blue-team-detection
claudeDetection engineering and threat hunting: Sigma and YARA rules with SIEM translations, detection-as-code, and hypothesis-driven hunts mapped to MITRE ATT&CK.
2 skills · 2 commands · 2 agents
5
claude
forensics-analysis
Digital forensics for authorized investigations: investigation planning, chain of custody, disk and artifact analysis, timelines, and memory forensics with Volatility.
/
Plugin forensics-analysis from marketplace libre-secops in Ormus-Solutions/LibreSecOps-Claude-Code. Commands read from the repo's manifest — 1 month ago.
What it installs
Skills (2)
forensic-methodologyForensic methodology following NIST SP 800-86 and ISO 27037: the forensic process, order of volatility (RFC 3227), evidence integrity, KAPE triage collection, and disk imaging with dc3dd and ewfacquire. Use when collecting or preserving evidence during an investigation.
memory-forensicsMemory forensics reference: acquisition tools (WinPMem, DumpIt, FTK Imager, LiME, AVML), Volatility 3 architecture, and triage patterns for processes, hidden processes, and injected code. Use when acquiring or analyzing a memory image during incident response.
Slash commands (2)
/forensics-analysis:evidence-chainRecord a chain of custody entry for digital evidence (collection, transfer, analysis, storage, or disposal), with optional hash verification and formal legal format.
/forensics-analysis:forensic-planCreate a forensic investigation plan for an authorized incident: evidence sources, order-of-volatility collection priorities, and analysis approach.
Subagents (2)
digital-forensics-examinerUse this agent when running an authorized forensic investigation of disk, file system, log, or network evidence: acquisition and write-blocking, NTFS and ext4 artifacts, Windows registry and event logs, Linux logs, Plaso super timelines, PCAP analysis, and anti-forensics detection. It produces an ev
memory-forensics-analystUse this agent when analyzing a RAM capture from an authorized incident response with Volatility 3: suspicious processes, code injection and process hollowing, rootkits, hidden network connections, and which credentials an adversary could have reached. It produces memory findings with the plugin com
More from Ormus-Solutions/LibreSecOps-Claude-Code
All 33 plugins →bug-bounty-methodology
claudeMethodology for authorized bug bounty programs: scope-respecting reconnaissance, attack surface mapping, and vulnerability reports that triagers can reproduce.
2 skills · 2 commands · 2 agents
5
compliance-frameworks
claudeCompliance assessment, gap analysis, and audit evidence planning for SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, and NIST frameworks.
2 skills · 2 commands · 2 agents
5
container-security
claudeContainer security for Docker and Podman: Dockerfile and Compose hardening, image vulnerability scanning with SBOMs, and runtime isolation.
2 skills · 2 commands · 2 agents
5
devsecops-pipelines
claudeSecurity-integrated CI/CD: pipeline security architecture, SAST, SCA, secrets, IaC, and container scanning in GitHub Actions, GitLab CI, and Jenkins, and build-breaking security gates.
2 skills · 2 commands · 2 agents
5
Identity and access management: IAM architecture, SSO and MFA design, RBAC/ABAC/ReBAC access control models, authentication flow review, and access audits.
2 skills · 2 commands · 2 agents
5
Similar plugins
incident-io
claudecodexWork with incident.io from Claude: respond to and investigate incidents, check on-call schedules and escalations, and author the runbooks, skills and architecture docs that incident.io investigations draw on. Bundles the official incident.io MCP server (OAuth on first use).
11 skills · 1 MCP server
anthropics/claude-plugins-official 47,076
cybersecurity-skills
claude818 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more. Mapped to 6 frameworks.
200 skills
mukul975/Anthropic-Cybersecurity-Skills 36,021
incident.io
claudecodexWork with incident.io from Claude: respond to and investigate incidents, check on-call schedules and escalations, and author the runbooks, skills and architecture docs that incident.io investigations draw on. Bundles the official incident.io MCP server (OAuth on first use).
11 skills · 1 MCP server
anthropics/knowledge-work-plugins 35,601
engineering-skills
claude32 engineering skills: architecture, frontend, backend, fullstack, QA, DevOps, security, AI/ML, data engineering, Playwright (9 sub-skills), self-improving agent, Stripe integration, TDD guide, tech stack evaluator, Google Workspace CLI, a11y audit (WCAG 2.2), Azure cloud architect, GCP cloud architect, security pen testing, Snowflake development, adversarial-reviewer, ai-security, cloud-security, incident-response, red-team, threat-detection. v2.8.1 audits senior-fullstack / senior-frontend / senior-backend against karpathy-coder + Matt Pocock — each ships a 7-question forcing-question library, 4 customization profiles (JSON), deterministic decision engine, composition map into POWERFUL specialists, plus cs-fullstack-engineer / cs-frontend-engineer / cs-backend-engineer orchestrator agents (context: fork) + /cs-fullstack-review, /cs-frontend-review, /cs-backend-review, /cs-engineer-grill slash commands.
35 skills · hooks
alirezarezvani/claude-skills 29,725
pharon
claudePharon, the warning light for your stack: keeps a local inventory of your packages, runtimes, container images, CI actions and services, and alerts your team when a compromised release, an exploited vulnerability, a vendor breach or an end-of-life date reaches it. Scans run on your machine and only the inventory is uploaded, after you approve the first upload in /pharon:setup. Needs a Pharon account; a 7-day free trial is available.
4 skills · hooks
davepoon/buildwithclaude 3,741
security
claudecodexThreat modeling, security architecture review, incident response, vulnerability management, and access and identity. Reviewer-class.
8 skills
cbrock84/headcount 2,573
Maintain forensics-analysis?
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.
claude & codex plugins33 plugins