Results for “event-id-4662”

Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts.

Detect Kerberos Pass-the-Ticket attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM.

Load this skill when the user says "implement issue", "implement-issue", or "/implement-issue". Implements a GitHub story issue end-to-end: prepares base branch, creates feature branch, implements the requirements, verifies via the verify-implementation skill, and opens a PR.

Advanced Tauri event patterns for bidirectional communication, streaming data, window-to-window messaging, and custom event handling

Extract Kerberos tickets from LSASS memory, inject them into an attacker session, and perform lateral movement to access remote systems as the impersonated user.

Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI event subscription persistence.

Session handoff generation and loading. Trigger: session end, context full, /handoff

issue-create, issue-start, issue-end, issue-merge에서 이슈 진행 상태가 성공적으로 전환된 직후 issue-onboard 그래프 캐시를 동기화합니다. `$issue-graph-sync

**Server Logs:**

Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.

セッション再開時に最新5件のhandoffを読み込み文脈を復元するスキル。「おはよう」「こんにちは」「こんばんは」「再開」「restart」または /resume-session を呼んだ時にトリガーする。new-session の対（読込側）。

Generate an event ticket image with QR code, event name, date, venue, and seat information.

GitHub 이슈를 완전 스냅샷으로 다시 읽어 `.issue/graph.json` 캐시를 생성·갱신합니다. "$issue-sync", "이슈 그래프 갱신", "그래프 만들기", issue-onboard가 그래프 없이 시작될 때 사용합니다.

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

Creates a presenter-mode deck with speaker notes, theme switching, and a popup teleprompter.

Close a work session without losing what just happened. Write a handoff brief that captures progress, the decisions you made, the unfinished items and their next steps, and the details that would evaporate overnight, then it asks whether to commit or save it, never automatically. Trigger on "wrap up this session", "write a handoff", "close out for the day", "hand this off", "what did we get done", or the end of any working session you might have to resume later.

Webinar Content & Events