cybersecurity

Plugin cybersecurity from marketplace my-skills-collection in SUEYTAME/claude-skills-collection. Commands read from the repo's manifest — 12 days ago.

Skills (200)

• abusing-dpapi-for-credential-access

  Extract DPAPI-protected secrets such as credentials and browser data offline and online.

• abusing-shadow-credentials-for-privesc

  Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.

• achieving-cmmc-level-2-compliance

  Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO a

• acquiring-disk-image-with-dd-and-dcfldd

  Create forensically sound bit-for-bit disk images using dd and dcfldd

• analyzing-active-directory-acl-abuse

  Detect dangerous ACL misconfigurations in Active Directory using ldap3

• analyzing-android-malware-with-apktool

  Perform static analysis of Android APK malware samples using apktool

• analyzing-api-gateway-access-logs

  Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect

• analyzing-apt-group-with-mitre-navigator

  Analyze advanced persistent threat (APT) group techniques using MITRE

• analyzing-azure-activity-logs-for-threats

  Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

• analyzing-bootkit-and-rootkit-samples

  Analyzes bootkit and advanced rootkit malware that infects the Master

• analyzing-browser-forensics-with-hindsight

  Analyze Chromium-based browser artifacts using Hindsight to extract browsing

• analyzing-campaign-attribution-evidence

  Campaign attribution analysis involves systematically evaluating evidence

• analyzing-certificate-transparency-for-phishing

  Monitor Certificate Transparency logs using crt.sh and Certstream to

• analyzing-cloud-storage-access-patterns

  Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage

• analyzing-cobalt-strike-beacon-configuration

  Extract and analyze Cobalt Strike beacon configuration from PE files

• analyzing-cobaltstrike-malleable-c2-profiles

  Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike

• analyzing-command-and-control-communication

  Analyzes malware command-and-control (C2) communication protocols to

• analyzing-cyber-kill-chain

  Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

• analyzing-disk-image-with-autopsy

  Perform comprehensive forensic analysis of disk images using Autopsy

• analyzing-dns-logs-for-exfiltration

  Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

• analyzing-docker-container-forensics

  Investigate compromised Docker containers by analyzing images, layers,

• analyzing-email-headers-for-phishing-investigation

  Parse and analyze email headers to trace the origin of phishing emails,

• analyzing-ethereum-smart-contract-vulnerabilities

  Perform static and symbolic analysis of Solidity smart contracts using

• analyzing-golang-malware-with-ghidra

  Reverse engineer Go-compiled malware using Ghidra with specialized scripts

• analyzing-heap-spray-exploitation

  Detect and analyze heap spray attacks in memory dumps using Volatility3

• analyzing-indicators-of-compromise

  Analyzes indicators of compromise (IOCs) including IP addresses, domains,

• analyzing-ios-app-security-with-objection

  Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.

• analyzing-kubernetes-audit-logs

  Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod,

• analyzing-linux-audit-logs-for-intrusion

  Uses the Linux Audit framework (auditd) with ausearch and aureport utilities

• analyzing-linux-elf-malware

  Analyzes malicious Linux ELF (Executable and Linkable Format) binaries

• analyzing-linux-kernel-rootkits

  Detect kernel-level rootkits in Linux memory dumps using Volatility3

• analyzing-linux-system-artifacts

  Examine Linux system artifacts including auth logs, cron jobs, shell

• analyzing-lnk-file-and-jump-list-artifacts

  Analyze Windows LNK shortcut files and Jump List artifacts to establish

• analyzing-macro-malware-in-office-documents

  Analyzes malicious VBA macros embedded in Microsoft Office documents

• analyzing-malicious-pdf-with-peepdf

  Perform static analysis of malicious PDF documents using peepdf, pdfid,

• analyzing-malicious-url-with-urlscan

  URLScan.io is a free service for scanning and analyzing suspicious URLs.

• analyzing-malware-behavior-with-cuckoo-sandbox

  Executes malware samples in Cuckoo Sandbox to observe runtime behavior

• analyzing-malware-family-relationships-with-malpedia

  Use the Malpedia platform and API to research malware family relationships,

• analyzing-malware-persistence-with-autoruns

  Use Sysinternals Autoruns to systematically identify and analyze malware

• analyzing-malware-sandbox-evasion-techniques

  Detect sandbox evasion techniques in malware samples by analyzing timing

• analyzing-memory-dumps-with-volatility

  Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,

• analyzing-memory-forensics-with-lime-and-volatility

  Performs Linux memory acquisition using LiME (Linux Memory Extractor)

