mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-03 09:20:18 +03:00
Rewrite 548 skill descriptions to the activation rubric
Each rewritten description now states both what the skill does (concrete capability, named tools/artifacts) and an explicit when-to-use trigger, improving agent discovery/activation. Grounded in each skill's own body; changes confined to the `description` field only (bodies and all other frontmatter untouched). Produced by a gated audit->rewrite->recheck loop (548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded). Schema: 817/817 pass. Framework-ID gate: 0 defects.
This commit is contained in:
Mahipal
@@ -1,6 +1,6 @@
|
||||
---
|
||||
name: abusing-dpapi-for-credential-access
|
||||
description: Extract DPAPI-protected secrets such as credentials and browser data offline and online.
|
||||
description: Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
|
||||
domain: cybersecurity
|
||||
subdomain: red-teaming
|
||||
tags:
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
name: abusing-shadow-credentials-for-privesc
|
||||
description: Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.
|
||||
description: Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
|
||||
domain: cybersecurity
|
||||
subdomain: red-teaming
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
---
|
||||
name: acquiring-disk-image-with-dd-and-dcfldd
|
||||
description: Create forensically sound bit-for-bit disk images using dd and dcfldd
|
||||
while preserving evidence integrity through hash verification.
|
||||
description: Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: analyzing-android-malware-with-apktool
|
||||
description: Perform static analysis of Android APK malware samples using apktool
|
||||
for decompilation, jadx for Java source recovery, and androguard for permission
|
||||
analysis, manifest inspection, and suspicious API call detection.
|
||||
description: Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
|
||||
domain: cybersecurity
|
||||
subdomain: malware-analysis
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: analyzing-apt-group-with-mitre-navigator
|
||||
description: Analyze advanced persistent threat (APT) group techniques using MITRE
|
||||
ATT&CK Navigator to create layered heatmaps of adversary TTPs for detection gap
|
||||
analysis and threat-informed defense.
|
||||
description: Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,11 +1,10 @@
|
||||
---
|
||||
name: analyzing-bootkit-and-rootkit-samples
|
||||
description: 'Analyzes bootkit and advanced rootkit malware that infects the Master
|
||||
Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware to gain persistence
|
||||
below the operating system. Covers boot sector analysis, UEFI module inspection,
|
||||
and anti-rootkit detection techniques. Activates for requests involving bootkit
|
||||
analysis, MBR malware investigation, UEFI persistence analysis, or pre-OS malware
|
||||
detection.
|
||||
description: 'Analyzes bootkit and advanced rootkit malware infecting the Master
|
||||
Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence,
|
||||
covering boot sector analysis, UEFI module inspection, and anti-rootkit detection.
|
||||
Use when compromise survives OS reinstallation or antivirus/EDR fails to detect
|
||||
malware despite clear infection signs.
|
||||
|
||||
'
|
||||
domain: cybersecurity
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: analyzing-browser-forensics-with-hindsight
|
||||
description: Analyze Chromium-based browser artifacts using Hindsight to extract browsing
|
||||
history, downloads, cookies, cached content, autofill data, saved passwords, and
|
||||
browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.
|
||||
description: Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: analyzing-campaign-attribution-evidence
|
||||
description: Campaign attribution analysis involves systematically evaluating evidence
|
||||
to determine which threat actor or group is responsible for a cyber operation. This
|
||||
skill covers collecting and weighting attr
|
||||
description: Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,10 +1,6 @@
|
||||
---
|
||||
name: analyzing-cloud-storage-access-patterns
|
||||
description: Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage
|
||||
by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics.
|
||||
Identifies after-hours bulk downloads, access from new IP addresses, unusual API
|
||||
calls (GetObject spikes), and potential data exfiltration using statistical baselines
|
||||
and time-series anomaly detection.
|
||||
description: Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.
|
||||
domain: cybersecurity
|
||||
subdomain: cloud-security
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: analyzing-cobaltstrike-malleable-c2-profiles
|
||||
description: Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike
|
||||
and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate
|
||||
network detection signatures.
|
||||
description: Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.
|
||||
domain: cybersecurity
|
||||
subdomain: malware-analysis
|
||||
tags:
|
||||
|
||||
@@ -1,10 +1,11 @@
|
||||
---
|
||||
name: analyzing-command-and-control-communication
|
||||
description: 'Analyzes malware command-and-control (C2) communication protocols to
|
||||
understand beacon patterns, command structures, data encoding, and infrastructure.
|
||||
Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development
|
||||
and threat intelligence. Activates for requests involving C2 analysis, beacon detection,
|
||||
C2 protocol reverse engineering, or command-and-control infrastructure mapping.
|
||||
description: 'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom
|
||||
protocols to reverse-engineer beacon patterns, command structures, data encoding,
|
||||
and infrastructure (primary servers, fallback domains, dead drops). Use after
|
||||
reverse engineering reveals network traffic needing protocol analysis or when
|
||||
building detection signatures for a framework like Cobalt Strike, Metasploit,
|
||||
or Sliver.
|
||||
|
||||
'
|
||||
domain: cybersecurity
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
---
|
||||
name: analyzing-disk-image-with-autopsy
|
||||
description: Perform comprehensive forensic analysis of disk images using Autopsy
|
||||
to recover files, examine artifacts, and build investigation timelines.
|
||||
description: Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,10 @@
|
||||
---
|
||||
name: analyzing-email-headers-for-phishing-investigation
|
||||
description: Parse and analyze email headers to trace the origin of phishing emails,
|
||||
verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.
|
||||
description: Parse and analyze email headers (Received chain, Return-Path, Message-ID)
|
||||
to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC
|
||||
results to confirm or rule out sender spoofing. Use when triaging a suspicious or
|
||||
reported email, investigating a phishing incident, or verifying whether a message's
|
||||
sender domain was spoofed.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,11 @@
|
||||
---
|
||||
name: analyzing-golang-malware-with-ghidra
|
||||
description: Reverse engineer Go-compiled malware using Ghidra with specialized scripts
|
||||
for function recovery, string extraction, and type reconstruction in stripped Go
|
||||
binaries.
|
||||
description: Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo
|
||||
and pclntab structures, recovering stripped/obfuscated function names (e.g. via
|
||||
GoResolver), and extracting embedded module/dependency strings and types from Go
|
||||
binaries. Use when analyzing a Go-language malware sample, deobfuscating a garble-packed
|
||||
Go binary, or recovering function names and third-party dependencies from a stripped
|
||||
Go executable.
|
||||
domain: cybersecurity
|
||||
subdomain: malware-analysis
|
||||
tags:
|
||||
|
||||
@@ -1,11 +1,10 @@
|
||||
---
|
||||
name: analyzing-linux-elf-malware
|
||||
description: 'Analyzes malicious Linux ELF (Executable and Linkable Format) binaries
|
||||
including botnets, cryptominers, ransomware, and rootkits targeting Linux servers,
|
||||
containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and
|
||||
reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving
|
||||
Linux malware analysis, ELF binary investigation, Linux server compromise assessment,
|
||||
or container malware analysis.
|
||||
description: 'Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware,
|
||||
and rootkits targeting Linux servers, containers, and cloud infrastructure — through
|
||||
static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples.
|
||||
Use when investigating Linux malware, triaging a suspicious ELF binary, assessing
|
||||
a compromised Linux server, or analyzing container-targeted malware.
