Skill UI

Conduct hypothesis-driven threat hunting for Command-and-Control (C2) activity (T1071). This skill guides the analysis of SIEM/EDR network telemetry to detect anomalous outbound traffic, rare destination IPs, non-standard ports, and unusual connection frequencies, helping identify beaconing or data exfiltration attempts. Essential for proactive defense and incident response.

This skill guides the deployment and configuration of Data Loss Prevention (DLP) controls directly on endpoints. It detects and prevents the unauthorized exfiltration of sensitive data (PII, PHI, PCI) via common vectors like email, USB drives, cloud storage uploads, and printing. Use this when establishing compliance policies (HIPAA, GDPR) or securing data against internal data movement risks.

This skill establishes normal network communication patterns by analyzing historical NetFlow/IPFIX data. Utilizing Python pandas, it computes hourly/daily volume distributions, per-host statistics, and top-talker profiles. Anomalies are detected using sophisticated statistical methods like z-score and IQR, allowing SOC analysts to quickly identify deviations such as data exfiltration spikes, persistent beaconing, or unusual port usage.

This skill provides a comprehensive guide to implementing robust USB device control policies. It restricts unauthorized removable media access to mitigate data exfiltration risks and prevent malware introduction via USB endpoints. Learn how to deploy granular policies using Group Policy Objects (GPO), Microsoft Intune, or advanced Endpoint Detection and Response (EDR) platforms to meet strict compliance standards.

A comprehensive guide to securing Software as a Service (SaaS) applications (e.g., Microsoft 365, Salesforce) using Zero Trust principles. This skill covers deploying CASB/SSPM solutions, enforcing conditional access policies (MFA, device compliance), governing OAuth permissions, and applying session-level DLP controls to prevent data exfiltration in multi-cloud environments. Ideal for security architects and engineers.

This skill provides SOC teams with a structured, multi-source workflow to investigate potential insider threats. It correlates data from SIEM, DLP, EDR, and HR feeds to detect data exfiltration attempts (via cloud, USB, email), unauthorized access patterns, and policy violations. It is crucial for building comprehensive investigation timelines, especially when handling departing employees or suspected data theft.

This skill detects covert data exfiltration occurring over DNS tunnels. It analyzes DNS query names by computing Shannon entropy, examining query length distributions, and identifying high subdomain cardinality. It is essential for security operations, incident response, and proactive threat hunting when suspicious or encoded DNS activity is suspected.

This comprehensive guide details a professional workflow for performing network forensics using Wireshark and tshark. Learn how to analyze captured PCAP files to identify malicious communications, reconstruct data exfiltration, extract crucial artifacts (HTTP, SMB, DICOM), and detect indicators of compromise (IOCs). Essential for incident response and malware analysis.

A comprehensive guide and toolkit for performing digital forensic analysis on network packet captures (PCAP/PCAPNG). It details techniques using Wireshark, tshark, and tcpdump to reconstruct communications, extract sensitive data, identify malicious C2 traffic, and establish irrefutable evidence of security breaches or data exfiltration.

A comprehensive guide for reverse engineering Android malware. It details how to use JADX and accompanying tools (apktool, androguard) to analyze APK metadata, extract permissions, decompile Java/Kotlin source code, and identify malicious functionalities like data exfiltration, C2 communication, and overlay attacks. Ideal for mobile threat analysis and security research.

This skill provides a comprehensive guide and methodology for identifying and exploiting Cross-Origin Resource Sharing (CORS) misconfigurations in web applications. It covers testing origin validation bypasses, analyzing preflight requests, and simulating data exfiltration during authorized penetration tests, crucial for assessing API security.

This guide details methodologies for identifying and exploiting XML External Entity (XXE) injection vulnerabilities in web applications. It covers basic file retrieval, blind XXE detection using out-of-band techniques, and data exfiltration, all critical steps during authorized penetration testing of XML-consuming APIs and services.