All authors
Claude Skills by bitbytelabio
github.com/bitbytelabio1,113 skills0 installs0 views
- Webapp Correlating Security Events In QradarCorrelates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources.Votes: 0GitHub stars: 2
- Webapp Correlating Threat CampaignsCorrelates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection.Votes: 0GitHub stars: 2
- Webapp Database SecurityDatabase security testing for SQL injection, privilege escalation, and misconfiguration.Votes: 0GitHub stars: 2
- Webapp DeepExhaustive security assessment with maximum coverage, depth, and vulnerability…Votes: 0GitHub stars: 2
- Webapp Deobfuscating Javascript MalwareDeobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic.Votes: 0GitHub stars: 2
- Webapp Deobfuscating Powershell Obfuscated MalwareSystematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.Votes: 0GitHub stars: 2
- Webapp Deploying Cloudflare Access For Zero TrustDeploying Cloudflare Access with Cloudflare Tunnel to provide zero trust access to self-hosted and private applications, configuring identity-aware access policies, device posture checks, and WARP client enrollment for VPN replacement.Votes: 0GitHub stars: 2
- Webapp Deploying Decoy Files For Ransomware DetectionDeploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses strategically placed decoy documents monitored via file integrity monitoring or OS-level watchdogs to trigger alerts when ransomware modifies or encrypts them.Votes: 0GitHub stars: 2
- Webapp Deploying Edr Agent With CrowdstrikeDeploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboarding endpoints to EDR coverage, configuring detection policies, or integrating Falcon telemetry with SIEM platforms.Votes: 0GitHub stars: 2
- Webapp Deploying Osquery For Endpoint MonitoringDeploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Use when building visibility into endpoint state, threat hunting across fleet, or implementing compliance monitoring.Votes: 0GitHub stars: 2
- Webapp Deploying Palo Alto Prisma Access Zero TrustDeploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.Votes: 0GitHub stars: 2
- Webapp Deploying Ransomware Canary FilesDeploys and monitors ransomware canary files across critical directories using Python's watchdog library for real-time filesystem event detection.Votes: 0GitHub stars: 2
- Webapp Deploying Software Defined PerimeterDeploy a Software-Defined Perimeter using the CSA v2.0 specification with Single Packet Authorization, mutual TLS, and SDP controller/gateway configuration to enforce zero trust network access.Votes: 0GitHub stars: 2
- Webapp Deploying Tailscale For Zero Trust VpnDeploy and configure Tailscale as a WireGuard-based zero trust mesh VPN with identity-aware access controls, ACLs, and exit nodes for secure peer-to-peer connectivity.Votes: 0GitHub stars: 2
- Webapp Detecting Anomalies In Industrial Control SystemsThis skill covers deploying anomaly detection systems for industrial control environments using machine learning models trained on OT network baselines, physics-based process models, and behavioral analysis of industrial protocol communications.Votes: 0GitHub stars: 2
- Webapp Detecting Api Enumeration AttacksDetect API enumeration attacks (BOLA/IDOR, OWASP API1:2023) by writing SIEM detection rules that flag sequential or UUID identifier iteration, parameter tampering, and mixed 200/401/403 response patterns from API gateway and WAF logs.Votes: 0GitHub stars: 2
- Webapp Detecting Aws Cloudtrail AnomaliesDetect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.Votes: 0GitHub stars: 2
- Webapp Detecting Aws Guardduty Findings AutomationAutomate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.Votes: 0GitHub stars: 2
- Webapp Detecting Aws Iam Privilege EscalationDetect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege…Votes: 0GitHub stars: 2
- Webapp Detecting Azure Lateral MovementDetect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.Votes: 0GitHub stars: 2
- Webapp Detecting Azure Service Principal AbuseDetect and investigate Azure service principal abuse including privilege escalation, credential compromise, admin consent bypass, and unauthorized enumeration in Microsoft Entra ID environments.Votes: 0GitHub stars: 2
- Webapp Detecting Beaconing Patterns With ZeekPerforms statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Pandas DataFrames, calculates inter-arrival time standard deviation, and flags periodic connections with low jitter.Votes: 0GitHub stars: 2
