Results for “intent-detection”

Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

Locates files by intent using semantic search, ideal for finding implementations, definitions, or documentation in medium to large repositories.

Collects publicly available information about a target organization to identify attack surfaces, social engineering targets, technology stacks, and credential exposures for authorized security testing.

Hunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking in Windows environments.

Extracts the user's true intent through one-question-at-a-time interviews, surfacing hidden assumptions before any plan or code is written.

Execution discipline with agency, instinct detection, critical safety rules, trust layer, and error resilience. v2.7 adds timeout handling, checkpointing, and decision logging.

Hunt for web shell deployments on internet-facing servers by analyzing file creation in web directories, suspicious process spawning from web servers, and anomalous HTTP patterns.

Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.

Detect container escape attempts using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.

Shape or refine the existing bead or caller intent without creating a second planning artifact. Triggers: "plan", "discover and plan", "shape this goal".

JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().

Translates user intent into a precise, unambiguous specification and requirements.

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

Harness Router

Weekly churn risk detection across active client accounts. Scans for signals like decreased engagement, missed meetings, delayed payments, and competitor mentions. Scores risk 1-10 and outputs prioritized alert list.