skills.rest
riparino
riparinoCOMMUNITY
Explore all skills by this author →
GitHub

defensive-crash-analysis

Analyze Windows crash telemetry to determine exploitability and identify exploitation patterns.

1|Updated Apr 27, 2026
Search Tags:#windows#soc#crash-analysis#exploitability#kql#windbg#wer
One-click install
npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-crash-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: defensive-crash-analysis
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-crash-analysis
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-crash-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Crash events often indicate exploitable vulnerabilities or unstable software; this skill provides structured guidance to triage Windows crash telemetry, identify exploit attempts, and correlate crashes with post-crash activity.

Core Features & Use Cases

  • Crash triage and exploitability assessment across WER events
  • Exception code reference and patch guidance
  • KQL-based crash-to-shell correlation for SOC workflows

Quick Start

Load the defensive-crash-analysis skill into your SOC environment and run the crash triage workflow against a recent crash event to identify exploitation indicators.

Frequently Asked Questions about defensive-crash-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage Windows crash events to determine if they are exploitable?▼

Use KQL queries to correlate Windows crash events with post-crash process activity. This skill provides KQL-based crash-to-shell correlation to identify suspected exploitation patterns and malicious post-crash behavior within your SOC environment.

What is the best way to analyze WER events for exploit attempts during incident response?▼

WinDbg is used for detailed memory dump analysis to confirm crash exploitability. This skill provides WinDbg guidance alongside WER event triage and KQL queries to correlate crashes with post-crash process events.

Can I use this crash analysis approach without prior memory dump experience?▼

No specific dependencies are required. Load the defensive-crash-analysis skill into your SOC environment and run the crash triage workflow against recent crash events to identify exploitation indicators.

Why does correlating post-crash process events matter for SOC workflows?▼

This skill focuses on Windows crash telemetry, WER events, and WinDbg guidance. If a crash event does not generate standard Windows exception codes or memory dumps, the triage workflow may not yield exploitability insights.

Related Skills

Explore More Data & Analytics Skills→
Thiago-Cruz-engThiago-Cruz-eng

dotnet-debugging

Triage Windows crash dumps and live process issues with WinDbg.

Community
Advanced
paleoterrapaleoterra
2

crash-log-analyzer

Parse macOS crash logs to identify crash causes and debugging information.

Community
Intermediate
riparinoriparino
1

defensive-exploit-detection

Correlate Windows application crashes with shell launches to detect exploit attempts.

Community
Advanced
SnailSploitSnailSploit
2.9k

crash-analysis

Analyze crash dumps with debuggers and sanitizers to assess exploitability.

Community
Advanced