Results for “exfiltration-detection”

Analyze Zeek conn.log and NetFlow data to detect ransomware network indicators including C2 beaconing, TOR exit node connections, data exfiltration, and suspicious DNS patterns.

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

Detect data exfiltration through DNS tunneling by analyzing query entropy, subdomain length, query volume, TXT record abuse, and response payload sizes using passive DNS monitoring.

Analyze Zeek dns.log files to detect DNS-based data exfiltration by computing Shannon entropy, flagging long subdomain labels, and identifying anomalous query patterns.

Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, long query lengths, and unusual DNS record types indicating covert channel communication.

Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.

Analyzes codebases to understand existing features, tracing entry points, execution paths, architecture layers, patterns, and dependencies before new development.

Use when filtering Entrez search results by date, organism, publication type, sequence features, or other database-specific criteria in bioinformatics pipelines.

Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.

Detect container escape attempts using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.

Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.

Hunt for Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons where Kerberos is expected, and correlating with credential dumping indicators.

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.

Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality using scapy for packet capture analysis.

Automates reverse engineering of PE and ELF binaries by driving IDA with the WPeGPT plugin, producing structured reports on program purpose, network IoCs, suspicious functions, and vulnerability assessment.

Bug Fleet

Skill for the Observability area of paddock. 105 symbols across 26 files.

Discover and exploit XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.

Use when inferring maximum-likelihood phylogenetic trees, selecting substitution models, running bootstrap support analyses, or performing partitioned phylogenetic analyses on sequence alignments.

Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.

POLAR v2.0 — ETH Alpha Hunter. The patience benchmark. Thesis exit permanently removed. Scanner enters, DSL exits. +19.8% ROE trades after removing thesis exit.

Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities.