npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Before exfiltrating data, adversaries typically stage collected files in a central location (MITRE ATT&CK T1074). This involves creating archives with tools like 7-Zip, RAR, or tar, consolidating files from multiple directories, and using temporary or hidden staging directories. This skill detects staging behavior by analyzing process creation logs for archiver activity, monitoring file system ...
Detects data staging before exfiltration by monitoring archive creation with 7-Zip/RAR, temp folder access, file consolidation, and staging patterns using EDR and process telemetry. For threat hunting in SOC investigations.
Detects data staging before exfiltration by monitoring 7-Zip/RAR compression, temp dir access, file merges, and staging patterns in EDR/Sysmon logs using Python. For threat hunting.
Hunts for data exfiltration indicators via network traffic analysis, detecting unusual flows, DNS tunneling, cloud storage uploads, and encrypted channel abuse. For threat hunting and incident response.
Share bugs, ideas, or general feedback.
Before exfiltrating data, adversaries typically stage collected files in a central location (MITRE ATT&CK T1074). This involves creating archives with tools like 7-Zip, RAR, or tar, consolidating files from multiple directories, and using temporary or hidden staging directories. This skill detects staging behavior by analyzing process creation logs for archiver activity, monitoring file system events in common staging paths, and identifying anomalous file consolidation patterns.