All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,770
- 1,241
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 13,993–14,016 of 29,770 skills
- Hunting For Persistence Via Wmi SubscriptionsHunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggeredVotes: 0GitHub stars: 4
- Hunting For Persistence Mechanisms In WindowsSystematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services, startup folders, and WMI subscriptions.Votes: 0GitHub stars: 4
- Hunting For Ntlm Relay Attackstespit etmeNTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status,Votes: 0GitHub stars: 4
- Hunting For Lolbins Execution In Endpoint LogsHunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used forVotes: 0GitHub stars: 4
- Hunting For Living Off The Land BinariesProactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading Tespit.Votes: 0GitHub stars: 4
- Hunting For Living Off The Cloud TechniquesHunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse of Azure, AWS, GCP services, and SaaS platforms.Votes: 0GitHub stars: 4
- Hunting For Lateral Movement Via Wmitespit etmeWMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI eventVotes: 0GitHub stars: 4
- Hunting For Domain Fronting C2 Traffictespit etmedomain fronting C2 traffic by analyzing SNI vs HTTP Host header mismatches in proxy logs and TLS certificate discrepancies using pyOpenSSL for certificate Denetle:ionVotes: 0GitHub stars: 4
- Hunting For Dns Tunneling With Zeektespit etmeDNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, long query lengths, and unusual DNS record types indicatingVotes: 0GitHub stars: 4
- Hunting For Dns Based PersistenceHunt for DNS-based persistence mechanisms including DNS hijacking, dangling CNAME records, wildcard DNS abuse, and unauthorized zone modifications using passive DNS databases, SecurityTrailsVotes: 0GitHub stars: 4
- Hunting For Defense Evasion Via Timestompingtespit etmeNTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporalVotes: 0GitHub stars: 4
- Hunting For Dcsync Attackstespit etmeDCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts.Votes: 0GitHub stars: 4
- Hunting For Dcom Lateral MovementHunt for DCOM-based lateral movement by Tespit etme abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects through Sysmon Event ID 1 (process creation) and Event ID 3 (networkVotes: 0GitHub stars: 4
- Hunting For Data Staging Before Exfiltrationtespit etmedata staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns viaVotes: 0GitHub stars: 4
- Hunting For Data Exfiltration IndicatorsHunt for data exfiltration through network traffic analysis, Tespit etme unusual data flows, DNS tunneling, cloud storage uploads, and encrypted channel abuse.Votes: 0GitHub stars: 4
- Hunting For Command And Control Beaconingtespit etmeC2 beaconing patterns in network traffic using frequency analysis, jitter Tespit, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.Votes: 0GitHub stars: 4
- Hunting For Beaconing With Frequency AnalysisIdentify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to tespit etmeperiodic callbacksVotes: 0GitHub stars: 4
- Hunting For Anomalous Powershell ExecutionHunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX filesVotes: 0GitHub stars: 4
- Detecting Wmi Persistencetespit etmeWMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.Votes: 0GitHub stars: 4
- Detecting T1548 Abuse Elevation Control Mechanismtespit etmeabuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusualVotes: 0GitHub stars: 4
- Detecting T1055 Process Injection With Sysmontespit etmeprocess injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote threadVotes: 0GitHub stars: 4
- Detecting T1003 Credential Dumping With Edrtespit etmeOS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security eventVotes: 0GitHub stars: 4
- Detecting Suspicious Powershell Executiontespit etmesuspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.Votes: 0GitHub stars: 4
- Detecting Service Account Abusetespit etmeabuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.Votes: 0GitHub stars: 4