All authors
Claude Skills by costrict-plugins-repo
github.com/costrict-plugins-repo753 skills7 installs1,149 views
- Building Red Team C2 Infrastructure With HavocDeploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMBVotes: 0GitHub stars: 67
- Building Role Mining For Rbac OptimizationApply bottom-up and top-down role mining techniques, including clusteringVotes: 0GitHub stars: 67
- Building Soc Escalation MatrixBuild a structured SOC escalation matrix defining severity tiers, responseVotes: 0GitHub stars: 67
- Building Soc Metrics And Kpi Tracking'Builds SOC performance metrics and KPI tracking dashboards measuringVotes: 0GitHub stars: 67
- Building Soc Playbook For Ransomware'Builds a structured SOC incident response playbook for ransomware attacksVotes: 0GitHub stars: 67
- Building Threat Actor Profile From OsintBuild threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos, correlating indicators, mapping adversary infrastructure with tools like Maltego and SpiderFoot, and producing structured dossiers of motivations, capabilities, infrastructure, and TTPs. Use when performing attribution or building an adversary dossier from open-source intelligence.Votes: 0GitHub stars: 67
- Building Threat Feed Aggregation With MispDeploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization and STIX/TAXII-based integration with Splunk, Elasticsearch, and SOAR platforms. Use when standing up centralized IOC management or wiring multi-source threat feeds into a SIEM.Votes: 0GitHub stars: 67
- Building Threat Hunt Hypothesis FrameworkBuild a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR/SIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report. Use when planning or running a proactive threat hunt or scoping compromise from an intel- or anomaly-driven lead.Votes: 0GitHub stars: 67
- Building Threat Intelligence Enrichment In SplunkBuild automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them against security events via lookup tables, modular inputs, and the Threat Intelligence Framework. Use when wiring threat intel into Splunk correlation searches to flag IOC matches and cut SOC triage time.Votes: 0GitHub stars: 67
- Building Threat Intelligence Feed Integration'Builds automated threat intelligence feed integration pipelines connectingVotes: 0GitHub stars: 67
- Building Threat Intelligence PlatformDesign and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed ingestion pipelines, enrichment workflows, STIX/TAXII interoperability, and analyst dashboards. Use when architecting or standing up a centralized CTI platform to collect, analyze, and disseminate threat intelligence across a security team.Votes: 0GitHub stars: 67
- Building Vulnerability Aging And Sla TrackingImplement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days critical, 30 days high, 60 days medium, 90 days low), with automated escalations and compliance metrics reporting. Use when designing SLA policies, building aging/remediation dashboards, or proving compliance with remediation timelines.Votes: 0GitHub stars: 67
- Building Vulnerability Dashboard With DefectdojoDeploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API. Use when consolidating scanner output into one dashboard or automating vulnerability ticketing and executive reporting.Votes: 0GitHub stars: 67
- Building Vulnerability Exception Tracking SystemBuild a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance.Votes: 0GitHub stars: 67
- Building Vulnerability Scanning Workflow'Builds a structured vulnerability scanning workflow using tools likeVotes: 0GitHub stars: 67
- Bypassing Authentication With Forced BrowsingDiscovering and accessing unprotected pages, APIs, and administrativeVotes: 0GitHub stars: 67
- Collecting Indicators Of Compromise'Systematically collects, categorizes, and distributes indicators ofVotes: 0GitHub stars: 67
- Collecting Open Source Intelligence'Collects and synthesizes open-source intelligence (OSINT) about threatVotes: 0GitHub stars: 67
- Collecting Threat Intelligence With MispDeploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines that aggregate indicators from community and commercial sources. Use when gathering, storing, or correlating IOCs and threat intelligence, or when scripting MISP ingestion via PyMISP.Votes: 0GitHub stars: 67
- Collecting Volatile Evidence From Compromised HostCollect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost. Use before isolating, shutting down, or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings.Votes: 0GitHub stars: 67
- Conducting Api Security Testing'Conducts security testing of REST, GraphQL, and gRPC APIs to identifyVotes: 0GitHub stars: 67
- Conducting Cloud Incident ResponseRespond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Use when CSPM alerts or audit logs show compromised cloud credentials, unauthorized IAM changes, or a breach spanning cloud services.Votes: 0GitHub stars: 67
- Conducting Cloud Penetration Testing'This skill outlines methodologies for performing authorized penetrationVotes: 0GitHub stars: 67
