Results for “misuse-resistance”

Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.

Systematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services, startup folders, and WMI subscriptions.

Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.

Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks by monitoring process creation, command-line arguments, and parent-child relationships.

Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.

许三多（军旅剧虚构）认知与表达框架（压缩蒸馏）：钝感坚持、不抛弃不放弃、草根成长 触发：士兵突击 等。禁止军事违法教程

Detect abuse of legitimate Windows binaries (LOLBins) like certutil, regsvr32, mshta, and rundll32 using process telemetry, Sigma rules, and parent-child process analysis.

Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.

凌不疑（古装虚构）认知与表达框架（压缩蒸馏）：复仇将军、疯批克制、家族血债 触发：星汉灿烂 等。虚构；禁止暴力教唆

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.

当试图建立或改变一个习惯、例行程序，但遇到阻力或难以坚持时

Use for writing, reviewing, debugging, or testing bounded retry policies in Python with Tenacity, including retry predicates, stop and wait strategies, jitter, exception propagation, callbacks, Retrying, and AsyncRetrying. Do not use for generic loops, scheduled jobs, domain polling without a retryable operation, or operations whose side effects are not safe to repeat.

Detects and fixes common MSBuild anti-patterns in .csproj, .vbproj, .fsproj, .props, .targets, and .proj files, covering Exec misuse, unquoted conditions, hardcoded paths, and more.

Enforce idiomatic Rust patterns for ownership, error handling, enums, traits, concurrency, and best practices to build safe, performant applications.

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring.

Restricts unauthorized removable media access on endpoints by implementing USB device control policies via Group Policy, Intune, or EDR platforms to prevent data exfiltration and malware introduction.

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.

明楼（谍战虚构）认知与表达框架（压缩蒸馏）：三面间谍、辞令层叠、亲情作人质 触发：伪装者 等。禁止间谍违法教程

安室透（少年推理漫）认知与表达框架（压缩蒸馏）：三重身份张力、波本梗、服务生伪装 触发：名侦探柯南 等。虚构；禁止犯罪教唆

Python resilience patterns including automatic retries, exponential backoff, timeouts, and fault-tolerant decorators. Use when adding retry logic, implementing timeouts, building fault-tolerant services, or handling transient failures.

Identifies common React useEffect anti-patterns and provides corrected implementations using derived state, event handlers, and cleanup functions.

Idiomatic Rust patterns, ownership, error handling, traits, concurrency, and best practices for building safe, performant applications.

Use when implementing rust functionality with production-grade patterns and safeguards.