Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and in-memory detection of known Mimikatz modules. Use when (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violations using Azure (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frames, and deviations from communication (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Detect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized write operations, anomalous function codes, malformed frames, (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
This skill covers detecting anomalies in Modbus/TCP and Modbus RTU communications in industrial control systems. It addresses function code monitoring, register range (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep packet inspection, (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Detect model stealing, model inversion, and membership inference performed through inference-API abuse by monitoring query patterns, applying output perturbation, and red-teaming your (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →