All categories
DevOps & Cloud
Deployment, cloud, containers, CI/CD, monitoring, and infrastructure
- 19,628
- 818
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse devops & cloud skills
Showing 14,113–14,136 of 19,628 skills
- Hunting For Lolbins Execution In Endpoint LogsHunts for LOLBins (Living Off the Land Binaries) abuse, mapped to MITREVotes: 0GitHub stars: 67
- Hunting For Living Off The Cloud TechniquesHunts for adversary abuse of legitimate cloud services (Azure, AWS, GCP,Votes: 0GitHub stars: 67
- Hunting For Lateral Movement Via WmiDetects WMI-based lateral movement (e.g. wmic process call create,Votes: 0GitHub stars: 67
- Hunting For Domain Fronting C2 TrafficDetects domain fronting C2 traffic by analyzing SNI-vs-HTTP-Host-headerVotes: 0GitHub stars: 67
- Hunting For Dns Tunneling With ZeekDetects DNS tunneling and covert-channel data exfiltration by analyzingVotes: 0GitHub stars: 67
- Hunting For Dns Based PersistenceHunts for DNS-based persistence mechanisms such as DNS hijacking, danglingVotes: 0GitHub stars: 67
- Hunting For Defense Evasion Via Timestomping'Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATIONVotes: 0GitHub stars: 67
- Hunting For Data Exfiltration IndicatorsHunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via large/frequent TXT queries, uploads to personal cloud storage, and encrypted-channel abuse, correlated against threat intel on destination domains. Use when hunting for data theft in a compromised environment, investigating unusual outbound data volumes, or determining what data was stolen during incident response.Votes: 0GitHub stars: 67
- Hunting For Command And Control BeaconingDetect C2 beaconing patterns in network traffic using frequency analysis,Votes: 0GitHub stars: 67
- Hunting For Cobalt Strike BeaconsDetect Cobalt Strike beacon command-and-control traffic using default TLS certificate signatures (serial 8BB00EE), JA3/JA3S/JARM fingerprints, HTTP malleable C2 profile pattern matching, and beacon jitter/interval analysis, built with Zeek network logs, Suricata IDS rules, and Python PCAP analysis. Use when hunting for Cobalt Strike beacon callbacks in network traffic or building detection rules for this C2 framework.Votes: 0GitHub stars: 67
- Hunting For Anomalous Powershell Execution'Hunt for malicious PowerShell activity by analyzing Script Block LoggingVotes: 0GitHub stars: 67
- Hardening Linux Endpoint With Cis Benchmark'Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu,Votes: 0GitHub stars: 67
- Hardening Docker Daemon ConfigurationHardens the Docker daemon (dockerd) through /etc/docker/daemon.json with user namespace remapping, TLS client authentication, seccomp profiles, and CIS Docker Benchmark controls such as icc, no-new-privileges, and live-restore. Use when securing a Docker host's daemon to prevent privilege escalation, breakout, or lateral movement, or when auditing daemon settings against CIS requirements. Keywords: dockerd, daemon.json, userns-remap, no-new-privileges, icc, live-restore, TLS socket. Do not us...Votes: 0GitHub stars: 67
- Exploiting Bgp Hijacking Vulnerabilities'Analyzes and simulates BGP hijacking scenarios in authorized lab environmentsVotes: 0GitHub stars: 67
- Detecting Wmi PersistenceDetect WMI event subscription persistence (MITRE T1546.003) by analyzing SysmonVotes: 0GitHub stars: 67
- Detecting T1055 Process Injection With SysmonDetect process injection techniques (T1055) - including DLL injection, processVotes: 0GitHub stars: 67
- Detecting S3 Data Exfiltration Attempts'Detecting data exfiltration attempts from AWS S3 buckets by analyzingVotes: 0GitHub stars: 67
- Detecting Ransomware Encryption Behavior'Detects ransomware encryption activity in real time using entropyVotes: 0GitHub stars: 67
- Detecting Port Scanning With Fail2ban'Configures Fail2ban with custom filters and actions to detect port scanningVotes: 0GitHub stars: 67
- Detecting Network Scanning With Ids SignaturesDetect network reconnaissance and port scanning using Suricata and SnortVotes: 0GitHub stars: 67
- Detecting Network Anomalies With ZeekDeploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs, detect anomalous behavior, and write custom scripts for organization-specific threats. Use for passive monitoring at network choke points, feeding SIEM/threat hunting with protocol metadata, or retrospective log analysis during incident response; not a substitute for inline IDS/IPS or host agents.Votes: 0GitHub stars: 67
- Detecting Modbus Protocol AnomaliesDetect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep packet inspection, using Zeek's Modbus analyzer, Suricata IDS with OT rules, and Python Markov chain models of normal transaction sequences. Use for deploying Modbus IDS in OT environments, baselining polling patterns, investigating suspicious Modbus traffic, or building function code allowlists.Votes: 0GitHub stars: 67
- Detecting Malicious Scheduled Tasks With Sysmon'Detect malicious scheduled task creation and modification using SysmonVotes: 0GitHub stars: 67
- Detecting Living Off The Land With LolbasDetect Living Off the Land Binaries (LOLBins/LOLBAS) abuse includingVotes: 0GitHub stars: 67