bug-bounty-methodology
claudeMethodology for authorized bug bounty programs: scope-respecting reconnaissance, attack surface mapping, and vulnerability reports that triagers can reproduce.
2 skills · 2 commands · 2 agents
4
claude
blue-team-detection
Detection engineering and threat hunting: Sigma and YARA rules with SIEM translations, detection-as-code, and hypothesis-driven hunts mapped to MITRE ATT&CK.
/
Plugin blue-team-detection from marketplace libre-secops in HermeticOrmus/LibreSecOps-Claude-Code. Commands read from the repo's manifest — 1 month ago.
What it installs
Skills (2)
detection-engineeringDetection engineering reference: the detection lifecycle and quality metrics, Sigma rule syntax and modifiers, YARA rule writing, a detection-as-code CI pipeline, and essential Windows detections. Use when writing, testing, or maintaining detection rules.
threat-hunting-methodologyHypothesis-driven threat hunting framework with hunt categories, required data sources, worked hunts for DNS tunneling, lateral movement, and persistence, and a hunt documentation template. Use when planning, running, or documenting a threat hunt.
Slash commands (2)
/blue-team-detection:detection-ruleCreate a Sigma detection rule for an ATT&CK technique, behavior description, or log sample, with optional SIEM translation, YARA rule, Atomic Red Team test, and tuning guide.
/blue-team-detection:hunt-hypothesisGenerate a structured threat hunting hypothesis with ATT&CK mapping, required telemetry, analysis steps, true and false positive indicators, and a decision tree.
Subagents (2)
detection-engineerUse this agent when you need an automated detection for a known adversary behavior or ATT&CK technique: writing Sigma or YARA rules, translating them to Splunk SPL, Elastic KQL, Sentinel KQL, or QRadar AQL, and setting up detection-as-code pipelines. It produces tested rules with data source require
threat-hunterUse this agent when searching proactively for adversary activity that existing alerts miss: forming a testable hunt hypothesis from threat intel, ATT&CK techniques, or a detection gap, then analyzing SIEM, endpoint, DNS, and network telemetry with stacking and baseline deviation. It produces a hunt
More from HermeticOrmus/LibreSecOps-Claude-Code
All 33 plugins →compliance-frameworks
claudeCompliance assessment, gap analysis, and audit evidence planning for SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, and NIST frameworks.
2 skills · 2 commands · 2 agents
4
container-security
claudeContainer security for Docker and Podman: Dockerfile and Compose hardening, image vulnerability scanning with SBOMs, and runtime isolation.
2 skills · 2 commands · 2 agents
4
devsecops-pipelines
claudeSecurity-integrated CI/CD: pipeline security architecture, SAST, SCA, secrets, IaC, and container scanning in GitHub Actions, GitLab CI, and Jenkins, and build-breaking security gates.
2 skills · 2 commands · 2 agents
4
forensics-analysis
claudeDigital forensics for authorized investigations: investigation planning, chain of custody, disk and artifact analysis, timelines, and memory forensics with Volatility.
2 skills · 2 commands · 2 agents
4
Identity and access management: IAM architecture, SSO and MFA design, RBAC/ABAC/ReBAC access control models, authentication flow review, and access audits.
2 skills · 2 commands · 2 agents
4
Similar plugins
yara-authoring
claudeYARA-X detection rule authoring with linting and quality analysis
1 skill
trailofbits/skills 8,166
cybersecurity
claudeEvidence-driven cybersecurity toolkit with 22 domain skills.
22 skills
Masriyan/Claude-Code-CyberSecurity-Skill 571
bloom
claudeA personal AI tutor based on Bloom's 2-sigma research: it generates a structured syllabus, teaches one adaptive lesson at a time, and tailors each next lesson to the learner's highlights and feedback. Bundles bloom-tutor plus six learn-* skills.
7 skills
Li-Evan/Bloom 305
Arkana
codexYour entire malware analysis lab, behind one AI prompt. 294 MCP tools for binary analysis (PE/ELF/Mach-O/shellcode) with angr, capa, FLOSS, YARA, Binary Refinery, Qiling, Speakeasy, oletools, and GoReSym integrations. Includes a 37-tool Qiling-backed debug + memory-inspection toolkit, multi-binary project workspaces, BSim function similarity, partial CFG acceptance, and a built-in dashboard.
4 skills · 1 MCP server
JameZUK/Arkana 259
cybersecurity
claudecodexOSS-only security for OWASP Top 10, pentest, vuln testing (XSS, SSRF, CSRF, business-logic, Host header), threat modeling (STRIDE, ATT&CK), Sigma rules, SAST, code audit, AI/LLM red-team, or replacing paid tools (Burp, Nessus, Splunk) with OSS.
1 skill
secondsky/claude-skills 248
incident-response-skills
claudeSecurity incident response and detection engineering skills for Sigma rules, SIEM integration, and threat hunting
32 skills
AgentSecOps/SecOpsAgentKit 234
Maintain blue-team-detection?
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.
claude & codex plugins33 plugins