All authors
Claude Skills by bitbytelabio
github.com/bitbytelabio1,113 skills0 installs0 views
- Red Conducting Social Engineering Pretext CallPlan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.Votes: 0GitHub stars: 2
- Red Conducting Spearphishing Simulation CampaignSpearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access.Votes: 0GitHub stars: 2
- Red Configuring Active Directory Tiered ModelImplement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory.Votes: 0GitHub stars: 2
- Red Configuring Ldap Security HardeningHarden LDAP directory services against common attacks including credential harvesting, LDAP injection, anonymous binding, and channel binding bypass.Votes: 0GitHub stars: 2
- Red Configuring Multi Factor Authentication With DuoDeploy Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points.Votes: 0GitHub stars: 2
- Red Configuring Network Segmentation With VlansDesigns and implements VLAN-based network segmentation on managed switches to isolate network zones, enforce access control between segments, and reduce the attack surface by limiting lateral movement paths in enterprise network environments.Votes: 0GitHub stars: 2
- Red Configuring Oauth2 Authorization FlowConfigure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant.Votes: 0GitHub stars: 2
- Red Configuring Pfsense Firewall RulesConfigures pfSense firewall rules, NAT policies, VPN tunnels, and traffic shaping to enforce network segmentation, control traffic flow, and protect internal network zones in enterprise and small-to-medium business environments.Votes: 0GitHub stars: 2
- Red Configuring Snort Ids For Intrusion DetectionInstalls, configures, and tunes Snort 3 intrusion detection system to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins on authorized network segments.Votes: 0GitHub stars: 2
- Red Configuring Suricata For Network MonitoringDeploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.Votes: 0GitHub stars: 2
- Red Configuring Tls 1 3 For Secure CommunicationsConfigures TLS 1.3 (RFC 8446) on servers, covering cipher suite and key-exchange group selection, and validates the resulting configuration with openssl s_client and testssl.sh.Votes: 0GitHub stars: 2
- Red Container Offensive Container EscapeContainer escape and breakout techniques targeting Docker, containerd, and Podman runtimes.Votes: 0GitHub stars: 2
- Red Container Offensive K8s AttacksKubernetes cluster attack techniques covering the full attack lifecycle from initial foothold in a pod to cluster-wide compromise.Votes: 0GitHub stars: 2
- Red Continuous Llm Red Teaming With PromptfooWires Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS presets, failing the build when jailbreak or injection vulnerabilities regress.Votes: 0GitHub stars: 2
- Red Defending Llms With GuardrailsDeploys Llama Guard 3 safety classification, NeMo Guardrails programmable dialogue rails, and LLM Guard input/output scanner pipelines as complementary runtime defenses that inspect and constrain LLM prompts and responses.Votes: 0GitHub stars: 2
- Red Deploying Active Directory HoneytokensDeploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths.Votes: 0GitHub stars: 2
- Red Deploying Cloud Deception With Decoy ResourcesDeploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them: canary IAM access keys, permission-less decoy users/roles/service principals, honey object-storage buckets, and decoy…Votes: 0GitHub stars: 2
- Red Deploying Honeytokens And CanarytokensPlants Canarytokens-based decoy artifacts (honey credentials, DNS tokens, web-bug URLs, AWS keys, documents, kubeconfigs) using Thinkst's open-source Canarytokens project and alerts via email or webhook when a token is touched.Votes: 0GitHub stars: 2
- Red Designing Adversary Engagement With Mitre EngagePlan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of deployed ad hoc.Votes: 0GitHub stars: 2
- Red Detecting Ai Model Prompt Injection AttacksDetects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer classification, flagging direct injections (system-prompt overrides, role-play escapes) and indirect injections (encoded payloads, obfuscation) per OWASP LLM Top 10…Votes: 0GitHub stars: 2
- Red Detecting Anomalous Authentication PatternsDetects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs.Votes: 0GitHub stars: 2
- Red Detecting Arp Poisoning In Network TrafficDetect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom monitoring scripts to protect against man-in-the-middle interception.Votes: 0GitHub stars: 2
- Red Detecting Attacks On Historian ServersDetect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL) using a Python detector that flags unauthorized queries, data manipulation, and lateral-movement indicators as historians pivot between IT and OT networks.Votes: 0GitHub stars: 2
- Red Detecting Attacks On Scada SystemsThis skill covers detecting cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) systems including man-in-the-middle attacks on industrial protocols, unauthorized command injection into PLCs, HMI compromise, historian data manipulation, and denial-of-service against control…Votes: 0GitHub stars: 2
- Red Detecting Aws Credential Exposure With TrufflehogScan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection.Votes: 0GitHub stars: 2
- Red Detecting Azure Storage Account MisconfigurationsAudit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions, using the azure-mgmt-storage Python SDK to generate a risk-scored report.Votes: 0GitHub stars: 2