|
||||
|
||||
'
|
||||
domain: cybersecurity
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: analyzing-linux-system-artifacts
|
||||
description: Examine Linux system artifacts including auth logs, cron jobs, shell
|
||||
history, and system configuration to uncover evidence of compromise or unauthorized
|
||||
activity.
|
||||
description: Examine Linux system artifacts (auth logs, cron/systemd persistence,
|
||||
shell history, SSH keys, and system configuration) to uncover evidence of compromise,
|
||||
detect rootkits or backdoors, and reconstruct user/attacker activity. Use when
|
||||
investigating a compromised Linux server or workstation, hunting for persistence
|
||||
mechanisms, or scoping a Linux-based breach during incident response.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,11 @@
|
||||
---
|
||||
name: analyzing-lnk-file-and-jump-list-artifacts
|
||||
description: Analyze Windows LNK shortcut files and Jump List artifacts to establish
|
||||
evidence of file access, program execution, and user activity using LECmd, JLECmd,
|
||||
and manual binary parsing of the Shell Link Binary format.
|
||||
description: Analyze Windows LNK shortcut files and Jump List artifacts with LECmd,
|
||||
JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file
|
||||
access, program execution, and user activity that persists even after the target
|
||||
file is deleted. Use when investigating Windows user activity, reconstructing file-access
|
||||
or program-execution timelines, or examining recent/frequently-used file evidence
|
||||
in a forensic exam.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -2,6 +2,9 @@
|
||||
name: analyzing-malicious-pdf-with-peepdf
|
||||
description: Perform static analysis of malicious PDF documents using peepdf, pdfid,
|
||||
and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.
|
||||
Use when triaging a suspicious PDF attachment from a phishing email, analyzing a
|
||||
PDF-based exploit document, or building detection signatures for weaponized PDF
|
||||
threats.
|
||||
domain: cybersecurity
|
||||
subdomain: malware-analysis
|
||||
tags:
|
||||
|
||||
@@ -1,10 +1,11 @@
|
||||
---
|
||||
name: analyzing-malware-behavior-with-cuckoo-sandbox
|
||||
description: 'Executes malware samples in Cuckoo Sandbox to observe runtime behavior
|
||||
including process creation, file system modifications, registry changes, network
|
||||
communications, and API calls. Generates comprehensive behavioral reports for malware
|
||||
classification and IOC extraction. Activates for requests involving dynamic malware
|
||||
analysis, sandbox detonation, behavioral analysis, or automated malware execution.
|
||||
description: 'Detonate malware samples in Cuckoo Sandbox to observe runtime behavior
|
||||
— process creation, file system and registry changes, network communications,
|
||||
and API calls — and generate behavioral reports for classification and IOC extraction.
|
||||
Use when a sample has passed static triage and needs dynamic/behavioral analysis,
|
||||
when mapping a full infection chain, or when building YARA/behavioral signatures
|
||||
from observed sandbox activity.
|
||||
|
||||
'
|
||||
domain: cybersecurity
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: analyzing-malware-family-relationships-with-malpedia
|
||||
description: Use the Malpedia platform and API to research malware family relationships,
|
||||
track variant evolution, link families to threat actors, and integrate YARA rules
|
||||
for detection across malware lineages.
|
||||
description: Query the Malpedia API to look up malware family aliases and naming
|
||||
(platform.family_name), pull community/vendor YARA rules, link families to threat
|
||||
actors, and map family relationships such as loader-payload chains and shared authorship.
|
||||
Use when researching a malware family's aliases, lineage, or actor attribution,
|
||||
or when sourcing YARA rules for detection.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: analyzing-malware-persistence-with-autoruns
|
||||
description: Use Sysinternals Autoruns to systematically identify and analyze malware
|
||||
persistence mechanisms across registry keys, scheduled tasks, services, drivers,
|
||||
and startup locations on Windows systems.
|
||||
description: Use Sysinternals Autoruns to systematically enumerate and analyze malware
|
||||
persistence mechanisms across Windows registry run keys, scheduled tasks, services,
|
||||
drivers, and startup locations. Use when hunting for persistence during Windows
|
||||
incident response, triaging a compromised endpoint, or validating that malware
|
||||
autostart entries have been fully identified and removed.
|
||||
domain: cybersecurity
|
||||
subdomain: malware-analysis
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: analyzing-malware-sandbox-evasion-techniques
|
||||
description: Detect sandbox evasion techniques in malware samples by analyzing timing
|
||||
checks, VM artifact queries, user interaction detection, and sleep inflation patterns
|
||||
from Cuckoo/AnyRun behavioral reports
|
||||
description: Detect sandbox and VM evasion techniques in malware samples by analyzing
|
||||
timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation
|
||||
patterns from Cuckoo or AnyRun behavioral reports. Use when a sample shows no or
|
||||
minimal activity in a sandbox, when a behavioral report needs review for evasion
|
||||
indicators, or when building detections for anti-analysis techniques.
|
||||
domain: cybersecurity
|
||||
subdomain: malware-analysis
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: analyzing-mft-for-deleted-file-recovery
|
||||
description: Analyze the NTFS Master File Table ($MFT) to recover metadata and content
|
||||
of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack
|
||||
space using MFTECmd, analyzeMFT, and X-Ways Forensics.
|
||||
description: Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,
|
||||
and X-Ways Forensics to recover metadata and content of deleted files by examining
|
||||
MFT record entries, $LogFile, $UsnJrnl, and MFT slack space. Use when recovering
|
||||
evidence of deleted files, reconstructing NTFS file-system timelines, or detecting
|
||||
anti-forensic timestomping during a Windows forensic examination.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: analyzing-network-covert-channels-in-malware
|
||||
description: Detect and analyze covert communication channels used by malware including
|
||||
DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2
|
||||
and data exfiltration.
|
||||
description: Detect and analyze covert communication channels used by malware, including
|
||||
DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse
|
||||
used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP
|
||||
traffic patterns, hunting for hidden C2 channels in network captures, or attributing
|
||||
exfiltration traffic to a known tunneling toolset.
|
||||
domain: cybersecurity
|
||||
subdomain: malware-analysis
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: analyzing-network-packets-with-scapy
|
||||
description: Craft, send, sniff, and dissect network packets using Scapy for protocol
|
||||
analysis, network reconnaissance, and traffic anomaly detection in authorized security
|
||||
testing
|
||||
description: Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets. Use when performing authorized network reconnaissance, protocol-level forensic analysis, or building traffic anomaly detection during security testing.
|
||||
domain: cybersecurity
|
||||
subdomain: network-security
|
||||
tags:
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
---
|
||||
name: analyzing-outlook-pst-for-email-forensics
|
||||
description: Analyze Microsoft Outlook PST and OST files for email forensic evidence
|
||||
including message content, headers, attachments, deleted items, and metadata using
|
||||
libpff, pst-utils, and forensic email analysis tools for legal investigations and
|
||||
incident response.
|
||||
description: Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder. Use when conducting email forensic investigations, legal e-discovery, or incident response that requires reconstructing communication patterns or tracing message routing from Outlook archives.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,10 +1,6 @@
|
||||
---
|
||||
name: analyzing-packed-malware-with-upx-unpacker
|
||||
description: 'Identifies and unpacks UPX-packed and other packed malware samples to
|
||||
expose the original executable code for static analysis. Covers both standard UPX
|
||||
unpacking and handling modified UPX headers that prevent automated decompression.
