CND
Ctrlk
  • CND
    • WHOAMI
    • PROJECTS
    • SELF DEVELOPMENT
  • PLAYBOOK
    • DCO
      • 01.PRE-ENGAGEMENT
      • 02.ENGAGEMENT
        • EXECUTE
          • 01.PRE-HUNT
          • 02.THREAT HUNTING
            • QUICK WINS
            • SIEM
              • SPLUNK
                • INITIAL TRIAGE
                • ANOMALY DETECTION
                  • USER AGENTS
                  • TRACING ATTACK CHAIN
                  • PATH TRAVERSAL
                  • SQL INJECTION
                  • EXFILTRATION
                  • RANSOMWARE STAGING & RCE
                  • OUTBOUND C2 COMMS CORRELATION
                  • COMMAND INJECTIONS
              • ELK
          • INCIDENT RESPONSE
          • FORENSICS
        • ASSESS
      • 03.POST-ENGAGEMENT
    • OCO
    • DEV
    • SRE
  • ENGINEERING
    • INSTALLATION PROCEDURES
    • CONFIGURATION PROCEDURES
  • SYSTEM ADMINISTRATION
    • LINUX
    • WINDOWS
  • TOOLING
    • OCO
    • DCO
    • DEV
    • SRE
    • ENG
Powered by GitBook
On this page
  1. PLAYBOOK
  2. DCO
  3. 02.ENGAGEMENT
  4. EXECUTE
  5. 02.THREAT HUNTING
  6. SIEM
  7. SPLUNK

ANOMALY DETECTION

USER AGENTSTRACING ATTACK CHAINPATH TRAVERSALSQL INJECTIONEXFILTRATIONRANSOMWARE STAGING & RCEOUTBOUND C2 COMMS CORRELATIONCOMMAND INJECTIONS
PreviousVISUALIZING LOGS TIMELINENextUSER AGENTS

Last updated 2 days ago