cybersecurity-skills

Plugin cybersecurity-skills from marketplace anthropic-cybersecurity-skills in RanuK12/securityskills. Commands read from the repo's manifest — 1 month ago.

Skills (200)

• abusing-dpapi-for-credential-access

  Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-te

• abusing-shadow-credentials-for-privesc

  Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/

• achieving-cmmc-level-2-compliance

  Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO a

• acquiring-disk-image-with-dd-and-dcfldd

  Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence

• analyzing-active-directory-acl-abuse

  Detect dangerous ACL misconfigurations in Active Directory using ldap3

• analyzing-android-malware-with-apktool

  Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use

• analyzing-api-gateway-access-logs

  Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect

• analyzing-apt-group-with-mitre-navigator

  Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce N

• analyzing-azure-activity-logs-for-threats

  Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

• analyzing-bootkit-and-rootkit-samples

  Analyzes bootkit and advanced rootkit malware infecting the Master

• analyzing-browser-forensics-with-hindsight

  Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident

• analyzing-campaign-attribution-evidence

  Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attributi

• analyzing-certificate-transparency-for-phishing

  Monitor Certificate Transparency logs using crt.sh and Certstream to

• analyzing-cloud-storage-access-patterns

  Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when inv

• analyzing-cobalt-strike-beacon-configuration

  Extract and analyze Cobalt Strike beacon configuration from PE files

• analyzing-cobaltstrike-malleable-c2-profiles

  Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engi

• analyzing-command-and-control-communication

  Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom

• analyzing-cyber-kill-chain

  Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

• analyzing-disk-image-with-autopsy

  Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic di

• analyzing-dns-logs-for-exfiltration

  Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

• analyzing-docker-container-forensics

  Investigate compromised Docker containers by analyzing images, layers,

• analyzing-email-headers-for-phishing-investigation

  Parse and analyze email headers (Received chain, Return-Path, Message-ID)

• analyzing-ethereum-smart-contract-vulnerabilities

  Perform static and symbolic analysis of Solidity smart contracts using

• analyzing-golang-malware-with-ghidra

  Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo

• analyzing-heap-spray-exploitation

  Detect and analyze heap spray attacks in memory dumps using Volatility3

• analyzing-indicators-of-compromise

  Analyzes indicators of compromise (IOCs) including IP addresses, domains,

• analyzing-ios-app-security-with-objection

  Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.

• analyzing-kubernetes-audit-logs

  Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod,

• analyzing-linux-audit-logs-for-intrusion

  Uses the Linux Audit framework (auditd) with ausearch and aureport utilities

• analyzing-linux-elf-malware

  Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware,

• analyzing-linux-kernel-rootkits

  Detect kernel-level rootkits in Linux memory dumps using Volatility3

• analyzing-linux-system-artifacts

  Examine Linux system artifacts (auth logs, cron/systemd persistence,

• analyzing-lnk-file-and-jump-list-artifacts

  Analyze Windows LNK shortcut files and Jump List artifacts with LECmd,

• analyzing-macro-malware-in-office-documents

  Analyzes malicious VBA macros embedded in Microsoft Office documents

• analyzing-malicious-pdf-with-peepdf

  Perform static analysis of malicious PDF documents using peepdf, pdfid,

• analyzing-malicious-url-with-urlscan

  URLScan.io is a free service for scanning and analyzing suspicious URLs.

• analyzing-malware-behavior-with-cuckoo-sandbox

  Detonate malware samples in Cuckoo Sandbox to observe runtime behavior

• analyzing-malware-family-relationships-with-malpedia

  Query the Malpedia API to look up malware family aliases and naming

• analyzing-malware-persistence-with-autoruns

  Use Sysinternals Autoruns to systematically enumerate and analyze malware

• analyzing-malware-sandbox-evasion-techniques

  Detect sandbox and VM evasion techniques in malware samples by analyzing

• analyzing-memory-dumps-with-volatility

  Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,

• analyzing-memory-forensics-with-lime-and-volatility

  Performs Linux memory acquisition using LiME (Linux Memory Extractor)

• analyzing-mft-for-deleted-file-recovery

  Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,

• analyzing-network-covert-channels-in-malware

  Detect and analyze covert communication channels used by malware, including

• analyzing-network-flow-data-with-netflow

  Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

• analyzing-network-packets-with-scapy

  Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets. Use when performing authorized network reconnaissance, protocol-level forensic analysis, or building traffic anomaly d