- Webapp Detecting Business Email Compromise With AiDeploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.Votes: 0GitHub stars: 2
- Webapp Detecting Business Email CompromiseBusiness Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors, or trusted partners to trick employees into transferring funds, sharing sensitive…Votes: 0GitHub stars: 2
- Webapp Detecting Cloud Threats With GuarddutyThis skill teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads.Votes: 0GitHub stars: 2
- Webapp Detecting Container Drift At RuntimeDetect unauthorized modifications to running containers by monitoring for binary execution drift, file system changes, and configuration deviations from the original container image.Votes: 0GitHub stars: 2
- Webapp Detecting Container Escape AttemptsContainer escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers.Votes: 0GitHub stars: 2
- Webapp Detecting Container Escape With Falco RulesDetect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.Votes: 0GitHub stars: 2
- Webapp Detecting Cryptomining In CloudThis skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments.Votes: 0GitHub stars: 2
- Webapp Detecting Dnp3 Protocol AnomaliesDetect anomalies in DNP3 (Distributed Network Protocol 3) communications used in SCADA systems by monitoring for unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic patterns using deep packet inspection and machine learning approaches.Votes: 0GitHub stars: 2
- Webapp Detecting Email Account CompromiseDetect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.Votes: 0GitHub stars: 2
- Webapp Detecting Fileless Malware TechniquesDetects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk.Votes: 0GitHub stars: 2
- Webapp Detecting Golden Ticket ForgeryDetect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic…Votes: 0GitHub stars: 2
- Webapp Detecting Insider Data Exfiltration Via DlpDetects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines.Votes: 0GitHub stars: 2
- Webapp Detecting Insider Threat BehaviorsDetect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.Votes: 0GitHub stars: 2
- Webapp Detecting Insider Threat With UebaImplement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and detect insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access patterns.Votes: 0GitHub stars: 2
- Webapp Detecting Lateral Movement With SplunkDetect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.Votes: 0GitHub stars: 2
- Webapp Detecting Living Off The Land With LolbasDetect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process…Votes: 0GitHub stars: 2
- Webapp Detecting Malicious Scheduled Tasks With SysmonDetect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702.Votes: 0GitHub stars: 2
- Webapp Detecting Mimikatz Execution PatternsDetect Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.Votes: 0GitHub stars: 2
- Webapp Detecting Modbus Protocol AnomaliesThis skill covers detecting anomalies in Modbus/TCP and Modbus RTU communications in industrial control systems. It addresses function code monitoring, register range validation, timing analysis, unauthorized client detection, and deep packet inspection for malformed Modbus frames.Votes: 0GitHub stars: 2
- Webapp Detecting Ntlm Relay With Event CorrelationDetect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to…Votes: 0GitHub stars: 2
- Webapp Detecting Oauth Token TheftDetects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly detection.Votes: 0GitHub stars: 2
- Webapp Detecting Privilege Escalation AttemptsDetect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.Votes: 0GitHub stars: 2
- Webapp Detecting Privilege Escalation In Kubernetes PodsDetect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.Votes: 0GitHub stars: 2
- Webapp Detecting Process Hollowing TechniqueDetect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.Votes: 0GitHub stars: 2
- Webapp Detecting Process Injection TechniquesDetects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts.Votes: 0GitHub stars: 2
- Webapp Detecting Ransomware Encryption BehaviorDetects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral heuristics. Identifies mass file modification patterns, abnormal entropy spikes in written data, and suspicious process behavior characteristic of ransomware encryption routines.Votes: 0GitHub stars: 2
- Webapp Detecting Ransomware Precursors In NetworkDetects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior.Votes: 0GitHub stars: 2
- Webapp Detecting Rootkit ActivityDetects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques.Votes: 0GitHub stars: 2