Results for “c2”

Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse engineering, or command-and-control infrastructure mapping.

The English summary is being prepared. Showing the original description.

Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse engineering, or command-and-control infrastructure mapping.

The English summary is being prepared. Showing the original description.

Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse engineering, or command-and-control infrastructure mapping.

The English summary is being prepared. Showing the original description.

Retrieve current cyber threat data, including malware indicators, addresses of attacker control servers, and vulnerabilities known to be exploited. Filter by threat type, source, severity, and date to identify relevant threats for review and reporting.

• Reviewing recently observed malware indicators
• Finding high-severity exploited vulnerabilities
• Checking attacker control server indicators

Search Windows PowerShell logs for traces of Empire, a framework used after a system is compromised. Identify characteristic launch commands, encoded code, module calls, and communication paths, then report suspicious events with timelines and severity scores.

• Investigating suspected Empire activity
• Checking encoded commands and communication paths
• Building detection rules from Empire indicators

Extract Cobalt Strike Beacon settings from executable files and memory dumps to identify command-and-control servers, communication patterns, and identifying markers. Use the findings to compare samples, investigate incidents, and develop file and network detection rules.

• Extract Beacon settings from suspicious files
• Identify command-and-control servers and traffic patterns
• Compare samples using watermark identifiers

Examine captured network traffic for hidden malware communications in DNS, ICMP, and HTTP. Analyze domain patterns, packet sizes, and traffic frequency to identify suspicious channels used for remote control or data theft.

• Investigating suspicious DNS, ICMP, or HTTP traffic
• Hunting for hidden malware control channels in packet captures
• Assessing possible data theft through unusual network traffic

Review SOC 2 Type II audit readiness through six questions about controls, the organizational safeguards assessed over an observation period. Identify evidence gaps, control changes, and exceptions, then organize readiness findings and three concrete next actions.

• Check readiness before the observation period begins
• Review control operation midway through the period
• Check evidence coverage before audit fieldwork

Build and run Omnigent’s server and Postgres together with Docker Compose on a laptop or existing Docker host. Use the supplied configuration and troubleshooting guidance to rebuild images, investigate startup problems, or adapt deployment to another platform.

• Running Omnigent locally with Postgres
• Starting the stack on an existing VPS or EC2 host
• Investigating startup and web interface problems

Create a coding bounty that locks ERC20 token rewards for making a failing test suite pass. The skill checks CLI configuration, gathers the repository, commit, reward, and arbitration details, then reports the escrow identifier and solution submission command.

• Post a funded bounty for fixing failing tests
• Specify the test commit, reward, and arbitration addresses
• Share solution submission and bounty status commands

Deploy to AWS Elastic Beanstalk, in either Beanstalk Standard mode (EC2) or Beanstalk Cluster mode (managed EKS). Triggers on: elastic beanstalk, EB, beanstalk standard, beanstalk cluster, managed EC2 platform, web app with managed patching, worker on EC2, Heroku alternative, don't want to manage servers or container orchestration, migrate from Heroku, managed operational lifecycle, containerised app without operating Kubernetes, several services sharing a managed cluster, managed EKS without kubectl. Covers web and worker applications on EC2, and containerised single- and multi-service applications on managed EKS.

The English summary is being prepared. Showing the original description.

Provides AWS CloudFormation patterns for EC2 instances, Security Groups, IAM roles, and load balancers. Use when creating EC2 instances, SPOT instances, Security Groups, IAM roles for EC2, Application Load Balancers (ALB), Target Groups, and implementing template structure with Parameters, Outputs, Mappings, Conditions, and cross-stack references.

The English summary is being prepared. Showing the original description.

DNS C2 operator skill for the AgentCore sandbox breakout demo. This skill should be used when the user asks to run C2 verification, attack a victim chatbot, send commands to a compromised session, retrieve exfiltrated data, or interact with the DNS C2 system.

The English summary is being prepared. Showing the original description.

