oyi77/1ai-skills - 17ページ

hunting-for-living-off-the-cloud-techniques

Hunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse of Azure, AWS, GCP services, and SaaS platforms. Use when hunting for adversary abuse of legitimate cloud services for c2,.

原文の言語: 英語

hunting-for-lolbins-execution-in-endpoint-logs

Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes. Use when hunting for adversary abuse of living…

原文の言語: 英語

hunting-for-persistence-mechanisms-in-windows

Systematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services, startup folders, and WMI subscriptions. Use when working with hunting for persistence mechanisms in windows.

原文の言語: 英語

hunting-for-persistence-via-wmi-subscriptions

Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events. Use when hunting for adversary persistence…

原文の言語: 英語

hunting-for-registry-persistence-mechanisms

Hunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking in Windows environments. Use when hunting for registry-based persistence mechanisms including run keys, winlogon modifications,.

原文の言語: 英語

hunting-for-scheduled-task-persistence

Hunt for adversary persistence via Windows Scheduled Tasks by analyzing task creation events, suspicious task actions, and unusual scheduling patterns. Use when hunting for adversary persistence via windows scheduled tasks by analyzing.

原文の言語: 英語

hunting-for-shadow-copy-deletion

Hunt for Volume Shadow Copy deletion activity that indicates ransomware preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow copy commands. Use when hunting for volume shadow copy deletion activity that indicates ransomware.

原文の言語: 英語

hunting-for-spearphishing-indicators

Hunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to detect targeted email attacks. Use when hunting for spearphishing campaign indicators across email logs, endpoint telemetry,.

原文の言語: 英語

hunting-for-startup-folder-persistence

Detect T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, analyzing autoruns entries, and using Python watchdog for real-time filesystem monitoring. Use when detecting t1547.001 startup folder…

原文の言語: 英語

hunting-for-supply-chain-compromise

Hunt for supply chain compromise indicators including trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. Use when hunting for supply chain compromise indicators including trojanized software…

原文の言語: 英語

hunting-for-suspicious-scheduled-tasks

Hunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious task properties, and unusual execution patterns that indicate T1053.005 abuse. Use when hunting for adversary persistence and execution via…

原文の言語: 英語

hunting-for-t1098-account-manipulation

Hunt for MITRE ATT&CK T1098 account manipulation including shadow admin creation, SID history injection, group membership changes, and credential modifications using Windows Security Event Logs. Use when hunting for mitre att&ck t1098 account manipulation…

原文の言語: 英語

hunting-for-unusual-network-connections

Hunt for unusual network connections by analyzing outbound traffic patterns, rare destinations, non-standard ports, and anomalous connection frequencies from endpoints. Use when hunting for unusual network connections by analyzing outbound traffic patterns,.

原文の言語: 英語

hunting-for-unusual-service-installations

Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms. Use when detecting suspicious windows service…

原文の言語: 英語

hunting-for-webshell-activity

Hunt for web shell deployments on internet-facing servers by analyzing file creation in web directories, suspicious process spawning from web servers, and anomalous HTTP patterns. Use when hunting for web shell deployments on internet-facing servers by…

原文の言語: 英語

implementing-alert-fatigue-reduction

Implements strategies to reduce SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness and prevent critical alert dismissal. Use when…

原文の言語: 英語

implementing-anti-phishing-training-program

Security awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positiv. Use when working with implementing anti phishing training…

原文の言語: 英語

implementing-anti-ransomware-group-policy

Configures Windows Group Policy Objects (GPO) to prevent ransomware execution and limit its spread. Implements AppLocker rules, Software Restriction Policies, Controlled Folder Access, attack surface reduction rules, and network protection settings. Activates…

原文の言語: 英語

implementing-api-abuse-detection-with-rate-limiting

Implement API abuse detection using token bucket, sliding window, and adaptive rate limiting algorithms to prevent DDoS, brute force, and credential stuffing attacks. Use when implementing api abuse detection using token bucket, sliding window, and.

原文の言語: 英語

implementing-api-gateway-security-controls

Implements security controls at the API gateway layer including authentication enforcement, rate limiting, request validation, IP allowlisting, TLS termination, and threat protection. The engineer configures API gateways (Kong, AWS API Gateway, Azure APIM,…

原文の言語: 英語

implementing-api-key-security-controls

Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for…

原文の言語: 英語

implementing-api-rate-limiting-and-throttling

Use when implements API rate limiting and throttling controls using token bucket, sliding window, and fixed window algorithms to protect against brute force attacks, credential stuffing, resource exhaustion, and API abuse. The engineer configures per-user,…

原文の言語: 英語

implementing-api-schema-validation-security

Implement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts and prevent injection, data exposure, and mass assignment attacks. Use when implementing api schema validation using openapi specifications and json…

原文の言語: 英語

implementing-api-security-posture-management

Implement API Security Posture Management to continuously discover, classify, and score APIs based on risk while enforcing security policies across the API lifecycle. Use when implementing api security posture management to continuously discover, classify,…

原文の言語: 英語

implementing-api-security-testing-with-42crunch

Implement comprehensive API security testing using the 42Crunch platform to perform static audit and dynamic conformance scanning of OpenAPI specifications. Use when implementing comprehensive api security testing using the 42crunch platform to.

原文の言語: 英語

implementing-api-threat-protection-with-apigee

Implement API threat protection using Google Apigee policies including JSON/XML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security for OWASP Top 10 defense. Use when implementing api threat protection using google apigee policies including…

原文の言語: 英語

implementing-application-whitelisting-with-applocker

Implements application whitelisting using Windows AppLocker to restrict unauthorized software execution on endpoints, reducing attack surface from malware, unauthorized tools, and shadow IT. Use when enforcing application control policies, meeting compliance…

原文の言語: 英語

implementing-aqua-security-for-container-scanning

Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries. Use when deploying aqua security's trivy scanner to detect vulnerabilities,…

原文の言語: 英語

implementing-attack-path-analysis-with-xm-cyber

Deploy XM Cyber's continuous exposure management platform to map attack paths, identify choke points, and prioritize the 2% of exposures that threaten critical assets. Use when deploying xm cyber's continuous exposure management platform to map attack.

原文の言語: 英語

implementing-attack-surface-management

Implements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain enumeration, service fingerprinting, and exposure scoring. Includes a weighted risk scoring…

原文の言語: 英語

implementing-aws-config-rules-for-compliance

Implementing AWS Config rules for continuous compliance monitoring of AWS resources, deploying managed and custom rules aligned to CIS and PCI DSS frameworks, configuring automatic remediation with SSM Automation, and aggregating compliance data across…

原文の言語: 英語

implementing-aws-iam-permission-boundaries

Configure IAM permission boundaries in AWS to delegate role creation to developers while enforcing maximum privilege limits set by the security team. Use when configureing iam permission boundaries in aws to delegate role creation.

原文の言語: 英語

implementing-aws-macie-for-data-classification

Implement Amazon Macie to automatically discover, classify, and protect sensitive data in S3 buckets using machine learning and pattern matching for PII, financial data, and credentials detection. Use when implementing amazon macie to automatically discover,…

原文の言語: 英語

implementing-aws-nitro-enclave-security

Use when implements AWS Nitro Enclave-based confidential computing environments with cryptographic attestation, KMS policy integration using PCR-based condition keys, and secure vsock communication channels. The practitioner builds enclave images, configures…

原文の言語: 英語

implementing-azure-ad-privileged-identity-management

Configure Microsoft Entra Privileged Identity Management to enforce just-in-time role activation, approval workflows, and access reviews for Azure AD privileged roles. Use when configureing microsoft entra privileged identity management to enforce…

原文の言語: 英語

implementing-beyondcorp-zero-trust-access-model

Implementing Google's BeyondCorp zero trust access model to eliminate implicit trust from the network perimeter, enforce identity-aware access controls using IAP, Access Context Manager, and Chrome Enterprise Premium for VPN-less secure application access. .…

原文の言語: 英語

implementing-bgp-security-with-rpki

Implement BGP route origin validation using RPKI with Route Origin Authorizations, RPKI-to-Router protocol, and ROV policies on Cisco and Juniper routers to prevent route hijacking. Use when implementing bgp route origin validation using rpki with route…

原文の言語: 英語

implementing-browser-isolation-for-zero-trust

Use when deploys remote browser isolation (RBI) as a core component of a Zero Trust architecture. Implements isolation policies with URL categorization and risk-based routing, content disarming and reconstruction (CDR) for file sanitization, data loss…

原文の言語: 英語

implementing-canary-tokens-for-network-intrusion

Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement. Integrates with webhook alerting (Slack, Teams, email, generic HTTP) for real-time intrusion notifications. Provides automated…

原文の言語: 英語

implementing-cisa-zero-trust-maturity-model

Implement the CISA Zero Trust Maturity Model v2.0 across the five pillars of identity, devices, networks, applications, and data to achieve progressive organizational zero trust maturity. Use when implementing the cisa zero trust maturity model v2.0 across…

原文の言語: 英語