Results for “dns”

Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality using scapy for packet capture analysis.

Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, and protocol abuse for C2 and data exfiltration.

Automates packet capture analysis using tshark and pyshark to extract protocol statistics, detect suspicious flows, identify IOCs, and analyze DNS anomalies from PCAP files.

Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header mismatches in proxy logs and TLS certificate discrepancies using pyOpenSSL for certificate inspection.

Provides a structured workflow for reverse engineering .NET and C# binaries, including deobfuscation with de4dot, static analysis via dnSpyEx IL view, dynamic debugging, and reliable IL patching for red-team tools and malware.

Build a comprehensive catalog of API endpoints including documented, undocumented, shadow, zombie, and deprecated APIs using passive traffic analysis, active scanning, DNS enumeration, JavaScript analysis, and cloud resource inventory.

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using passive reconnaissance tools and public data sources.

Detect brand impersonation attacks across domains, social media, mobile apps, and dark web channels to identify phishing campaigns, fake sites, and unauthorized brand usage.

Discover and exploit broken link hijacking vulnerabilities by identifying references to expired domains, decommissioned cloud resources, and dead external services that can be claimed by an attacker.

Deploys and configures Zeek network security monitor to passively analyze traffic, generate structured logs, detect anomalous behavior, and create custom detection scripts for threat hunting and incident response.

Detects and exploits ransomware kill switch mechanisms including mutex-based execution guards, domain-based kill switches, and registry-based termination checks. Implements proactive mutex vaccination and kill switch domain monitoring to prevent ransomware from executing.