All authors
Claude Skills by bitbytelabio
github.com/bitbytelabio1,113 skills0 installs0 views
- Red Hunting For Domain Fronting C2 TrafficDetects domain fronting C2 traffic by analyzing SNI-vs-HTTP-Host-header mismatches in proxy logs and inspecting TLS certificate discrepancies with pyOpenSSL.Votes: 0GitHub stars: 2
- Red Hunting For Ntlm Relay AttacksDetects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event ID 4624 logon type 3 with NTLMSSP authentication, flagging IP-to-hostname mismatches, Responder/LLMNR poisoning signatures, SMB signing status, and anomalous cross-domain authentication patterns.Votes: 0GitHub stars: 2
- Red Hunting For Spearphishing IndicatorsHunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to detect targeted email attacks.Votes: 0GitHub stars: 2
- Red Hunting Saas Sso Token AbuseHunts for stolen-session and OAuth/PRT token replay (T1550.001) by correlating Microsoft Entra ID SigninLogs SessionId/UniqueTokenIdentifier fields and Okta System Log sso/session events to spot impossible travel, refresh-token reuse, and token use from anomalous ASNs.Votes: 0GitHub stars: 2
- Red Implementing Alert Fatigue ReductionImplements strategies to reduce SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness and prevent critical alert dismissal.Votes: 0GitHub stars: 2
- Red Implementing Anti Phishing Training ProgramGuides designing, deploying, and measuring an anti-phishing security awareness program - baseline phishing simulations, interactive training modules, just-in-time learning, and metric tracking - using platforms like KnowBe4, Proofpoint Security Awareness, or Cofense.Votes: 0GitHub stars: 2
- Red Implementing Attack Path Analysis With Xm CyberDeploys XM Cyber's continuous exposure management platform to build attack graphs that chain vulnerabilities, misconfigurations, identity risks, and credential weaknesses toward critical assets, identifying the small fraction of exposures sitting on converging "choke points".Votes: 0GitHub stars: 2
- Red Implementing Attack Surface ManagementImplements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain enumeration, service fingerprinting, and exposure scoring.Votes: 0GitHub stars: 2
- Red Implementing Aws Iam Permission BoundariesConfigure IAM permission boundaries in AWS to delegate role creation to developers while enforcing maximum privilege limits set by the security team.Votes: 0GitHub stars: 2
- Red Implementing Aws Security HubDeploy AWS Security Hub as a centralized CSPM platform, backed by AWS Config, aggregating findings from GuardDuty, Inspector, Macie, and third-party tools; enable CIS Foundations, PCI-DSS, and NIST standards; automate remediation via EventBridge/Systems Manager; and produce Audit Manager evidence.Votes: 0GitHub stars: 2
- Red Implementing Azure Ad Privileged Identity ManagementConfigure Microsoft Entra Privileged Identity Management to enforce just-in-time role activation, approval workflows, and access reviews for Azure AD privileged roles.Votes: 0GitHub stars: 2
- Red Implementing Bgp Security With RpkiImplement BGP route origin validation using RPKI with Route Origin Authorizations, RPKI-to-Router protocol, and ROV policies on Cisco and Juniper routers to prevent route hijacking.Votes: 0GitHub stars: 2
- Red Implementing Browser Isolation For Zero TrustDeploys remote browser isolation (RBI) as a core component of a Zero Trust architecture.Votes: 0GitHub stars: 2
- Red Implementing Conditional Access Policies Azure AdConfigure Microsoft Entra ID (Azure AD) Conditional Access policies for zero trust access control.Votes: 0GitHub stars: 2
- Red Implementing Ddos Mitigation With CloudflareConfigure Cloudflare DDoS protection with managed rulesets, rate limiting, WAF rules, Bot Management, and origin protection to mitigate volumetric, protocol, and application-layer attacks.Votes: 0GitHub stars: 2
- Red Implementing Delinea Secret Server For PamImplements Delinea Secret Server for privileged access management (PAM) including secret vault configuration, role-based access policies, automated password rotation, session recording, and integration with Active Directory and cloud platforms.Votes: 0GitHub stars: 2
