All authors
Claude Skills by costrict-plugins-repo
github.com/costrict-plugins-repo753 skills7 installs1,149 views
- Detecting Deepfake Audio In Vishing AttacksDetect AI-generated deepfake audio used in voice phishing (vishing) by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models, supporting batch audio analysis, confidence scoring, and forensic reporting. Use for deepfake voice detection, vishing investigations, AI-generated speech analysis, voice cloning detection, or audio authenticity verification.Votes: 0GitHub stars: 67
- Detecting Dll Sideloading AttacksDetect DLL side-loading and search-order hijacking (MITRE T1574) where adversaries plant malicious DLLs for legitimate signed applications to load, by analyzing Sysmon Event ID 7 DLL-load events, checking signatures/hashes against known-good versions, and flagging path anomalies with EDR tools like CrowdStrike, MDE, or SentinelOne. Use when investigating EDR alerts on unsigned DLLs, hunting for APT persistence via trojanized applications, or triaging incidents involving DLL hijacking.Votes: 0GitHub stars: 67
- Detecting Dnp3 Protocol AnomaliesDetect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic using deep packet inspection and machine learning approaches. Use when securing energy-sector or other OT/ICS networks, investigating suspicious DNP3 master/outstation activity, or building an anomaly-based IDS for industrial control traffic.Votes: 0GitHub stars: 67
- Detecting Dns Exfiltration With Dns Query AnalysisDetect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume to single domains, TXT/CNAME/NULL record abuse, and oversized response payloads using passive DNS monitoring and statistical/ML methods. Use when hunting for covert DNS-based data exfiltration or building a passive DNS anomaly detection capability.Votes: 0GitHub stars: 67
- Detecting Email Account CompromiseDetect compromised O365 and Google Workspace email accounts by analyzing Unified Audit Logs and Azure AD sign-in logs for impossible travel, inbox rule creation/deletion (Set-InboxRule, New-InboxRule), external mail forwarding rules, and unusual Microsoft Graph API access or OAuth token use. Use when investigating suspected business email compromise (BEC), account takeover, or mailbox persistence via malicious inbox rules.Votes: 0GitHub stars: 67
- Detecting Email Forwarding Rules AttackDetect malicious inbox/mail-flow forwarding rules that adversaries create to maintainVotes: 0GitHub stars: 67
- Detecting Evasion Techniques In Endpoint Logs'Detects defense evasion techniques used by adversaries in endpoint logsVotes: 0GitHub stars: 67
- Detecting Exfiltration Over Dns With ZeekDetect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropyVotes: 0GitHub stars: 67
- Detecting Fileless Attacks On Endpoints'Detects fileless malware and in-memory attacks that execute entirelyVotes: 0GitHub stars: 67
- Detecting Fileless Malware Techniques'Detects and analyzes fileless malware that operates entirely in memoryVotes: 0GitHub stars: 67
- Detecting Golden Ticket Attacks In Kerberos LogsDetect Golden Ticket attacks in Active Directory using Splunk and KQL queriesVotes: 0GitHub stars: 67
- Detecting Golden Ticket ForgeryDetect Kerberos Golden Ticket forgery (e.g. Mimikatz-forged tickets) by analyzingVotes: 0GitHub stars: 67
- Detecting Insider Data Exfiltration Via Dlp'Detects insider data exfiltration by analyzing DLP policy violations,Votes: 0GitHub stars: 67
- Detecting Insider Threat BehaviorsDetect insider threat behavioral indicators including unusual data access,Votes: 0GitHub stars: 67
- Detecting Insider Threat With UebaImplement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearchVotes: 0GitHub stars: 67
- Detecting Kerberoasting AttacksDetect Kerberoasting attacks by monitoring for anomalous Kerberos TGSVotes: 0GitHub stars: 67
- Detecting Lateral Movement In Network'Identifies lateral movement techniques in enterprise networks by analyzingVotes: 0GitHub stars: 67
- Detecting Lateral Movement With SplunkDetect adversary lateral movement across networks using Splunk SPL queriesVotes: 0GitHub stars: 67
- Detecting Lateral Movement With Zeek'Detect lateral movement in network traffic using Zeek (formerly Bro)Votes: 0GitHub stars: 67
- Detecting Living Off The Land Attacks'Detect abuse of legitimate Windows binaries (LOLBins) used for livingVotes: 0GitHub stars: 67
- Detecting Living Off The Land With LolbasDetect Living Off the Land Binaries (LOLBins/LOLBAS) abuse includingVotes: 0GitHub stars: 67
- Detecting Malicious Scheduled Tasks With Sysmon'Detect malicious scheduled task creation and modification using SysmonVotes: 0GitHub stars: 67
- Detecting Mimikatz Execution PatternsDetect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and in-memory detection of known Mimikatz modules. Use when threat hunting for T1003 credential access, triaging EDR/SIEM alerts on LSASS access, scoping compromise during incident response, or validating detection coverage in a purple team exercise.Votes: 0GitHub stars: 67
- Detecting Misconfigured Azure StorageAudit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft Defender for Storage. Use for storage security audits across subscriptions, responding to Defender for Storage anonymous-access alerts, verifying compliance controls, or setting security baselines when onboarding a subscription.Votes: 0GitHub stars: 67
- Detecting Mobile Malware Behavior'Detects and analyzes malicious behavior in mobile applications throughVotes: 0GitHub stars: 67
