Claude Skills by andycungkrinx91

Extract cached credentials, password hashes, Kerberos tickets, and authentication

Produce Sigma-based EVTX timelines and summaries with Hayabusa.

Detect Cobalt Strike beacon network activity using default TLS certificate

Hunt for data exfiltration through network traffic analysis, detecting

Security awareness training is the human layer of phishing defense. An

'Configures Windows Group Policy Objects (GPO) to prevent ransomware

Configure Microsoft Entra Privileged Identity Management to enforce just-in-time

'Implements Delinea Secret Server for privileged access management (PAM)

'Implements comprehensive Google Workspace security hardening including

Configure Google Workspace advanced phishing and malware protection settings

Configure SAML 2.0 single sign-on for Google Workspace with a third-party

'Implements HashiCorp Vault dynamic secrets engines for database credentials,

Deploy SailPoint IdentityNow or IdentityIQ for identity governance and

Implement continuous identity verification for zero trust using phishing-resistant

Deploy Mimecast Targeted Threat Protection including URL Protect, Attachment

Deploy privileged access management for database systems including Oracle,

'Implements passwordless authentication using Microsoft Entra ID with

Deploy CyberArk Privileged Access Management to discover, vault, rotate,

'Designs and implements a ransomware-resilient backup strategy following

'Detects and exploits ransomware kill switch mechanisms including mutex-based

Implement SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider

Implement automated user provisioning and deprovisioning using SCIM 2.0

Automate phishing incident response using Splunk SOAR REST API to create

Implement HashiCorp Boundary for identity-aware zero trust infrastructure

Build and run a third-party / vendor risk management (TPRM) program aligned to NIST SP 800-161 C-SCRM and NIST CSF 2.0 GV.SC: inventory and tier vendors by risk, send the right due-diligence questionnaire (SIG, CAIQ), review evidence (SOC 2, ISO 27001, pen-test reports), set contractual security and right-to-audit clauses, monitor vendors continuously, manage Nth-party / subcontractor risk, and offboard securely. Use when an organization needs to assess a new vendor before onboarding, when st...

Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths with built-in queries and custom Cypher.

Inventory cryptography, deploy hybrid X25519 and ML-KEM, and prioritize harvest-now-decrypt-later data.

Model threat actors, intrusion sets, campaigns, and TTPs as a STIX 2.1 knowledge graph in OpenCTI (Filigran) using the pycti Python client, connectors, and import workers for structured cyber threat intelligence.

Use NetExec for SMB, WinRM, LDAP, and MSSQL enumeration, password spraying,

Deploy a Havoc team server with Yaotl profiles, generate evasive Demon agents with indirect syscalls and sleep obfuscation, and run post-exploitation and pivoting for adversary emulation.

Stand up a Sliver C2 server and listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF/.NET tooling via the armory for adversary emulation.

Run MISP, curate feeds, and auto-generate detections for Wazuh, Sigma, and Suricata.

Configure and execute access recertification campaigns in Saviynt Enterprise

Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks

'Performs entitlement review and access certification campaigns using

'Performs OAuth 2.0 scope minimization review to identify over-permissioned

Monitor paste sites like Pastebin and GitHub Gists for leaked credentials,

GoPhish is an open-source phishing simulation framework used by security

'Executes a structured ransomware incident response from initial detection

'Plans and facilitates tabletop exercises simulating ransomware incidents

Automate GoPhish phishing simulation campaigns using the Python gophish

Automate credential rotation for service accounts across Active Directory,

Perform recon, persistence, privilege escalation, and data search via the Microsoft Graph API using GraphRunner.

'Executes structured recovery from a ransomware incident following NIST

Run ntlmrelayx into ADCS web enrollment to obtain a domain controller certificate via ESC8.

Reverse engineer ransomware encryption routines to identify cryptographic

Scan container images, IaC, and SBOMs for vulnerabilities and misconfigurations in CI/CD with Trivy.

'This skill guides practitioners through hardening AWS Identity and Access

Test and validate ransomware recovery procedures including backup restore

Threat actor infrastructure tracking involves monitoring and mapping