AI导哈

数据与研究

analyzing-dns-logs-for-exfiltration

mukul975/anthro…y-skills

Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.

  • 529 次安装
  • 3.5万 星标
  • 收录于

安装命令

npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill analyzing-dns-logs-for-exfiltration

SKILL.md

Analyzing DNS Logs for Exfiltration

When to Use

Use this skill when:

  • SOC teams suspect data exfiltration through DNS tunneling to bypass firewall/proxy controls
  • Threat intelligence indicates adversaries using DNS-based C2 channels (e.g., Cobalt Strike DNS beacon)
  • UEBA detects anomalous DNS query volumes from specific hosts
  • Malware analysis reveals DNS-over-HTTPS (DoH) or DNS tunneling capabilities

Do not use for standard DNS troubleshooting or availability monitoring — this skill focuses on security-relevant DNS abuse detection.

Prerequisites

  • DNS query logging enabled (Windows DNS Server, Bind, Infoblox, or Cisco Umbrella)
  • DNS logs ingested into SIEM (Splunk with Stream:DNS, dns sourcetype, or Zeek DNS logs)
  • Passive DNS data for historical domain resolution analysis
  • Baseline of normal DNS behavior (query volume, domain distribution, TXT record frequency)
  • Python with math and collections libraries for entropy calculation

相关 Skills

testing-api-security-with-owasp-top-10mukul975/anthro…y-skillsSystematically assesses REST, GraphQL, and gRPC API endpoints against the OWASP API Security Top 10 (2023) using Burp Suite and Postman for automated and manual testing. Use during authorized API penetration tests, before deploying new endpoints to production, or when validating API gateway controls and rate limiting.测试与安全807analyzing-api-gateway-access-logsmukul975/anthro…y-skillsParses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.后端与数据库769analyzing-android-malware-with-apktoolmukul975/anthro…y-skillsPerform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.移动开发683acquiring-disk-image-with-dd-and-dcflddmukul975/anthro…y-skillsCreate forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.设计与多媒体678testing-for-xss-vulnerabilitiesmukul975/anthro…y-skillsTests web applications for reflected, stored, and DOM-based Cross-Site Scripting by injecting JavaScript payloads with Burp Suite (XSS extensions, Active Scan++) and browser tools, then bypassing sanitization and CSP to demonstrate session hijacking and user impersonation. Use for OWASP WSTG client-side injection testing or when evaluating input sanitization and output encoding coverage.测试与安全677performing-web-application-penetration-testmukul975/anthro…y-skillsPerforms systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses Burp Suite as the primary interception proxy alongside manual testing techniques to find flaws that automated scanners miss. Activates for requests involving web app pentest, OWASP testing, application security assessment, or web vulnerability testing.测试与安全668