网络运维工程师

access.md ★ 29.7k

from "anthropics"

Manage Discord channel access — approve pairings, edit allowlists, set DM/group policy. Use when the user asks to pair, approve someone, check who's allowed, or

hunting-for-ntlm-relay-attacks.md ★ 7.2k

from "mukul975"

Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic sig

building-detection-rules-with-sigma.md ★ 7.2k

from "mukul975"

Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel.

detecting-cryptomining-in-cloud.md ★ 7.2k

from "mukul975"

This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying crypto

analyzing-network-packets-with-scapy.md ★ 7.2k

from "mukul975"

Craft, send, sniff, and dissect network packets using Scapy for protocol analysis, network reconnaissance, and traffic anomaly detection in authorized security

analyzing-docker-container-forensics.md ★ 7.2k

from "mukul975"

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

performing-network-packet-capture-analysis.md ★ 7.2k

from "mukul975"

Perform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferr

analyzing-malware-sandbox-evasion-techniques.md ★ 7.2k

from "mukul975"

Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns f

performing-network-traffic-analysis-with-tshark.md ★ 7.2k

from "mukul975"

Automate network traffic analysis using tshark and pyshark for protocol statistics, suspicious flow detection, DNS anomaly identification, and IOC extraction fr

exploiting-ipv6-vulnerabilities.md ★ 7.2k

from "mukul975"

Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments

hunting-for-persistence-mechanisms-in-windows.md ★ 7.2k

from "mukul975"

Systematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services, startup folders, and WMI subscriptions.

analyzing-tls-certificate-transparency-logs.md ★ 7.2k

from "mukul975"

Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued

analyzing-windows-lnk-files-for-artifacts.md ★ 7.2k

from "mukul975"

Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.

recovering-from-ransomware-attack.md ★ 7.2k

from "mukul975"

Executes structured recovery from a ransomware incident following NIST and CISA frameworks, including environment isolation, forensic evidence preservation, cle

implementing-ransomware-kill-switch-detection.md ★ 7.2k

from "mukul975"

Detects and exploits ransomware kill switch mechanisms including mutex-based execution guards, domain-based kill switches, and registry-based termination checks