Download

Skill UI

Browse and discover 10397+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search data-exfiltration , found 47 results

Default Newest Most Downloaded

Detecting DNS Exfiltration with Zeek Analysis

detecting-exfiltration-over-dns-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

This skill provides a methodology to detect data exfiltration attempts hidden within DNS queries. By analyzing Zeek dns.log files, the agent computes Shannon entropy of subdomains, flags unusually long labels, and monitors unique subdomain counts per parent domain. This technique is crucial for identifying malicious tunneling tools like dnscat2 or iodine that bypass traditional security controls.

Detecting Insider Data Exfiltration Patterns

detecting-insider-data-exfiltration-via-dlp

mukul975/Anthropic-Cybersecurity-Skills

This skill provides structured procedures and Python examples for detecting internal data exfiltration. It analyzes endpoint, cloud, and email logs by establishing behavioral baselines and performing statistical anomaly detection. Use cases include investigating insider threats, monitoring DLP policy violations, and building robust User and Entity Behavior Analytics (UEBA) rules for SOC teams.

Detecting Insider Threat Behaviors

detecting-insider-threat-behaviors

mukul975/Anthropic-Cybersecurity-Skills

This guide details methodologies for proactively hunting and detecting various insider threat indicators. It focuses on identifying unusual data access patterns, off-hours activity, mass file exfiltration, and unauthorized privilege abuse. By correlating data from EDR and SIEM platforms, security teams can scope compromises, simulate attack chains, and significantly enhance proactive threat detection capabilities.

Detecting Insider Threats Using UEBA

detecting-insider-threat-with-ueba

mukul975/Anthropic-Cybersecurity-Skills

This skill implements User and Entity Behavior Analytics (UEBA) to detect sophisticated insider threats. It builds behavioral baselines from diverse log sources (authentication, file access, network) using Elasticsearch/OpenSearch. It calculates anomaly scores and performs peer group analysis to identify deviations indicative of data exfiltration, privilege abuse, or unauthorized access patterns.

Detecting S3 Data Exfiltration Attempts

detecting-s3-data-exfiltration-attempts

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive guide and workflow for detecting unauthorized data exfiltration from AWS S3 buckets. It details how to leverage multiple AWS services—including CloudTrail, GuardDuty, Amazon Macie, and Athena—to analyze access patterns, identify bulk downloads, and detect cross-account data transfers, ensuring robust cloud compliance and security monitoring.

Detecting Shadow IT Cloud Usage

detecting-shadow-it-cloud-usage

mukul975/Anthropic-Cybersecurity-Skills

This skill analyzes network logs, including proxy access logs, DNS query logs, and netflow data, to detect unauthorized Software as a Service (SaaS) applications and cloud services (Shadow IT). It classifies domains against known catalogs, measures data exfiltration volumes, calculates risk scores, and generates comprehensive reports for security and compliance teams.

Hunting For Data Exfiltration Indicators

hunting-for-data-exfiltration-indicators

mukul975/Anthropic-Cybersecurity-Skills

This skill provides advanced threat hunting techniques to detect unauthorized data exfiltration. It guides the analysis of network traffic, DNS queries, and cloud uploads to identify unusual data flows, DNS tunneling, and abuse of encrypted channels, essential for incident response and preventing data loss.

Detecting Data Staging Before Exfiltration

hunting-for-data-staging-before-exfiltration

mukul975/Anthropic-Cybersecurity-Skills

This skill guides security analysts in detecting data staging activities, a critical precursor to data exfiltration. It monitors for the use of archiving tools (7-Zip, RAR), unusual file consolidation patterns, and suspicious writes to temporary or hidden directories using EDR and process telemetry. Essential for proactive threat hunting and improving detection coverage for T1074 techniques.

Detecting DNS Tunneling and Data Exfiltration

hunting-for-dns-tunneling-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive guide and detection methodology for identifying covert communication channels utilizing DNS records. This technique analyzes Zeek dns.log for indicators such as high-entropy subdomains, excessive query volume, unusually long query lengths, and abnormal record type distributions, which suggest data exfiltration or Command and Control (C2) activity.

Hunting For Living Off The Cloud Techniques

hunting-for-living-off-the-cloud-techniques

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive guide and methodology for proactively hunting adversary abuse of legitimate cloud services (Azure, AWS, GCP, SaaS). This technique focuses on identifying Command and Control (C2), data staging, and exfiltration methods that leverage normal cloud functionality, making detection challenging.

Hunting Unusual Network Connections

hunting-for-unusual-network-connections

mukul975/Anthropic-Cybersecurity-Skills

A proactive methodology for detecting signs of compromise by analyzing outbound network traffic. This technique focuses on identifying anomalous patterns, such as connections to rare destinations, non-standard ports (T1571), or unusual connection frequencies, which often indicate Command and Control (C2) activity or data exfiltration.

Implementing Endpoint Data Loss Prevention

implementing-endpoint-dlp-controls

mukul975/Anthropic-Cybersecurity-Skills

This skill guides the deployment and configuration of Data Loss Prevention (DLP) controls directly on endpoints. It detects and prevents the unauthorized exfiltration of sensitive data (PII, PHI, PCI) via common vectors like email, USB drives, cloud storage uploads, and printing. Use this when establishing compliance policies (HIPAA, GDPR) or securing data against internal data movement risks.

Prev 123 4 Next

Language