Claude Skills by Mikaru0Mystic

Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data

Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines,

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs)

'Map advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework

'Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics,

Analyze the threat landscape using MISP (Malware Information Sharing Platform) by querying event statistics,

'Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate

Detect typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations

'Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System Partition

Investigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable

Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal,

'Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application

'Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege

Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers

Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history,

Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and

Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable

'Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs,

'Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies,

'This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS,

'Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage,

'Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous

'Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and

'Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains

'Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using

Build an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS

Extract and catalog attack patterns from cyber threat intelligence reports into a structured STIX-based library

'Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and

'This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security

Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify

Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning,

Establish SAML 2.0 identity federation between on-premises Active Directory and Azure AD (Microsoft Entra ID)

'Builds comprehensive identity governance and lifecycle management processes including joiner-mover-leaver automation,

'Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership

'Designs and documents structured incident response playbooks that define step-by-step procedures for specific

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source

Build an automated pipeline to defang indicators of compromise (URLs, IPs, domains, emails) for safe sharing

OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its

Build structured communication templates for malware incidents including stakeholder notifications, executive

Establish a structured operational process to triage, test, and deploy Microsoft Patch Tuesday security updates

Implement a phishing report button in email clients with automated triage workflow that analyzes user-reported

'Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST

Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners, redirectors, and Demon agents for

Ultimate AI-powered cybersecurity code review skill. Performs comprehensive security audit across 8 dimensions: vulnerability detection (OWASP Top 10:2021, CWE Top 25:2024), secret scanning, dependency/supply chain analysis, IaC security, threat intelligence (malware/backdoor/C2 detection, MITRE ATT&CK mapping), authorization verification, AI-generated code audit, and compliance mapping. Spawns 8 parallel specialist agents with weighted scoring (0-100). Framework-aware false-positive suppress...

Apply the NIST AI Risk Management Framework (AI RMF 1.0) and adjacent guidance to AI / ML systems — model lifecycle governance, fairness and bias evaluation, robustness, transparency, accountability, third-party model risk, monitoring for drift, and AI incident response. Broader than prompt-injection (which is the security slice). Use when the user mentions 'AI risk,' 'AI governance,' 'NIST AI RMF,' 'AI compliance,' 'ML governance,' 'model risk management,' 'AI fairness,' 'AI bias,' 'algorith...

Audit REST, GraphQL, and RPC APIs against the OWASP API Security Top 10 (2023). Use when the user mentions 'API security,' 'API audit,' 'BOLA,' 'broken object level authorization,' 'BFLA,' 'function-level authorization,' 'mass assignment,' 'API rate limiting,' 'GraphQL security,' 'REST security,' 'API authentication,' 'API authorization,' 'excessive data exposure,' or needs to review API endpoints for security weaknesses.

Learn from public breach disclosures — extract the audit question each one implies and check your own stack. Capital One IMDS abuse, LastPass vault exfiltration, Okta Lapsus$, Snowflake credential reuse, MOVEit, SolarWinds, Equifax, Target POS, Codecov, Uber, Twilio — what would you check now if your boss said 'could that happen to us?' Use when the user mentions 'breach analysis,' 'lessons learned,' 'security postmortem,' 'breach patterns,' 'breach lessons,' 'has this happened to us,' 'apply...

Audit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps. Use when the user mentions 'cloud security,' 'cloud audit,' 'AWS security,' 'GCP security,' 'Azure security,' 'IAM audit,' 'S3 bucket,' 'cloud misconfiguration,' 'cloud hardening,' or needs to review cloud infrastructure security.

Audit container images, Dockerfiles, and Kubernetes manifests for misconfigurations, excessive privileges, exposed secrets, and runtime risks. Use when the user mentions 'container security,' 'Docker security,' 'Dockerfile audit,' 'Kubernetes security,' 'K8s security,' 'pod security,' 'container hardening,' 'kubectl audit,' 'image scanning,' 'distroless,' 'rootless containers,' 'pod security policy,' 'pod security standards,' 'PSS,' 'network policy,' 'OPA Gatekeeper,' 'Kyverno,' 'runtime secu...

Audit cryptography implementation — algorithm choice, key sizes, KDF parameters, IV/nonce handling, signature verification, randomness, TLS configuration, and key rotation. Deeper than owasp-audit A02. Use when the user mentions 'crypto review,' 'cryptography audit,' 'encryption review,' 'KDF,' 'PBKDF2,' 'Argon2,' 'bcrypt cost,' 'IV reuse,' 'nonce reuse,' 'AES mode,' 'AES-GCM,' 'AES-ECB,' 'signature verification,' 'TLS configuration,' 'cipher suites,' 'key rotation,' 'libsodium,' 'BoringSSL,'...