Initial commit - 611 cybersecurity skills across all subdomains

skills/detecting-qr-code-phishing-with-email-security/references/standards.md

@@ -0,0 +1,39 @@
+# Standards & References: Detecting QR Code Phishing
+
+## Industry Statistics (2025-2026)
+- Quishing incidents grew from 46,000 to 250,000 between Aug-Nov 2025 (Kaspersky)
+- 89.3% of QR code phishing targets credential theft
+- 12% of January 2026 attacks used ASCII text-based QR codes
+- Only 36% of quishing incidents accurately identified by recipients
+- 25% year-over-year growth in quishing incidents
+
+## MITRE ATT&CK References
+- **T1566.001**: Phishing: Spearphishing Attachment (QR in PDF/image)
+- **T1566.002**: Phishing: Spearphishing Link (QR-encoded URL)
+- **T1204.001**: User Execution: Malicious Link (user scans QR)
+- **T1598.003**: Phishing for Information: Spearphishing Link
+
+## Quishing Attack Patterns
+| Pattern | Description | Detection Difficulty |
+|---|---|---|
+| Inline QR image | QR code embedded directly in email body | Medium |
+| PDF attachment QR | QR code inside attached PDF document | High |
+| Split QR code | QR divided into two benign-looking images | Very High |
+| ASCII QR code | QR rendered as text characters | Very High |
+| Nested QR code | QR within QR with intermediate redirect | High |
+| Styled QR code | Artistic QR with logos/colors | Medium |
+
+## Common Quishing Themes
+- MFA enrollment/reset requiring QR scan
+- Document signing via QR code
+- Voicemail notification with QR access
+- Package delivery QR confirmation
+- IT security update requiring QR authentication
+- Shared document access via QR
+
+## Detection Technologies
+- Multimodal AI (OCR + deep image + NLP)
+- Computer vision QR code detection
+- URL reputation analysis for decoded URLs
+- Mobile threat defense QR scanning
+- Behavioral analysis of image-only emails

skills/detecting-qr-code-phishing-with-email-security/references/workflows.md

@@ -0,0 +1,95 @@
+# Workflows: Detecting QR Code Phishing
+
+## Workflow 1: QR Code Email Detection Pipeline
+
+```
+Inbound email arrives at gateway
+  |
+  v
+[Standard text/URL scanning]
+  +-- Check text-based URLs (standard pipeline)
+  +-- No malicious URLs found in text
+  |
+  v
+[Image analysis module]
+  +-- Scan all embedded images and attachments
+  +-- Apply QR code detection algorithm
+  +-- Check for ASCII/text-rendered QR codes
+  +-- Scan PDF attachments for embedded QR codes
+  |
+  v
+[QR code detected?]
+  +-- NO --> Continue standard delivery
+  +-- YES --> Extract encoded URL
+  |
+  v
+[URL reputation and analysis]
+  +-- Check URL against threat intelligence feeds
+  +-- Check domain age and registration data
+  +-- Submit to sandbox for real-time analysis
+  +-- Check for credential harvesting indicators
+  |
+  v
+[Decision]
+  +-- MALICIOUS URL: Block email, alert SOC
+  +-- SUSPICIOUS URL: Quarantine, add warning banner
+  +-- UNKNOWN URL: Tag email with QR warning banner
+  +-- CLEAN URL: Deliver with informational banner
+```
+
+## Workflow 2: Quishing Incident Response
+
+```
+User reports QR code phishing email
+  |
+  v
+[Triage (15 minutes)]
+  +-- Extract QR code and decode URL
+  +-- Check if URL is active credential harvester
+  +-- Search mailboxes for same email to other recipients
+  |
+  v
+[Containment]
+  +-- Block sender domain across email gateway
+  +-- Retract email from all recipient inboxes
+  +-- Block decoded URL at web proxy/firewall
+  +-- If user scanned: check for credential compromise
+  |
+  v
+[Investigation]
+  +-- Did any user submit credentials on phishing page?
+  +-- Check authentication logs for compromised accounts
+  +-- If credentials entered: force password reset + revoke sessions
+  +-- Review phishing page infrastructure
+  |
+  v
+[Recovery and prevention]
+  +-- Add QR URL pattern to detection rules
+  +-- Update security awareness training
+  +-- Send targeted alert to affected users
+  +-- Document IOCs for threat intelligence sharing
+```
+
+## Workflow 3: Mobile QR Scanning Protection
+
+```
+User scans QR code with mobile device
+  |
+  v
+[Mobile threat defense intercepts]
+  +-- Decode QR destination URL
+  +-- Check against mobile threat intelligence
+  |
+  v
+[URL assessment]
+  +-- KNOWN MALICIOUS: Block and alert user
+  +-- SUSPICIOUS: Display warning, require confirmation
+  +-- CREDENTIAL PAGE: Extra warning about entering passwords
+  +-- CLEAN: Allow access
+  |
+  v
+[If user proceeds to suspicious site]
+  +-- Route through secure browser/VPN
+  +-- Monitor for credential submission
+  +-- Log URL and user action for SOC review
+```