net-capture-zeek-zeekanomaly
| | DNS_Tunneling_Detected | 10.10.3.45 | 8.8.8.8 | 847 queries to suspect-domain.
- License 许可
- MIT
- 最近更新
- 2026-09-01
- Stars
- ★ 0
- Forks
- 0
01 前言 Front Matter
- name
- net-capture-zeek-zeekanomaly
- domain
- cybersecurity
- description
- | | DNS_Tunneling_Detected | 10.10.3.45 | 8.8.8.8 | 847 queries to suspect-domain.
02 资源文件 1
- 参考文档index.json565 B
03 SKILL.md 正文
| | DNS_Tunneling_Detected | 10.10.3.45 | 8.8.8.8 | 847 queries to suspect-domain.xyz in 5 min | | Possible_Beaconing | 10.10.5.12 | 203.0.113.50:443 | 62 connections with 59.8s avg interval | | SSL::Invalid_Server_Cert | 10.10.8.22 | 198.51.100.33:443 | Self-signed cert, CN=localhost | | SSH::Password_Guessing | 45.33.32.156 | 10.10.20.11:22 | 487 failed attempts in 30 min |
Recommendations
- Isolate 10.10.3.45 and investigate for DNS tunneling malware
- Block 203.0.113.50 at firewall and forensically image 10.10.5.12
- Investigate self-signed TLS certificate on 198.51.100.33
- Block 45.33.32.156 and enforce SSH key-only authentication
04 同仓库更多 Skills
services-wmi-persistence-detect
Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.
services-wmi-exec-exploit
Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.
registry-artifact-extract
Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
processes-token-impersonate-detect
Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.
processes-thread-injection-detect
Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.
processes-hollow-technique-detect
Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.