Results for “breakout-detection”

Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.

Proactively hunt for threats by analyzing IOCs, detecting behavioral anomalies in telemetry, and prioritizing signals mapped to MITRE ATT&CK.

Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.

Identifies recurring patterns across three or more domains to extract universal principles and apply them to new contexts.

Detect model stealing, model inversion, and membership inference performed through inference-API abuse by monitoring query patterns, applying output perturbation, and red-teaming your own model's extractability.

Detects outbound HTTP clients constructed without explicit timeouts in AEM Cloud Service code and applies mechanical fixes with CSO-aligned defaults to prevent request-thread pool saturation.

Analyzes Zeek conn.log connection intervals using statistical methods to detect C2 beaconing patterns, flagging periodic connections with low jitter.

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.

Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.

Evaluates account-level drawdown and losing-streak rules from local thesis files to decide whether new trade risk is allowed, without external APIs.

Identifies recurring patterns across three or more domains to extract universal principles and apply them to new problems.

Hunt for unusual network connections by analyzing outbound traffic patterns, rare destinations, non-standard ports, and anomalous connection frequencies from endpoints.

Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.

Detect container escape attempts using Falco, seccomp, and auditd, with rules for privileged containers, Docker socket access, and kernel module loading.

Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach, using network segmentation, endpoint isolation, credential revocation, and access control modifications.

Screen post-earnings gap-up stocks for Post-Earnings Announcement Drift patterns using weekly candle analysis to detect red candle pullbacks and breakout signals.

Hunt for Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons where Kerberos is expected, and correlating with credential dumping indicators.

Use when investigating a bug, runtime error, unexpected behavior, test failure, or crash. For systematic root cause analysis, error message interpretation, stack trace reading, reproduction steps, and targeted fixes. Activate when the user says "it's broken", "this doesn't work", "I'm getting an error", or "help me debug".

Use this skill for reproduction-first debugging, root cause isolation, minimal fixes, regression tests. Trigger when the task involves agent profile work related to Staff Debugger Agent, implementation, audits, debugging, strategy, or validation.

Econometrics skill for Regression Discontinuity Design (RDD). Activates when the user asks about: "regression discontinuity", "RDD", "RD design", "sharp RDD", "fuzzy RDD", "running variable", "forcing variable", "cutoff", "bandwidth selection", "local linear regression", "McCrary test", "density test", "RDROBUST", "continuity assumption", "donut hole RDD", "geographic RDD", "断点回归", "回归不连续", "运行变量", "截断值", "带宽选择", "精确断点", "模糊断点", "密度检验", "局部线性回归"

Provides a structured debugging workflow for diagnosing errors, test failures, and unexpected behavior, including root cause analysis and verification steps.

4-phase systematic debugging methodology with root cause analysis and evidence-based verification. Use when debugging complex issues.

Checks desktop, tablet, and mobile UI for overflow, clipping, navigation, grid, canvas, and breakpoint regressions.

Econometrics skill for Regression Discontinuity Design (RDD). Activates when the user asks about: "regression discontinuity", "RDD", "RD design", "sharp RDD", "fuzzy RDD", "running variable", "forcing variable", "cutoff", "bandwidth selection", "local linear regression", "McCrary test", "density test", "RDROBUST", "continuity assumption", "donut hole RDD", "geographic RDD", "断点回归", "回归不连续", "运行变量", "截断值", "带宽选择", "精确断点", "模糊断点", "密度检验", "局部线性回归"

Pattern-Based Diagnosis

Detect DCOM-based lateral movement by correlating Sysmon process creation and network connection events, WMI event analysis, and RPC endpoint mapper traffic to identify abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects.

Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.

Provides structured debugging guidance for errors, test failures, and unexpected behavior, including root cause analysis and verification steps.

When a learner gets something wrong or feels stuck, require them to diagnose the problem before receiving help. Ensures help targets the actual cognitive breakdown, not just the surface error.

Investigates hard, flaky, or performance failures through a six-phase feedback-loop-first debugging process; use when quick targeted debugging is insufficient.

Discover and exploit broken link hijacking vulnerabilities by identifying references to expired domains, decommissioned cloud resources, and dead external services that can be claimed by an attacker.

Debugging specialist for errors, test failures, and unexpected behavior. Use proactively when encountering any issues.

Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

Analyzing session replays, extracting persona-based behavioral patterns, and storytelling UX issues. Reads the 'why' from real user operation logs. Works with Field/Echo for persona validation.

Debugging specialist for errors, test failures, and unexpected behavior. Use proactively when encountering any issues.