- Conducting Domain Persistence With DcsyncPerform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz. Use in authorized engagements after finding principals with replication rights, to establish long-term domain persistence, or to validate detections for replication abuse.Votes: 0GitHub stars: 67
- Conducting External Reconnaissance With OsintConduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile. Use for the passive info-gathering phase of a pentest, external footprinting, or collecting employee/email intel for a social engineering campaign.Votes: 0GitHub stars: 67
- Conducting Full Scope Red Team EngagementPlan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploitation to evaluate an organization's detection, prevention, and response against APT-style behavior. Use when scoping or running a full-scope, objective-based engagement, or purple-teaming against a specific threat actor's TTPs.Votes: 0GitHub stars: 67
- Conducting Internal Network Penetration TestExecute an internal network penetration test simulating an insider threatVotes: 0GitHub stars: 67
- Conducting Internal Reconnaissance With Bloodhound CeConduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin. Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths.Votes: 0GitHub stars: 67
- Conducting Malware Incident ResponseRespond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including trojan/worm/ransomware outbreaks, malware triage, or infected endpoint remediation.Votes: 0GitHub stars: 67
- Conducting Man In The Middle Attack Simulation'Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and BettercapVotes: 0GitHub stars: 67
- Conducting Memory Forensics With Volatility'Performs memory forensics analysis using Volatility 3 to extract evidenceVotes: 0GitHub stars: 67
- Conducting Mobile App Penetration Test'Conducts penetration testing of iOS and Android mobile applicationsVotes: 0GitHub stars: 67
- Conducting Network Penetration Test'Conducts comprehensive network penetration tests against authorizedVotes: 0GitHub stars: 67
- Conducting Pass The Ticket AttackPerform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonate the ticket owner without knowing their password. Use during authorized post-exploitation to move laterally or escalate access via stolen Kerberos tickets, or to validate detections for Kerberos ticket theft and reuse.Votes: 0GitHub stars: 67
- Conducting Phishing Incident ResponseRespond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quarantining malicious messages organization-wide, and remediating affected accounts. Use when investigating a reported phishing or credential-phishing email, a suspected spearphishing incident, or when a mailbox-wide purge and account remediation is needed.Votes: 0GitHub stars: 67
- Conducting Post Incident Lessons LearnedFacilitate structured post-incident reviews to identify root causes,Votes: 0GitHub stars: 67
- Conducting Social Engineering Penetration TestDesign and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx to measure human security resilience. Use when scoping or running an authorized human-attack-surface test and reporting results to identify security awareness training gaps.Votes: 0GitHub stars: 67
- Conducting Social Engineering Pretext CallPlan and execute authorized vishing (voice phishing) pretext calls toVotes: 0GitHub stars: 67
- Conducting Spearphishing Simulation CampaignRun a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LNK, OneNote, QR codes), standing up look-alike-domain email infrastructure with SPF/DKIM/DMARC via GoPhish, and tracking results. Use in authorized engagements to gain initial access via personalized phishing against specific individuals, distinct from broad campaigns.Votes: 0GitHub stars: 67
- Conducting Wireless Network Penetration Test'Conducts authorized wireless network penetration tests to assess theVotes: 0GitHub stars: 67
- Configuring Active Directory Tiered ModelImplement Microsoft's Enhanced Security Admin Environment (ESAE) tieredVotes: 0GitHub stars: 67
- Configuring Aws Verified Access For ZtnaConfigure AWS Verified Access to provide VPN-less zero trust networkVotes: 0GitHub stars: 67
- Configuring Certificate Authority With OpensslBuild a two-tier PKI Certificate Authority hierarchy (offline Root CAVotes: 0GitHub stars: 67
- Configuring Host Based Intrusion Detection'Configures host-based intrusion detection systems (HIDS) to monitorVotes: 0GitHub stars: 67
- Configuring Hsm For Key StorageConfigures Hardware Security Modules for cryptographic key storageVotes: 0GitHub stars: 67
- Configuring Identity Aware Proxy With Google Iap'Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforceVotes: 0GitHub stars: 67
- Configuring Ldap Security HardeningHardens LDAP directory services against credential harvesting, LDAPVotes: 0GitHub stars: 67
- Configuring Microsegmentation For Zero TrustConfigures microsegmentation policies to enforce least-privilege workload-to-workloadVotes: 0GitHub stars: 67
- Configuring Multi Factor Authentication With DuoDeploys Cisco Duo multi-factor authentication across enterprise applications,Votes: 0GitHub stars: 67
- Configuring Network Segmentation With Vlans'Designs and implements VLAN-based (802.1Q) network segmentation onVotes: 0GitHub stars: 67