Results for “suspicious-flows”

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns using the Python netflow library.

Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.

Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.

Hunt for unusual network connections by analyzing outbound traffic patterns, rare destinations, non-standard ports, and anomalous connection frequencies from endpoints.

Track weekly funding rounds across configurable verticals with primary-source verification, per-round analysis, and risk assessment.

Diagnose Salesforce Flows that fail to run, produce wrong results, or error out, using debug mode, interview logs, fault emails, and test suites.

Guides architecture decisions, flow type selection, bulk safety validation, and fault handling standards for Salesforce Flow design and review.

Detects unusual options activity and classifies smart money signals to help follow institutional positioning, including volume/OI ratio spikes, block trades, sweep orders, and net premium flow.

Use when unsure which skill or flow fits your current situation

Hunt for web shell deployments on internet-facing servers by analyzing file creation in web directories, suspicious process spawning from web servers, and anomalous HTTP patterns.

Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs. Identifies wallet clusters, tracks fund movement through mixers and exchanges, and supports law enforcement attribution.

Use when running QA Lab channel message flow evidence.

Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, long query lengths, and unusual DNS record types indicating covert channel communication.

沈墨（悬疑剧虚构）认知与表达框架（压缩蒸馏）：创伤反杀叙事、时代灰雾、钢琴意象 触发：漫长的季节 等。虚构；禁止犯罪模仿

Analyze Zeek conn.log and NetFlow data to detect ransomware network indicators including C2 beaconing, TOR exit node connections, data exfiltration, and suspicious DNS patterns.

Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality using scapy for packet capture analysis.

Triggered by "tidy up", "clean up transactions", "categorize uncategorized", "organize my transactions"