Skill UI

Details the deployment, hardening, and operation of a resilient Command and Control (C2) infrastructure using the open-source Sliver framework. This guide covers advanced techniques including multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), deployable redirectors, and domain fronting, making it essential for authorized red-teaming and sophisticated adversary simulation.

This comprehensive guide details the deployment and hardening of the Havoc C2 framework, a modern post-exploitation Command and Control system. Learn how to establish a production-grade infrastructure, including configuring Teamservers, setting up various listeners (HTTP/HTTPS/SMB), and integrating Nginx redirectors. It provides OPSEC-hardened techniques for authorized red team adversary emulation engagements.

This skill provides methods and tools for detecting sophisticated cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS). It focuses on detecting anomalies like unauthorized command injection, Man-in-the-Middle attacks on industrial protocols (Modbus, DNP3), and data manipulation, which traditional IT security tools often miss. Usage involves establishing deterministic communication baselines and monitoring network traffic for deviations.

This script performs statistical analysis on Zeek connection logs (conn.log) to detect Command and Control (C2) beaconing patterns. It leverages the ZAT library to load data into Pandas DataFrames, calculates inter-arrival time statistics, and flags connections with low standard deviation relative to the mean. This technique is crucial for network threat hunting and security incident investigation when identifying malicious, periodic callbacks.

This tool detects critical anomalies in DNP3 communications used within SCADA and ICS environments. It employs deep packet inspection and machine learning to monitor for unauthorized control commands, protocol violations, firmware update attempts, and deviations from established network baselines. It is essential for securing critical infrastructure, such as energy grids and industrial control networks, and building robust anomaly-based Intrusion Detection Systems (IDS).

This tool automates the extraction of embedded configuration details from Agent Tesla Remote Access Trojan (RAT) samples. It is designed to recover crucial exfiltration credentials (SMTP, FTP, Telegram), keylogger settings, and Command and Control (C2) endpoints by analyzing and deobfuscating the .NET assembly structure. Essential for threat intelligence, incident response, and malware reverse engineering.

This skill provides a systematic methodology for detecting Command and Control (C2) beaconing patterns in network traffic. It utilizes advanced statistical techniques, including Coefficient of Variation (CV) and jitter analysis, applied to network flow logs (Zeek, proxy, firewall). It is crucial for proactive threat hunting and incident response to identify compromised endpoints communicating periodically with malicious infrastructure.

This skill provides comprehensive methods to detect Cobalt Strike beacon command-and-control (C2) traffic. It uses advanced network forensics techniques, including analyzing default TLS certificates (e.g., serial 8BB00EE), JA3/JA3S fingerprints, HTTP malleable profiles, and beacon interval jitter, leveraging Zeek logs, Suricata rules, and Python PCAP analysis. It is essential for threat hunters and SOC analysts investigating sophisticated C2 communications.

This capability provides advanced threat hunting by analyzing network telemetry (DNS, proxy, connection logs) to detect Command and Control (C2) beaconing patterns. It uses statistical analysis, frequency detection, and jitter analysis to identify compromised endpoints communicating with adversary infrastructure, crucial for proactive threat detection and incident response.

A comprehensive guide to identifying covert data exfiltration channels using Zeek logs. This technique analyzes DNS traffic for high-entropy subdomains, unusually long query lengths, abnormal record types (TXT/NULL), and excessive query volume, which are key indicators of malicious DNS tunneling or command-and-control (C2) activity.

This skill detects command-and-control (C2) traffic hidden using domain fronting techniques. It analyzes proxy and web gateway logs by comparing discrepancies between the TLS SNI field and the HTTP Host header. By inspecting these mismatches and correlating them with known CDN provider properties, it helps security analysts hunt for sophisticated network evasion tactics.

A specialized technique for proactive threat hunting, designed to detect adversary activity that abuses legitimate cloud services (like Azure, AWS, GCP, and SaaS platforms). It focuses on identifying 'living off the cloud' tradecraft, such as using cloud APIs for command-and-control (C2), staging data, or exfiltrating information while blending into normal network traffic.