windows▌

Critical patterns and pitfalls for Windows PowerShell.

Provides expertise in building modern Windows desktop applications using WinUI 3, WPF, and Windows App SDK. Specializes in XAML-based UI development, MVVM architecture, native Windows integration, and modern packaging with MSIX.

Essential syntax rules and pitfalls for Windows PowerShell scripting. \n \n Parentheses required around all cmdlet calls when using logical operators ( -or , -and ); missing them causes parsing errors \n Unicode and emoji characters prohibited in scripts; use ASCII-only alternatives like [OK] , [!] , [WARN] for status indicators \n Null checks mandatory before property access; always validate objects exist before calling methods or accessing properties \n JSON operations require explicit -Depth

Keep this workflow focused on existing debug windows and menu entries. Do not add a new utility/debug control window unless the user asks explicitly.

Secure Windows desktop automation with strict process validation, permission tiers, and audit logging. \n \n Provides UI Automation Framework (UIA) and Win32 API integration for discovering and interacting with Windows application elements, including window management, input simulation, and process interaction \n Enforces security-first approach with process validation, blocked application lists (password managers, admin tools, security software), and permission tier model (read-only, standard,

Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.

Configures Windows Group Policy Objects (GPO) to prevent ransomware execution and limit its spread. Implements AppLocker rules, Software Restriction Policies, Controlled Folder Access, attack surface reduction rules, and network protection settings. Activates for requests involving Windows GPO hardening against ransomware, AppLocker configuration, Controlled Folder Access setup, or endpoint protection via Group Policy.

Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.

Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.

Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts.