Skill UI

This skill provides structured procedures and Python examples for detecting internal data exfiltration. It analyzes endpoint, cloud, and email logs by establishing behavioral baselines and performing statistical anomaly detection. Use cases include investigating insider threats, monitoring DLP policy violations, and building robust User and Entity Behavior Analytics (UEBA) rules for SOC teams.

This skill implements User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch. It goes beyond static rules to build behavioral baselines (e.g., login times, data volume) for users and entities. By calculating anomaly scores and performing peer group analysis, it detects suspicious activities such as data exfiltration, privilege abuse, and unauthorized access, allowing organizations to proactively identify high-risk insider threats.

A comprehensive guide and workflow for detecting unauthorized data exfiltration from AWS S3 buckets. It details how to leverage multiple AWS services—including CloudTrail, GuardDuty, Amazon Macie, and Athena—to analyze access patterns, identify bulk downloads, and detect cross-account data transfers, ensuring robust cloud compliance and security monitoring.

A comprehensive guide for security professionals to detect data exfiltration by analyzing network telemetry (Zeek, Suricata) and logs. Techniques include identifying DNS tunneling, unusual cloud uploads, and detecting large/abusive data flows across various channels during incident response and proactive threat hunting.

Detects data-staging activity (MITRE ATT&CK T1074) by analyzing EDR/Sysmon process-creation and file-system telemetry. This skill monitors for archive creation (7-Zip, RAR, tar), unusual file consolidation from multiple directories, and suspicious activity in temporary or hidden paths. It is essential for threat hunting, building robust detection rules, and validating security monitoring coverage against data exfiltration attempts.

A comprehensive guide to identifying covert data exfiltration channels using Zeek logs. This technique analyzes DNS traffic for high-entropy subdomains, unusually long query lengths, abnormal record types (TXT/NULL), and excessive query volume, which are key indicators of malicious DNS tunneling or command-and-control (C2) activity.

This advanced skill guides users on hunting for Living Off the Land Binaries (LOLBins) abuse by analyzing endpoint process creation logs. It focuses on detecting malicious use of legitimate Windows binaries (like certutil or mshta) for defense evasion or data exfiltration, mapping techniques to MITRE T1218. Ideal for threat hunters and security teams building advanced detection rules.

Conduct hypothesis-driven threat hunting for Command-and-Control (C2) activity (T1071). This skill guides the analysis of SIEM/EDR network telemetry to detect anomalous outbound traffic, rare destination IPs, non-standard ports, and unusual connection frequencies, helping identify beaconing or data exfiltration attempts. Essential for proactive defense and incident response.

This skill guides the deployment and configuration of Data Loss Prevention (DLP) controls directly on endpoints. It detects and prevents the unauthorized exfiltration of sensitive data (PII, PHI, PCI) via common vectors like email, USB drives, cloud storage uploads, and printing. Use this when establishing compliance policies (HIPAA, GDPR) or securing data against internal data movement risks.

This skill establishes normal network communication patterns by analyzing historical NetFlow/IPFIX data. Utilizing Python pandas, it computes hourly/daily volume distributions, per-host statistics, and top-talker profiles. Anomalies are detected using sophisticated statistical methods like z-score and IQR, allowing SOC analysts to quickly identify deviations such as data exfiltration spikes, persistent beaconing, or unusual port usage.

This skill provides a comprehensive guide to implementing robust USB device control policies. It restricts unauthorized removable media access to mitigate data exfiltration risks and prevent malware introduction via USB endpoints. Learn how to deploy granular policies using Group Policy Objects (GPO), Microsoft Intune, or advanced Endpoint Detection and Response (EDR) platforms to meet strict compliance standards.

A comprehensive guide to securing Software as a Service (SaaS) applications (e.g., Microsoft 365, Salesforce) using Zero Trust principles. This skill covers deploying CASB/SSPM solutions, enforcing conditional access policies (MFA, device compliance), governing OAuth permissions, and applying session-level DLP controls to prevent data exfiltration in multi-cloud environments. Ideal for security architects and engineers.