Skill UI

A comprehensive guide for security professionals to detect data exfiltration by analyzing network telemetry (Zeek, Suricata) and logs. Techniques include identifying DNS tunneling, unusual cloud uploads, and detecting large/abusive data flows across various channels during incident response and proactive threat hunting.

This skill detects anti-forensic timestomping by analyzing NTFS Master File Table (MFT) entries. It compares timestamps from the $STANDARD_INFORMATION attribute (user-modifiable) against the $FILE_NAME attribute (kernel-protected). Discrepancies, such as SI Created < FN Created, strongly indicate malicious manipulation and defense evasion. This methodology is crucial for advanced threat hunting and digital forensic investigations.

This skill provides a structured methodology for threat hunting DNS-based persistence mechanisms. It detects unauthorized changes such as DNS hijacking, dangling CNAME records enabling subdomain takeover, wildcard DNS abuse, or unauthorized NS delegation modifications. By utilizing passive DNS history (e.g., SecurityTrails API) and auditing cloud DNS logs (Route53, Azure, Cloudflare), users can identify persistent attack vectors that survive traditional remediation efforts.

This skill detects command-and-control (C2) traffic hidden using domain fronting techniques. It analyzes proxy and web gateway logs by comparing discrepancies between the TLS SNI field and the HTTP Host header. By inspecting these mismatches and correlating them with known CDN provider properties, it helps security analysts hunt for sophisticated network evasion tactics.

A specialized technique for proactive threat hunting, designed to detect adversary activity that abuses legitimate cloud services (like Azure, AWS, GCP, and SaaS platforms). It focuses on identifying 'living off the cloud' tradecraft, such as using cloud APIs for command-and-control (C2), staging data, or exfiltrating information while blending into normal network traffic.

This guide provides a systematic methodology for proactive threat hunting targeting Living-off-the-Land Binaries (LOLBins). Attackers misuse legitimate, signed system binaries (like certutil or rundll32) to execute malicious payloads or download files, effectively bypassing traditional security controls and application allowlisting. Use this framework when establishing EDR/SIEM detection rules or when investigating advanced, fileless defense-evasion techniques.

This advanced skill guides users on hunting for Living Off the Land Binaries (LOLBins) abuse by analyzing endpoint process creation logs. It focuses on detecting malicious use of legitimate Windows binaries (like certutil or mshta) for defense evasion or data exfiltration, mapping techniques to MITRE T1218. Ideal for threat hunters and security teams building advanced detection rules.

This comprehensive guide outlines a structured methodology for threat hunting and incident response, focusing on identifying adversary persistence mechanisms across Windows endpoints. It covers critical areas such as Registry Run/RunOnce keys, services, scheduled tasks, WMI event subscriptions, and COM hijacking. Use this workflow to proactively detect unauthorized backdoors, strengthen detection rules, and assess overall security posture against MITRE ATT&CK techniques (T1547).

This method targets fileless and trigger-based persistence mechanisms on Windows hosts by monitoring WMI event subscriptions (MITRE T1546.003). It hunts for suspicious activity involving WMI Event Filters, Consumers, and Bindings, which are critical indicators during advanced threat hunting and incident response when standard persistence locations are clean.

This skill detects sophisticated process injection techniques (MITRE T1055), including CreateRemoteThread and DLL injection. By analyzing Sysmon Event IDs 8 and 10 alongside EDR telemetry, it enables security analysts to hunt for in-memory code injection and defense evasion tactics used by adversaries on Windows endpoints. Essential for incident response and building detection coverage.

A comprehensive guide for hypothesis-driven threat hunting focusing on Windows Scheduled Task persistence (T1053). This methodology guides the creation of advanced SIEM/EDR queries against critical events like task creation (Event ID 4698), suspicious actions, and unusual scheduling patterns. Essential for incident response, proactive threat hunting, and security assessments.

A comprehensive guide for security professionals to proactively hunt for Indicators of Compromise related to Volume Shadow Copy deletion (T1490). This technique is critical for detecting ransomware preparation and anti-forensics activity. It details using SIEM/EDR platforms to query for specific commands (vssadmin, wmic, PowerShell) associated with deleting system recovery points and shadow copies.