Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →