byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/hunting-for-domain-fronting-c2-traffic/SKILL.md
Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header (SKILL.md metadata excerpt)
Compare the method, check the prerequisites, then go to the exact source.
byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/hunting-for-domain-fronting-c2-traffic/SKILL.md
Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header (SKILL.md metadata excerpt)
mukul975/anthropic-cybersecurity-skillsskills/hunting-for-domain-fronting-c2-traffic/SKILL.md
Detects domain fronting C2 traffic by analyzing SNI-vs-HTTP-Host-header (SKILL.md metadata excerpt)
byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/hunting-for-lateral-movement-via-wmi/SKILL.md
Detect WMI-based lateral movement by analyzing Windows Event ID 4688 (SKILL.md metadata excerpt)
mukul975/anthropic-cybersecurity-skillsskills/hunting-for-lateral-movement-via-wmi/SKILL.md
Detects WMI-based lateral movement (e.g. wmic process call create, (SKILL.md metadata excerpt)
byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/hunting-for-living-off-the-cloud-techniques/SKILL.md
Hunt for adversary abuse of legitimate cloud services for C2, data staging, (SKILL.md metadata excerpt)
mukul975/anthropic-cybersecurity-skillsskills/hunting-for-living-off-the-cloud-techniques/SKILL.md
Hunts for adversary abuse of legitimate cloud services (Azure, AWS, GCP, (SKILL.md metadata excerpt)
byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/hunting-for-living-off-the-land-binaries/SKILL.md
Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) (SKILL.md metadata excerpt)
mukul975/anthropic-cybersecurity-skillsskills/hunting-for-living-off-the-land-binaries/SKILL.md
Proactively hunts for adversary abuse of legitimate, signed system binaries (SKILL.md metadata excerpt)
byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md
Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by (SKILL.md metadata excerpt)
mukul975/anthropic-cybersecurity-skillsskills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md
Hunts for LOLBins (Living Off the Land Binaries) abuse, mapped to MITRE (SKILL.md metadata excerpt)
mukul975/anthropic-cybersecurity-skillsskills/hunting-for-ntlm-relay-attacks/SKILL.md
Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event (SKILL.md metadata excerpt)
byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/hunting-for-ntlm-relay-attacks/SKILL.md
Detect NTLM relay attacks by analyzing Windows Event 4624 logon type (SKILL.md metadata excerpt)
Snapshot w7-discovery-20260912 · 8364 file observations across 30 repositories. Source collection is not a quality or safety assessment.