All authors
Claude Skills by costrict-plugins-repo
github.com/costrict-plugins-repo753 skills7 installs1,149 views
- Configuring Oauth2 Authorization FlowConfigures secure OAuth 2.0 authorization flows, including AuthorizationVotes: 0GitHub stars: 67
- Configuring Pfsense Firewall Rules'Configures pfSense firewall rules, NAT policies, IPsec/OpenVPN tunnels,Votes: 0GitHub stars: 67
- Configuring Snort Ids For Intrusion Detection'Installs, configures, and tunes Snort 3 to monitor network trafficVotes: 0GitHub stars: 67
- Configuring Suricata For Network Monitoring'Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets,Votes: 0GitHub stars: 67
- Configuring Tls 1 3 For Secure CommunicationsConfigures TLS 1.3 (RFC 8446) on servers, covering cipher suite andVotes: 0GitHub stars: 67
- Configuring Windows Defender Advanced Settings'Configures Microsoft Defender for Endpoint (MDE) advanced protectionVotes: 0GitHub stars: 67
- Configuring Windows Event Logging For Detection'Configures Windows Event Logging with advanced audit policies to generateVotes: 0GitHub stars: 67
- Configuring Zscaler Private Access For Ztna'Configures Zscaler Private Access (ZPA) to replace traditional VPNVotes: 0GitHub stars: 67
- Containing Active Breach'Executes containment strategies to stop active adversary operationsVotes: 0GitHub stars: 67
- Correlating Security Events In Qradar'Correlates security events in IBM QRadar SIEM using AQL (Ariel QueryVotes: 0GitHub stars: 67
- Correlating Threat Campaigns'Correlates disparate security incidents, IOCs, and adversary behaviorsVotes: 0GitHub stars: 67
- Deobfuscating Javascript MalwareDeobfuscates malicious JavaScript found in phishing pages, web skimmers, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control-flow obfuscation to reveal the original malicious logic. Use when investigating a phishing page's obfuscated JavaScript, analyzing a Magecart-style web skimmer, or deobfuscating a JavaScript dropper that fetches second-stage malware.Votes: 0GitHub stars: 67
- Deobfuscating Powershell Obfuscated MalwareSystematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or invocation tricks and you need to recover the underlying commands, dropped payloads, or C2 endpoints.Votes: 0GitHub stars: 67
- Deploying Active Directory Honeytokens'Deploys deception-based honeytokens in Active Directory including fakeVotes: 0GitHub stars: 67
- Deploying Cloudflare Access For Zero TrustDeploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks, and WARP client enrollment as a VPN replacement. Use when replacing VPN with Cloudflare One, exposing internal apps without open inbound ports, or securing contractor/third-party access to specific applications.Votes: 0GitHub stars: 67
- Deploying Decoy Files For Ransomware Detection'Deploys canary files (honeytokens) across file systems to detect ransomwareVotes: 0GitHub stars: 67
- Deploying Edr Agent With Crowdstrike'Deploys and configures CrowdStrike Falcon EDR agents across enterpriseVotes: 0GitHub stars: 67
- Deploying Osquery For Endpoint Monitoring'Deploys and configures osquery for real-time endpoint monitoring usingVotes: 0GitHub stars: 67
- Deploying Palo Alto Prisma Access Zero TrustDeploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ZTNA Connectors, security policy enforcement, and Strata Cloud Manager integration for unified management. Use when implementing enterprise-grade SASE with integrated ZTNA/SWG/CASB/FWaaS, replacing both VPN and branch firewalls with cloud-delivered security, or integrating ZTNA with an existing Palo Alto NGFW estate.Votes: 0GitHub stars: 67
- Deploying Ransomware Canary FilesDeploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, credentials, database exports) where ransomware enumerates first, and alerting via email, Slack, or syslog on any read/modify/rename/delete. Use for early-warning ransomware detection on file servers, NAS, or endpoints, or to supplement EDR where agents can't be deployed.Votes: 0GitHub stars: 67
- Deploying Software Defined PerimeterDeploys a Software-Defined Perimeter per the CSA v2.0 specification, configuring Single Packet Authorization, mutual TLS, and SDP controller/gateway components to enforce zero trust network access. Use when building or hardening zero trust network architecture, implementing SPA-based "invisible" infrastructure that cloaks services from unauthenticated scanning, or meeting compliance requirements for zero trust network access.Votes: 0GitHub stars: 67
- Deploying Tailscale For Zero Trust VpnDeploys and configures Tailscale (or self-hosted Headscale) as a WireGuard-based zero trust mesh VPN, setting up identity-aware ACLs, exit nodes, subnet routers, and MagicDNS for encrypted peer-to-peer connectivity. Use when replacing traditional VPN servers with an identity-authenticated mesh network or enforcing granular per-device access control lists.Votes: 0GitHub stars: 67
- Detecting Ai Model Prompt Injection AttacksDetects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer classification, flagging direct injections (system-prompt overrides, role-play escapes) and indirect injections (encoded payloads, obfuscation) per OWASP LLM Top 10 (LLM01:2025). Use for input validation layers in chatbots/agents/RAG pipelines, or for retrospectively classifying injection attempts in logs or incident investigations.Votes: 0GitHub stars: 67
