Results for “sysinternals”

Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.

Investigates insider threat indicators including data exfiltration attempts, unauthorized access patterns, policy violations, and pre-departure behaviors using SIEM analytics, DLP alerts, and HR data correlation.

Profile a target (script, process, GPU, memory, interconnect) using external tools and code instrumentation. Produces structured performance reports with actionable recommendations. Use when user says "profile", "benchmark", "bottleneck", or wants performance analysis.

Add the /bl switch to MSBuild-based commands to generate binary logs for build diagnostics and performance analysis.

Drafts Terms of Service and Privacy Policy documents by auditing a codebase and marketing site to infer company details, then asking only for missing information.

Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics for fingerprints of offensive Entra ID tools such as ROADtools, AADInternals, and AzureHound.

Detect anomalous user activities including impossible travel, unusual access patterns, privilege abuse, and insider threats using SIEM-based behavioral baselines and statistical analysis.

Run Microsoft Entra ID tenant reconnaissance, token acquisition and manipulation, and federation backdoor testing with the AADInternals PowerShell toolkit to validate identity-attack resilience.

Use when working in Go and you need DataList/DataTable-style data wrangling, quick previews, parallel transforms, file I/O (CSV/Excel/Parquet), Excel-like column formulas (CCL), or charts; also use when data analysis is requested without a specified stack, defaulting to Go + Insyra over Python + pandas.

Scans installed or specified agent skills for advertising, covert commercial intent, task hijacking, suspicious external calls, and sensitive-data access. Reports findings first and quarantines only after explicit user confirmation.

Configure rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation. Generates server and client configuration files with GnuTLS stream drivers, x509 certificate authentication, per-host log segregation, and reliable queue settings for high-availability syslog infrastructure.

SENTINEL v2.0 — Quality Trader Convergence Scanner. Inverted pipeline: find ELITE/RELIABLE traders, see where they converge. When 5+ quality traders hold the same asset in the same direction, enter.

name: ing description: Ing namespace for Netsnek e.U. engineering workflow automation. Streamlines build pipelines, deployment orchestration, and infrastructure provisioning for development teams. ...

Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case.

Python SDK for inference.sh - run AI apps, build agents, and integrate with 150+ models. Package: inferencesh (pip install inferencesh). Supports sync/async, streaming, file uploads. Build agents with template or ad-hoc patterns, tool builder API, skills, and human approval. Use for: Python integration, AI apps, agent development, RAG pipelines, automation. Triggers: python sdk, inferencesh, pip install, python api, python client, async inference, python agent, tool builder python, programmatic ai, python integration, sdk python

Enumerate SMB, WinRM, LDAP, and MSSQL services, validate credentials, spray passwords, and execute commands on remote hosts using NetExec during authorized penetration tests.

Rumor Scanner — find early signals including M&A rumors, insider activity, analyst upgrades/downgrades, social whispers, and SEC/regulatory activity via AIsa API. Ranked by impact score. Use when the user asks about rumors, insider trading, M&A activity, analyst changes, or early market signals.

Systematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services, startup folders, and WMI subscriptions.

Plan, execute, document, and retest authorized security assessments of AI agents and multi-agent workflows using safe adversarial cases, synthetic identities, canaries, and evidence-based findings. Use when defining red-team rules of engagement, assessing prompt injection or excessive agency, testing tool and identity boundaries, evaluating memory or cross-agent attacks, scoring a campaign, or verifying remediation in an approved environment.

Conduct internal audits against ISO/IEC 42001:2023 by identifying AIMS gaps, building an AI risk register with Annex A control mappings, and generating a 12-month Clause 9.2 audit plan.

Use when a product needs third-party integrations such as payments, email, analytics, AI providers, storage, or internal services. Trigger on requests to plan integration boundaries, provider selection, failure handling, or sync strategies.

Use Geniml for audited local genomic-interval workflows: validate BED and universe contracts, plan Region2Vec or scEmbed runs, inspect model/tokenizer compatibility, and assess consensus universes.

Maps an organization's external attack surface using public sources like DNS records, certificate transparency logs, search engines, social media, and data breach databases, without directly interacting with target systems.

Diagnose your own behavior by reading the structured logs you leave behind — turns.jsonl, events.jsonl, chat_history.jsonl, scheduler.yaml. Use when something has gone wrong (a message didn't land, a scheduled job isn't firing, a communication pattern feels off), when you need to understand a pattern over many turns, or when cost / token usage needs auditing. Covers jq query recipes and points at the debugging-jobs / debugging-communication / debugging-drift companion guides for specific failure modes.

Detect malicious scheduled task creation and modification using Sysmon Event IDs 1, 11, and Windows Security Event 4698/4702, correlating task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement.

Mechanics for building and managing pollers — subprocess scripts that check external services on a schedule and emit events when something has changed. Use when authoring a new poller (a `pollers.json` manifest plus a script in any language), debugging why a poller isn't firing, or extending an existing one. Pollers run on cron, emit JSONL events when there's something to report, and stay silent otherwise (silence-as-filter). The framework discovers `<home>/skills/<name>/pollers.json` files at startup and via `reload_pollers`; each emitted event becomes a fresh turn on a `poller:<name>` synthetic channel. Companion to the `world-scanning` skill, which catalogs *what's worth polling*. Distinct from `async-tasks` (one-shot wake-up via bash_async, not recurring) and from in-process scheduler callables (saga-consolidate, oauth-usage-poll — those mutate mimir-internal state and aren't subprocess-isolated).

Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs using pandas for behavioral analytics and statistical baselines.

Patterns, conventions, and guardrails for the closed-loop systems in AegisNex. Covers the AI intelligence graph, Guardian auto-restart, multi-agent orchestration, incident lifecycle, self-improvement memory, and risk/policy gates.

Optional low-priority poller that inventories Worklink tool pins from <home>/worklink.yaml and files/reuses Chainlink bump issues when upstream versions drift. Opt-in: copy this directory into <home>/skills/worklink-tool-pins/ and configure tool_pins in worklink.yaml.

Patterns and pitfalls for modularizing large Shiny apps with plotly, sf, and cross-module reactives

Develop firmware for microcontrollers, implement RTOS applications, and optimize power consumption for resource-constrained devices.

Integrates SAST, DAST, and SCA security scanning into CI/CD pipelines using open-source tools like Semgrep, Trivy, OWASP ZAP, and Gitleaks.

Perform high-performance genomic interval operations and bioinformatics file I/O on Polars DataFrames, including overlap, nearest, merge, coverage, complement, subtract, and reading/writing BED, VCF, BAM, GFF, FASTA, and FASTQ formats with streaming and cloud-native support.

Use when data operation or statistical analysis tasks do not need full program implementation, and the agent should operate Insyra through CLI/REPL, .isr scripts, or DSL workflows, including environment workflows, reproducible command pipelines, and command selection guidance.