|
||||
Activates for requests involving malware unpacking, UPX decompression, packer removal,
|
||||
or preparing packed samples for analysis.
|
||||
description: 'Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress in its import table, or when preparing a packed binary for disassembly in Ghidra or IDA.
|
||||
|
||||
'
|
||||
domain: cybersecurity
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: analyzing-persistence-mechanisms-in-linux
|
||||
description: Detect and analyze Linux persistence mechanisms including crontab entries,
|
||||
systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys
|
||||
backdoors using auditd and file integrity monitoring
|
||||
description: Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-hunting
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: analyzing-powershell-empire-artifacts
|
||||
description: Detect PowerShell Empire framework artifacts in Windows event logs by
|
||||
identifying Base64 encoded launcher patterns, default user agents, staging URL structures,
|
||||
stager IOCs, and known Empire module signatures in Script Block Logging events.
|
||||
description: Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast), and staging URL patterns. Use when hunting for or confirming Empire C2 activity in Windows event logs.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-hunting
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
---
|
||||
name: analyzing-prefetch-files-for-execution-history
|
||||
description: Parse Windows Prefetch files to determine program execution history including
|
||||
run counts, timestamps, and referenced files for forensic investigation.
|
||||
description: Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced files/DLLs. Use when building a timeline of program execution on a Windows system, confirming whether a suspicious binary ran, or correlating execution evidence with other forensic artifacts during an investigation.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: analyzing-ransomware-leak-site-intelligence
|
||||
description: Monitor and analyze ransomware group data leak sites (DLS) to track victim
|
||||
postings, extract threat intelligence on group tactics, and assess sector-specific
|
||||
ransomware risk for proactive defense.
|
||||
description: Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk assessments. Use when performing threat intelligence gathering on active ransomware groups or building proactive defense reporting from double-extortion leak-site activity.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: analyzing-ransomware-network-indicators
|
||||
description: Identify ransomware network indicators including C2 beaconing patterns,
|
||||
TOR exit node connections, data exfiltration flows, and encryption key exchange
|
||||
via Zeek conn.log and NetFlow analysis
|
||||
description: Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-hunting
|
||||
tags:
|
||||
|
||||
@@ -1,11 +1,6 @@
|
||||
---
|
||||
name: analyzing-ransomware-payment-wallets
|
||||
description: 'Traces ransomware cryptocurrency payment flows using blockchain analysis
|
||||
tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs. Identifies
|
||||
wallet clusters, tracks fund movement through mixers and exchanges, and supports
|
||||
law enforcement attribution. Activates for requests involving ransomware payment
|
||||
tracing, bitcoin wallet analysis, cryptocurrency forensics, or blockchain intelligence
|
||||
gathering.
|
||||
description: 'Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments.
|
||||
|
||||
'
|
||||
domain: cybersecurity
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
---
|
||||
name: analyzing-slack-space-and-file-system-artifacts
|
||||
description: Examine file system slack space, MFT entries, USN journal, and alternate
|
||||
data streams to recover hidden data and reconstruct file activity on NTFS volumes.
|
||||
description: Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: analyzing-threat-actor-ttps-with-mitre-attack
|
||||
description: MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics,
|
||||
techniques, and procedures (TTPs) based on real-world observations. This skill covers
|
||||
systematically mapping threat actor beh
|
||||
description: Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,11 +1,6 @@
|
||||
---
|
||||
name: analyzing-threat-actor-ttps-with-mitre-navigator
|
||||
description: 'Map advanced persistent threat (APT) group tactics, techniques, and
|
||||
procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti
|
||||
Python library. The analyst queries STIX/TAXII data for group-technique associations,
|
||||
generates Navigator layer files for visualization, and compares defensive coverage
|
||||
against adversary profiles. Activates for requests involving APT TTP mapping, ATT&CK
|
||||
Navigator layers, threat actor profiling, or MITRE technique coverage analysis.
|
||||
description: 'Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group''s techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.
|
||||
|
||||
'
|
||||
domain: cybersecurity
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
---
|
||||
name: analyzing-threat-landscape-with-misp
|
||||
description: Analyze the threat landscape using MISP (Malware Information Sharing
|
||||
Platform) by querying event statistics, attribute distributions, threat actor galaxy
|
||||
clusters, and tag trends over time. Uses PyMISP to pull event data, compute IOC
|
||||
type breakdowns, identify top threat actors and malware families, and generate threat
|
||||
landscape reports with temporal trends.
|
||||
description: Query a MISP (Malware Information Sharing Platform) instance via PyMISP
|
||||
to compute event statistics, IOC type breakdowns, threat actor galaxy clusters,
|
||||
and tag trends, and generate threat landscape reports with temporal trends. Use
|
||||
when asked to analyze threat intelligence data, summarize top threat actors or
|
||||
malware families, or produce a CTI landscape report from MISP events.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,9 @@
|
||||
---
|
||||
name: analyzing-typosquatting-domains-with-dnstwist
|
||||
description: Detect typosquatting, homograph phishing, and brand impersonation domains
|
||||
using dnstwist to generate domain permutations and identify registered lookalike
|
||||
domains targeting your organization.
|
||||
description: Generate domain permutations with dnstwist and check DNS resolution
|
||||
to detect typosquatting, homograph phishing, and brand impersonation domains registered
|
||||
against your organization. Use when asked to monitor for lookalike domains, investigate
|
||||
a phishing domain, or assess brand-impersonation risk.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,12 +1,10 @@
|
||||
---
|
||||
name: analyzing-uefi-bootkit-persistence
|
||||
description: 'Analyzes UEFI bootkit persistence mechanisms including firmware implants
|
||||
in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques,
|
||||
and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus,
|
||||
LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection,
|
||||
chipsec-based firmware integrity verification, and Secure Boot configuration auditing.
|
||||
Activates for requests involving UEFI malware analysis, firmware persistence investigation,
|
||||
boot chain integrity verification, or Secure Boot bypass detection.
|
||||
description: 'Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,
|
||||
Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware integrity
|
||||
verification, detecting known families like BlackLotus, LoJax, and MoonBounce.
|
||||
Use for UEFI malware analysis, firmware persistence investigation, or Secure Boot
|
||||
bypass detection.
|
||||
|
||||
'
|
||||
domain: cybersecurity
|
||||
|
||||
@@ -1,7 +1,9 @@
|
||||
---
|
||||
name: analyzing-usb-device-connection-history
|
||||
description: Investigate USB device connection history from Windows registry, event
|
||||
logs, and setupapi logs to track removable media usage and potential data exfiltration.
|
||||
description: Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,
|
||||
and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged
|
||||
timestamps, and drive letter mappings. Use when investigating removable media usage,
|
||||
tracking device provenance, or building a timeline for suspected data exfiltration.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,12 +1,10 @@
|
||||
---
|
||||
name: analyzing-windows-amcache-artifacts
|
||||
description: 'Parses and analyzes the Windows Amcache.hve registry hive to extract
|
||||
evidence of program execution, application installation, and driver loading for
|
||||
digital forensics investigations. Uses Eric Zimmerman''s AmcacheParser and Timeline
|
||||
Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and
|
||||
timeline reconstruction. Activates for requests involving Amcache forensics, program
|
||||
execution evidence, Windows artifact analysis, or application compatibility cache
|
||||
investigation.
