Skill UI

Detects unauthorized S3 mass downloads by correlating CloudTrail S3 events, GuardDuty findings, Macie alerts, and VPC logs, enabling security teams to spot cross-account transfers and respond swiftly.

Extract embedded Agent Tesla RAT configuration such as SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 data from .NET assemblies via dnSpy/ILSpy decompilation and memory analysis for malware research or red-team validation.

Guides analysts through identifying and validating data exfiltration indicators via traffic baselines, anomaly detection, and protocol abuse analysis during incident response.

Detect data staging activity before exfiltration by monitoring archive tool execution, staging directories, large file consolidation, sensitive path access, and producing structured hunt reports that map events to MITRE ATT&CK techniques.

Analyze Zeek dns.log for long queries, high-entropy subdomains, unusual record types, and query volumes to detect DNS tunneling and covert data exfiltration before it reaches other channels.

Defines steps to inventory USB usage, configure GPO/Intune/EDR policies, deploy Microsoft Defender rules, and audit events to block unauthorized removable media while allowing approved devices, used for preventing data exfiltration via USB.

Guides SOC analysts through SIEM, DLP, UEBA, and HR data correlation to investigate data exfiltration, unauthorized access, and pre-departure anomalies for insider threats.

Analyzes Content Security Policy implementations and demonstrates bypass techniques such as unsafe directives, JSONP gadgets, nonce leaks, base-uri and form-action tricks to enable XSS execution and sensitive data exfiltration during security assessments.

Use Wireshark, tshark, tcpdump, and Python tooling to inspect PCAP/PCAPNG data, reconstruct communications, surface malicious traffic, and support incident investigations with evidence of exfiltration or C2 activity.

Uses AWS Athena to define forensic tables and run queries against CloudTrail, VPC Flow, S3 access, and ALB logs, helping security teams detect unauthorized access, data exfiltration, lateral movement, and privilege escalation during incident investigations.

This guide provides a comprehensive, advanced methodology for red team operations. It covers critical topics such as Operational Security (OPSEC), designing robust C2 infrastructure using redirectors, employing living-off-the-land techniques, mastering lateral movement, establishing persistence, and planning data exfiltration while evading modern defensive systems. Use this to plan complex red team engagements or deeply understand Advanced Persistent Threat (APT) TTPs.

Offensive cloud security methodology for AWS, Azure, and GCP. Covers identity discovery, credential harvesting, enumeration, privilege escalation, persistence, data exfiltration, lateral movement, serverless abuse, Kubernetes paths, and detection evasion during authorized assessments.