Category: Cyber Threat

Low-and-Slow Data Exfiltration Detection — Isolation Forest + LSTM autoencoder on VPC Flow Logs — HACKFORLAB cover image
0 38
Posted in Cyber Threat

Detecting Low-and-Slow Data Exfiltration with Isolation Forest + LSTM

Hunt DNS tunnels, ICMP tunnels, and HTTPS covert channels using Isolation Forest + LSTM autoencoder on AWS VPC Flow Logs.

Rohit Sadgune 15th May 2026 0 Comment
Botnet Coordination & DDoS Staging Hunt — K-means + hierarchical clustering on VPC Flow Logs — HACKFORLAB cover image
0 40
Posted in Cyber Threat

Hunting Botnet Coordination and DDoS Staging with Clustering

Surface coordinated botnets and pre-DDoS staging via K-means + hierarchical clustering on host behaviour fingerprints from AWS VPC Flow Logs.

Rohit Sadgune 15th May 2026 0 Comment
Living-off-the-Land Kill Chain Detection — Markov chain + ensemble scoring on VPC Flow Logs — HACKFORLAB cover image
0 40
Posted in Cyber Threat

Living-off-the-Land Kill Chain Detection with Markov Chains

Detect blended LOTL attack chains by modelling network state transitions as Markov chains across MITRE ATT&CK phases on AWS VPC Flow Logs.

Rohit Sadgune 15th May 2026 0 Comment
Adaptive C2 Beacon Detection at Scale — FFT spectral analysis and DBSCAN on VPC Flow Logs — HACKFORLAB cover image
0 45
Posted in Cyber Threat

Adaptive C2 Beacon Detection: FFT and DBSCAN on VPC Flow Logs

Detection playbook for jitter-evading C2 beacons (Cobalt Strike, Sliver, Mythic, Brute Ratel) using FFT spectral analysis and DBSCAN clustering on AWS VPC Flow Logs.

Rohit Sadgune 13th May 2026 0 Comment
AWS Bedrock Threat Hunting: A CloudTrail Log Analysis Playbook — HACKFORLAB cover image
0 51
Posted in Cyber Threat

AWS Bedrock Threat Hunting: A CloudTrail Log Analysis Playbook

A SOC playbook for hunting AWS Bedrock abuse with CloudTrail logs — LLMjacking, Shadow AI, prompt exfiltration, guardrail tampering & more.

Rohit Sadgune 9th May 2026 0 Comment