Initial commit - 611 cybersecurity skills across all subdomains

2026-08-06 19:00:17 +03:00 · 2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
@@ -0,0 +1,46 @@
+# Standards and Frameworks Reference
+
+## STIX 2.1 Infrastructure Object
+```json
+{
+  "type": "infrastructure",
+  "name": "C2 Server",
+  "infrastructure_types": ["command-and-control"],
+  "description": "Cobalt Strike TeamServer at 198.51.100.1",
+  "first_seen": "2025-01-01T00:00:00Z",
+  "last_seen": "2025-06-01T00:00:00Z"
+}
+```
+
+## Diamond Model of Intrusion Analysis
+- **Adversary**: Threat actor or group
+- **Capability**: Tools, techniques, and malware
+- **Infrastructure**: C2 servers, domains, hosting
+- **Victim**: Targeted organization or individual
+
+## Infrastructure Types (STIX vocabulary)
+- command-and-control, botnet, exfiltration, hosting-malware
+- hosting-target-lists, phishing, staging, undefined
+
+## Network Fingerprinting Methods
+| Method | Type | Description |
+|--------|------|-------------|
+| JARM | Active | TLS server fingerprint from 10 TLS handshakes |
+| JA3S | Passive | Server Hello hash from TLS negotiation |
+| JA3 | Passive | Client Hello hash for client fingerprinting |
+| Favicon Hash | Active | HTTP favicon file hash |
+| HTTP Headers | Active/Passive | Server banner and header fingerprinting |
+| SSH Key | Active | SSH host key fingerprint |
+
+## Passive DNS Record Types
+- A/AAAA: Domain to IP mapping
+- CNAME: Domain alias
+- MX: Mail server records
+- NS: Nameserver records
+- TXT: Text records (SPF, DKIM, verification)
+
+## References
+- [Diamond Model Paper](https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf)
+- [STIX Infrastructure](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_jo3k1o6lr9)
+- [JARM](https://github.com/salesforce/jarm)
+- [JA3/JA3S](https://github.com/salesforce/ja3)
@@ -0,0 +1,50 @@
+# Infrastructure Tracking Workflows
+
+## Workflow 1: IP-Centric Pivoting
+```
+[Known C2 IP] --> [Shodan/Censys] --> [Service Fingerprints]
+      |                                      |
+      v                                      v
+[Passive DNS] --> [Associated Domains] --> [WHOIS Analysis] --> [Registrant Pivot]
+      |                                                               |
+      v                                                               v
+[SSL Certs] --> [Subject Alt Names] --> [New Domains] --> [Additional IPs]
+```
+
+## Workflow 2: Domain-Centric Pivoting
+```
+[Known C2 Domain] --> [DNS History] --> [Historical IPs] --> [Co-hosted Domains]
+        |                                                          |
+        v                                                          v
+  [CT Logs] --> [Subdomains] --> [Infrastructure Map] --> [Shared Hosting Analysis]
+        |
+        v
+  [WHOIS] --> [Registrant/Email] --> [Other Registered Domains]
+```
+
+## Workflow 3: C2 Framework Hunting
+```
+[C2 Signature] --> [Shodan Search] --> [Candidate Servers] --> [Validation]
+                                                                    |
+                                                                    v
+                                                          [JARM Fingerprint]
+                                                                    |
+                                                                    v
+                                                          [Confirm C2 Type]
+                                                                    |
+                                                                    v
+                                                          [Track Over Time]
+```
+
+## Workflow 4: Continuous Monitoring
+```
+[Watchlist IPs/Domains] --> [Scheduled Scans] --> [Change Detection] --> [Alerts]
+                                                         |
+                                                +--------+--------+
+                                                |        |        |
+                                                v        v        v
+                                          [New Port] [DNS Change] [New Cert]
+                                                |        |        |
+                                                v        v        v
+                                          [Investigate] [Update TI] [Share]
+```