|
||||
description: 'Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s
|
||||
AmcacheParser and Timeline Explorer to extract evidence of program execution, application
|
||||
installation, and driver loading, including SHA-1 hash correlation with threat
|
||||
intel and timeline reconstruction. Use for Amcache forensics, program execution
|
||||
evidence gathering, or application compatibility cache investigations in DFIR work.
|
||||
|
||||
'
|
||||
domain: cybersecurity
|
||||
|
||||
@@ -1,7 +1,9 @@
|
||||
---
|
||||
name: analyzing-windows-lnk-files-for-artifacts
|
||||
description: Parse Windows LNK shortcut files to extract target paths, timestamps,
|
||||
volume information, and machine identifiers for forensic timeline reconstruction.
|
||||
description: Parse Windows LNK shortcut files to extract target paths, MAC timestamps,
|
||||
volume serial numbers, and machine identifiers for forensic timeline reconstruction.
|
||||
Use when investigating recently-accessed files, tracking removable media or network
|
||||
paths referenced by shortcuts, or building a DFIR timeline from LNK artifacts.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: analyzing-windows-prefetch-with-python
|
||||
description: Parse Windows Prefetch files using the windowsprefetch Python library
|
||||
to reconstruct application execution history, detect renamed or masquerading binaries,
|
||||
and identify suspicious program execution patterns.
|
||||
description: Parse Windows Prefetch (.pf) files with the windowsprefetch Python
|
||||
library to reconstruct application execution history, run counts, and accessed
|
||||
file/volume lists. Use when investigating renamed or masquerading binaries, verifying
|
||||
program execution timelines, or hunting for suspicious execution patterns in incident
|
||||
response.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,10 @@
|
||||
---
|
||||
name: analyzing-windows-registry-for-artifacts
|
||||
description: Extract and analyze Windows Registry hives to uncover user activity,
|
||||
installed software, autostart entries, and evidence of system compromise.
|
||||
description: Extract and analyze Windows Registry hives with tools like RegRipper
|
||||
and Registry Explorer to uncover user activity, installed software, autostart/persistence
|
||||
entries, and evidence of system compromise. Use when investigating registry-based
|
||||
persistence, reconstructing user or system activity, or performing DFIR triage
|
||||
on a Windows image.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: analyzing-windows-shellbag-artifacts
|
||||
description: Analyze Windows Shellbag registry artifacts to reconstruct folder browsing
|
||||
activity, detect access to removable media and network shares, and establish user
|
||||
interaction with directories even after deletion using SBECmd and ShellBags Explorer.
|
||||
description: Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and
|
||||
Shellbags Explorer to reconstruct folder browsing activity and prove user interaction
|
||||
with directories, including removable media and network shares, even after the
|
||||
folders are deleted. Use when reconstructing a user's folder access history or
|
||||
proving access to a since-removed directory in DFIR work.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,6 +1,9 @@
|
||||
---
|
||||
name: assessing-vector-and-embedding-weaknesses
|
||||
description: Test vector stores for embedding inversion, cross-tenant leakage, and poisoning.
|
||||
description: Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector,
|
||||
FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per
|
||||
OWASP LLM08:2025. Use when performing an authorized security assessment of a RAG
|
||||
pipeline's retrieval layer or auditing multi-tenant vector-store isolation.
|
||||
domain: cybersecurity
|
||||
subdomain: ai-security
|
||||
tags:
|
||||
|
||||
@@ -1,6 +1,10 @@
|
||||
---
|
||||
name: attacking-entra-id-with-roadtools
|
||||
description: Enumerate Entra ID with ROADrecon and acquire and exchange tokens with roadtx.
|
||||
description: Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and
|
||||
acquire, exchange, and abuse tokens (including primary refresh tokens) with roadtx.
|
||||
Use for authorized red-team enumeration of a tenant's directory objects or for
|
||||
token-based identity attacks against Entra ID you are explicitly authorized to
|
||||
test.
|
||||
domain: cybersecurity
|
||||
subdomain: identity-access-management
|
||||
tags:
|
||||
|
||||
@@ -1,6 +1,10 @@
|
||||
---
|
||||
name: attacking-oauth-with-device-code-phishing
|
||||
description: Run OAuth 2.0 device-code and illicit-consent phishing against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services.
|
||||
description: Run OAuth 2.0 device-code and illicit-consent phishing attacks against
|
||||
Microsoft Entra ID, using TokenTactics-style tooling to steal access and refresh
|
||||
tokens, bypass MFA, and pivot across Microsoft 365 services. Use for authorized
|
||||
red-team engagements simulating device-code or consent-grant phishing against a
|
||||
tenant you have explicit written permission to test.
|
||||
domain: cybersecurity
|
||||
subdomain: identity-access-management
|
||||
tags:
|
||||
|
||||
@@ -1,12 +1,6 @@
|
||||
---
|
||||
name: auditing-cloud-with-cis-benchmarks
|
||||
description: 'This skill details how to conduct cloud security audits using Center
|
||||
for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting
|
||||
CIS Foundations Benchmark controls, running automated assessments with tools like
|
||||
Prowler and ScoutSuite, remediating failed controls, and maintaining continuous
|
||||
compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.
|
||||
|
||||
'
|
||||
description: Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.
|
||||
domain: cybersecurity
|
||||
subdomain: cloud-security
|
||||
tags:
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
name: auditing-entra-id-with-aadinternals
|
||||
description: Run Microsoft Entra ID tenant reconnaissance, token acquisition and manipulation, and federation backdoor testing with the AADInternals PowerShell toolkit to validate identity-attack resilience.
|
||||
description: Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation. Use during an authorized Entra ID/Microsoft 365 red-team assessment to map external attack surface or verify AD FS signing certs resist Golden SAML.
|
||||
domain: cybersecurity
|
||||
subdomain: identity-access-management
|
||||
tags:
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
name: auditing-mcp-servers-for-tool-poisoning
|
||||
description: Scan Model Context Protocol servers and tool metadata for poisoning, SSRF, and unauthenticated exposure.
|
||||
description: Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs' mcp-scan for static/runtime scanning plus manual SSRF/auth checks and description pinning. Use before adding a new MCP server to an agent stack, when reviewing an internal MCP server, detecting rug pulls, or investigating an agent's unexpected tool-driven behavior.
|
||||
domain: cybersecurity
|
||||
subdomain: ai-security
|
||||
tags:
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
name: benchmarking-kubernetes-with-kube-bench
|
||||
description: Run CIS Kubernetes Benchmark checks and remediate findings with kube-bench.
|
||||
description: Run kube-bench (Aqua Security) against a Kubernetes cluster's control-plane, kubelet, and node configuration to check compliance with the CIS Kubernetes Benchmark and remediate PASS/FAIL/WARN findings. Use when establishing a security baseline for a new cluster, performing periodic hardening audits, validating remediation after configuration changes, or gathering compliance evidence for SOC 2/PCI DSS.
|
||||
domain: cybersecurity
|
||||
subdomain: container-security
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: building-adversary-infrastructure-tracking-system
|
||||
description: Build an automated system to track adversary infrastructure using passive
|
||||
DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor
|
||||
threat actor command-and-control networks.
