“tunneling”的搜索结果

Tunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat, DNS/ICMP/HTTP tunneling, ProxyChains, and multi-layer pivoting strategies.

中文简介正在准备中。当前显示原文说明。

Detects DNS-based tunneling and data exfiltration in DNS logs: scoring high query volume to single domains, long/high-entropy subdomains, unusual record types, and encoded payload labels. Activates for requests to hunt DNS tunneling, detect DNS exfiltration, or analyze suspicious DNS query patterns.

中文简介正在准备中。当前显示原文说明。

Analyze DNS logs to find signs of hidden data transfers. Use query length, character randomness, traffic volume, and response sizes to identify suspicious domains and support monitoring rules with Python, Suricata, and Splunk examples.

中文简介正在准备中。当前显示英语简介。

• Investigating possible data theft through DNS traffic
• Ranking suspicious domains found in DNS logs
• Creating DNS tunneling detection rules

Analyze DNS logs for signs of hidden command traffic and data theft. Use character randomness, query timing, TXT record inspection, and machine learning to identify suspicious domains and support security monitoring rules.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected DNS tunneling
• Classifying algorithmically generated domains
• Detecting periodic DNS beacon traffic

Examine captured network traffic for hidden malware communications in DNS, ICMP, and HTTP. Analyze domain patterns, packet sizes, and traffic frequency to identify suspicious channels used for remote control or data theft.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious DNS, ICMP, or HTTP traffic
• Hunting for hidden malware control channels in packet captures
• Assessing possible data theft through unusual network traffic

Supports authorized security exercises that test data transfer outside a network. Organizes channel choices, compression, encryption, splitting, and receipt verification, alongside the monitoring signals defenders can use to identify different transfer methods.

中文简介正在准备中。当前显示英语简介。

• Comparing data transfer channels for an authorized exercise
• Planning compression, encryption, and file splitting
• Verifying received files against SHA-256 records

Dense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICMP tunneling (icmpsh, ptunnel-ng), cloud storage dead drops (S3 presigned URLs, Azure Blob SAS tokens, GCS signed URLs), email-based exfil (SMTP, EWS, draft method), steganography (image, audio, document metadata), encoding/encryption (base64 chunking, XOR, AES), covert channels (custom protocol tunneling, HTTP header encoding, timing channels), and data staging (compression, splitting, encryption). Tools: dnscat2, iodine, dns2tcp, PacketWhisper, chisel, stunnel, icmpsh, ptunnel-ng, steghide, zsteg, OpenStego. MITRE ATT&CK: T1048 (Exfiltration Over Alternative Protocol), T1041 (Exfiltration Over C2 Channel), T1567 (Exfiltration Over Web Service), T1029 (Scheduled Transfer), T1030 (Data Transfer Size Limits), T1132 (Data Encoding), T1001 (Data Obfuscation). Use when planning or executing data exfiltration during authorized red team engagements or post-exploita...

中文简介正在准备中。当前显示原文说明。

Analyze Zeek DNS logs for possible data theft hidden in domain queries. The skill examines unusual character patterns, long labels, distinct subdomains, and query volume, then ranks suspicious domains and produces a JSON evidence report.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected DNS tunneling
• Finding possible data leaks hidden in DNS queries
• Ranking suspicious domains and identifying source IPs

Analyze DNS query logs for signs of hidden data transfers and attacker command channels. This skill uses unusual name lengths, randomness, and traffic volumes, then correlates findings with endpoint processes and estimates possible data loss.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected data theft through DNS
• Finding algorithmically generated domains used by malware
• Reviewing hosts with unusually high DNS query volumes

Find specialist playbooks for internal network penetration testing after initial access is established. Covers movement between hosts, credential collection, privilege escalation, persistent access, tunneling, and assessments involving Active Directory, certificate services, Exchange, and SharePoint.

中文简介正在准备中。当前显示英语简介。

• Plan internal network testing after gaining initial access
• Find playbooks for movement between hosts and credential collection
• Review privilege escalation and persistent access test areas

Tune game physics for stable, good-feeling motion — fixed vs variable timestep, render interpolation, mass/gravity/drag, continuous collision detection (CCD) to stop tunneling, fixing jitter, and collision layers/masks. Engine-neutral. Use when the user mentions physics feel, jitter, tunneling, fixed timestep, FixedUpdate, CCD, bouncing/unstable physics, or collision layers.

中文简介正在准备中。当前显示原文说明。

Expert-level quantum mechanics knowledge. Use when working with wave functions, Schrodinger equation, quantum states, operators, uncertainty principle, quantum tunneling, spin, angular momentum, perturbation theory, or quantum entanglement. Also use when the user mentions 'wave function', 'Schrodinger', 'Heisenberg', 'quantum state', 'eigenvalue', 'superposition', 'tunneling', 'spin', 'Hilbert space', 'Dirac notation', 'commutator', or 'quantum measurement'.

中文简介正在准备中。当前显示原文说明。

Detect data exfiltration through DNS tunneling by analyzing query entropy, subdomain length, query volume, TXT record abuse, and response payload sizes using passive DNS monitoring.

中文简介正在准备中。当前显示原文说明。

Detects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. Activates for requests involving DNS-based C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or DGA domain classification.

中文简介正在准备中。当前显示原文说明。

Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 and data exfiltration.

中文简介正在准备中。当前显示原文说明。

Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.

中文简介正在准备中。当前显示原文说明。

Detect data exfiltration through DNS tunneling by analyzing query entropy, subdomain length, query volume, TXT record abuse, and response payload sizes using passive DNS monitoring.

中文简介正在准备中。当前显示原文说明。

Detects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. Activates for requests involving DNS-based C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or DGA domain classification.

中文简介正在准备中。当前显示原文说明。

Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 and data exfiltration.

中文简介正在准备中。当前显示原文说明。

Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.

中文简介正在准备中。当前显示原文说明。

Detect data exfiltration through DNS tunneling by analyzing query entropy, subdomain length, query volume, TXT record abuse, and response payload sizes using passive DNS monitoring.

中文简介正在准备中。当前显示原文说明。

Detects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. Activates for requests involving DNS-based C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or DGA domain classification.

中文简介正在准备中。当前显示原文说明。

Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.

中文简介正在准备中。当前显示原文说明。

Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 and data exfiltration.

中文简介正在准备中。当前显示原文说明。