• analyzing-mft-for-deleted-file-recovery

  Analyze the NTFS Master File Table ($MFT) to recover metadata and content

• analyzing-network-covert-channels-in-malware

  Detect and analyze covert communication channels used by malware including

• analyzing-network-flow-data-with-netflow

  Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

• analyzing-network-packets-with-scapy

  Craft, send, sniff, and dissect network packets using Scapy for protocol

• analyzing-network-traffic-for-incidents

  Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

• analyzing-network-traffic-of-malware

  Analyzes network traffic generated by malware during sandbox execution

• analyzing-network-traffic-with-wireshark

  Captures and analyzes network packet data using Wireshark and tshark

• analyzing-office365-audit-logs-for-compromise

  Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect

• analyzing-outlook-pst-for-email-forensics

  Analyze Microsoft Outlook PST and OST files for email forensic evidence

• analyzing-packed-malware-with-upx-unpacker

  Identifies and unpacks UPX-packed and other packed malware samples to

• analyzing-pdf-malware-with-pdfid

  Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to

• analyzing-persistence-mechanisms-in-linux

  Detect and analyze Linux persistence mechanisms including crontab entries,

• analyzing-powershell-empire-artifacts

  Detect PowerShell Empire framework artifacts in Windows event logs by

• analyzing-powershell-script-block-logging

  Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX

• analyzing-prefetch-files-for-execution-history

  Parse Windows Prefetch files to determine program execution history including

• analyzing-ransomware-encryption-mechanisms

  Analyzes encryption algorithms, key management, and file encryption

• analyzing-ransomware-leak-site-intelligence

  Monitor and analyze ransomware group data leak sites (DLS) to track victim

• analyzing-ransomware-network-indicators

  Identify ransomware network indicators including C2 beaconing patterns,

• analyzing-ransomware-payment-wallets

  Traces ransomware cryptocurrency payment flows using blockchain analysis

• analyzing-sbom-for-supply-chain-vulnerabilities

  Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON

• analyzing-security-logs-with-splunk

  Leverages Splunk Enterprise Security and SPL (Search Processing Language)

• analyzing-slack-space-and-file-system-artifacts

  Examine file system slack space, MFT entries, USN journal, and alternate

• analyzing-supply-chain-malware-artifacts

  Investigate supply chain attack artifacts including trojanized software

• analyzing-threat-actor-ttps-with-mitre-attack

  MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics,

• analyzing-threat-actor-ttps-with-mitre-navigator

  Map advanced persistent threat (APT) group tactics, techniques, and

• analyzing-threat-intelligence-feeds

  Analyzes structured and unstructured threat intelligence feeds to extract

• analyzing-threat-landscape-with-misp

  Analyze the threat landscape using MISP (Malware Information Sharing

• analyzing-tls-certificate-transparency-logs

  Queries Certificate Transparency logs via crt.sh and pycrtsh to detect

• analyzing-typosquatting-domains-with-dnstwist

  Detect typosquatting, homograph phishing, and brand impersonation domains

• analyzing-uefi-bootkit-persistence

  Analyzes UEFI bootkit persistence mechanisms including firmware implants

• analyzing-usb-device-connection-history

  Investigate USB device connection history from Windows registry, event

• analyzing-web-server-logs-for-intrusion

  Parse Apache and Nginx access logs to detect SQL injection attempts,

• analyzing-windows-amcache-artifacts

  Parses and analyzes the Windows Amcache.hve registry hive to extract

• analyzing-windows-event-logs-in-splunk

  Analyzes Windows Security, System, and Sysmon event logs in Splunk to

• analyzing-windows-lnk-files-for-artifacts

  Parse Windows LNK shortcut files to extract target paths, timestamps,

• analyzing-windows-prefetch-with-python

  Parse Windows Prefetch files using the windowsprefetch Python library

• analyzing-windows-registry-for-artifacts

  Extract and analyze Windows Registry hives to uncover user activity,

• analyzing-windows-shellbag-artifacts

  Analyze Windows Shellbag registry artifacts to reconstruct folder browsing

• assessing-vector-and-embedding-weaknesses
• attacking-entra-id-with-roadtools
• attacking-oauth-with-device-code-phishing
• auditing-aws-s3-bucket-permissions
• auditing-azure-active-directory-configuration
• auditing-cloud-with-cis-benchmarks
• auditing-entra-id-with-aadinternals
• auditing-foundry-smart-contract-security
• auditing-gcp-iam-permissions
• auditing-kubernetes-cluster-rbac
• auditing-kubernetes-rbac-privilege-escalation
• auditing-mcp-servers-for-tool-poisoning
• auditing-terraform-infrastructure-for-security
• auditing-tls-certificate-transparency-logs
• auditing-uefi-firmware-with-chipsec
• automating-ioc-enrichment
• benchmarking-kubernetes-with-kube-bench
• building-adversary-infrastructure-tracking-system
• building-attack-pattern-library-from-cti-reports
• building-automated-malware-submission-pipeline
• building-c2-infrastructure-with-sliver-framework
• building-c2-redirector-infrastructure
• building-cloud-siem-with-sentinel
• building-detection-rule-with-splunk-spl
• building-detection-rules-with-sigma
• building-devsecops-pipeline-with-gitlab-ci
• building-identity-federation-with-saml-azure-ad
• building-identity-governance-lifecycle-process
• building-incident-response-dashboard
• building-incident-response-playbook
• building-incident-timeline-with-timesketch
• building-ioc-defanging-and-sharing-pipeline
• building-ioc-enrichment-pipeline-with-opencti
• building-malware-incident-communication-template
• building-patch-tuesday-response-process
• building-phishing-reporting-button-workflow
• building-ransomware-playbook-with-cisa-framework
• building-red-team-c2-infrastructure-with-havoc
• building-role-mining-for-rbac-optimization
• building-soc-escalation-matrix
• building-soc-metrics-and-kpi-tracking
• building-soc-playbook-for-ransomware
• building-super-timelines-with-plaso
• building-threat-actor-profile-from-osint
• building-threat-feed-aggregation-with-misp
• building-threat-hunt-hypothesis-framework
• building-threat-intelligence-enrichment-in-splunk
• building-threat-intelligence-feed-integration
• building-threat-intelligence-platform
• building-vulnerability-aging-and-sla-tracking
• building-vulnerability-dashboard-with-defectdojo
• building-vulnerability-exception-tracking-system
• building-vulnerability-scanning-workflow
• bypassing-authentication-with-forced-browsing
• coercing-authentication-with-coercer-petitpotam
• collecting-indicators-of-compromise
• collecting-open-source-intelligence
• collecting-threat-intelligence-with-misp
• collecting-volatile-evidence-from-compromised-host
• conducting-api-security-testing
• conducting-cloud-incident-response
• conducting-cloud-penetration-testing
• conducting-cyber-risk-assessment-with-nist-800-30
• conducting-domain-persistence-with-dcsync
• conducting-external-reconnaissance-with-osint
• conducting-full-scope-red-team-engagement
• conducting-internal-network-penetration-test
• conducting-internal-reconnaissance-with-bloodhound-ce
• conducting-malware-incident-response
• conducting-man-in-the-middle-attack-simulation
• conducting-memory-forensics-with-volatility
• conducting-mobile-app-penetration-test
• conducting-network-penetration-test
• conducting-pass-the-ticket-attack
• conducting-phishing-incident-response
• conducting-post-incident-lessons-learned
• conducting-social-engineering-penetration-test
• conducting-social-engineering-pretext-call
• conducting-spearphishing-simulation-campaign
• conducting-wireless-network-penetration-test
• configuring-active-directory-tiered-model
• configuring-aws-verified-access-for-ztna
• configuring-certificate-authority-with-openssl
• configuring-host-based-intrusion-detection
• configuring-hsm-for-key-storage
• configuring-identity-aware-proxy-with-google-iap
• configuring-ldap-security-hardening
• configuring-microsegmentation-for-zero-trust
• configuring-multi-factor-authentication-with-duo
• configuring-network-segmentation-with-vlans
• configuring-oauth2-authorization-flow
• configuring-pfsense-firewall-rules
• configuring-snort-ids-for-intrusion-detection
• configuring-suricata-for-network-monitoring
• configuring-tls-1-3-for-secure-communications
• configuring-windows-defender-advanced-settings
• configuring-windows-event-logging-for-detection
• configuring-zscaler-private-access-for-ztna
• containing-active-breach
• continuous-llm-red-teaming-with-promptfoo
• correlating-security-events-in-qradar
• correlating-threat-campaigns
• defending-llms-with-guardrails
• deobfuscating-javascript-malware
• deobfuscating-powershell-obfuscated-malware
• deploying-active-directory-honeytokens
• deploying-cloud-deception-with-decoy-resources
• deploying-cloudflare-access-for-zero-trust
• deploying-decoy-files-for-ransomware-detection
• deploying-edr-agent-with-crowdstrike
• deploying-honeytokens-and-canarytokens
• deploying-osquery-for-endpoint-monitoring
• deploying-palo-alto-prisma-access-zero-trust
• deploying-ransomware-canary-files
• deploying-software-defined-perimeter
• deploying-tailscale-for-zero-trust-vpn
• designing-adversary-engagement-with-mitre-engage
• detecting-ai-model-prompt-injection-attacks
• detecting-anomalies-in-industrial-control-systems
• detecting-anomalous-authentication-patterns

Similar plugins