|
||||
description: Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate transparency logs, WHOIS records, and IP enrichment to map threat-actor C2 networks and flag newly registered domains matching known patterns. Use when pivoting from known indicators to discover related C2 infrastructure or maintaining a continuously updated map of a threat actor's network.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: building-attack-pattern-library-from-cti-reports
|
||||
description: Extract and catalog attack patterns from cyber threat intelligence reports
|
||||
into a structured STIX-based library mapped to MITRE ATT&CK for detection engineering
|
||||
and threat-informed defense.
|
||||
description: Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1 attack-pattern library with detection templates. Use when cataloging attack patterns from CTI reports for threat-informed detection engineering, or generating Sigma/YARA templates from documented behaviors.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: building-c2-infrastructure-with-sliver-framework
|
||||
description: Build and configure a resilient command-and-control infrastructure using
|
||||
BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator
|
||||
support for authorized red team engagements.
|
||||
description: Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations. Use when standing up resilient C2 for a red-team engagement or generating beacon/session implants that must survive blue-team detection.
|
||||
domain: cybersecurity
|
||||
subdomain: red-teaming
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
---
|
||||
name: building-c2-redirector-infrastructure
|
||||
description: Architect redirectors with nginx and Apache, malleable profiles, and OPSEC
|
||||
for resilient C2.
|
||||
description: Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let's Encrypt TLS, and applying OPSEC controls like domain fronting and UA/geo filtering. Use when standing up red-team C2 that must survive blue-team triage or ensuring only profile-matching implant traffic reaches the hidden team server.
|
||||
domain: cybersecurity
|
||||
subdomain: red-teaming
|
||||
tags:
|
||||
|
||||
@@ -1,12 +1,6 @@
|
||||
---
|
||||
name: building-cloud-siem-with-sentinel
|
||||
description: 'This skill covers deploying Microsoft Sentinel as a cloud-native SIEM
|
||||
and SOAR platform for centralized security operations. It details configuring data
|
||||
connectors for multi-cloud log ingestion, writing KQL detection queries, building
|
||||
automated response playbooks with Logic Apps, and leveraging the Sentinel data lake
|
||||
for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.
|
||||
|
||||
'
|
||||
description: Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks. Use when establishing a centralized SOC for multi-cloud environments, migrating from a legacy SIEM, or performing petabyte-scale threat hunting; not for AWS-only setups where Security Hub/GuardDuty suffice or for endpoint EDR needs.
|
||||
domain: cybersecurity
|
||||
subdomain: cloud-security
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
---
|
||||
name: building-devsecops-pipeline-with-gitlab-ci
|
||||
description: Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD
|
||||
integrating SAST, DAST, container scanning, dependency scanning, and secret detection.
|
||||
description: Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security templates. Use when building a shift-left DevSecOps pipeline in GitLab, adding automated vulnerability scanning stages to .gitlab-ci.yml, or triaging scanner findings with GitLab Duo AI before deployment.
|
||||
domain: cybersecurity
|
||||
subdomain: devsecops
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: building-identity-federation-with-saml-azure-ad
|
||||
description: Establish SAML 2.0 identity federation between on-premises Active Directory
|
||||
and Azure AD (Microsoft Entra ID) for seamless cross-domain authentication and SSO
|
||||
to cloud applications.
|
||||
description: Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federation models (AD FS, password hash sync, pass-through auth, third-party IdP) and the SAML authentication flow. Use when extending on-premises authentication authority to cloud resources or designing hybrid identity SSO architecture for Entra ID.
|
||||
domain: cybersecurity
|
||||
subdomain: identity-access-management
|
||||
tags:
|
||||
|
||||
@@ -1,12 +1,6 @@
|
||||
---
|
||||
name: building-identity-governance-lifecycle-process
|
||||
description: 'Builds comprehensive identity governance and lifecycle management processes
|
||||
including joiner-mover-leaver automation, role mining, access request workflows,
|
||||
periodic recertification, and orphaned account remediation using IGA platforms.
|
||||
Activates for requests involving identity lifecycle management, JML processes, role-based
|
||||
access provisioning, or identity governance program design.
|
||||
|
||||
'
|
||||
description: Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests, periodic recertification, and orphaned-account remediation sourced from an HR feed. Use when automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance.
|
||||
domain: cybersecurity
|
||||
subdomain: identity-access-management
|
||||
tags:
|
||||
|
||||
@@ -1,13 +1,10 @@
|
||||
---
|
||||
name: building-incident-response-playbook
|
||||
description: 'Designs and documents structured incident response playbooks that define
|
||||
step-by-step procedures for specific incident types aligned with NIST SP 800-61r3
|
||||
and SANS PICERL frameworks. Covers playbook structure, decision trees, escalation
|
||||
criteria, RACI matrices, and integration with SOAR platforms. Activates for requests
|
||||
involving IR playbook creation, incident response procedure documentation, response
|
||||
runbook development, or SOAR playbook design.
|
||||
|
||||
'
|
||||
description: Designs and documents structured incident response playbooks with step-by-step
|
||||
procedures per incident type, decision trees, escalation criteria, RACI matrices,
|
||||
and SOAR platform integration, aligned to NIST SP 800-61r3 and SANS PICERL. Use
|
||||
when creating or maturing an IR program, documenting response runbooks for a new
|
||||
incident type, or designing SOAR playbooks.
|
||||
domain: cybersecurity
|
||||
subdomain: incident-response
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: building-incident-timeline-with-timesketch
|
||||
description: Build collaborative forensic incident timelines using Timesketch to ingest,
|
||||
normalize, and analyze multi-source event data for attack chain reconstruction and
|
||||
investigation documentation.
|
||||
normalize, and analyze multi-source event data (including Plaso output) for attack
|
||||
chain reconstruction and investigation documentation. Use when reconstructing the
|
||||
sequence of events during an incident investigation or when multiple analysts need
|
||||
to jointly tag, annotate, and search a shared DFIR timeline.
|
||||
domain: cybersecurity
|
||||
subdomain: incident-response
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: building-ioc-defanging-and-sharing-pipeline
|
||||
description: Build an automated pipeline to defang indicators of compromise (URLs,
|
||||
IPs, domains, emails) for safe sharing and distribute them in STIX format through
|
||||
TAXII feeds and threat intelligence platforms.
|
||||
description: Build an automated pipeline that ingests raw IOCs (URLs, IPs, domains,
|
||||
emails), normalizes and deduplicates them, then produces defanged renderings for
|
||||
safe human reading alongside canonical STIX 2.1 bundles distributed via TAXII servers,
|
||||
MISP, or email reports. Use when preparing indicators of compromise for safe analyst
|
||||
sharing or automating threat intel distribution to TAXII/MISP feeds.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: building-ioc-enrichment-pipeline-with-opencti
|
||||
description: OpenCTI is an open-source platform for managing cyber threat intelligence
|
||||
knowledge, built on STIX 2.1 as its native data model. This skill covers building
|
||||
an automated IOC enrichment pipeline using O
|
||||
description: Build an automated IOC enrichment pipeline on OpenCTI (STIX 2.1 native
|
||||
threat intel platform) using its internal enrichment connectors to pull context
|
||||
from VirusTotal, Shodan, AbuseIPDB, and GreyNoise, correlate indicators with known
|
||||
actors/campaigns, and score them for analyst prioritization. Use when deploying
|
||||
OpenCTI or automating enrichment and confidence scoring of newly ingested indicators.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: building-malware-incident-communication-template
|
||||
description: Build structured communication templates for malware incidents including
|
||||
stakeholder notifications, executive briefings, technical advisories, and regulatory
|
||||
disclosures with severity-based escalation procedures.