• analyzing-network-traffic-for-incidents

  Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

• analyzing-network-traffic-of-malware

  Analyzes network traffic generated by malware during sandbox execution

• analyzing-network-traffic-with-wireshark

  Captures and analyzes network packet data using Wireshark and tshark

• analyzing-office365-audit-logs-for-compromise

  Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect

• analyzing-outlook-pst-for-email-forensics

  Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder. Use when conducting email forensic investigations, legal e-discovery, or incident re

• analyzing-packed-malware-with-upx-unpacker

  Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress in its

• analyzing-pdf-malware-with-pdfid

  Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to

• analyzing-persistence-mechanisms-in-linux

  Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hu

• analyzing-powershell-empire-artifacts

  Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast),

• analyzing-powershell-script-block-logging

  Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX

• analyzing-prefetch-files-for-execution-history

  Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced files/DLLs. Use when building a timeline of program execution on a Windows system, conf

• analyzing-ransomware-encryption-mechanisms

  Analyzes encryption algorithms, key management, and file encryption

• analyzing-ransomware-leak-site-intelligence

  Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk assessments. Use when performing threat intelligence gathering on active ransomwar

• analyzing-ransomware-network-indicators

  Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre

• analyzing-ransomware-payment-wallets

  Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware

• analyzing-sbom-for-supply-chain-vulnerabilities

  Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON

• analyzing-security-logs-with-splunk

  Leverages Splunk Enterprise Security and SPL (Search Processing Language)