- Red Implementing Gcp Vpc Firewall RulesImplementing and auditing GCP VPC firewall rules to enforce network segmentation, restrict ingress and egress traffic, apply hierarchical firewall policies across the organization, and monitor firewall rule effectiveness using VPC Flow Logs.Votes: 0GitHub stars: 2
- Red Implementing Google Workspace Admin SecurityImplements comprehensive Google Workspace security hardening including admin console configuration, phishing-resistant MFA enforcement, DLP policies, email authentication (SPF/DKIM/DMARC), OAuth app control, and external sharing restrictions.Votes: 0GitHub stars: 2
- Red Implementing Google Workspace Phishing ProtectionConfigures Google Workspace advanced phishing and malware protection settings in the Admin Console — pre-delivery message scanning, attachment protection, spoofing/impersonation detection, and Enhanced Safe Browsing enforcement.Votes: 0GitHub stars: 2
- Red Implementing Google Workspace Sso ConfigurationConfigure SAML 2.0 single sign-on for Google Workspace with a third-party identity provider, enabling centralized authentication and enforcing organization-wide access policies.Votes: 0GitHub stars: 2
- Red Implementing Hardware Security Key AuthenticationImplements FIDO2/WebAuthn hardware security key authentication including registration ceremonies, authentication flows, YubiKey enrollment, and passkey migration strategies.Votes: 0GitHub stars: 2
- Red Implementing Hashicorp Vault Dynamic SecretsImplements HashiCorp Vault dynamic secrets engines for database credentials, AWS IAM keys, and PKI certificates with automatic generation, lease management, and credential rotation to eliminate static secrets in application configurations.Votes: 0GitHub stars: 2
- Red Implementing Hipaa Security Rule SafeguardsImplement the HIPAA Security Rule (45 CFR Part 164 Subpart C) to protect electronic protected health information (ePHI): conduct the required risk analysis, deploy the administrative, physical, and technical safeguards, handle required vs addressable implementation specifications, execute Business…Votes: 0GitHub stars: 2
- Red Implementing Identity Governance With SailpointDeploy SailPoint IdentityNow or IdentityIQ for identity governance and administration.Votes: 0GitHub stars: 2
- Red Implementing Just In Time Access ProvisioningImplement Just-In-Time (JIT) access provisioning to eliminate standing privileges by granting temporary, time-bound access only when needed.Votes: 0GitHub stars: 2
- Red Implementing Mimecast Targeted Attack ProtectionDeploys and configures Mimecast Targeted Threat Protection (TTP) modules -- URL Protect (click-time URL rewriting/analysis), Attachment Protect (sandbox detonation), Impersonation Protect (BEC/whaling detection), and Internal Email Protect -- for Microsoft 365 or Google Workspace.Votes: 0GitHub stars: 2
- Red Implementing Mitre Attack Coverage MappingImplement MITRE ATT&CK coverage mapping to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.Votes: 0GitHub stars: 2
- Red Implementing Network Access Control With Cisco IseDeploy Cisco Identity Services Engine for 802.1X wired and wireless authentication, MAC Authentication Bypass, posture assessment, and dynamic VLAN assignment for network access control.Votes: 0GitHub stars: 2
- Red Implementing Network Access ControlImplements 802.1X port-based network access control using RADIUS authentication, PacketFence NAC, and switch configurations to enforce identity-based access policies, posture assessment, and automatic VLAN assignment for authorized devices.Votes: 0GitHub stars: 2
- Red Implementing Network Intrusion Prevention With SuricataDeploy and configure Suricata as a network intrusion prevention system with custom rules, Emerging Threats rulesets, and inline traffic inspection for real-time threat blocking.Votes: 0GitHub stars: 2
- Red Implementing Network Segmentation With Firewall ZonesDesign and implement network segmentation using firewall security zones, VLANs, ACLs, and microsegmentation policies to restrict lateral movement and enforce least-privilege network access.Votes: 0GitHub stars: 2
