Results for “windows-registry”

Systematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services, startup folders, and WMI subscriptions.

Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.

Install, discover, and wire reusable blocks and components into HyperFrames compositions using the CLI.

Sincroniza el registro central de skills con AGENTS.md y registry/AGENT_REGISTRY.md, detectando skills huérfanas o faltantes y auditando el ecosistema.

Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.

Windows GUI automation toolkit for global hotkeys and window management. Use when users need to register global hotkeys, find/control windows, automate GUI operations, or perform Windows desktop automation. Requires Windows OS with pywin32, pyuserinput, and pyautogui dependencies.

Write, debug, and maintain Windows batch files (.bat/.cmd) for system administration, automation, and CLI tool development.

Searches a local cache of Windows WinMD metadata to find the right Windows API for any capability and retrieve full type details including methods, properties, events, and enumeration values.

Maps legacy UWP APIs to correct Windows App SDK equivalents with before/after code snippets for migrating to WinUI 3.

Bootstrap, develop, and design modern WinUI 3 desktop applications with C# and the Windows App SDK using official Microsoft guidance, WinUI Gallery patterns, Windows App SDK samples, and CommunityToolkit components.

Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.

Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.

Extract DPAPI-protected secrets such as credentials and browser data from Windows systems during authorized penetration tests.

Persistent cross-session memory management. Enables agents to remember user preferences, project conventions, and past decisions across different sessions using a structured MEMORY.md index and topic files.

Save the current diagnosis state to disk for cross-session recall, including conclusions, rejected directions, and next steps.

Parse and analyze Windows forensic artifacts including MFT, registry hives, prefetch files, event logs, LNK files, and jump lists using Eric Zimmerman's EZ Tools suite and KAPE.

Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.

Create, list, remove, and rename Gameplay Tags with runtime registration (GameplayTagService). Use when the user asks to add or register gameplay tags, list/query existing tags, or rename/remove tags (e.g. Ability.Attack.Melee, State.Stunned).

Guides WinUI 3 and Windows App SDK development with setup, scaffolding, design, and troubleshooting workflows.

Execute remote commands on Windows targets using WMI-based lateral movement techniques, including Impacket wmiexec.py, CrackMapExec, and native PowerShell WMI commands for red team engagements.

Restores the most recent diagnosis snapshot saved by dbs-save, allowing users to continue a previous diagnostic session.

Example skill demonstrating the registry structure and format

Full Windows desktop control. Mouse, keyboard, screenshots - interact with any Windows application like a human.

Utilize Windows Management Instrumentation (WMI) to execute malicious payloads, establish lateral movement, and execute commands stealthily across an Active Directory environment without dropping binaries to disk or relying on traditional Service Creation (PsExec) mechanics.

REJESTR KONFIGURACJI (ConfigReg) platformy Soneta (enova365, Triva) od strony kodu C#: drzewo węzłów, providery `IConfigRegProvider` (Root/Module/Table/Row/SubRow/SubTable/Storage/Addins), atrybut `[ConfigReg(Hide/Ignore/Include/ChildrenType)]`, format `*.reg.json`, potok Loader → Differ/Merger → SessionUpdater. Używaj ZAWSZE gdy użytkownik: (1) pyta o rejestr konfiguracji, ConfigReg, `Soneta.Config.Reg`, tabelę `ConfigRegistry` lub menu „Zarządzanie konfiguracją"; (2) chce włączyć/wyłączyć tabelę, kolumnę lub węzeł z rejestru (`Ignore`, `Hide`, `Include`, `ChildrenType`); (3) pisze provider rejestru, obsługę zapisu (`SaveChild`, `delayed`), porównywanie (`ConfigRegDiffer`), scalanie (`ConfigRegMerger`), serializację (`RegConfigJsonConverter`); (4) buduje lub debuguje `*.reg.json` — sigile `$strict`, `$v`, `#klucz`, `@atrybut`, `$blob`, ścieżki `Business/FeatureDefs/Name=CECHA`; (5) przenosi ustawienia między bazami przez rejestr. Import/eksport przez XML (`dbinit.xml`) to INNY mechanizm → /soneta-config.

Redis database management. Key-value operations, caching, pub/sub, and data structure commands.

Identify and analyze malware persistence mechanisms on Windows systems using Sysinternals Autoruns, covering registry keys, scheduled tasks, services, drivers, and startup locations.

Detects and exploits ransomware kill switch mechanisms including mutex-based execution guards, domain-based kill switches, and registry-based termination checks. Implements proactive mutex vaccination and kill switch domain monitoring to prevent ransomware from executing.