Claude Skills by andycungkrinx91

'Builds comprehensive identity governance and lifecycle management processes

Implement a phishing report button in email clients with automated triage

'Builds a structured ransomware incident response playbook aligned with

Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer across MS-RPRN, MS-DFSNM, and MS-FSRVP to feed NTLM relay into AD CS Web Enrollment (ESC8) and other relay targets.

'Responds to phishing incidents by analyzing reported emails, extracting

Design and execute a social engineering penetration test including phishing,

Spearphishing simulation is a targeted social engineering attack vector

'Configuring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request

Harden LDAP directory services against common attacks including credential

Configure secure OAuth 2.0 authorization flows including Authorization

Plant canarytokens and honey credentials and alert on breach.

'Deploys and monitors ransomware canary files across critical directories

'Detecting exposed AWS credentials in source code repositories, CI/CD

Business Email Compromise (BEC) is a sophisticated fraud scheme where

'Detecting compromised cloud credentials across AWS, Azure, and GCP by

Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit

'Detects AI-generated deepfake audio used in voice phishing (vishing)

'Detects and responds to OAuth token theft and replay attacks in cloud

Detect and prevent QR code phishing (quishing) attacks that bypass traditional

'Detects ransomware encryption activity in real time using entropy analysis,

Spearphishing targets specific individuals using personalized, researched

Detect OS credential dumping techniques targeting LSASS memory, SAM database,

Detonate granular AWS, Azure, GCP, and Kubernetes attack techniques to validate

Exploit privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during authorized container-security assessments.

Enumerate and exploit Active Directory Certificate Services ESC1 through ESC16 misconfigurations with Certipy, including SAN abuse, NTLM relay to web enrollment (ESC8), and golden certificate forgery.

Use Pacu modules for AWS privilege escalation, persistence, and backdooring.

Detecting and exploiting HTTP request smuggling vulnerabilities caused

'Exploits JWT algorithm confusion vulnerabilities where the server''s

Perform Kerberoasting attacks using Impacket's GetUserSPNs to extract

MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1

Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB,

Detect and exploit JavaScript prototype pollution vulnerabilities on

Detect and exploit race condition vulnerabilities in web applications

Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote

Extract cached credentials, password hashes, Kerberos tickets, and authentication

Produce Sigma-based EVTX timelines and summaries with Hayabusa.

Detect Cobalt Strike beacon network activity using default TLS certificate

Hunt for data exfiltration through network traffic analysis, detecting

Security awareness training is the human layer of phishing defense. An

'Configures Windows Group Policy Objects (GPO) to prevent ransomware

Configure Microsoft Entra Privileged Identity Management to enforce just-in-time

'Implements Delinea Secret Server for privileged access management (PAM)

'Implements comprehensive Google Workspace security hardening including

Configure Google Workspace advanced phishing and malware protection settings

Configure SAML 2.0 single sign-on for Google Workspace with a third-party

'Implements HashiCorp Vault dynamic secrets engines for database credentials,

Deploy SailPoint IdentityNow or IdentityIQ for identity governance and

Implement continuous identity verification for zero trust using phishing-resistant

Deploy Mimecast Targeted Threat Protection including URL Protect, Attachment