Results for “secret-exfiltration”

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

Execute advanced evasion by injecting malicious code into the memory space of a legitimate, suspended process (Process Hollowing). This skill details techniques to bypass static and dynamic analysis by masking malicious activity behind trusted processes like svchost.exe or explorer.exe.

Detect data exfiltration through DNS tunneling by analyzing query entropy, subdomain length, query volume, TXT record abuse, and response payload sizes using passive DNS monitoring.

Analyze Zeek dns.log files to detect DNS-based data exfiltration by computing Shannon entropy, flagging long subdomain labels, and identifying anomalous query patterns.

Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.

明楼（谍战虚构）认知与表达框架（压缩蒸馏）：三面间谍、辞令层叠、亲情作人质 触发：伪装者 等。禁止间谍违法教程

Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, long query lengths, and unusual DNS record types indicating covert channel communication.

Env & Secrets Manager

Persists app data on Android using Room, SQLite, SharedPreferences, DataStore, and encryption.

Discover and exploit XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.

Detect process injection techniques (T1055) including CreateRemoteThread, process hollowing, and DLL injection via Sysmon Event IDs 8 and 10 and EDR process telemetry.

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.

Anti-distillation defense for employee Skills. Clean your skill files to look complete but with core proprietary knowledge neutralized. Use when user wants to protect trade secrets, sanitize forced knowledge transfers, or create safe-to-submit skill documents.

Reviews secrets, config defaults, environment variables, logs, credentials, CI secrets, and unsafe settings.

明台（谍战虚构）认知与表达框架（压缩蒸馏）：公子成长、技能蒙太奇、信仰落地 触发：伪装者 等。禁止间谍违法教程

韩寒（作家车手）认知与表达框架（压缩蒸馏）：反套路叙事、冷幽默、公共发言锋利… 触发：三重门赛车 等。不伪造赛事实；尊重他人

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques