Skill UI

This guide provides a structured methodology for proactively detecting and hunting various insider threat behaviors. It focuses on identifying indicators such as unusual data access, off-hours activity, mass file downloads, and privilege misuse. It is crucial for threat-hunting during incident response or investigating departed employees for potential data theft.

This guide details how to hunt for adversary lateral movement (MITRE ATT&CK TA0008) using Splunk's advanced SPL querying capabilities. It focuses on analyzing Windows authentication logs (e.g., Type 3/10 logons), correlating event IDs (4624, 4648) with process creation data (Sysmon), and identifying unusual source-destination relationships across the network to scope the breadth of a compromise.

This skill focuses on advanced threat detection techniques used to identify the abuse of legitimate Windows binaries (LOLBins) for malicious purposes. It requires monitoring process creation, command-line arguments, and network activity to pinpoint fileless and living-off-the-land attacks. Ideal for building SIEM/EDR detection rules, threat hunting, and hardening endpoint security policies.

A comprehensive system for detecting anomalies in industrial Modbus/TCP and Modbus RTU traffic. It monitors function codes, validates register ranges, analyzes timing patterns, and uses deep packet inspection combined with Markov chains to identify suspicious activity. Essential for deploying Modbus IDS, baselining polling patterns, and securing Operational Technology (OT) environments against unauthorized commands.

A comprehensive skill for detecting early-stage ransomware indicators before data encryption occurs. It utilizes advanced network detection tools such as Zeek and Suricata, combined with SIEM correlation rules and threat intelligence feeds. This method monitors the entire pre-encryption kill chain, identifying precursor behaviors like initial access broker activity, Cobalt Strike C2 beaconing, credential harvesting (e.g., Mimikatz signatures), and data staging attempts, enabling timely incident response and containment.

A comprehensive guide to detecting sophisticated rootkit activity and persistent threats that evade standard security tools (like Task Manager or EDR). Techniques include cross-view process analysis, identifying System Service Descriptor Table (SSDT) hooks, kernel module analysis, and network connection forensics using tools like Volatility. Use this when standard monitoring fails, and deep system integrity checks are required.

A comprehensive guide and workflow for threat hunting suspicious PowerShell activity (T1059.001). This technique focuses on detecting advanced adversary techniques such as encoded commands, AMSI bypass, and download cradles using telemetry from EDR platforms (CrowdStrike, MDE), SIEMs (Splunk, Elastic), and Sysmon. Essential for proactive threat detection, incident response, and security assessment.

A comprehensive guide and set of detection rules for identifying OS credential dumping techniques (MITRE T1003). It leverages EDR telemetry, Sysmon process access monitoring, and Windows security event correlation to detect attacks targeting LSASS memory, SAM databases, and NTDS.dit files. Essential for proactive threat hunting and incident response.

A comprehensive guide for digital forensics and incident response, detailing methods to extract and analyze critical web activity data. This includes history, cookies, cache, downloads, and bookmarks from major browsers like Chrome, Firefox, and Edge. Techniques involve utilizing SQLite querying and specialized tools on forensic images or live systems to establish a user's digital timeline.

A comprehensive tool for security analysts to hunt for malicious PowerShell activity. It analyzes Windows Event Log (EVTX) files by parsing Script Block Logging (Event 4104), Module Logging (4103), and process creation events. Detects obfuscated commands, AMSI bypass attempts, encoded payloads, and credential dumping techniques crucial for incident response and threat hunting.

Detects data-staging activity (MITRE ATT&CK T1074) by analyzing EDR/Sysmon process-creation and file-system telemetry. This skill monitors for archive creation (7-Zip, RAR, tar), unusual file consolidation from multiple directories, and suspicious activity in temporary or hidden paths. It is essential for threat hunting, building robust detection rules, and validating security monitoring coverage against data exfiltration attempts.

A comprehensive guide to identifying covert data exfiltration channels using Zeek logs. This technique analyzes DNS traffic for high-entropy subdomains, unusually long query lengths, abnormal record types (TXT/NULL), and excessive query volume, which are key indicators of malicious DNS tunneling or command-and-control (C2) activity.