All authors
Claude Skills by MustafaKemal0146
github.com/MustafaKemal0146961 skills11 installs1,632 views
- Hunting For Data Staging Before Exfiltrationtespit etmedata staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns viaVotes: 0GitHub stars: 4
- Hunting For Dcom Lateral MovementHunt for DCOM-based lateral movement by Tespit etme abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects through Sysmon Event ID 1 (process creation) and Event ID 3 (networkVotes: 0GitHub stars: 4
- Hunting For Dcsync Attackstespit etmeDCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts.Votes: 0GitHub stars: 4
- Hunting For Defense Evasion Via Timestompingtespit etmeNTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporalVotes: 0GitHub stars: 4
- Hunting For Dns Based PersistenceHunt for DNS-based persistence mechanisms including DNS hijacking, dangling CNAME records, wildcard DNS abuse, and unauthorized zone modifications using passive DNS databases, SecurityTrailsVotes: 0GitHub stars: 4
- Hunting For Dns Tunneling With Zeektespit etmeDNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, long query lengths, and unusual DNS record types indicatingVotes: 0GitHub stars: 4
- Hunting For Domain Fronting C2 Traffictespit etmedomain fronting C2 traffic by analyzing SNI vs HTTP Host header mismatches in proxy logs and TLS certificate discrepancies using pyOpenSSL for certificate Denetle:ionVotes: 0GitHub stars: 4
- Hunting For Lateral Movement Via Wmitespit etmeWMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI eventVotes: 0GitHub stars: 4
- Hunting For Living Off The Cloud TechniquesHunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse of Azure, AWS, GCP services, and SaaS platforms.Votes: 0GitHub stars: 4
- Hunting For Living Off The Land BinariesProactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading Tespit.Votes: 0GitHub stars: 4
- Hunting For Lolbins Execution In Endpoint LogsHunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used forVotes: 0GitHub stars: 4
- Hunting For Ntlm Relay Attackstespit etmeNTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status,Votes: 0GitHub stars: 4
- Hunting For Persistence Mechanisms In WindowsSystematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services, startup folders, and WMI subscriptions.Votes: 0GitHub stars: 4
- Hunting For Persistence Via Wmi SubscriptionsHunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggeredVotes: 0GitHub stars: 4
- Hunting For Process Injection Techniquestespit etmeprocess injection techniques (T1055) including CreateRemoteThread, process hollowing, and DLL injection via Sysmon Event IDs 8 and 10 and EDR process telemetryVotes: 0GitHub stars: 4
- Hunting For Registry Persistence MechanismsHunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking in Windows environments.Votes: 0GitHub stars: 4
- Hunting For Registry Run Key Persistencetespit etmeMITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.Votes: 0GitHub stars: 4
- Hunting For Scheduled Task PersistenceHunt for adversary persistence via Windows Scheduled Tasks by analyzing task creation events, suspicious task actions, and unusual scheduling patterns.Votes: 0GitHub stars: 4
- Hunting For Shadow Copy DeletionHunt for Volume Shadow Copy deletion activity that indicates ransomware preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow copy commands.Votes: 0GitHub stars: 4
- Hunting For Spearphishing IndicatorsHunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to tespit etmetargeted email attacks.Votes: 0GitHub stars: 4
- Hunting For Startup Folder Persistencetespit etmeT1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, analyzing autoruns entries, and using Python watchdog for real-time filesystemVotes: 0GitHub stars: 4
- Hunting For Supply Chain CompromiseHunt for supply chain compromise indicators including trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts.Votes: 0GitHub stars: 4
- Hunting For Suspicious Scheduled TasksHunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious task properties, and unusual execution patterns that indicate T1053.005Votes: 0GitHub stars: 4
- Hunting For T1098 Account ManipulationHunt for MITRE ATT&CK T1098 account manipulation including shadow admin creation, SID history injection, group membership changes, and credential modifications using Windows Security EventVotes: 0GitHub stars: 4
- Hunting For Unusual Network ConnectionsHunt for unusual network connections by analyzing outbound traffic patterns, rare destinations, non-standard ports, and anomalous connection frequencies from endpoints.Votes: 0GitHub stars: 4
- Hunting For Unusual Service Installationstespit etmesuspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistenceVotes: 0GitHub stars: 4
- Hunting For Webshell ActivityHunt for web shell Dağıt:ments on internet-facing servers by analyzing file creation in web directories, suspicious process spawning from web servers, and anomalous HTTP patterns.Votes: 0GitHub stars: 4
