Claude Skills by CyberStrikeus

Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic.

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

Adversaries may chain together multiple proxies to disguise the source of malicious traffic.

Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffi...

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to ...

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network.

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure.

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel.

Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel.

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.

Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions.

Adversaries may transfer tools or other files from an external system into a compromised environment.

Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect.

Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect.

Adversaries may encode data to make the content of command and control traffic more difficult to detect.

Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network.

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks.

An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks.

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.

Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution.

Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or ...

Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number o...

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations.

Adversaries may communicate using a protocol and port pairing that are typically not associated.

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems.

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure.

Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users.

Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content.

Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying th...

Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.

Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability.

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target.

Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target.

Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users.

Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS).