Results for “event-id-4662”

Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts.

Lark/Feishu real-time event listening / subscribing / consuming: stream events as NDJSON via `lark-cli event consume <EventKey>` (covers IM messages/reactions/chat changes, Approval status changes, Task updates, VC meeting started/joined/ended, Minutes generated, Whiteboard updated, etc.). Use for Lark bots, real-time message processing, long-running subscribers, streaming webhook/push handlers. Supports `--max-events` / `--timeout` bounded runs and a stderr ready-marker contract — designed for AI agents running as subprocesses.

Renews or reactivates Google Workspace Events subscriptions, either individually by name or all subscriptions expiring within a specified time window.

Subscribes to Google Workspace events and streams them as NDJSON, with options for Pub/Sub setup, polling, and cleanup.

Upload offline conversions, enhanced conversions for leads, click conversions, and Google Analytics events using the Data Manager API /v1/events/ingest endpoint.

Detect Kerberos Pass-the-Ticket attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM.

Manage Google Workspace event subscriptions: create, list, update, delete, reactivate, and stream events via the gws CLI.

Manage Google Calendar resources and events via the gws CLI, including ACLs, calendars, events, free/busy queries, and settings.

Detect malicious scheduled task creation and modification using Sysmon Event IDs 1, 11, and Windows Security Event 4698/4702, correlating task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement.

Load this skill when the user says "implement issue", "implement-issue", or "/implement-issue". Implements a GitHub story issue end-to-end: prepares base branch, creates feature branch, implements the requirements, verifies via the verify-implementation skill, and opens a PR.

Advanced Tauri event patterns for bidirectional communication, streaming data, window-to-window messaging, and custom event handling

Creates a new Google Calendar event with optional location, description, attendees, and Google Meet link.

Publish and subscribe to real-time event channels for agent-to-agent communication via a simple CLI, with channel locking and schema validation.

Server-Sent Events for real-time server-to-client streaming. Express, Fastify, FastAPI, Spring WebFlux SSE implementations. Event streams, reconnection, and EventSource API. USE WHEN: user mentions "SSE", "Server-Sent Events", "EventSource", "event stream", "text/event-stream", "live feed", "streaming updates" DO NOT USE FOR: bidirectional communication - use `socket-io`; WebRTC - use `webrtc`; LLM streaming - use AI SDK skills

Extract Kerberos tickets from LSASS memory, inject them into an attacker session, and perform lateral movement to access remote systems as the impersonated user.

飞书事件订阅：通过 WebSocket 长连接实时监听飞书事件（消息、通讯录变更、日历变更等），输出 NDJSON 到 stdout，支持 compact Agent 友好格式、正则路由、文件输出。当用户需要实时监听飞书事件、构建事件驱动管道时使用。

Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI event subscription persistence.

Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, and auditing SMB and LDAP signing enforcement.

Session handoff generation and loading. Trigger: session end, context full, /handoff

issue-create, issue-start, issue-end, issue-merge에서 이슈 진행 상태가 성공적으로 전환된 직후 issue-onboard 그래프 캐시를 동기화합니다. `$issue-graph-sync

**Server Logs:**

Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.

Hunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious task properties, and unusual execution patterns.

Build event budgets with categories and contingency. TRIGGERS - Use when user needs help with event-budget related tasks.

セッション再開時に最新5件のhandoffを読み込み文脈を復元するスキル。「おはよう」「こんにちは」「こんばんは」「再開」「restart」または /resume-session を呼んだ時にトリガーする。new-session の対（読込側）。

Show available GSD commands and usage guide

Generate an event ticket image with QR code, event name, date, venue, and seat information.

GitHub 이슈를 완전 스냅샷으로 다시 읽어 `.issue/graph.json` 캐시를 생성·갱신합니다. "$issue-sync", "이슈 그래프 갱신", "그래프 만들기", issue-onboard가 그래프 없이 시작될 때 사용합니다.

Queries Google Calendar free/busy status for multiple users to find a meeting slot and create an event.

Update GSD to latest version with changelog display

Takes a conference or event speakers URL, extracts the people, filters their companies against the user's ICP, and deep-researches only the speakers at ICP-fit companies. Outputs a person-first HTML report with a 'why reach out' rationale per person.

Facilitates discussion-based tabletop exercises for SOC teams to test incident response procedures, communication workflows, and decision-making under pressure without impacting production systems.

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

Creates a presenter-mode deck with speaker notes, theme switching, and a popup teleprompter.

Close a work session without losing what just happened. Write a handoff brief that captures progress, the decisions you made, the unfinished items and their next steps, and the details that would evaporate overnight, then it asks whether to commit or save it, never automatically. Trigger on "wrap up this session", "write a handoff", "close out for the day", "hand this off", "what did we get done", or the end of any working session you might have to resume later.