|
||||
description: Build structured communication templates for malware incidents (ransomware,
|
||||
wiper, trojan, worm), covering internal stakeholder notifications, executive briefings,
|
||||
technical advisories for IT teams, customer notifications, and regulatory disclosures,
|
||||
with severity-based escalation procedures. Use when drafting or standardizing incident
|
||||
communications and notification workflows for a malware outbreak.
|
||||
domain: cybersecurity
|
||||
subdomain: incident-response
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,10 @@
|
||||
---
|
||||
name: building-patch-tuesday-response-process
|
||||
description: Establish a structured operational process to triage, test, and deploy
|
||||
Microsoft Patch Tuesday security updates within risk-based remediation SLAs.
|
||||
description: Establish a repeatable operational process for triaging, testing, and
|
||||
deploying Microsoft Patch Tuesday security updates (Windows, Office, Exchange, SQL
|
||||
Server, Azure) via WSUS/SCCM within risk-based remediation SLAs, from advisory review
|
||||
through validation. Use when building or improving a monthly patch management workflow
|
||||
or prioritizing which CVEs to remediate first.
|
||||
domain: cybersecurity
|
||||
subdomain: vulnerability-management
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: building-phishing-reporting-button-workflow
|
||||
description: Implement a phishing report button in email clients with automated triage
|
||||
workflow that analyzes user-reported suspicious emails and provides feedback to
|
||||
reporters.
|
||||
description: Implement a phishing report button (Microsoft 365 built-in Report button
|
||||
or third-party like KnowBe4/Cofense) in email clients with a SOAR-driven automated
|
||||
triage workflow that classifies reported emails, extracts IOCs, takes remediation
|
||||
actions, and gives feedback to reporters. Use when deploying user-reported phishing
|
||||
intake or automating triage of the resulting reporting mailbox.
|
||||
domain: cybersecurity
|
||||
subdomain: phishing-defense
|
||||
tags:
|
||||
|
||||
@@ -1,12 +1,10 @@
|
||||
---
|
||||
name: building-ransomware-playbook-with-cisa-framework
|
||||
description: 'Builds a structured ransomware incident response playbook aligned with
|
||||
the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation,
|
||||
description: Builds a structured ransomware incident response playbook aligned with
|
||||
the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation,
|
||||
detection, containment, eradication, recovery, and post-incident phases with actionable
|
||||
checklists. Activates for requests involving ransomware response planning, CISA
|
||||
compliance, incident response playbook creation, or ransomware preparedness assessment.
|
||||
|
||||
'
|
||||
checklists. Use when creating or updating a ransomware playbook, running a CISA-aligned
|
||||
readiness assessment, or validating response steps during a tabletop exercise.
|
||||
domain: cybersecurity
|
||||
subdomain: ransomware-defense
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,10 @@
|
||||
---
|
||||
name: building-red-team-c2-infrastructure-with-havoc
|
||||
description: Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners,
|
||||
redirectors, and Demon agents for authorized red team operations.
|
||||
description: Deploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMB
|
||||
listeners, Nginx redirectors, and Demon agents) with malleable traffic profiles and
|
||||
OPSEC-hardened infrastructure for authorized red team operations. Use when standing
|
||||
up or hardening Havoc C2 infrastructure for a written, authorized adversary emulation
|
||||
engagement.
|
||||
domain: cybersecurity
|
||||
subdomain: red-teaming
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: building-role-mining-for-rbac-optimization
|
||||
description: Apply bottom-up and top-down role mining techniques to discover optimal
|
||||
RBAC roles from existing user-permission assignments, reducing role explosion and
|
||||
enforcing least privilege.
|
||||
description: Apply bottom-up and top-down role mining techniques, including clustering
|
||||
algorithms and formal concept analysis, to discover optimal RBAC roles from existing
|
||||
user-permission assignments, consolidating overlapping roles and enforcing least
|
||||
privilege. Use when an identity program needs to reduce role explosion or redesign
|
||||
its RBAC role set from access data.
|
||||
domain: cybersecurity
|
||||
subdomain: identity-access-management
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,10 @@
|
||||
---
|
||||
name: building-soc-escalation-matrix
|
||||
description: Build a structured SOC escalation matrix defining severity tiers, response
|
||||
SLAs, escalation paths, and notification procedures for security incidents.
|
||||
SLAs, tiered escalation paths, and notification procedures for security incidents,
|
||||
using context-driven criteria that combine business risk, asset criticality, and
|
||||
data sensitivity. Use when designing or revising how a SOC triages and escalates
|
||||
incidents across analyst tiers.
|
||||
domain: cybersecurity
|
||||
subdomain: soc-operations
|
||||
tags:
|
||||
|
||||
@@ -1,6 +1,10 @@
|
||||
---
|
||||
name: building-super-timelines-with-plaso
|
||||
description: Generate log2timeline and Plaso super-timelines and triage them in Timesketch.
|
||||
description: Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py,
|
||||
psort.py, and psteal.py CLI tools (fusing file-system MACB, registry, EVTX, browser
|
||||
history, prefetch, LNK, and more), then triage and filter the results in Timesketch.
|
||||
Use when reconstructing the full sequence of events on a compromised or forensically
|
||||
imaged host during a DFIR investigation.
|
||||
domain: cybersecurity
|
||||
subdomain: digital-forensics
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: building-threat-actor-profile-from-osint
|
||||
description: Build comprehensive threat actor profiles using open-source intelligence
|
||||
(OSINT) techniques to document adversary motivations, capabilities, infrastructure,
|
||||
and TTPs for proactive defense.
|
||||
description: Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos, correlating indicators, mapping adversary infrastructure with tools like Maltego and SpiderFoot, and producing structured dossiers of motivations, capabilities, infrastructure, and TTPs. Use when performing attribution or building an adversary dossier from open-source intelligence.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: building-threat-feed-aggregation-with-misp
|
||||
description: Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate,
|
||||
and distribute threat intelligence feeds from multiple sources for centralized IOC
|
||||
management and automated SIEM integration.
|
||||
description: Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization and STIX/TAXII-based integration with Splunk, Elasticsearch, and SOAR platforms. Use when standing up centralized IOC management or wiring multi-source threat feeds into a SIEM.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
---
|
||||
name: building-threat-hunt-hypothesis-framework
|
||||
description: Build a systematic threat hunt hypothesis framework that transforms threat
|
||||
intelligence, attack patterns, and environmental data into testable hunting hypotheses.
|
||||
description: Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR/SIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report. Use when planning or running a proactive threat hunt or scoping compromise from an intel- or anomaly-driven lead.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-hunting
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
---
|
||||
name: building-threat-intelligence-enrichment-in-splunk
|
||||
description: Build automated threat intelligence enrichment pipelines in Splunk Enterprise
|
||||
Security using lookup tables, modular inputs, and the Threat Intelligence Framework.
|
||||
description: Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them against security events via lookup tables, modular inputs, and the Threat Intelligence Framework. Use when wiring threat intel into Splunk correlation searches to flag IOC matches and cut SOC triage time.
