Skill UI

This skill provides structured methods for detecting credential stuffing attacks by analyzing authentication logs. It focuses on identifying complex patterns such as login velocity anomalies, high IP diversity, password spray techniques, and suspicious geographical distributions of failed logins. It is essential for SOC analysts conducting threat hunting or building robust detection rules against account takeover attempts.

A comprehensive tool for security analysts to hunt for malicious PowerShell activity. It analyzes Windows Event Log (EVTX) files by parsing Script Block Logging (Event 4104), Module Logging (4103), and process creation events. Detects obfuscated commands, AMSI bypass attempts, encoded payloads, and credential dumping techniques crucial for incident response and threat hunting.

This skill provides a systematic methodology for detecting Command and Control (C2) beaconing patterns in network traffic. It utilizes advanced statistical techniques, including Coefficient of Variation (CV) and jitter analysis, applied to network flow logs (Zeek, proxy, firewall). It is crucial for proactive threat hunting and incident response to identify compromised endpoints communicating periodically with malicious infrastructure.

This skill provides comprehensive methods to detect Cobalt Strike beacon command-and-control (C2) traffic. It uses advanced network forensics techniques, including analyzing default TLS certificates (e.g., serial 8BB00EE), JA3/JA3S fingerprints, HTTP malleable profiles, and beacon interval jitter, leveraging Zeek logs, Suricata rules, and Python PCAP analysis. It is essential for threat hunters and SOC analysts investigating sophisticated C2 communications.

A comprehensive guide for security professionals to detect data exfiltration by analyzing network telemetry (Zeek, Suricata) and logs. Techniques include identifying DNS tunneling, unusual cloud uploads, and detecting large/abusive data flows across various channels during incident response and proactive threat hunting.

This guide details how to hunt for DCSync attacks (MITRE ATT&CK T1003.006) in Active Directory environments. It focuses on analyzing Windows Security Event ID 4662, specifically looking for DS-Replication-Get-Changes requests originating from non-domain-controller accounts. This technique is critical for incident response, purple teaming, and detecting unauthorized credential theft via Active Directory replication abuse.

A comprehensive guide to identifying covert data exfiltration channels using Zeek logs. This technique analyzes DNS traffic for high-entropy subdomains, unusually long query lengths, abnormal record types (TXT/NULL), and excessive query volume, which are key indicators of malicious DNS tunneling or command-and-control (C2) activity.

This skill detects command-and-control (C2) traffic hidden using domain fronting techniques. It analyzes proxy and web gateway logs by comparing discrepancies between the TLS SNI field and the HTTP Host header. By inspecting these mismatches and correlating them with known CDN provider properties, it helps security analysts hunt for sophisticated network evasion tactics.

A specialized technique for proactive threat hunting, designed to detect adversary activity that abuses legitimate cloud services (like Azure, AWS, GCP, and SaaS platforms). It focuses on identifying 'living off the cloud' tradecraft, such as using cloud APIs for command-and-control (C2), staging data, or exfiltrating information while blending into normal network traffic.

This guide provides a systematic methodology for proactive threat hunting targeting Living-off-the-Land Binaries (LOLBins). Attackers misuse legitimate, signed system binaries (like certutil or rundll32) to execute malicious payloads or download files, effectively bypassing traditional security controls and application allowlisting. Use this framework when establishing EDR/SIEM detection rules or when investigating advanced, fileless defense-evasion techniques.

This advanced skill guides users on hunting for Living Off the Land Binaries (LOLBins) abuse by analyzing endpoint process creation logs. It focuses on detecting malicious use of legitimate Windows binaries (like certutil or mshta) for defense evasion or data exfiltration, mapping techniques to MITRE T1218. Ideal for threat hunters and security teams building advanced detection rules.

This comprehensive guide outlines a structured methodology for threat hunting and incident response, focusing on identifying adversary persistence mechanisms across Windows endpoints. It covers critical areas such as Registry Run/RunOnce keys, services, scheduled tasks, WMI event subscriptions, and COM hijacking. Use this workflow to proactively detect unauthorized backdoors, strengthen detection rules, and assess overall security posture against MITRE ATT&CK techniques (T1547).