Correlate web process spawning and command injection signals to detect RCE attempts.
npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-rce
Please help me install this Agent Skill. Skill: defensive-rce Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-rce Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-rce
Detect and triage remote code execution attempts targeting web applications by correlating web process spawning, command injection signals, and webshell indicators.
Load the full RCE detection methodology against your telemetry to trigger detections and triage incidents.
High-intent search queries and answers about installing and using this skill.
Detect remote code execution by correlating web server process spawning, command injection signals, and webshell indicators across Windows and Linux server logs to identify suspicious child processes and reverse shells.
Yes, you can use KQL queries for MDE and Azure Sentinel alongside Sigma rules and YARA signatures to detect webshell deployment via file changes, HTTP interactions, and malicious process trees.
Triage command injection by correlating Sysmon process spawning logs with web server telemetry to identify unauthorized system utilities executing as child processes of web server workers.
Webshell and reverse shell detections map directly to MITRE ATT&CK techniques T1190, T1505.003, and T1059, aligning process execution and command injection findings for SOC triage.
Yes, this RCE detection methodology applies across both Windows and Linux web servers using Sysmon, MDE, and web server logs to identify webshells and suspicious process trees.
Correlate YARA signature matches with KQL and Sigma detection queries to identify webshell deployment via file changes and HTTP interactions, mapping results to ATT&CK T1505.003 for triage.
balsm-healthDetect webshell deployments by analyzing process creation, network, and web access logs.
AgentSecOpsAnalyze endpoint telemetry and artifacts for incident response with Velociraptor VQL workflows.
riparinoDetect webshell uploads using YARA, Sigma, and KQL queries.
RedHatProductSecurityImplement structured JSON logging for data access and security events.