- Detecting Modbus Command Injection AttacksDetect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frames, and deviations from communication baselines using ICS-aware IDS and deep packet inspection. Use when deploying IDS for Modbus OT networks, investigating unauthorized PLC register/coil changes, or responding to FrostyGoop-style Modbus attacks.Votes: 0GitHub stars: 67
- Detecting Modbus Protocol AnomaliesDetect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep packet inspection, using Zeek's Modbus analyzer, Suricata IDS with OT rules, and Python Markov chain models of normal transaction sequences. Use for deploying Modbus IDS in OT environments, baselining polling patterns, investigating suspicious Modbus traffic, or building function code allowlists.Votes: 0GitHub stars: 67
- Detecting Network Anomalies With ZeekDeploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs, detect anomalous behavior, and write custom scripts for organization-specific threats. Use for passive monitoring at network choke points, feeding SIEM/threat hunting with protocol metadata, or retrospective log analysis during incident response; not a substitute for inline IDS/IPS or host agents.Votes: 0GitHub stars: 67
- Detecting Network Scanning With Ids SignaturesDetect network reconnaissance and port scanning using Suricata and SnortVotes: 0GitHub stars: 67
- Detecting Ntlm Relay With Event CorrelationDetect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB/LDAP signing, and flagging NTLMv2-to-NTLMv1 downgrades. Use for hunting credential relay in NTLM-enabled AD, investigating auth-source anomalies, building SIEM correlation rules, or responding to PetitPotam/DFSCoerce/PrinterBug alerts.Votes: 0GitHub stars: 67
- Detecting Oauth Token TheftDetect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Token Protection conditional access policies. Use for impossible-travel or anomalous token-usage alerts, suspected session hijacking, sign-in log analysis, or configuring token-binding defenses in Azure/M365.Votes: 0GitHub stars: 67
- Detecting Pass The Hash AttacksDetect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected, and correlating with credential-dumping indicators. Use when threat hunting for lateral movement via stolen NTLM hashes, triaging EDR/SIEM alerts on suspicious NTLM logons, scoping compromise during incident response, or validating detection coverage in a purple team exercise.Votes: 0GitHub stars: 67
- Detecting Pass The Ticket AttacksDetect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection queries for Splunk and Elastic SIEM. Use when investigating incidents involving stolen or replayed Kerberos tickets, building detection rules or threat hunting queries for ticket abuse, or validating SOC monitoring coverage for credential-theft attack techniques.Votes: 0GitHub stars: 67
- Detecting Port Scanning With Fail2ban'Configures Fail2ban with custom filters and actions to detect port scanningVotes: 0GitHub stars: 67
- Detecting Privilege Escalation AttemptsDetect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse. Use when threat hunting for T1068-style privilege escalation, triaging EDR/SIEM alerts on suspicious privilege changes, scoping compromise during incident response, or validating detection coverage in a purple team exercise.Votes: 0GitHub stars: 67
- Detecting Privilege Escalation In Kubernetes PodsDetects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux capabilities, and syscall patterns. Use when investigating a pod running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope. Keywords: allowPrivilegeEscalation, runAsRoot, capabilities, securityContext, OPA, Falco, audit log. Do n...Votes: 0GitHub stars: 67
- Detecting Process Hollowing TechniqueDetect process hollowing (MITRE T1055.012) by analyzing memory-mappedVotes: 0GitHub stars: 67
- Detecting Process Injection Techniques'Detects and analyzes process injection techniques used by malware includingVotes: 0GitHub stars: 67
- Detecting Qr Code Phishing With Email SecurityDetect and prevent QR code phishing (quishing) attacks that embedVotes: 0GitHub stars: 67
- Detecting Ransomware Encryption Behavior'Detects ransomware encryption activity in real time using entropyVotes: 0GitHub stars: 67
- Detecting Ransomware Precursors In Network'Detects early-stage ransomware indicators in network traffic beforeVotes: 0GitHub stars: 67
- Detecting Rdp Brute Force AttacksDetect RDP brute force attacks by parsing Windows Security Event LogsVotes: 0GitHub stars: 67
- Detecting Rootkit Activity'Detects rootkit presence on compromised systems by identifying hiddenVotes: 0GitHub stars: 67
- Detecting S3 Data Exfiltration Attempts'Detecting data exfiltration attempts from AWS S3 buckets by analyzingVotes: 0GitHub stars: 67
- Detecting Serverless Function Injection'Detects and prevents code injection attacks targeting serverless functionsVotes: 0GitHub stars: 67
- Detecting Service Account AbuseDetect abuse of service accounts by hunting for anomalous interactiveVotes: 0GitHub stars: 67
- Detecting Shadow Api EndpointsDiscover and inventory shadow API endpoints that operate outsideVotes: 0GitHub stars: 67
- Detecting Shadow It Cloud UsageDetect unauthorized SaaS and cloud service usage (shadow IT) by parsingVotes: 0GitHub stars: 67
- Detecting Spearphishing With Email GatewayDetect and block spearphishing emails that use personalized, researchedVotes: 0GitHub stars: 67
- Detecting Sql Injection Via Waf LogsAnalyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injectionVotes: 0GitHub stars: 67