[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HN02GA8JR8GG7TNSAEXGJS":3,"skill-same:01M6HN02GA8JR8GG7TNSAEXGJS":122},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6HN02GA8JR8GG7TNSAEXGJS","performing-adversary-in-the-middle-phishing-detection",null,"Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-adversary-in-the-middle-phishing-detection\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"performing","phishing","detection","performing adversary in the middle phishing detection","adversary-in-the-middle","at","reverse","attacks","co","respond","de","steal","cm","cybersecurity","t1566","t1003","credential-theft","defense","proxy","pr","2026-11-10 10:12:30",false,"---\nname: performing-adversary-in-the-middle-phishing-detection\ndescription: Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.\ndomain: cybersecurity\nsubdomain: phishing-defense\ntags:\n- aitm\n- evilproxy\n- evilginx\n- phishing\n- mfa-bypass\n- session-hijacking\n- reverse-proxy\n- credential-theft\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AT-01\n- DE.CM-09\n- RS.CO-02\n- DE.AE-02\nmitre_attack:\n- T1566\n- T1598\n- T1534\n- T1036\n- T1003\ncategory: performing-adversary-in-the-middle-phishing-detection\n---\n# Performing Adversary-in-the-Middle Phishing Detection\n\n## Overview\nAdversary-in-the-Middle (AiTM) phishing attacks use reverse-proxy infrastructure to sit between the victim and the legitimate authentication service, intercepting both credentials and session cookies in real time. This allows attackers to bypass multi-factor authentication (MFA). The most prevalent PhaaS kits in 2025 include Tycoon 2FA, Sneaky 2FA, EvilProxy, and Evilginx. Over 1 million PhaaS attacks were detected in January-February 2025 alone. These attacks have evolved from QR codes to HTML attachments and SVG files for link distribution.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing adversary in the middle phishing detection\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Azure AD \u002F Entra ID Conditional Access policies\n- SIEM with authentication log ingestion (Azure AD sign-in logs)\n- Web proxy with SSL inspection and URL categorization\n- Endpoint Detection and Response (EDR) solution\n- FIDO2\u002Fphishing-resistant MFA capability\n\n## Key Concepts\n\n### How AiTM Works\n1. Victim receives phishing email with link to attacker-controlled domain\n2. Attacker domain runs reverse proxy that mirrors legitimate login page\n3. Victim enters credentials on proxied page; credentials captured in transit\n4. Reverse proxy forwards credentials to real authentication service\n5. MFA challenge sent to victim; victim completes MFA on proxied page\n6. Attacker captures session cookie returned by legitimate service\n7. Attacker replays session cookie to access victim's account without MFA\n\n### Major AiTM Kits (2025)\n| Kit | Type | Primary Targets | Evasion |\n|---|---|---|---|\n| Tycoon 2FA | PhaaS | Microsoft 365, Google | CAPTCHA, Cloudflare turnstile |\n| EvilProxy | PhaaS | Microsoft 365, Google, Okta | Random URLs, IP rotation |\n| Evilginx | Open-source | Any web application | Custom phishlets |\n| Sneaky 2FA | PhaaS | Microsoft 365 | Anti-bot checks |\n| NakedPages | PhaaS | Multiple | Minimal infrastructure |\n\n### Detection Indicators\n- Authentication from unusual IP not matching user profile\n- Session cookie reuse from different IP\u002Fdevice than authentication\n- Login page served from non-Microsoft\u002Fnon-Google infrastructure\n- CDN requests to legitimate auth providers from phishing domains\n- Impossible travel between authentication and session usage\n\n## Workflow\n\n### Step 1: Deploy Phishing-Resistant MFA\n- Implement FIDO2 security keys or Windows Hello for Business for high-value accounts\n- Configure Conditional Access to require phishing-resistant MFA for admins\n- Enable certificate-based authentication where possible\n- Disable SMS and voice MFA for privileged accounts\n- AiTM cannot intercept FIDO2 because authentication is bound to origin domain\n\n### Step 2: Configure Conditional Access Policies\n- Require compliant\u002Fmanaged device for sensitive application access\n- Block authentication from anonymous proxies and Tor exit nodes\n- Enforce token binding to limit session cookie replay\n- Configure continuous access evaluation (CAE) for real-time token revocation\n- Implement sign-in risk policies that require re-authentication for risky sign-ins\n\n### Step 3: Build AiTM Detection Rules\n- Alert on sign-in followed by session from different IP within 10 minutes\n- Detect authentication where proxy IP does not match user's expected location\n- Monitor for impossible travel patterns in session usage\n- Alert on inbox rules created immediately after authentication (common post-compromise)\n- Detect new MFA method registration from suspicious sign-in\n\n### Step 4: Monitor Web Proxy for AiTM Infrastructure\n- Log and analyze DNS queries to newly registered domains\n- Detect connections to known PhaaS infrastructure IPs\n- Alert on authentication page backgrounds loaded from legitimate CDNs through proxy domains\n- Monitor for SSL certificates issued to domains mimicking corporate login pages\n- Block access to