Results for “honeypot-detection”

Detects the test platform (VSTest vs Microsoft.Testing.Platform) and test framework (MSTest, xUnit, NUnit, TUnit) from .NET project files.

Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates.

Deploy honeytokens and canarytokens as decoy artifacts to detect intrusions with near-zero false positives.

Detect pnpm workspace structure, optional Turborepo overlay, package metadata, and internal dependency graph for monorepo-aware skills

Detect AI-generated audio, images, video, and text, trace synthesis sources, apply watermarks, verify speaker identity, and analyze media intelligence using the Resemble AI platform.

Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.

Use when sampling synthetic sequences, alignments, or consensus sequences from one or more profile HMMs.

Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.

Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality using scapy for packet capture analysis.

Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time using file integrity monitoring or OS-level watchdogs.

Analyze .NET malware by decompiling and debugging assemblies with dnSpy, deobfuscating with de4dot, and extracting C2 configurations and IOCs.

Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom Python monitoring scripts to protect against man-in-the-middle interception.

Buy USDC lottery tickets, check jackpots, claim winnings, and manage LP positions on the Base blockchain via the Megapot protocol.

LEMON v2.0 — The Degen Fader. Identifies historically reckless traders (DEGEN activity + CHOPPY consistency) on Hyperliquid, monitors their live positions, and counter-trades them when they're bleeding at high leverage. If a cluster of degens goes max-leverage long on a coin and starts losing, LEMON shorts it — betting on their inevitable liquidation cascade. DSL exit managed by plugin runtime via runtime.yaml.

Debug Node.js with node inspect, --inspect, breakpoints, CDP, heap, and CPU profiles.

Hunt for Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons where Kerberos is expected, and correlating with credential dumping indicators.

Detect DCOM-based lateral movement by correlating Sysmon process creation and network connection events, WMI event analysis, and RPC endpoint mapper traffic to identify abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects.

Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral heuristics.

Use when building cursor-following spotlight reveals that expose a second aligned image through a soft radial mask—hover-to-color, before-and-after, x-ray, material, texture, product-detail, or illustrated heroes where a desaturated or embossed base stays visible while another treatment follows an eased pointer.

Performs advanced network reconnaissance using Nmap's scripting engine, timing controls, evasion techniques, and output parsing to discover hosts, enumerate services, detect vulnerabilities, and fingerprint operating systems across authorized target networks.

Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.

HNSW vector search for pattern similarity retrieval and knowledge graph maintenance with PageRank scoring, community detection, and 3-tier memory management.

HYDRA v2.0 — Squeeze Detector. Finds crowded trades about to unwind. Funding extreme + SM positioned against the crowd + price starting to move. Goes opposite to the funding crowd. Only liquid assets ($20M+ volume). DSL exit managed by plugin runtime via runtime.yaml.

Detect monorepo structure, identify shared chokepoints, and generate safe parallel lane specs aligned to package boundaries

Hunt for web shell deployments on internet-facing servers by analyzing file creation in web directories, suspicious process spawning from web servers, and anomalous HTTP patterns.

Walks a running app across routes, states, and interactions to find real bugs, then root-causes, fixes, adds regression tests, and verifies each fix before committing.