Claude Skills by CyberStrikeus

Adversaries may setup email forwarding rules to collect sensitive information.

Adversaries may target user email to collect sensitive information.

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listen...

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering ...

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various brow...

Adversaries may leverage Confluence repositories to mine valuable information.

Adversaries may leverage the SharePoint repository as a source to mine valuable information.

Adversaries may leverage code repositories to collect valuable information.

Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information.

Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.

Adversaries may leverage databases to mine valuable information.

Adversaries may leverage information repositories to mine valuable information.

Adversaries may access data from cloud storage.

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries.

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method.

An adversary may compress and/or encrypt data that is collected prior to exfiltration.

Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).

Adversaries may access network configuration files to collect sensitive data about the device and the network.

Adversaries may collect data related to managed devices from configuration repositories.

Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel.

Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.

Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure.

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals.

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds.

Adversaries may steal data by exfiltrating it over an existing command and control channel.

Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel.

Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel.

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.

Adversaries may attempt to exfiltrate data over a USB connected physical device.

Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive.

Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel.

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.

Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel.

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel.

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

Adversaries may add junk data to protocols used for command and control to make detection more difficult.

Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.

Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.

Adversaries may obfuscate command and control traffic to make it more difficult to detect.

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thre

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.

Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic.

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.