[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7EKZPZ7ZD6ASTYADC1413TX":3,"skill-same:01M7EKZPZ7ZD6ASTYADC1413TX":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":6,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M7EKZPZ7ZD6ASTYADC1413TX","hunting-for-unusual-network-connections",null,"Runs a hypothesis-driven threat hunt for command-and-control activity (T1071) by querying SIEM\u002FEDR network telemetry for anomalous outbound traffic, rare destinations, non-standard ports, and unusual connection frequencies from endpoints. Use when hunting for beaconing\u002FC2 traffic, after threat intel flags suspicious infrastructure, or when alerts fire on anomalous connections.","lza6\u002FArmor-piercing-system-prompts","lza6","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F128880206?v=4","01M7EB3K7WPX5T28EJ2NVHE6EG","Chinese-tingfeng","01M7EB3K97E1KQ16QWKJMFNGX8",11,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fhunting-for-unusual-network-connections\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: hunting-for-unusual-network-connections\ndescription: Runs a hypothesis-driven threat hunt for command-and-control activity (T1071) by querying SIEM\u002FEDR network telemetry for anomalous outbound traffic, rare destinations, non-standard ports, and unusual connection frequencies from endpoints. Use when hunting for beaconing\u002FC2 traffic, after threat intel flags suspicious infrastructure, or when alerts fire on anomalous connections.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- mitre-attack\n- network-analysis\n- c2\n- anomaly-detection\n- proactive-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Certificate Analysis\n- Application Protocol Command Analysis\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmitre_attack:\n- T1046\n- T1057\n- T1082\n- T1083\n- T1071\n---\n\n# Hunting For Unusual Network Connections\n\n## When to Use\n\n- When proactively hunting for indicators of hunting for unusual network connections in the environment\n- After threat intelligence indicates active campaigns using these techniques\n- During incident response to scope compromise related to these techniques\n- When EDR or SIEM alerts trigger on related indicators\n- During periodic security assessments and purple team exercises\n\n## Prerequisites\n\n- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)\n- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)\n- Sysmon deployed with comprehensive configuration\n- Windows Security Event Log forwarding enabled\n- Threat intelligence feeds for IOC correlation\n\n## Workflow\n\n1. **Formulate Hypothesis**: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.\n2. **Identify Data Sources**: Determine which logs and telemetry are needed to validate or refute the hypothesis.\n3. **Execute Queries**: Run detection queries against SIEM and EDR platforms to collect relevant events.\n4. **Analyze Results**: Examine query results for anomalies, correlating across multiple data sources.\n5. **Validate Findings**: Distinguish true positives from false positives through contextual analysis.\n6. **Correlate Activity**: Link findings to broader attack chains and threat actor TTPs.\n7. **Document and Report**: Record findings, update detection rules, and recommend response actions.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1071 | Application Layer Protocol |\n| T1095 | Non-Application Layer Protocol |\n| T1571 | Non-Standard Port |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CrowdStrike Falcon | EDR telemetry and threat detection |\n| Microsoft Defender for Endpoint | Advanced hunting with KQL |\n| Splunk Enterprise | SIEM log analysis with SPL queries |\n| Elastic Security | Detection rules and investigation timeline |\n| Sysmon | Detailed Windows event monitoring |\n| Velociraptor | Endpoint artifact collection and hunting |\n| Sigma Rules | Cross-platform detection rule format |\n\n## Common Scenarios\n\n1. **Scenario 1**: Backdoor communicating to C2 on non-standard port\n2. **Scenario 2**: Data exfiltration over DNS to attacker nameserver\n3. **Scenario 3**: Compromised host scanning internal network\n4. **Scenario 4**: Cryptominer connecting to mining pool\n\n## Output Format\n\n```\nHunt ID: TH-HUNTIN-[DATE]-[SEQ]\nTechnique: T1071\nHost: [Hostname]\nUser: [Account context]\nEvidence: [Log entries, process trees, network data]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\nConfidence: [High\u002FMedium\u002FLow]\nRecommended Action: [Containment, investigation, monitoring]\n```\n","# Hunting For Unusual Network Connections\n\n## When to Use\n\n- When proactively hunting for indicators of hunting for unusual network connections in the environment\n- After threat intelligence indicates active campaigns using these techniques\n- During incident response to scope compromise related to these techniques\n- When EDR or SIEM alerts trigger on related indicators\n- During periodic security assessments and purple team exercises\n\n## Prerequisites\n\n- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)\n- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)\n- Sysmon deployed with comprehensive configuration\n- Windows Security Event Log forwarding enabled\n- Threat intelligence feeds for IOC correlation\n\n## Workflow\n\n1. **Formulate Hypothesis**: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.\n2. **Identify Data Sources**: Determine which logs and telemetry are needed to validate or refute the hypothesis.\n3. **Execute Queries**: Run detection queries against SIEM and EDR platforms to collect relevant events.\n4. **Analyze Results**: Examine query results for anomalies, correlating across multiple data sources.\n5. **Validate Findings**: Distinguish true positives from false positives through contextual analysis.\n6. **Correlate Activity**: Link findings to broader attack chains and threat actor TTPs.\n7. **Document and Report**: Record findings, update detection rules, and recommend response actions.