- Performing Threat Hunting With Yara RulesUse YARA pattern-matching rules to hunt for malware, suspicious files, and indicators of compromise across filesystems and memory dumps. Covers rule authoring, yara-python scanning, and integrationVotes: 0GitHub stars: 4
- Analyzing Apt Group With Mitre NavigatorAnalyze advanced persistent threat (APT) group techniques using MITRE ATT&CK Navigator to create layered heatmaps of adversary TTPs for Tespit gap analysis and threat-informed defense.Votes: 0GitHub stars: 4
- Analyzing Campaign Attribution EvidenceCampaign attribution analysis involves systematically evaluating evidence to Belirle: which threat actor or group is responsible for a cyber operation. bu skill covers collecting and weightingVotes: 0GitHub stars: 4
- Analyzing Certificate Transparency For PhishingMonitor Certificate Transparency logs using crt.sh and Certstream to tespit etmephishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.Votes: 0GitHub stars: 4
- Analyzing Cyber Kill ChainAnalyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controlsVotes: 0GitHub stars: 4
- Analyzing Indicators Of CompromiseAnalyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to Belirle: maliciousness confidence, campaign attribution, and blocking priority.Votes: 0GitHub stars: 4
- Analyzing Malware Family Relationships With MalpediaUse the Malpedia platform and API to research malware family relationships, track variant evolution, link families to threat actors, and integrate YARA rules for Tespit across malware lineages.Votes: 0GitHub stars: 4
- Analyzing Ransomware Leak Site IntelligenceMonitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence on group tactics, and assess sector-specific ransomware risk for proactive defense.Votes: 0GitHub stars: 4
- Analyzing Threat Actor Ttps With Mitre AttackMITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. bu skill covers systematically mapping threatVotes: 0GitHub stars: 4
- Analyzing Threat Actor Ttps With Mitre NavigatorMap advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti Python library. The analyst queriesVotes: 0GitHub stars: 4
- Analyzing Threat Intelligence FeedsAnalyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds,Votes: 0GitHub stars: 4
- Analyzing Threat Landscape With MispŞunu analiz et: threat landscape using MISP (Malware Information Sharing Platform) by querying event statistics, attribute distributions, threat actor galaxy clusters, and tag trends over time.Votes: 0GitHub stars: 4
- Analyzing Typosquatting Domains With Dnstwisttespit etmetyposquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations and identify registered lookalike domains targeting your organization.Votes: 0GitHub stars: 4
- Auditing Tls Certificate Transparency LogsMonitors Certificate Transparency (CT) logs to tespit etmeunauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned domains. UsesVotes: 0GitHub stars: 4
- Automating Ioc EnrichmentAutomates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage timeVotes: 0GitHub stars: 4
- Building Adversary Infrastructure Tracking SystemBuild an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor threat actor command-and-control networks.Votes: 0GitHub stars: 4
- Building Attack Pattern Library From Cti ReportsExtract and catalog attack patterns from cyber threat intelligence reports into a structured STIX-based library mapped to MITRE ATT&CK for Tespit engineering and threat-informed defense.Votes: 0GitHub stars: 4
- Building Ioc Defanging And Sharing PipelineBuild an automated pipeline to defang indicators of compromise (URLs, IPs, domains, emails) for safe sharing and distribute them in STIX format through TAXII feeds and threat intelligence platforms.Votes: 0GitHub stars: 4
- Building Ioc Enrichment Pipeline With OpenctiOpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its native data model. bu skill covers building an automated IOC enrichment pipelineVotes: 0GitHub stars: 4
- Building Threat Actor Profile From OsintBuild comprehensive threat actor profiles using open-source intelligence (OSINT) techniques to document adversary motivations, capabilities, infrastructure, and TTPs for proactive defense.Votes: 0GitHub stars: 4
- Building Threat Feed Aggregation With MispDağıt: MISP (Malware Information Sharing Platform) to aggregate, correlate, and distribute threat intelligence feeds from multiple sources for centralized IOC management and automated SIEMVotes: 0GitHub stars: 4
- Building Threat Intelligence PlatformBuilding a Threat Intelligence Platform (TIP) involves Dağıt:ing and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence.Votes: 0GitHub stars: 4
- Collecting Open Source IntelligenceCollects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools,Votes: 0GitHub stars: 4