Network Security

detecting-shadow-it-cloud-usage helps identify unauthorized SaaS and cloud usage from proxy logs, DNS queries, and netflow. It classifies domains, compares them with approved lists, and supports security audit workflows with structured evidence from the detecting-shadow-it-cloud-usage skill guide.

The detecting-network-anomalies-with-zeek skill helps deploy Zeek for passive network monitoring, review structured logs, and build custom detections for beaconing, DNS tunneling, and unusual protocol activity. It is suited for threat hunting, incident response, SIEM-ready network metadata, and Security Audit workflows—not inline prevention.

detecting-beaconing-patterns-with-zeek helps analyze Zeek conn.log intervals to detect C2-style beaconing. It uses ZAT, groups flows by source, destination, and port, and scores low-jitter patterns with statistical checks. Ideal for SOC, threat hunting, incident response, and detecting-beaconing-patterns-with-zeek for Security Audit workflows.

The configuring-aws-verified-access-for-ztna skill helps you design and configure AWS Verified Access for VPN-less zero trust network access with identity and device posture checks in Cedar. Use this configuring-aws-verified-access-for-ztna guide for access control planning, trust providers, group policies, and endpoint setup.

analyzing-ransomware-network-indicators helps analyze Zeek conn.log and NetFlow to spot C2 beaconing, TOR exits, exfiltration, and suspicious DNS for Security Audit and incident response.

The security skill creates PlantUML security architecture diagrams with AWS stencils for identity, encryption, firewalling, compliance, and threat detection. Use it for IAM flows, zero-trust designs, encryption pipelines, Security Audit diagrams, and review-ready documentation. It is not meant for general cloud infrastructure or generic UML modeling.

hunting-advanced-persistent-threats is a threat-hunting skill for detecting APT-style activity across endpoint, network, and memory telemetry. It helps analysts build hypothesis-driven hunts, map findings to MITRE ATT&CK, and turn threat intel into practical queries and investigation steps instead of ad hoc searches.

detecting-port-scanning-with-fail2ban helps configure Fail2ban to detect port scans, SSH brute force attempts, and reconnaissance, then ban suspicious IPs and alert security teams. This skill fits hardening and detecting-port-scanning-with-fail2ban for Security Audit workflows, with practical guidance for logs, jails, filters, and safe tuning.

detecting-arp-poisoning-in-network-traffic helps detect ARP spoofing in live traffic or PCAPs using ARPWatch, Dynamic ARP Inspection, Wireshark, and Python checks. Built for incident response, SOC triage, and repeatable analysis of IP-to-MAC changes, gratuitous ARPs, and MITM indicators.

detecting-lateral-movement-in-network helps detect post-compromise lateral movement in enterprise networks using Windows event logs, Zeek telemetry, SMB, RDP, and SIEM correlation. It is useful for threat hunting, incident response, and detecting-lateral-movement-in-network for Security Audit reviews with practical detection workflows.

detecting-cryptomining-in-cloud helps security teams detect unauthorized cryptomining in cloud workloads by correlating cost spikes, mining-port traffic, GuardDuty crypto findings, and runtime process evidence. Use it for triage, detection engineering, and detecting-cryptomining-in-cloud for Security Audit workflows.

detecting-command-and-control-over-dns is a cybersecurity skill for spotting C2 over DNS, including tunneling, beaconing, DGA domains, and TXT/CNAME abuse. It supports SOC analysts, threat hunters, and security audits with entropy checks, passive DNS correlation, and Zeek or Suricata-style detection workflows.

detecting-attacks-on-scada-systems is a cybersecurity skill for spotting attacks on SCADA and OT/ICS environments. It helps analyze industrial protocol abuse, unauthorized PLC commands, HMI compromise, historian tampering, and denial-of-service, with practical guidance for incident response and detection validation.

The configuring-suricata-for-network-monitoring skill helps deploy and tune Suricata for IDS/IPS monitoring, EVE JSON logging, rules management, and SIEM-ready output. It suits the configuring-suricata-for-network-monitoring for Security Audit workflow when you need practical setup, validation, and false-positive reduction.

configuring-ldap-security-hardening helps security engineers and auditors assess LDAP risks, including anonymous bind, weak signing, missing LDAPS, and channel binding gaps. Use this configuring-ldap-security-hardening guide to review the reference docs, run the Python audit helper, and produce practical remediation for a Security Audit.

building-c2-infrastructure-with-sliver-framework helps authorized red team and Security Audit work plan, install, and use Sliver-based C2 infrastructure with redirectors, HTTPS listeners, operator access, and resilience checks. It includes a practical guide, workflow files, and repo scripts for deployment and validation.

analyzing-network-traffic-of-malware helps inspect PCAPs and telemetry from sandbox runs or incident response to find C2, exfiltration, payload downloads, DNS tunneling, and detection ideas. It is a practical analyzing-network-traffic-of-malware guide for Security Audit and malware triage.

analyzing-command-and-control-communication helps analyze malware C2 traffic to identify beaconing, decode commands, map infrastructure, and support Security Audit, threat hunting, and malware triage with PCAP-based evidence and practical workflow guidance.