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1071 | Application Layer Protocol |\n| T1095 | Non-Application Layer Protocol |\n| T1571 | Non-Standard Port |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CrowdStrike Falcon | EDR telemetry and threat detection |\n| Microsoft Defender for Endpoint | Advanced hunting with KQL |\n| Splunk Enterprise | SIEM log analysis with SPL queries |\n| Elastic Security | Detection rules and investigation timeline |\n| Sysmon | Detailed Windows event monitoring |\n| Velociraptor | Endpoint artifact collection and hunting |\n| Sigma Rules | Cross-platform detection rule format |\n\n## Common Scenarios\n\n1. **Scenario 1**: Backdoor communicating to C2 on non-standard port\n2. **Scenario 2**: Data exfiltration over DNS to attacker nameserver\n3. **Scenario 3**: Compromised host scanning internal network\n4. **Scenario 4**: Cryptominer connecting to mining pool\n\n## Output Format\n\n```\nHunt ID: TH-HUNTIN-[DATE]-[SEQ]\nTechnique: T1071\nHost: [Hostname]\nUser: [Account context]\nEvidence: [Log entries, process trees, network data]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\nConfidence: [High\u002FMedium\u002FLow]\nRecommended Action: [Containment, investigation, monitoring]\n```\n",{"name":5,"tags":24,"author":31,"domain":32,"license":15,"version":33,"nist_csf":34,"subdomain":25,"description":7,"mitre_attack":39,"d3fend_techniques":45},[25,26,27,28,29,30],"threat-hunting","mitre-attack","network-analysis","c2","anomaly-detection","proactive-detection","mahipal","cybersecurity","1.0",[35,36,37,38],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[40,41,42,43,44],"T1046","T1057","T1082","T1083","T1071",[46,47,48,49,50],"File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis","main","d69096e239f2a89aabc2cd078c47664a9d3b1e11","04-安全渗透\u002Fhunting-for-unusual-network-connections",3,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts","https:\u002F\u002Fgithub.com\u002Flza6","个人vx：Tf00798\r\n个人✈：@TFGY999","2026-10-08 14:29:22",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add lza6\u002FArmor-piercing-system-prompts --skill hunting-for-unusual-network-connections",{"tool":65,"command":66},"bunx","bunx skills add lza6\u002FArmor-piercing-system-prompts --skill hunting-for-unusual-network-connections",{"tool":68,"command":69},"pnpm","pnpm dlx skills add lza6\u002FArmor-piercing-system-prompts --skill hunting-for-unusual-network-connections","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fhunting-for-unusual-network-connections\u002FSKILL.md",true,[73,79,83],{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fapi-reference.md","REFERENCE","参考文档",1971,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fhunting-for-unusual-network-connections\u002Freferences\u002Fapi-reference.md",{"path":80,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fstandards.md",1586,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fhunting-for-unusual-network-connections\u002Freferences\u002Fstandards.md",{"path":84,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fworkflows.md",2992,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fhunting-for-unusual-network-connections\u002Freferences\u002Fworkflows.md",[88,96,103,110,117,124],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":19},"01M7EXRM12046G0GM1WGMMFXCN","ci-cd-and-automation","Automates CI\u002FCD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.","MIT","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fci-cd-and-automation\u002FSKILL.md",[],[],{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":19},"01M7EXRFYYSJ3Y15AGPDDEWWQD","chrome-devtools","Uses Chrome DevTools via MCP for efficient debugging, troubleshooting and browser automation. Use when debugging web pages, automating browser interactions, analyzing performance, or inspecting network requests. This skill does not apply to `--slim` mode (MCP configuration).","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchrome-devtools\u002FSKILL.md",[],[],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":19},"01M7EXR6EYPE4X5X1BTAE6QJRV","chrome-cdp","Drive a real Chrome via the Chrome DevTools Protocol (CDP). Ensures a\ndebuggable Chrome is running (launching it if needed) so the agent can\nnavigate, read page content, inspect the DOM, run JavaScript, and take\nscreenshots — without the user typing any launch command. Includes a\nfirst-class \"review a live running app\" flow: point Chrome at the app under\ndevelopment and inspect\u002Fscreenshot the REAL page (what a static-artifact tool\ncannot do). Backed by Glimpse and the chrome-devtools MCP server. Use when\nasked to \"use chrome\", \"open chrome\", \"drive my browser\", \"read the page in\nchrome\", \"review the running app\", \"screenshot the app\", or \"\u002Fchrome-cdp\".","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchrome-cdp\u002FSKILL.md",[],[],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":19},"01M7EXR1Y7E79KQKG4J798XGH6","check-identity-pack","Run an AFP 100-point or AUSTRAC safe-harbour identity check over a set of documents, and report exactly what's missing. Use when the user asks to check identity documents, verify someone's ID for onboarding, or assess whether a document pack satisfies Australian identity requirements.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fcheck-identity-pack\u002FSKILL.md",[],[],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":19},"01M7EXQXW7C7PGREJW9ZZTZ16H","changelog","Auto-generates a changelog from git commits, sprint data, and design documents. Produces both internal and player-facing versions.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchangelog\u002FSKILL.md",[],[],{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":130,"publishedAt":19},"01M7EXQMH2ZME3ANN8Q8MEWPFB","cellxgene-census","Query the CZ CELLxGENE Census programmatically for versioned public single-cell and spatial transcriptomics data. Use when you need population-scale cell metadata, gene expression slices, Census summary counts, source H5AD URIs\u002Fdownloads, embeddings, spatial Census data, or reference atlas comparisons across organisms, tissues, diseases, assays, and cell types. For analyzing your own local single-cell data use scanpy, anndata, or scvi-tools.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fcellxgene-census\u002FSKILL.md",[],[]]