known EvilProxy\u002FEvilginx infrastructure via threat intelligence\n\n### Step 5: Implement Post-Compromise Detection\n- Alert on mailbox forwarding rules created after suspicious authentication\n- Detect OAuth app consent after AiTM sign-in\n- Monitor for email sending patterns indicating BEC follow-up\n- Alert on SharePoint\u002FOneDrive mass download after session hijack\n- Track lateral movement from compromised account\n\n## Tools & Resources\n- **Microsoft Entra ID Protection**: Risk-based Conditional Access\n- **Azure AD Sign-in Logs**: Authentication event analysis\n- **Okta ThreatInsight**: AiTM proxy detection at IdP level\n- **Sekoia TDR**: AiTM campaign tracking and intelligence\n- **Evilginx (defensive)**: Understanding attack mechanics for detection\n\n## Validation\n- Phishing-resistant MFA blocks AiTM session capture in test scenario\n- Conditional Access denies session replay from different device\u002FIP\n- SIEM alerts fire on simulated AiTM sign-in patterns\n- Web proxy blocks connections to known PhaaS infrastructure\n- Post-compromise rules detect inbox rule creation after suspicious auth\n","# Performing Adversary-in-the-Middle Phishing Detection\n\n## Overview\nAdversary-in-the-Middle (AiTM) phishing attacks use reverse-proxy infrastructure to sit between the victim and the legitimate authentication service, intercepting both credentials and session cookies in real time. This allows attackers to bypass multi-factor authentication (MFA). The most prevalent PhaaS kits in 2025 include Tycoon 2FA, Sneaky 2FA, EvilProxy, and Evilginx. Over 1 million PhaaS attacks were detected in January-February 2025 alone. These attacks have evolved from QR codes to HTML attachments and SVG files for link distribution.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing adversary in the middle phishing detection\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Azure AD \u002F Entra ID Conditional Access policies\n- SIEM with authentication log ingestion (Azure AD sign-in logs)\n- Web proxy with SSL inspection and URL categorization\n- Endpoint Detection and Response (EDR) solution\n- FIDO2\u002Fphishing-resistant MFA capability\n\n## Key Concepts\n\n### How AiTM Works\n1. Victim receives phishing email with link to attacker-controlled domain\n2. Attacker domain runs reverse proxy that mirrors legitimate login page\n3. Victim enters credentials on proxied page; credentials captured in transit\n4. Reverse proxy forwards credentials to real authentication service\n5. MFA challenge sent to victim; victim completes MFA on proxied page\n6. Attacker captures session cookie returned by legitimate service\n7. Attacker replays session cookie to access victim's account without MFA\n\n### Major AiTM Kits (2025)\n| Kit | Type | Primary Targets | Evasion |\n|---|---|---|---|\n| Tycoon 2FA | PhaaS | Microsoft 365, Google | CAPTCHA, Cloudflare turnstile |\n| EvilProxy | PhaaS | Microsoft 365, Google, Okta | Random URLs, IP rotation |\n| Evilginx | Open-source | Any web application | Custom phishlets |\n| Sneaky 2FA | PhaaS | Microsoft 365 | Anti-bot checks |\n| NakedPages | PhaaS | Multiple | Minimal infrastructure |\n\n### Detection Indicators\n- Authentication from unusual IP not matching user profile\n- Session cookie reuse from different IP\u002Fdevice than authentication\n- Login page served from non-Microsoft\u002Fnon-Google infrastructure\n- CDN requests to legitimate auth providers from phishing domains\n- Impossible travel between authentication and session usage\n\n## Workflow\n\n### Step 1: Deploy Phishing-Resistant MFA\n- Implement FIDO2 security keys or Windows Hello for Business for high-value accounts\n- Configure Conditional Access to require phishing-resistant MFA for admins\n- Enable certificate-based authentication where possible\n- Disable SMS and voice MFA for privileged accounts\n- AiTM cannot intercept FIDO2 because authentication is bound to origin domain\n\n### Step 2: Configure Conditional Access Policies\n- Require compliant\u002Fmanaged device for sensitive application access\n- Block authentication from anonymous proxies and Tor exit nodes\n- Enforce token binding to limit session cookie replay\n- Configure continuous access evaluation (CAE) for real-time token revocation\n- Implement sign-in risk policies that require re-authentication for risky sign-ins\n\n### Step 3: Build AiTM Detection Rules\n- Alert on sign-in followed by session from different IP within 10 minutes\n- Detect authentication where proxy IP does not match user's expected location\n- Monitor for impossible travel patterns in session usage\n- Alert on inbox rules created immediately after authentication (common post-compromise)\n- Detect new MFA method registration from suspicious sign-in\n\n### Step 4: Monitor Web Proxy for AiTM Infrastructure\n- Log and analyze DNS queries to newly registered domains\n- Detect connections to known PhaaS infrastructure IPs\n- Alert on authentication page backgrounds loaded from legitimate CDNs through proxy domains\n- Monitor for SSL certificates issued to domains mimicking corporate login pages\n- Block access to known EvilProxy\u002FEvilginx infrastructure via threat intelligence\n\n### Step 5: Implement