Results for “c2”

Detects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. Activates for requests involving DNS-based C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or DGA domain classification.

The English summary is being prepared. Showing the original description.

Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners, redirectors, and Demon agents for authorized red team operations.

The English summary is being prepared. Showing the original description.

Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.

The English summary is being prepared. Showing the original description.

Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.

The English summary is being prepared. Showing the original description.

Detects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. Activates for requests involving DNS-based C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or DGA domain classification.

The English summary is being prepared. Showing the original description.

Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners, redirectors, and Demon agents for authorized red team operations.

The English summary is being prepared. Showing the original description.

Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.

The English summary is being prepared. Showing the original description.

Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.

The English summary is being prepared. Showing the original description.

Prepare a node to participate in federation, a setup connecting multiple nodes. Generate an ed25519 keypair and configuration, optionally set a compliance mode, and display the public key and endpoint to share with peers.

• Initialize a node for federation
• Set a compliance mode during initial setup
• Check the public key and endpoint to share with peers

Process 3D scan data with CloudCompare through text commands. Clean point clouds, collections of measured 3D points, extract ground surfaces, align scans, calculate distances, and convert or export point clouds and surface meshes in supported formats.

• Remove noise and reduce point counts in LiDAR scans
• Extract ground points from buildings and vegetation
• Align two scans and calculate distances between them

Analyze AWS spending by service, region, and resource tags to find unused resources and oversized configurations. Get specific cost reduction recommendations, estimated savings, and guidance for budgets and ongoing cost monitoring.

• Compare monthly AWS spending by service
• Find unused storage and idle instances
• Estimate savings from configuration changes

Recover hidden malware settings and communication parameters in an isolated CTF environment. Document how values are decoded, preserve supporting evidence, and connect recovered fields to the sample’s observed behavior.

• Recovering hidden malware configuration fields
• Decoding command server addresses and beacon settings
• Separating loaders from staged payloads

Update Pester test assertions, checks of expected results, from classic v5 syntax to v6 Should-* commands. Identify behavior changes involving booleans, empty values, and collections, then verify the suite and report conversions needing human judgment.

• Convert assertions in PowerShell test files
• Adopt Should-* syntax one file at a time
• Review boolean, empty-value, and collection checks

Detect unauthorized cryptocurrency mining in cloud workloads by combining billing changes, CPU usage, mining pool connections, and process alerts. Follow workflows to preserve evidence, isolate affected resources, and trace how attackers gained access.

• Investigating sudden cloud billing increases
• Responding to GuardDuty cryptocurrency alerts
• Checking containers for unauthorized mining processes

Unwrap layers of obfuscated PowerShell malware to recover hidden commands, additional malicious code, and server addresses. Combines script structure analysis with execution tracing and decoding tools to support incident investigation and detection work.

• Investigating an obfuscated PowerShell script
• Recovering hidden commands and additional malicious code
• Extracting suspicious URLs, IP addresses, and file paths

Analyze NetFlow v9 and IPFIX records, which summarize network connections, to spot traffic spikes, scanning, unusual outbound transfers, and periodic connections. Compare traffic against normal patterns and produce a prioritized findings report.

• Investigating sudden increases in network traffic
• Checking unusual outbound transfers for possible data theft
• Finding periodic connections to external control servers

Investigate captured network traffic and connection records with Wireshark, Zeek, and NetFlow analysis. Identify communications with attacker infrastructure, trace movement between internal systems, estimate data transfers, and produce findings linked to packet evidence and timestamps.

• Investigating suspicious periodic connections
• Measuring the volume and destination of data transfers
• Tracing attacker movement between internal systems

Prepare SaaS teams for SOC 2 audits by mapping evaluation criteria to controls, the measures used to manage risk. Build control matrices, track supporting evidence, identify gaps, and assess readiness for Type I or Type II.

• Build a matrix of controls, owners, and evidence requirements
• Identify gaps in Type I or Type II audit preparation
• Track evidence collection for each control

Assess smart-home and commercial mesh networks, where devices relay communications. Covers Zigbee, Thread, and Matter, with methods for observing radio traffic, reviewing device setup and key handling, and testing exposure of lighting, locks, and sensors.

• Planning a smart-home mesh security assessment
• Reviewing Zigbee lighting and lock controls
• Checking Thread network credential handling

Use the AltLLM Portal CLI to create NOWPayments crypto payment links, check their status repeatedly until settlement, or pay supported links directly from a wallet. Includes handling discount codes and checking which payment currencies are allowed.

• Create a NOWPayments crypto payment link
• Monitor a payment link until settlement
• Pay a supported link directly from a wallet

Check AI watermarks through Google, OpenAI, Microsoft, or Meta verification services. The skill links results to file hashes, identifiers used to verify file integrity, and records separate evidence for each configured account and verification route.

• Checking watermarks through provider verification services
• Comparing Gemini results across configured accounts
• Recording API and browser checks separately

Evaluates, configures, and migrates workloads to AWS Lambda Managed Instances (LMI). Runs Lambda Event Functions (standard Lambda) on EC2 instances in the user's account while AWS manages provisioning, patching, scaling, routing, and load balancing. Triggers when queries mention Lambda Managed Instances, LMI, capacity providers, multi-concurrent execution environments, EC2-backed Lambda, persistent Lambda instances, PerExecutionEnvironmentMaxConcurrency, CapacityProviderConfig, cold start elimination via dedicated instances, migrating Lambda Event Functions to managed instances, or cost comparison between Lambda Event Functions and LMI with Savings Plans or Reserved Instances. Also covers long-running and asynchronous workloads and the 90-minute (5400s) function timeout for asynchronous and event-source-mapping (SQS, Kinesis, DynamoDB Streams / ESM) invocations, including how to raise the function timeout up to 90 minutes / 5400s and the related duration limits.

The English summary is being prepared. Showing the original description.

Für Mehrdeutigkeit 305c2: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Schnittstellenkarte mit Zuständigkeits- und Nachweisfragen.

The English summary is being prepared. Showing the original description.

Identify recurrent and driver copy number alterations across a tumor cohort with GISTIC2 (G-score, Ziggurat deconstruction, focal vs broad/arm-level analysis, q-values from permutation) and quantify copy-number signatures with the Steele 2022 COSMIC framework and the Drews 2022 CINSignatures framework. Covers driver-gene localization from recurrence peaks, distinguishing focal drivers from arm-level passengers, and the caller-sensitivity caveats of copy-number signatures. Use when finding recurrently amplified or deleted regions in a cohort, localizing driver genes, separating focal from broad events, running GISTIC2, or extracting copy-number mutational signatures.

The English summary is being prepared. Showing the original description.