Skill UI

This comprehensive guide details how to deploy and configure a resilient Command and Control (C2) infrastructure using the advanced Sliver framework. It covers setting up multi-protocol listeners (HTTPS, mTLS, DNS, WireGuard), implementing complex redirectors, domain fronting, and establishing operational security controls for professional red team engagements and advanced security assessments.

This guide provides a comprehensive walkthrough for deploying and configuring a production-grade Command and Control (C2) infrastructure using the open-source Havoc framework. It covers setting up the Teamserver, configuring secure HTTPS listeners, implementing redirectors (e.g., Nginx), and deploying Demon agents for advanced post-exploitation red team operations. This skill is essential for authorized security assessments and building robust defensive countermeasures.

This skill provides methods and tools for detecting sophisticated cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS). It focuses on detecting anomalies like unauthorized command injection, Man-in-the-Middle attacks on industrial protocols (Modbus, DNP3), and data manipulation, which traditional IT security tools often miss. Usage involves establishing deterministic communication baselines and monitoring network traffic for deviations.

This script performs statistical analysis on Zeek connection logs (conn.log) to detect Command and Control (C2) beaconing patterns. It leverages the ZAT library to load data into Pandas DataFrames, calculates inter-arrival time statistics, and flags connections with low standard deviation relative to the mean. This technique is crucial for network threat hunting and security incident investigation when identifying malicious, periodic callbacks.

A specialized tool for detecting anomalies within DNP3 (Distributed Network Protocol 3) communications used in critical SCADA and energy sector infrastructure. It employs deep packet inspection and baseline comparison to monitor for unauthorized control commands, protocol violations, suspicious firmware update attempts, and deviations from established operational traffic patterns.

A specialized Intrusion Detection System (IDS) designed for Operational Technology (OT) and Industrial Control Systems (ICS). It monitors Modbus TCP/RTU traffic to detect unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines. Essential for securing SCADA environments against attacks like FrostyGoop.

This skill provides a systematic methodology for detecting Command and Control (C2) beaconing patterns in network traffic. It utilizes advanced statistical techniques, including Coefficient of Variation (CV) and jitter analysis, applied to network flow logs (Zeek, proxy, firewall). It is crucial for proactive threat hunting and incident response to identify compromised endpoints communicating periodically with malicious infrastructure.

This skill guides threat hunters in detecting Cobalt Strike Command and Control (C2) beacons. It utilizes advanced network forensic techniques, including analyzing default TLS certificate serials, JA3/JA3S/JARM fingerprints, beacon jitter, and HTTP profile matching. Detection is achieved by correlating data from Zeek logs, Suricata rules, and Python PCAP analysis to identify suspicious outbound communications.

This capability provides advanced threat hunting by analyzing network telemetry (DNS, proxy, connection logs) to detect Command and Control (C2) beaconing patterns. It uses statistical analysis, frequency detection, and jitter analysis to identify compromised endpoints communicating with adversary infrastructure, crucial for proactive threat detection and incident response.

A comprehensive guide and detection methodology for identifying covert communication channels utilizing DNS records. This technique analyzes Zeek dns.log for indicators such as high-entropy subdomains, excessive query volume, unusually long query lengths, and abnormal record type distributions, which suggest data exfiltration or Command and Control (C2) activity.

This skill detects domain fronting, an advanced technique used by attackers to mask Command and Control (C2) traffic. It analyzes proxy/web gateway logs for mismatches between the TLS SNI field and the HTTP Host header, combined with deep TLS certificate inspection using pyOpenSSL. This is crucial for security teams investigating sophisticated network threats and validating detection coverage.

A comprehensive guide and methodology for proactively hunting adversary abuse of legitimate cloud services (Azure, AWS, GCP, SaaS). This technique focuses on identifying Command and Control (C2), data staging, and exfiltration methods that leverage normal cloud functionality, making detection challenging.