- Red Implementing Network Traffic Analysis With ArkimeDeploy and query Arkime (formerly Moloch) for full packet capture network traffic analysis. Uses the Arkime API v3 to search sessions, download PCAPs, analyze connection patterns, detect beaconing behavior, and identify suspicious network flows.Votes: 0GitHub stars: 2
- Red Implementing Network Traffic BaseliningBuild network traffic baselines from NetFlow/IPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly/daily traffic pattern…Votes: 0GitHub stars: 2
- Red Implementing Next Generation Firewall With Palo AltoConfigure and deploy Palo Alto Networks next-generation firewalls with App-ID, User-ID, zone-based policies, SSL decryption, and threat prevention profiles for enterprise network security.Votes: 0GitHub stars: 2
- Red Implementing Pam For Database AccessDeploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL.Votes: 0GitHub stars: 2
- Red Implementing Passwordless Auth With Microsoft EntraImplements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks.Votes: 0GitHub stars: 2
- Red Implementing Passwordless Authentication With Fido2Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators.Votes: 0GitHub stars: 2
- Red Implementing Privileged Access Management With CyberarkDeploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across enterprise infrastructure.Votes: 0GitHub stars: 2
- Red Implementing Privileged Access WorkstationDesign and implement Privileged Access Workstations (PAWs) with device hardening, just-in-time access, and integration with CyberArk or BeyondTrust for secure administrative operations.Votes: 0GitHub stars: 2
- Red Implementing Privileged Session MonitoringImplements privileged session monitoring and recording using Privileged Access Management (PAM) solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source alternatives.Votes: 0GitHub stars: 2
- Red Implementing Saml Sso With OktaImplement SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP).Votes: 0GitHub stars: 2
- Red Implementing Scim Provisioning With OktaImplement automated user provisioning and deprovisioning using SCIM 2.0 protocol with Okta as the identity provider.Votes: 0GitHub stars: 2
- Red Implementing Soar Playbook For PhishingAutomates phishing incident response by calling the Splunk SOAR (Phantom) REST API to create containers, attach artifacts (emails, URLs, attachments), and trigger response playbooks.Votes: 0GitHub stars: 2
- Red Implementing Threat Modeling With Mitre AttackImplements threat modeling using the MITRE ATT&CK framework to map adversary TTPs against organizational assets, assess detection coverage gaps, and prioritize defensive investments.Votes: 0GitHub stars: 2
- Red Implementing Zero Standing Privilege With CyberarkDeploy CyberArk Secure Cloud Access to eliminate standing privileges in hybrid and multi-cloud environments using just-in-time access with time, entitlement, and approval controls.Votes: 0GitHub stars: 2
- Red Infrastructure Offensive Advanced RedteamComprehensive red team operations methodology covering full engagement lifecycle from planning through reporting.Votes: 0GitHub stars: 2
- Red Infrastructure Offensive Edr EvasionEDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques.Votes: 0GitHub stars: 2
- Red Infrastructure Offensive Initial AccessInitial access techniques checklist: phishing (spear/smishing), credential stuffing, exposed service exploitation, supply chain attacks, watering hole, VPN/RDP brute force, public-facing application exploitation. Maps to MITRE ATT&CK TA0001.Votes: 0GitHub stars: 2
- Red Infrastructure Offensive Keylogger ArchLow-level keylogger architecture design: kernel driver hooks (WH_KEYBOARD_LL, SetWindowsHookEx), ETW-based input capture, user-mode vs kernel-mode approaches, stealth techniques, and data exfiltration.Votes: 0GitHub stars: 2
- Red Infrastructure Offensive ShellcodeShellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code (PIC), building shellcode loaders, evading AV/EDR detection, or converting PE files to shellcode.Votes: 0GitHub stars: 2