Browse Skills
Detecting Cloud Threats With Guardduty
v1.0.0>
Detecting Compromised Cloud Credentials
v1.0.0>
Detecting Container Drift At Runtime
v1.0.0Detect unauthorized modifications to running containers by monitoring for binary execution drift, file system changes, and configuration deviations from the original container image.
Detecting Credential Dumping With Edr
v1.0.0Detect OS credential dumping techniques including LSASS access, SAM extraction, and DCSync using EDR telemetry and Sysmon logs.
Detecting Cryptomining In Cloud
v1.0.0>
Detecting Dll Sideloading Attacks
v1.0.0Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.
Detecting Dnp3 Protocol Anomalies
v1.0.0>
Detecting Dns Exfiltration With Dns Query Analysis
v1.0.0Detect data exfiltration through DNS tunneling by analyzing query entropy, subdomain length, query volume, TXT record abuse, and response payload sizes using passive DNS monitoring.
Detecting Evasion Techniques In Endpoint Logs
v1.0.0>
Detecting Exfiltration Over Dns With Zeek
v1.0.0Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains and anomalous query patterns
Detecting Fileless Attacks On Endpoints
v1.0.0>
Detecting Fileless Malware Techniques
v1.0.0>