Post-Compromise Detection\n- Alert on mailbox forwarding rules created after suspicious authentication\n- Detect OAuth app consent after AiTM sign-in\n- Monitor for email sending patterns indicating BEC follow-up\n- Alert on SharePoint\u002FOneDrive mass download after session hijack\n- Track lateral movement from compromised account\n\n## Tools & Resources\n- **Microsoft Entra ID Protection**: Risk-based Conditional Access\n- **Azure AD Sign-in Logs**: Authentication event analysis\n- **Okta ThreatInsight**: AiTM proxy detection at IdP level\n- **Sekoia TDR**: AiTM campaign tracking and intelligence\n- **Evilginx (defensive)**: Understanding attack mechanics for detection\n\n## Validation\n- Phishing-resistant MFA blocks AiTM session capture in test scenario\n- Conditional Access denies session replay from different device\u002FIP\n- SIEM alerts fire on simulated AiTM sign-in patterns\n- Web proxy blocks connections to known PhaaS infrastructure\n- Post-compromise rules detect inbox rule creation after suspicious auth\n",{"name":5,"tags":44,"author":51,"domain":32,"license":15,"version":52,"category":5,"nist_csf":53,"subdomain":58,"description":7,"mitre_attack":59},[45,46,47,20,48,49,50,35],"aitm","evilproxy","evilginx","mfa-bypass","session-hijacking","reverse-proxy","mahipal","1.0",[54,55,56,57],"PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02","phishing-defense",[60,61,62,63,64],"T1566","T1598","T1534","T1036","T1003","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fperforming-adversary-in-the-middle-phishing-detection",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill performing-adversary-in-the-middle-phishing-detection",{"tool":79,"command":80},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill performing-adversary-in-the-middle-phishing-detection",{"tool":82,"command":83},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill performing-adversary-in-the-middle-phishing-detection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-adversary-in-the-middle-phishing-detection\u002FSKILL.md",true,[87,93,98,104,108,112,118],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"assets\u002Ftemplate.md","ASSET","资产文件",1375,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-adversary-in-the-middle-phishing-detection\u002Fassets\u002Ftemplate.md",{"path":94,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-adversary-in-the-middle-phishing-detection\u002FLICENSE",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fapi-reference.md","REFERENCE","参考文档",2815,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-adversary-in-the-middle-phishing-detection\u002Freferences\u002Fapi-reference.md",{"path":105,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fstandards.md",1446,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-adversary-in-the-middle-phishing-detection\u002Freferences\u002Fstandards.md",{"path":109,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fworkflows.md",1994,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-adversary-in-the-middle-phishing-detection\u002Freferences\u002Fworkflows.md",{"path":113,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":116,"sourceHtmlUrl":117},"scripts\u002Fagent.py","SCRIPT","脚本",7073,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-adversary-in-the-middle-phishing-detection\u002Fscripts\u002Fagent.py",{"path":119,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":120,"sourceHtmlUrl":121},"scripts\u002Fprocess.py",11016,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-adversary-in-the-middle-phishing-detection\u002Fscripts\u002Fprocess.py",[123,153,179,202,218,236],{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":134,"publishedAt":39},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[129],{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[135,136,137,138,139,140,32,141,142,143,144,145,21,146,147,148,149,150,151,152],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":159,"publishedAt":39},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[160,161,162,163,164,32,165,166,167,168,169,170,171,172,173,174,175,176,177,178],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":39},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[186,187,150,32,188,189,190,146,147,191,192,193,194,195,196,197,198,199,200,201],"security","triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":208,"publishedAt":39},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[186,209,210,187,150,164,32,211,189,144,212,213,146,147,214,192,174,215,216,217],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":219,"name":220,"nameZh":6,"description":221,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":222,"categories":223,"keywords":224,"publishedAt":39},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[186,225,226,227,228,229,32,230,231,232,189,233,146,33,234,235,195,31,150,29],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","notable-events","incident-review",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":242,"publishedAt":39},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[243,244,245,246,32,247,248,249,250,251,252,33,253,254,31,255,29,256,257,258],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]