|
||||
domain: cybersecurity
|
||||
subdomain: soc-operations
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: building-threat-intelligence-platform
|
||||
description: Building a Threat Intelligence Platform (TIP) involves deploying and
|
||||
integrating multiple CTI tools into a unified system for collecting, analyzing,
|
||||
enriching, and disseminating threat intelligence. T
|
||||
description: Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed ingestion pipelines, enrichment workflows, STIX/TAXII interoperability, and analyst dashboards. Use when architecting or standing up a centralized CTI platform to collect, analyze, and disseminate threat intelligence across a security team.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
---
|
||||
name: building-vulnerability-aging-and-sla-tracking
|
||||
description: Implement a vulnerability aging dashboard and SLA tracking system to
|
||||
measure remediation performance against severity-based timelines and drive accountability.
|
||||
description: Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days critical, 30 days high, 60 days medium, 90 days low), with automated escalations and compliance metrics reporting. Use when designing SLA policies, building aging/remediation dashboards, or proving compliance with remediation timelines.
|
||||
domain: cybersecurity
|
||||
subdomain: vulnerability-management
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
---
|
||||
name: building-vulnerability-dashboard-with-defectdojo
|
||||
description: Deploy DefectDojo as a centralized vulnerability management dashboard
|
||||
with scanner integrations, deduplication, metrics tracking, and Jira ticketing workflows.
|
||||
description: Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API. Use when consolidating scanner output into one dashboard or automating vulnerability ticketing and executive reporting.
|
||||
domain: cybersecurity
|
||||
subdomain: vulnerability-management
|
||||
tags:
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
---
|
||||
name: building-vulnerability-exception-tracking-system
|
||||
description: Build a vulnerability exception and risk acceptance tracking system with
|
||||
approval workflows, compensating controls documentation, and expiration management.
|
||||
description: Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance.
|
||||
domain: cybersecurity
|
||||
subdomain: vulnerability-management
|
||||
tags:
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
name: coercing-authentication-with-coercer-petitpotam
|
||||
description: Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer across MS-RPRN, MS-DFSNM, and MS-FSRVP to feed NTLM relay into AD CS Web Enrollment (ESC8) and other relay targets.
|
||||
description: Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz modes, feeding the coerced NTLM auth into a relay against AD CS Web Enrollment (ESC8), LDAP (RBCD), or SMB. Use in authorized engagements to complete a coercion-relay chain against a Domain Controller, or to validate coercion detections and signing/EPA mitigations.
|
||||
domain: cybersecurity
|
||||
subdomain: red-teaming
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: collecting-threat-intelligence-with-misp
|
||||
description: MISP (Malware Information Sharing Platform) is an open-source threat
|
||||
intelligence platform for gathering, sharing, storing, and correlating Indicators
|
||||
of Compromise (IOCs) of targeted attacks, threat
|
||||
description: Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines that aggregate indicators from community and commercial sources. Use when gathering, storing, or correlating IOCs and threat intelligence, or when scripting MISP ingestion via PyMISP.
|
||||
domain: cybersecurity
|
||||
subdomain: threat-intelligence
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: collecting-volatile-evidence-from-compromised-host
|
||||
description: Collect volatile forensic evidence from a compromised system following
|
||||
order of volatility, preserving memory, network connections, processes, and system
|
||||
state before they are lost.
|
||||
description: Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost. Use before isolating, shutting down, or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings.
|
||||
domain: cybersecurity
|
||||
subdomain: incident-response
|
||||
tags:
|
||||
|
||||
@@ -1,11 +1,6 @@
|
||||
---
|
||||
name: conducting-cloud-incident-response
|
||||
description: 'Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment,
|
||||
cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure.
|
||||
Activates for requests involving cloud incident response, AWS security incident, Azure compromise, GCP breach, cloud forensics,
|
||||
or cloud identity compromise.
|
||||
|
||||
'
|
||||
description: Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Use when CSPM alerts or audit logs show compromised cloud credentials, unauthorized IAM changes, or a breach spanning cloud services.
|
||||
domain: cybersecurity
|
||||
subdomain: incident-response
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: conducting-domain-persistence-with-dcsync
|
||||
description: Perform DCSync attacks to replicate Active Directory credentials and
|
||||
establish domain persistence by extracting KRBTGT, Domain Admin, and service account
|
||||
hashes for Golden Ticket creation.
|
||||
description: Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz. Use in authorized engagements after finding principals with replication rights, to establish long-term domain persistence, or to validate detections for replication abuse.
|
||||
domain: cybersecurity
|
||||
subdomain: red-teaming
|
||||
tags:
|
||||
|
||||
@@ -1,14 +1,6 @@
|
||||
---
|
||||
name: conducting-external-reconnaissance-with-osint
|
||||
description: 'Conducts external reconnaissance using Open Source Intelligence (OSINT)
|
||||
techniques to map an organization''s external attack surface without directly interacting
|
||||
with target systems. The tester gathers information from public sources including
|
||||
DNS records, certificate transparency logs, search engines, social media, code repositories,
|
||||
and data breach databases to build a comprehensive target profile. Activates for
|
||||
requests involving OSINT reconnaissance, external footprinting, attack surface mapping,
|
||||
or passive information gathering.
|
||||
|
||||
'
|
||||
description: Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile. Use for the passive info-gathering phase of a pentest, external footprinting, or collecting employee/email intel for a social engineering campaign.
|
||||
domain: cybersecurity
|
||||
subdomain: penetration-testing
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: conducting-full-scope-red-team-engagement
|
||||
description: Plan and execute a comprehensive red team engagement covering reconnaissance
|
||||
through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's
|
||||
detection and response capabilities.
|
||||
description: Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploitation to evaluate an organization's detection, prevention, and response against APT-style behavior. Use when scoping or running a full-scope, objective-based engagement, or purple-teaming against a specific threat actor's TTPs.
|
||||
domain: cybersecurity
|
||||
subdomain: red-teaming
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: conducting-internal-reconnaissance-with-bloodhound-ce
|
||||
description: Conduct internal Active Directory reconnaissance using BloodHound Community
|
||||
Edition to map attack paths, identify privilege escalation chains, and discover
|
||||
misconfigurations in domain environments.
|
||||
description: Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin. Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths.
|
||||
domain: cybersecurity
|
||||
subdomain: red-teaming
|
||||
tags:
|
||||
|
||||
@@ -1,11 +1,6 @@
|
||||
---
|
||||
name: conducting-malware-incident-response
|
||||
description: 'Responds to malware infections across enterprise endpoints by identifying the malware family, determining infection
|
||||
vectors, assessing spread, and executing eradication procedures. Covers the full lifecycle from detection through containment,
|
||||
analysis, removal, and recovery. Activates for requests involving malware response, malware eradication, trojan removal,
|
||||
worm containment, malware triage, or infected endpoint remediation.
|
||||
|
||||
'
|
||||
description: Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including trojan/worm/ransomware outbreaks, malware triage, or infected endpoint remediation.
|
||||
domain: cybersecurity
|
||||
subdomain: incident-response
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: conducting-pass-the-ticket-attack
|
||||
description: Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen
|
||||
Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's
|
||||
password. By extracting Kerberos tickets fro
|
||||
description: Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonate the ticket owner without knowing their password. Use during authorized post-exploitation to move laterally or escalate access via stolen Kerberos tickets, or to validate detections for Kerberos ticket theft and reuse.
