Claude Skills by mukul975

Establish SAML 2.0 identity federation between on-premises Active Directory and Azure AD (Microsoft Entra ID)

'Builds comprehensive identity governance and lifecycle management processes including joiner-mover-leaver automation,

'Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership

'Designs and documents structured incident response playbooks that define step-by-step procedures for specific

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source

Build an automated pipeline to defang indicators of compromise (URLs, IPs, domains, emails) for safe sharing

OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its

Build structured communication templates for malware incidents including stakeholder notifications, executive

Establish a structured operational process to triage, test, and deploy Microsoft Patch Tuesday security updates

Implement a phishing report button in email clients with automated triage workflow that analyzes user-reported

'Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST

Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners, redirectors, and Demon agents for

<!-- Folder name of the skill -->

Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through

Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and

Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source

'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass,

Analyze advanced persistent threat (APT) group techniques using MITRE ATT&CK Navigator to create layered heatmaps

'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative

'Analyzes bootkit and advanced rootkit malware that infects the Master Boot Record (MBR), Volume Boot Record

Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached

Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or

Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates,

Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS

Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure,

Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract

'Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures,

'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases

Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and

'Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to

Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify

Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy,

Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction,

Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns,

'Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts

'Performs runtime mobile security exploration of iOS applications using Objection, a Frida-powered toolkit that

'Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications,

'Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized

'Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware,

Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules),

Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover

Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution,

'Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download

Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript,

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content,

'Executes malware samples in Cuckoo Sandbox to observe runtime behavior including process creation, file system

Use the Malpedia platform and API to research malware family relationships, track variant evolution, link families

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry

Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction