Stats
Actions
Tags
Hunts data exfiltration indicators via network traffic analysis, detecting anomalous data flows, DNS tunnels, cloud storage uploads, and encrypted channel abuse. For threat hunting in compromised environments.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersecurity-skills-zh:hunting-for-data-exfiltration-indicatorsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
- 在失陷环境中主动狩猎数据窃取行为时
| 概念 | 描述 |
|---|---|
| T1041 | 通过 C2 通道外泄数据 |
| T1048 | 通过替代协议外泄数据 |
| T1048.001 | 通过对称加密非 C2 通道外泄 |
| T1048.002 | 通过非对称加密非 C2 通道外泄 |
| T1048.003 | 通过未加密/混淆非 C2 通道外泄 |
| T1567 | 通过 Web 服务外泄数据 |
| T1567.002 | 外泄至云存储 |
| T1052 | 通过物理介质外泄 |
| T1029 | 定时传输 |
| T1030 | 数据传输大小限制（暂存） |
| T1537 | 转移数据至云账户 |
| T1020 | 自动化外泄 |
| 工具 | 用途 |
|---|---|
| Splunk | 数据量分析与 SPL 查询的 SIEM |
| Zeek | 用于数据流分析的网络元数据 |
| Microsoft Defender for Cloud Apps | 云外泄检测的 CASB |
| Netskope | 云 DLP 与外泄检测 |
| Suricata | 协议异常检测的网络 IDS |
| RITA | DNS 外泄与信标检测 |
| ExtraHop | 数据流分析的网络流量分析 |
狩猎 ID：TH-EXFIL-[日期]-[序号]
外泄通道：[HTTP/DNS/邮件/云/USB]
来源：[主机/用户]
目标：[域名/IP/服务]
数据量：[字节/MB/GB]
时间段：[开始 - 结束]
协议：[HTTPS/DNS/SMTP/SMB]
涉及文件：[数量/类型]
风险等级：[严重/高/中/低]
置信度：[高/中/低]
npx claudepluginhub killvxk/cybersecurity-skills-zhHunt for data exfiltration through network traffic analysis, detecting unusual data flows, DNS tunneling, cloud storage uploads, and encrypted channel abuse.
Hunts for data exfiltration indicators via network traffic analysis, detecting unusual flows, DNS tunneling, cloud storage uploads, and encrypted channel abuse. For threat hunting and incident response.
Hunts for data exfiltration indicators via network traffic analysis, detecting unusual flows, DNS tunneling, cloud storage uploads, and encrypted channel abuse. For threat hunting and incident response.