|
||||
domain: cybersecurity
|
||||
subdomain: red-teaming
|
||||
tags:
|
||||
|
||||
@@ -1,13 +1,6 @@
|
||||
---
|
||||
name: conducting-phishing-incident-response
|
||||
description: 'Responds to phishing incidents by analyzing reported emails, extracting
|
||||
indicators, assessing credential compromise, quarantining malicious messages across
|
||||
the organization, and remediating affected accounts. Covers email header analysis,
|
||||
URL/attachment sandboxing, and mailbox-wide purge operations. Activates for requests
|
||||
involving phishing response, email incident, credential phishing, spear phishing
|
||||
investigation, or phishing remediation.
|
||||
|
||||
'
|
||||
description: Respond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quarantining malicious messages organization-wide, and remediating affected accounts. Use when investigating a reported phishing or credential-phishing email, a suspected spearphishing incident, or when a mailbox-wide purge and account remediation is needed.
|
||||
domain: cybersecurity
|
||||
subdomain: incident-response
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: conducting-social-engineering-penetration-test
|
||||
description: Design and execute a social engineering penetration test including phishing,
|
||||
vishing, smishing, and physical pretexting campaigns to measure human security resilience
|
||||
and identify training gaps.
|
||||
description: Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx to measure human security resilience. Use when scoping or running an authorized human-attack-surface test and reporting results to identify security awareness training gaps.
|
||||
domain: cybersecurity
|
||||
subdomain: penetration-testing
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
---
|
||||
name: conducting-spearphishing-simulation-campaign
|
||||
description: Spearphishing simulation is a targeted social engineering attack vector
|
||||
used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing
|
||||
uses OSINT-derived intelligence to craf
|
||||
description: Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LNK, OneNote, QR codes), standing up look-alike-domain email infrastructure with SPF/DKIM/DMARC via GoPhish, and tracking results. Use in authorized engagements to gain initial access via personalized phishing against specific individuals, distinct from broad campaigns.
|
||||
domain: cybersecurity
|
||||
subdomain: red-teaming
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,11 @@
|
||||
---
|
||||
name: configuring-active-directory-tiered-model
|
||||
description: Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered
|
||||
administration model for Active Directory. Covers Tier 0/1/2 separation, privileged
|
||||
access workstations (PAWs), administrative f
|
||||
administration model for Active Directory, covering Tier 0/1/2 separation, privileged
|
||||
access workstations (PAWs), administrative forest design, and authentication policy
|
||||
silos. Use when designing or hardening AD privileged-access architecture, segmenting
|
||||
Domain/Enterprise Admin accounts into tiers, or containing lateral movement and
|
||||
credential theft (pass-the-hash, Kerberoasting, golden tickets).
|
||||
domain: cybersecurity
|
||||
subdomain: identity-access-management
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,11 @@
|
||||
---
|
||||
name: configuring-aws-verified-access-for-ztna
|
||||
description: Configure AWS Verified Access to provide VPN-less zero trust network
|
||||
access to internal applications using identity and device posture verification with
|
||||
Cedar policy language.
|
||||
access to internal apps, combining identity trust providers (IAM Identity Center,
|
||||
Okta/OIDC), device posture providers (CrowdStrike, Jamf), Cedar policy authoring, and
|
||||
Terraform deployment. Use when replacing VPN access with ZTNA, writing Cedar access
|
||||
policies, or deploying Verified Access instances, groups, and endpoints across AWS
|
||||
accounts.
|
||||
domain: cybersecurity
|
||||
subdomain: zero-trust-architecture
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,11 @@
|
||||
---
|
||||
name: configuring-certificate-authority-with-openssl
|
||||
description: A Certificate Authority (CA) is the trust anchor in a PKI hierarchy,
|
||||
responsible for issuing, signing, and revoking digital certificates. This skill
|
||||
covers building a two-tier CA hierarchy (Root CA +
|
||||
description: Build a two-tier PKI Certificate Authority hierarchy (offline Root CA
|
||||
plus issuing Intermediate CA) using OpenSSL and the Python cryptography library,
|
||||
covering certificate extensions, CRL distribution points, OCSP responder
|
||||
configuration, and certificate policy management. Use when standing up an internal
|
||||
CA, issuing or revoking X.509 certificates, or designing PKI trust hierarchies for
|
||||
TLS, code-signing, or client-authentication use cases.
|
||||
domain: cybersecurity
|
||||
subdomain: cryptography
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: configuring-hsm-for-key-storage
|
||||
description: Hardware Security Modules (HSMs) are tamper-resistant physical devices
|
||||
that safeguard cryptographic keys and perform cryptographic operations in a hardened
|
||||
environment. Keys stored in an HSM never lea
|
||||
description: Configures Hardware Security Modules for cryptographic key storage
|
||||
using the PKCS#11 standard interface, covering key generation, signing, encryption,
|
||||
and key management on physical HSMs and SoftHSM2 for development. Use when protecting
|
||||
cryptographic keys so they never leave a hardened device boundary, or when building
|
||||
and testing PKCS#11-based key management workflows.
|
||||
domain: cybersecurity
|
||||
subdomain: cryptography
|
||||
tags:
|
||||
|
||||
@@ -1,9 +1,11 @@
|
||||
---
|
||||
name: configuring-identity-aware-proxy-with-google-iap
|
||||
description: 'Configuring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request
|
||||
identity verification for Compute Engine, App Engine, Cloud Run, and GKE services
|
||||
using access levels, context-aware policies, and programmatic access with service
|
||||
accounts.
|
||||
description: 'Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce
|
||||
per-request identity verification on Compute Engine, App Engine, Cloud Run, and
|
||||
GKE, including IAM bindings, Access Context Manager access levels, session/reauth
|
||||
settings, and service-account programmatic access. Use when replacing VPN access
|
||||
with identity-based access to GCP backends or configuring context-aware, zero-trust
|
||||
policies for Google Cloud services.
|
||||
|
||||
'
|
||||
domain: cybersecurity
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
name: configuring-ldap-security-hardening
|
||||
description: Harden LDAP directory services against common attacks including credential
|
||||
harvesting, LDAP injection, anonymous binding, and channel binding bypass. Covers
|
||||
LDAPS enforcement, channel binding, LDAP si
|
||||
description: Hardens LDAP directory services against credential harvesting, LDAP
|
||||
injection, anonymous binding, and channel-binding bypass by enforcing LDAPS, channel
|
||||
binding, and LDAP signing. Use when securing an LDAP or Active Directory environment
|
||||
against these attack classes or auditing directory service configurations for
|
||||
these vulnerabilities.
|
||||
domain: cybersecurity
|
||||
subdomain: identity-access-management
|
||||
tags:
|
||||
|
||||
@@ -1,8 +1,9 @@
|
||||
---
|
||||
name: configuring-microsegmentation-for-zero-trust
|
||||
description: Configure microsegmentation policies to enforce least-privilege workload-to-workload
|
||||
access using tools like VMware NSX, Illumio, and Calico, preventing lateral movement
|
||||
in zero trust architectures.
|
||||
description: Configures microsegmentation policies to enforce least-privilege workload-to-workload
|
||||
access using tools such as VMware NSX, Illumio, and Calico, preventing lateral
|
||||
movement in zero trust architectures. Use when designing or implementing network
|
||||
microsegmentation as part of a zero trust architecture aligned with NIST SP 800-207.
|
||||
domain: cybersecurity
|
||||
subdomain: zero-trust-architecture
|
||||
tags:
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user