Operate and debug the DNS C2 system non-interactively. This skill should be used when Claude needs to launch an exploit, send commands to a compromised session and collect output, diagnose why a payload is not calling home, or inspect C2 server state. Triggers on requests like "run the exploit", "send whoami to the session", "why isn't the payload calling back", "check what sessions are active", or "debug the C2".

The English summary is being prepared. Showing the original description.

Create and implement Malleable C2 profiles in Cobalt Strike to evade network intrusion detection systems (NIDS/IPS) and endpoint detection architectures. This skill focuses on molding the Beacon's HTTP/HTTPS traffic to resemble legitimate network traffic like Amazon, Google, or jQuery.

The English summary is being prepared. Showing the original description.

Analyzes remote access trojan command-and-control by mapping the RAT command set, identifying the C2 transport and beacon parameters, and cataloging operator capabilities from static strings and config. Activates for requests to analyze RAT C2, map a trojan command handler, or identify remote-access capabilities and C2 transport.

The English summary is being prepared. Showing the original description.

Architect redirectors with nginx and Apache, malleable profiles, and OPSEC for resilient C2.

The English summary is being prepared. Showing the original description.

EC2 など別マシンへのセッション引き継ぎが第一用途。現セッションの Recap（LLM 要約）と Next Actions を VCS 共有可能な `.claude/journal.md` の先頭に追記する。ローカル端末固有で他マシンから見えない built-in `/recap` の限界を補う。同一マシン内のセッション区切りにも使える。「EC2 に引き継ぎ」「別マシンに渡したい」「handoff」「ハンドオーバー」「journal に残して」「新セッションに渡したい」「新しい会話を始めたい」「セッションを区切りたい」で発動。

The English summary is being prepared. Showing the original description.

Soc2 Compliance Checker - Auto-activating skill for Security Advanced. Triggers on: soc2 compliance checker, soc2 compliance checker Part of the Security Advanced skill category.

The English summary is being prepared. Showing the original description.

Command and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profiles, Beacon types HTTP/HTTPS/DNS/SMB, Beacon Object Files for in-memory execution, sleep and jitter tuning, named pipe pivoting), Sliver (implant generation across mTLS/WireGuard/DNS transport, operator multiplayer mode, armory extensions), Mythic (agent ecosystem with Apollo/Poseidon/Medusa, C2 profile configuration, translation containers), Havoc (Demon agent with sleep obfuscation via Ekko/Zilean, indirect syscalls, dotnet inline execution), Metasploit (msfvenom payload generation, multi/handler staging, Meterpreter post-exploitation modules), redirector architecture using Apache mod_rewrite and Nginx, domain fronting through CDN providers, DNS-based C2 for restrictive network egress, and TLS certificate management for infrastructure OPSEC. Tools: Cobalt Strike, Sliver, Mythic, Havoc, Metasploit Framework. Aligns to MITRE ATT&CK T1071 (Application Layer P...

The English summary is being prepared. Showing the original description.

Configure and audit AWS users, roles, and access policies. Work through least-privilege permissions, granting only the access needed, along with GitHub Actions authentication, cross-account access, permission boundaries, and checks for unused or excessive access.

• Create execution roles for EC2 and Lambda
• Design policies with only the required permissions
• Configure GitHub Actions authentication through OIDC

Send crypto payments through Binance Pay using QR codes or payment links, then check payment status. Generate links and QR codes to receive payments, with support for C2C payments and automatic detection of PIX QR codes.

• Pay using a Binance Pay QR code
• Pay using a PIX QR code
• Generate a link to receive crypto

Use natural language to compare Binance P2P offers, prices, and payment methods. Review personal orders and dispute progress, submit evidence for existing appeals, and manage advertisements when the account has the required merchant permissions.

• Compare P2P offers by payment method
• Review personal order history and details
• Track appeals and submit supporting evidence

Examine Zeek connection logs for regular callbacks that may indicate communication with an attacker’s control server. Use ZAT and Pandas to group connections, measure timing variation, and identify source and destination pairs for further investigation.

• Hunting for periodic callbacks in Zeek connection logs
• Comparing connection timing across source and destination pairs
• Developing beaconing detection rules and hunting queries