- Detecting Anomalies In Industrial Control SystemsDeploys anomaly detection for OT/ICS environments using machine learning on OT network baselines, physics-based process models, and Modbus/DNP3/OPC UA traffic analysis to flag deviations, rogue devices, and mismatches against historian data. Use for continuous OT monitoring, baselining deterministic SCADA polling, or investigating alerts from Nozomi Guardian/Dragos needing deeper protocol analysis.Votes: 0GitHub stars: 67
- Detecting Anomalous Authentication Patterns'Detects anomalous authentication patterns using UEBA analytics, statisticalVotes: 0GitHub stars: 67
- Detecting Api Enumeration AttacksDetect API enumeration attacks (BOLA/IDOR, OWASP API1:2023) by writing SIEMVotes: 0GitHub stars: 67
- Detecting Arp Poisoning In Network TrafficDetect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARPVotes: 0GitHub stars: 67
- Detecting Attacks On Historian Servers'Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GEVotes: 0GitHub stars: 67
- Detecting Attacks On Scada Systems'This skill covers detecting cyber attacks targeting Supervisory ControlVotes: 0GitHub stars: 67
- Detecting Aws Cloudtrail AnomaliesDetect unusual API call patterns in AWS CloudTrail logs using boto3,Votes: 0GitHub stars: 67
- Detecting Aws Credential Exposure With Trufflehog'Scan source code repositories, CI/CD pipelines, and configuration filesVotes: 0GitHub stars: 67
- Detecting Aws Guardduty Findings AutomationBuild automated AWS GuardDuty finding response pipelines using EventBridgeVotes: 0GitHub stars: 67
- Detecting Aws Iam Privilege EscalationDetect AWS IAM privilege escalation paths using boto3 and CloudsplainingVotes: 0GitHub stars: 67
- Detecting Azure Lateral MovementDetect lateral movement in Azure AD/Entra ID environments using MicrosoftVotes: 0GitHub stars: 67
- Detecting Azure Service Principal AbuseDetect Azure service principal abuse in Microsoft Entra ID using KQL detectionVotes: 0GitHub stars: 67
- Detecting Azure Storage Account MisconfigurationsAudit Azure Blob and ADLS storage accounts for public access exposure, weakVotes: 0GitHub stars: 67
- Detecting Beaconing Patterns With Zeek'Performs statistical analysis of Zeek conn.log connection intervalsVotes: 0GitHub stars: 67
- Detecting Bluetooth Low Energy Attacks'Detects and analyzes Bluetooth Low Energy (BLE) security attacks includingVotes: 0GitHub stars: 67
- Detecting Broken Object Property Level AuthorizationDetect and test for OWASP API3:2023 Broken Object Property Level AuthorizationVotes: 0GitHub stars: 67
- Detecting Business Email Compromise With AiDeploy AI and NLP-powered detection systems to identify business emailVotes: 0GitHub stars: 67
- Detecting Business Email CompromiseDetect Business Email Compromise (BEC) fraud, where attackers impersonateVotes: 0GitHub stars: 67
- Detecting Cloud Threats With Guardduty'Deploy and operationalize Amazon GuardDuty, covering protection plansVotes: 0GitHub stars: 67
- Detecting Command And Control Over Dns'Detect command-and-control (C2) traffic tunneled over DNS from tools likeVotes: 0GitHub stars: 67
- Detecting Compromised Cloud Credentials'Detect compromised cloud credentials across AWS, Azure, and GCP by analyzingVotes: 0GitHub stars: 67
- Detecting Container Drift At RuntimeDetects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image, using Falco and Microsoft Defender for Containers. Use when validating immutable-infrastructure controls, hunting for unexpected package installs or binaries written inside a running container, or determining whether a container diverged from the image it was built from. Keywords: drift, immutable infrastructure, new binary execute...Votes: 0GitHub stars: 67
- Detecting Container Escape AttemptsDetects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensitive host mounts, and anomalous syscalls - and explains which signals matter regardless of whether Falco, Sysdig, auditd, or an EDR is doing the collection. Use when deciding what breakout behaviour to monitor, investigating a suspected Docker or Kubernetes breakout, or comparing escape coverage across runtime sensors. Keywords: container escape, breakout, namespaces, CAP_SYS_A...Votes: 0GitHub stars: 67
- Detecting Container Escape With Falco RulesWrites and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering host filesystem mounts, sensitive host path access, kernel module loading, and privileged capability abuse, including how to drive down false positives. Use when authoring or tuning a specific Falco rule for breakout behaviour, or triaging a noisy escape-related Falco alert. Keywords: Falco rule, macro, list, condition, priority, falco_rules.local.yaml, tunin...Votes: 0GitHub stars: 67
- Detecting Credential Dumping TechniquesDetect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g. via Mimikatz) using Sysmon Event ID 10 process-access logging, Windows Security logs, and SIEM correlation rules. Use when hunting for credential-theft activity on Windows/Active Directory hosts or triaging EDR alerts on LSASS access.Votes: 0GitHub stars: 67
- Detecting Cryptomining In Cloud'This skill teaches security teams how to detect and respond to unauthorizedVotes: 0GitHub stars: 67
- Detecting Dcsync Attack In Active DirectoryDetect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions.Votes: 0GitHub stars: 67