- Red Detecting Bluetooth Low Energy AttacksDetects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception.Votes: 0GitHub stars: 2
- Red Detecting Broken Object Property Level AuthorizationDetect and test for OWASP API3:2023 Broken Object Property Level Authorization (BOPLA), covering excessive data exposure in API responses and mass assignment via injected request-body properties.Votes: 0GitHub stars: 2
- Red Detecting Command And Control Over DnsDetects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns.Votes: 0GitHub stars: 2
- Red Detecting Compromised Cloud CredentialsDetect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-travel patterns, and credential-stuffing indicators using GuardDuty, Microsoft Defender for Identity, and Google SCC Event Threat Detection.Votes: 0GitHub stars: 2
- Red Detecting Container Runtime Threats With FalcoDeploys and operates Falco with the modern eBPF driver in Kubernetes and Docker, covering driver selection, Helm installation, output channels, and the built-in ruleset that detects container escape, namespace abuse, privileged mounts, and anomalous syscalls.Votes: 0GitHub stars: 2
- Red Detecting Credential Dumping TechniquesDetect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g. via Mimikatz) using Sysmon Event ID 10 process-access logging, Windows Security logs, and SIEM correlation rules.Votes: 0GitHub stars: 2
- Red Detecting Data And Model PoisoningIdentify poisoned training data and backdoored ML models across the pipeline using IBM's Adversarial Robustness Toolbox (activation clustering, spectral signatures, trigger reconstruction), Cleanlab for label-quality issues, and supply-chain checks like weight-hash verification and safetensors…Votes: 0GitHub stars: 2
- Red Detecting Dcsync Attack In Active DirectoryDetect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls.Votes: 0GitHub stars: 2
- Red Detecting Deepfake Audio In Vishing AttacksDetect AI-generated deepfake audio used in voice phishing (vishing) by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models, supporting batch audio analysis, confidence scoring, and forensic reporting.Votes: 0GitHub stars: 2
- Red Detecting Dependency ConfusionDetect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like `confused` and OWASP `dep-scan`, then enforcing source restrictions via `.npmrc`, `pip.conf`/`pyproject.toml`, and Maven…Votes: 0GitHub stars: 2
- Red Detecting Dll Sideloading AttacksDetect DLL side-loading and search-order hijacking (MITRE T1574) where adversaries plant malicious DLLs for legitimate signed applications to load, by analyzing Sysmon Event ID 7 DLL-load events, checking signatures/hashes against known-good versions, and flagging path anomalies with EDR tools…Votes: 0GitHub stars: 2
- Red Detecting Dns Exfiltration With Dns Query AnalysisDetect data exfiltration through DNS tunneling by analyzing query entropy, subdomain length, query volume, TXT record abuse, and response payload sizes using passive DNS monitoring.Votes: 0GitHub stars: 2
- Red Detecting Email Forwarding Rules AttackDetect malicious inbox/mail-flow forwarding rules that adversaries create to maintain persistent access to email communications for intelligence collection and business email compromise.Votes: 0GitHub stars: 2
- Red Detecting Entra Offensive Tools In Graph LogsHunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics using KQL to fingerprint offensive Entra ID enumeration tools such as ROADtools, AADInternals, and AzureHound, including User-Agent signatures, roadrecon endpoint sweeps, and sign-in correlation.Votes: 0GitHub stars: 2
- Red Detecting Evasion Techniques In Endpoint LogsDetects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling.Votes: 0GitHub stars: 2
- Red Detecting Exfiltration Over Dns With ZeekDetect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains and anomalous query…Votes: 0GitHub stars: 2
- Red Detecting Fileless Attacks On EndpointsDetects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware.Votes: 0GitHub stars: 2
- Red Detecting Golden Ticket Attacks In Kerberos LogsDetect Golden Ticket attacks in Active Directory using Splunk and KQL queries against domain controller event logs, looking for Kerberos TGT anomalies such as mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures.Votes: 0GitHub stars: 2
- Red Detecting Indirect Prompt InjectionDetect and defend against indirect prompt injection hidden in web pages, documents, and images consumed by an agent, via content extraction (HTML/PDF/OCR), normalization, and scanning with LLM Guard's PromptInjection scanner or Hugging Face Prompt Guard 2.Votes: 0GitHub stars: 2
- Red Detecting Kerberoasting AttacksDetect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769) targeting service accounts with SPNs, which attackers request offline to crack service account passwords.Votes: 0GitHub stars: 2
- Red Detecting Lateral Movement In NetworkIdentifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.Votes: 0GitHub stars: 2
- Red Detecting Lateral Movement With ZeekDetect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.Votes: 0GitHub stars: 2
- Red Detecting Living Off The Land AttacksDetect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.Votes: 0GitHub stars: 2
- Red Detecting Malicious Npm PackagesTriage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, and dynamic detonation with network/filesystem monitoring.Votes: 0GitHub stars: 2