All authors
Claude Skills by MustafaKemal0146
github.com/MustafaKemal0146961 skills11 installs1,632 views
- Performing Ioc Enrichment AutomationAutomates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan, MISP, and other intelligence sources to provide contextual scoring and dispositionVotes: 0GitHub stars: 4
- Performing Lateral Movement Detectiontespit etme (s) lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, andVotes: 0GitHub stars: 4
- Performing Log Source Onboarding In SiemPerform structured log source onboarding into SIEM platforms by configuring collectors, parsers, normalization, and validation for complete security visibility.Votes: 0GitHub stars: 4
- Performing Purple Team ExercisePerforms purple team exercises by coordinating red team adversary emulation with blue team Tespit validation using MITRE ATT&CK-mapped attack scenarios, real-time Tespit testing, andVotes: 0GitHub stars: 4
- Performing Red Team Phishing With GophishAutomate GoPhish phishing simulation campaigns using the Python gophish library. Creates email templates with tracking pixels, configures SMTP sending profiles, builds target groups from CSV,Votes: 0GitHub stars: 4
- Performing Soc Tabletop ExercisePerforms tabletop exercises for SOC teams simulating security incidents through discussion-based scenarios to test incident response procedures, communication workflows, and decision-makingVotes: 0GitHub stars: 4
- Performing Ssrf Vulnerability ExploitationTest for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters. Tests AWS/GCP/AzureVotes: 0GitHub stars: 4
- Performing Threat Hunting With Elastic SiemPerforms proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, Tespit rules, and Timeline investigation to identify threats that evade automated Tespit. Use when SOCVotes: 0GitHub stars: 4
- Performing User Behavior AnalyticsPerforms User and Entity Behavior Analytics (UEBA) to tespit etmeanomalous user activities including impossible travel, unusual access patterns, privilege abuse, and insider threats using SIEM-basedVotes: 0GitHub stars: 4
- Seclists Pattern MatchingSecLists-based security testing skillVotes: 0GitHub stars: 4
- Triaging Security Alerts In SplunkTriages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions usingVotes: 0GitHub stars: 4
- Detecting Deepfake Audio In Vishing Attackstespit etme (s) AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifyingVotes: 0GitHub stars: 4
- Analyzing Sbom For Supply Chain VulnerabilitiesParses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API.Votes: 0GitHub stars: 4
- Detecting Typosquatting Packages In Npm Pypitespit etme (s) typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristicsVotes: 0GitHub stars: 4
- Implementing Sigstore For Software SigningImplements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographicVotes: 0GitHub stars: 4
- Analyzing Persistence Mechanisms In Linuxtespit etmeand analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd andVotes: 0GitHub stars: 4
- Analyzing Powershell Empire Artifactstespit etmePowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known EmpireVotes: 0GitHub stars: 4
- Analyzing Ransomware Network IndicatorsIdentify ransomware network indicators including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange via Zeek conn.log and NetFlow analysisVotes: 0GitHub stars: 4
- Building Threat Hunt Hypothesis FrameworkBuild a systematic threat hunt hypothesis framework that transforms threat intelligence, attack patterns, and environmental data into testable hunting hypotheses.Votes: 0GitHub stars: 4
- Detecting Credential Dumping Techniquestespit etmeLSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rulesVotes: 0GitHub stars: 4
- Detecting Dcsync Attack In Active Directorytespit etmeDCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replicationVotes: 0GitHub stars: 4
- Detecting Dll Sideloading Attackstespit etmeDLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.Votes: 0GitHub stars: 4
- Detecting Email Forwarding Rules Attacktespit etmemalicious email forwarding rules created by adversaries to maintain persistent Erişim: email communications for intelligence collection and BEC attacks.Votes: 0GitHub stars: 4
- Detecting Golden Ticket Attacks In Kerberos Logstespit etmeGolden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PACVotes: 0GitHub stars: 4
- Detecting Golden Ticket Forgerytespit etmeKerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and ElasticVotes: 0GitHub stars: 4
- Detecting Insider Threat Behaviorstespit etmeinsider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.Votes: 0GitHub stars: 4
- Detecting Insider Threat With UebaImplement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and tespit etmeinsider threat indicatorsVotes: 0GitHub stars: 4
- Detecting Kerberoasting Attackstespit etmeKerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.Votes: 0GitHub stars: 4
- Detecting Lateral Movement With Splunktespit etmeadversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.Votes: 0GitHub stars: 4
- Detecting Living Off The Land Attackstespit etmeabuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspiciousVotes: 0GitHub stars: 4
- Detecting Living Off The Land With Lolbastespit etmeLiving Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysisVotes: 0GitHub stars: 4
- Detecting Malicious Scheduled Tasks With Sysmontespit etmemalicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. TheVotes: 0GitHub stars: 4
- Detecting Mimikatz Execution Patternstespit etmeMimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory Tespit of known modules.Votes: 0GitHub stars: 4
- Detecting Ntlm Relay With Event Correlationtespit etmeNTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditingVotes: 0GitHub stars: 4
- Detecting Pass The Hash Attackstespit etmePass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons with NTLM where Kerberos is expected, and correlating with credential dumping.Votes: 0GitHub stars: 4
- Detecting Pass The Ticket Attackstespit etmeKerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEMVotes: 0GitHub stars: 4
- Detecting Privilege Escalation Attemptstespit etmeprivilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.Votes: 0GitHub stars: 4
- Detecting Process Hollowing Techniquetespit etmeprocess hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.Votes: 0GitHub stars: 4
- Detecting Rdp Brute Force Attackstespit etmeRDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, andVotes: 0GitHub stars: 4
- Detecting Service Account Abusetespit etmeabuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.Votes: 0GitHub stars: 4
- Detecting Suspicious Powershell Executiontespit etmesuspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.Votes: 0GitHub stars: 4
- Detecting T1003 Credential Dumping With Edrtespit etmeOS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security eventVotes: 0GitHub stars: 4
- Detecting T1055 Process Injection With Sysmontespit etmeprocess injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote threadVotes: 0GitHub stars: 4
- Detecting T1548 Abuse Elevation Control Mechanismtespit etmeabuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusualVotes: 0GitHub stars: 4
- Detecting Wmi Persistencetespit etmeWMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.Votes: 0GitHub stars: 4
- Hunting For Anomalous Powershell ExecutionHunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX filesVotes: 0GitHub stars: 4
- Hunting For Beaconing With Frequency AnalysisIdentify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to tespit etmeperiodic callbacksVotes: 0GitHub stars: 4
- Hunting For Cobalt Strike Beaconstespit etmeCobalt Strike beacon network activity using default TLS certificate signatures (serial 8BB00EE), JA3/JA3S/JARM fingerprints, HTTP C2 profile pattern matching, beacon jitter analysis,Votes: 0GitHub stars: 4
- Hunting For Command And Control Beaconingtespit etmeC2 beaconing patterns in network traffic using frequency analysis, jitter Tespit, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.Votes: 0GitHub stars: 4
- Hunting For Data Exfiltration IndicatorsHunt for data exfiltration through network traffic analysis, Tespit etme unusual data flows, DNS tunneling, cloud storage uploads, and encrypted channel abuse.Votes: 0GitHub stars: 4