• analyzing-slack-space-and-file-system-artifacts

  Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when stand

• analyzing-supply-chain-malware-artifacts

  Investigate supply chain attack artifacts including trojanized software

• analyzing-threat-actor-ttps-with-mitre-attack

  Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threa

• analyzing-threat-actor-ttps-with-mitre-navigator

  Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when prof

• analyzing-threat-intelligence-feeds

  Analyzes structured and unstructured threat intelligence feeds to extract

• analyzing-threat-landscape-with-misp

  Query a MISP (Malware Information Sharing Platform) instance via PyMISP

• analyzing-tls-certificate-transparency-logs

  Queries Certificate Transparency logs via crt.sh and pycrtsh to detect

• analyzing-typosquatting-domains-with-dnstwist

  Generate domain permutations with dnstwist and check DNS resolution

• analyzing-uefi-bootkit-persistence

  Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,

• analyzing-usb-device-connection-history

  Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,

• analyzing-web-server-logs-for-intrusion

  Parse Apache and Nginx access logs to detect SQL injection attempts,

• analyzing-windows-amcache-artifacts

  Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s

• analyzing-windows-event-logs-in-splunk

  Analyzes Windows Security, System, and Sysmon event logs in Splunk to

• analyzing-windows-lnk-files-for-artifacts

  Parse Windows LNK shortcut files to extract target paths, MAC timestamps,

• analyzing-windows-prefetch-with-python

  Parse Windows Prefetch (.pf) files with the windowsprefetch Python

• analyzing-windows-registry-for-artifacts

  Extract and analyze Windows Registry hives with tools like RegRipper

• analyzing-windows-shellbag-artifacts

  Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and

• assessing-vector-and-embedding-weaknesses
• attacking-entra-id-with-roadtools
• attacking-oauth-with-device-code-phishing
• auditing-aws-s3-bucket-permissions
• auditing-azure-active-directory-configuration
• auditing-cloud-with-cis-benchmarks
• auditing-entra-id-with-aadinternals
• auditing-foundry-smart-contract-security
• auditing-gcp-iam-permissions
• auditing-kubernetes-cluster-rbac
• auditing-kubernetes-rbac-privilege-escalation
• auditing-mcp-servers-for-tool-poisoning
• auditing-terraform-infrastructure-for-security
• auditing-tls-certificate-transparency-logs
• auditing-uefi-firmware-with-chipsec
• automating-ioc-enrichment
• benchmarking-kubernetes-with-kube-bench
• building-adversary-infrastructure-tracking-system
• building-attack-pattern-library-from-cti-reports
• building-automated-malware-submission-pipeline
• building-c2-infrastructure-with-sliver-framework
• building-c2-redirector-infrastructure
• building-cloud-siem-with-sentinel
• building-detection-rule-with-splunk-spl
• building-detection-rules-with-sigma
• building-devsecops-pipeline-with-gitlab-ci
• building-identity-federation-with-saml-azure-ad
• building-identity-governance-lifecycle-process
• building-incident-response-dashboard
• building-incident-response-playbook
• building-incident-timeline-with-timesketch
• building-ioc-defanging-and-sharing-pipeline
• building-ioc-enrichment-pipeline-with-opencti
• building-malware-incident-communication-template
• building-patch-tuesday-response-process
• building-phishing-reporting-button-workflow
• building-ransomware-playbook-with-cisa-framework
• building-red-team-c2-infrastructure-with-havoc
• building-role-mining-for-rbac-optimization
• building-soc-escalation-matrix
• building-soc-metrics-and-kpi-tracking
• building-soc-playbook-for-ransomware
• building-super-timelines-with-plaso
• building-threat-actor-profile-from-osint
• building-threat-feed-aggregation-with-misp
• building-threat-hunt-hypothesis-framework
• building-threat-intelligence-enrichment-in-splunk
• building-threat-intelligence-feed-integration
• building-threat-intelligence-platform
• building-vulnerability-aging-and-sla-tracking
• building-vulnerability-dashboard-with-defectdojo
• building-vulnerability-exception-tracking-system
• building-vulnerability-scanning-workflow
• bypassing-authentication-with-forced-browsing
• coercing-authentication-with-coercer-petitpotam
• collecting-indicators-of-compromise
• collecting-open-source-intelligence
• collecting-threat-intelligence-with-misp
• collecting-volatile-evidence-from-compromised-host
• conducting-api-security-testing
• conducting-cloud-incident-response
• conducting-cloud-penetration-testing
• conducting-cyber-risk-assessment-with-nist-800-30
• conducting-domain-persistence-with-dcsync
• conducting-external-reconnaissance-with-osint
• conducting-full-scope-red-team-engagement
• conducting-internal-network-penetration-test
• conducting-internal-reconnaissance-with-bloodhound-ce
• conducting-malware-incident-response
• conducting-man-in-the-middle-attack-simulation
• conducting-memory-forensics-with-volatility
• conducting-mobile-app-penetration-test
• conducting-network-penetration-test
• conducting-pass-the-ticket-attack
• conducting-phishing-incident-response
• conducting-post-incident-lessons-learned
• conducting-social-engineering-penetration-test
• conducting-social-engineering-pretext-call
• conducting-spearphishing-simulation-campaign
• conducting-wireless-network-penetration-test
• configuring-active-directory-tiered-model
• configuring-aws-verified-access-for-ztna
• configuring-certificate-authority-with-openssl
• configuring-host-based-intrusion-detection
• configuring-hsm-for-key-storage
• configuring-identity-aware-proxy-with-google-iap
• configuring-ldap-security-hardening
• configuring-microsegmentation-for-zero-trust
• configuring-multi-factor-authentication-with-duo
• configuring-network-segmentation-with-vlans
• configuring-oauth2-authorization-flow
• configuring-pfsense-firewall-rules
• configuring-snort-ids-for-intrusion-detection
• configuring-suricata-for-network-monitoring
• configuring-tls-1-3-for-secure-communications
• configuring-windows-defender-advanced-settings
• configuring-windows-event-logging-for-detection
• configuring-zscaler-private-access-for-ztna
• containing-active-breach
• continuous-llm-red-teaming-with-promptfoo
• correlating-security-events-in-qradar
• correlating-threat-campaigns
• defending-llms-with-guardrails
• deobfuscating-javascript-malware
• deobfuscating-powershell-obfuscated-malware
• deploying-active-directory-honeytokens
• deploying-cloud-deception-with-decoy-resources
• deploying-cloudflare-access-for-zero-trust
• deploying-decoy-files-for-ransomware-detection
• deploying-edr-agent-with-crowdstrike
• deploying-honeytokens-and-canarytokens
• deploying-osquery-for-endpoint-monitoring
• deploying-palo-alto-prisma-access-zero-trust
• deploying-ransomware-canary-files
• deploying-software-defined-perimeter
• deploying-tailscale-for-zero-trust-vpn
• designing-adversary-engagement-with-mitre-engage
• detecting-ai-model-prompt-injection-attacks
• detecting-anomalies-in-industrial-control-systems
• detecting-anomalous-authentication-patterns

Similar plugins