abuse-elevation-control-mechanism\u002Fscripts\u002Fagent.py",{"path":121,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fprocess.py",4818,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-t1548-abuse-elevation-control-mechanism\u002Fscripts\u002Fprocess.py",[125,156,182,203,219,238],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":136,"publishedAt":39},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[131],{"categoryNo":132,"categoryName":133,"taxonomyType":134,"taxonomyTypeDesc":135},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[137,138,139,140,141,142,38,143,144,145,146,147,148,149,150,151,152,153,154,155],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":39},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[163,164,165,166,167,38,168,169,170,171,172,173,174,175,176,177,178,179,180,181],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":39},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[30,189,153,38,190,191,192,149,150,193,194,195,196,197,198,199,26,200,201,202],"triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","scope","impact","consistency",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":209,"publishedAt":39},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[30,210,211,189,153,167,38,212,191,146,213,214,149,150,215,194,177,216,217,218],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":225,"publishedAt":39},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[30,226,227,228,229,230,38,231,232,233,191,234,149,235,236,237,197,28,153,25],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review",{"skillNo":239,"name":240,"nameZh":6,"description":241,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":242,"categories":243,"keywords":244,"publishedAt":39},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[245,246,247,29,38,34,248,249,250,251,252,235,253,254,28,255,25,256,257,258],"infrastructure","tracking threat actor infrastructure","tracking","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]