Results for “tamper-detection”

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.

Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.

Find adjacent vendors and subs (not top market primes) who fill a capability gap against a displacement target using USASpending flows and SAM entity signals. Use when user defines a teaming gap and wants vault-ready partner shortlist with citations.

Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality using scapy for packet capture analysis.

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.

Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.

Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.

VIPER v2.1 — Range-bound liquidity sniper. Enters at support/resistance when Bollinger Bands are tight, ATR is low, RSI is at extremes within the range, and volume is declining. Works when nothing is trending — the chop predator. USD-weighted OI filtering (min $5M). DSL High Water Mode (mandatory). 5-minute scan interval. Second-best performer in the Senpi zoo at +6.2% ROI.

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.

Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral heuristics.

Diagnose failures from runtime evidence before editing code.

Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.

Analyze Zeek network logs to detect lateral movement techniques including SMB admin share access, DCE/RPC remote service creation, NTLM account spray, Kerberos anomalies, and large internal data transfers.

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.

Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.

Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.

MAMBA v2.0 — Range-bound high water + regime protection. A trading strategy config override based on the VIPER skill with three protective gates: BTC regime filter, per-asset cooldown after losses, and hard leverage cap at 10x.

Detect DCOM-based lateral movement by correlating Sysmon process creation and network connection events, WMI event analysis, and RPC endpoint mapper traffic to identify abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects.

Detect abuse of legitimate Windows binaries (LOLBins) like certutil, regsvr32, mshta, and rundll32 using process telemetry, Sigma rules, and parent-child process analysis.

Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom Python monitoring scripts to protect against man-in-the-middle interception.

Engineering privacy and data governance: PII detection, data flow mapping, consent patterns, GDPR/CCPA-compliant implementation, DPIA. Use when privacy-by-design is needed.

Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks by monitoring process creation, command-line arguments, and parent-child relationships.

Use to surface fraud, scam and financial-crime signals that customers describe to support before detection systems see them, and to check whether agents recognised and routed them. Trigger for "are customers reporting scams", "new scam pattern targeting our customers", "did we spot the fraud signals", authorised push payment scams, "customer was coached by someone on the phone", or fraud reports arriving through support.

Performs advanced network reconnaissance using Nmap's scripting engine, timing controls, evasion techniques, and output parsing to discover hosts, enumerate services, detect vulnerabilities, and fingerprint operating systems across authorized target networks.

Use when users need webpage scraping, structured data extraction, crawling strategy, anti-bot handling, selector design, or repeatable web data collection workflows.

Use to scan support conversations for a harm nobody has categorised yet — a new failure mode, a scam pattern, or a product change hurting a group of customers before it shows in any metric. Trigger for "is anything new going wrong", "scan for emerging issues", "early warning from support", horizon scanning, a new scam pattern, or preparing for a question about what you might be missing.

FOX v2.0 — Dual-mode emerging movers scanner. All live trading lessons from Fox v1.0 applied, plus one experimental tweak: Stalker minReasons = 3. Stalker entries must have at least 3 distinct scoring reasons, not just pass the score threshold. This forces breadth of confirmation beyond the auto-awarded base climb score + one bonus. Stalker minScore 7, minTotalClimb 8, tighter Phase 1 for low-score entries, consecutive-loss streak gate. XYZ banned. Leverage 7-10x. DSL exit managed by plugin runtime via runtime.yaml.