Results for “command-interception”

Detect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines.

Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.

Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.

Detect DCSync attacks by monitoring Active Directory replication requests from non-domain-controller accounts via Event ID 4662 and associated GUIDs.

Bash/Linux terminal patterns. Critical commands, piping, error handling, scripting. Use when working on macOS or Linux systems.

Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom Python monitoring scripts to protect against man-in-the-middle interception.

Conduct authorized red team initial access using EvilGinx3 adversary-in-the-middle phishing to capture session tokens and bypass multi-factor authentication.

Imported skill history from langchain

Detect container escape attempts using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.

Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities.

Execute remote commands on Windows targets using WMI-based lateral movement techniques, including Impacket wmiexec.py, CrackMapExec, and native PowerShell WMI commands for red team engagements.

Runbook skill for failures: cron error, PA failure, cascade, gateway disconnect, semantic DB stale. Walks: detect → classify → diagnose → notify → log. Replaces ad-hoc failure handling. Triggers: "cron failed", "X is broken", "cascade", "incident", "gateway down", "PA failure".

Imported skill file_ops from langchain

Read the `<!-- pk-commands BEGIN -->` ... `<!-- pk-commands END -->` block

建议在逻辑间隔处手动压缩上下文，以在任务阶段中保留上下文，而非任意的自动压缩。

Runs an interactive command in a separate window and waits for it to close. Invoked only when another skill explicitly calls for it, never on its own.

Bash/Linux terminal patterns. Critical commands, piping, error handling, scripting. Use when working on macOS or Linux systems.

Bash/Linux terminal patterns. Critical commands, piping, error handling, scripting. Use when working on macOS or Linux systems.

Bash/Linux terminal patterns. Critical commands, piping, error handling, scripting. Use when working on macOS or Linux systems.