All authors
Claude Skills by nuroctane
github.com/nuroctane628 skills2 installs1,111 views
- Analyzing Uefi Bootkit Persistence'Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,Votes: 0GitHub stars: 3
- Analyzing Usb Device Connection HistoryCorrelate Windows registry keys (USBSTOR, MountedDevices), Event Logs,Votes: 0GitHub stars: 3
- Analyzing Windows Amcache Artifacts'Parses the Windows Amcache.hve registry hive with Eric Zimmerman''sVotes: 0GitHub stars: 3
- Analyzing Windows Lnk Files For ArtifactsParse Windows LNK shortcut files to extract target paths, MAC timestamps,Votes: 0GitHub stars: 3
- Analyzing Windows Prefetch With PythonParse Windows Prefetch (.pf) files with the windowsprefetch PythonVotes: 0GitHub stars: 3
- Analyzing Windows Registry For ArtifactsExtract and analyze Windows Registry hives with tools like RegRipperVotes: 0GitHub stars: 3
- Analyzing Windows Shellbag ArtifactsAnalyze Windows Shellbag (BagMRU) registry artifacts with SBECmd andVotes: 0GitHub stars: 3
- Auditing Cloud With Cis BenchmarksAudit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.Votes: 0GitHub stars: 3
- Building Adversary Infrastructure Tracking SystemBuild an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate transparency logs, WHOIS records, and IP enrichment to map threat-actor C2 networks and flag newly registered domains matching known patterns. Use when pivoting from known indicators to discover related C2 infrastructure or maintaining a continuously updated map of a threat actor's network.Votes: 0GitHub stars: 3
- Building Attack Pattern Library From Cti ReportsParse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1 attack-pattern library with detection templates. Use when cataloging attack patterns from CTI reports for threat-informed detection engineering, or generating Sigma/YARA templates from documented behaviors.Votes: 0GitHub stars: 3
- Building C2 Infrastructure With Sliver FrameworkDeploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations. Use when standing up resilient C2 for a red-team engagement or generating beacon/session implants that must survive blue-team detection.Votes: 0GitHub stars: 3
- Building Cloud Siem With SentinelDeploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks. Use when establishing a centralized SOC for multi-cloud environments, migrating from a legacy SIEM, or performing petabyte-scale threat hunting; not for AWS-only setups where Security Hub/GuardDuty suffice or for endpoint EDR needs.Votes: 0GitHub stars: 3
- Building Devsecops Pipeline With Gitlab CiConfigure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security templates. Use when building a shift-left DevSecOps pipeline in GitLab, adding automated vulnerability scanning stages to .gitlab-ci.yml, or triaging scanner findings with GitLab Duo AI before deployment.Votes: 0GitHub stars: 3
- Building Identity Federation With Saml Azure AdConfigure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federation models (AD FS, password hash sync, pass-through auth, third-party IdP) and the SAML authentication flow. Use when extending on-premises authentication authority to cloud resources or designing hybrid identity SSO architecture for Entra ID.Votes: 0GitHub stars: 3
- Building Identity Governance Lifecycle ProcessDesign identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests, periodic recertification, and orphaned-account remediation sourced from an HR feed. Use when automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance.Votes: 0GitHub stars: 3
- Building Incident Response PlaybookDesigns and documents structured incident response playbooks with step-by-stepVotes: 0GitHub stars: 3
- Building Incident Timeline With TimesketchBuild collaborative forensic incident timelines using Timesketch to ingest,Votes: 0GitHub stars: 3
- Building Ioc Defanging And Sharing PipelineBuild an automated pipeline that ingests raw IOCs (URLs, IPs, domains,Votes: 0GitHub stars: 3
- Building Ioc Enrichment Pipeline With OpenctiBuild an automated IOC enrichment pipeline on OpenCTI (STIX 2.1 nativeVotes: 0GitHub stars: 3
- Building Malware Incident Communication TemplateBuild structured communication templates for malware incidents (ransomware,Votes: 0GitHub stars: 3
- Building Patch Tuesday Response ProcessEstablish a repeatable operational process for triaging, testing, andVotes: 0GitHub stars: 3
- Building Phishing Reporting Button WorkflowImplement a phishing report button (Microsoft 365 built-in Report buttonVotes: 0GitHub stars: 3
- Building Ransomware Playbook With Cisa FrameworkBuilds a structured ransomware incident response playbook aligned withVotes: 0GitHub stars: 3
- CybersecurityRouter into 800+ Anthropic-Cybersecurity-Skills (MITRE ATT&CK, NIST CSF, ATLAS, D3FEND, AI RMF, F3). Use for security investigations, DFIR, red/blue team playbooks.Votes: 0GitHub stars: 3
- Performing Kubernetes Cis Benchmark With Kube BenchTurns kube-bench output into a finished CIS Kubernetes Benchmark audit: interpreting PASS/FAIL/WARN per control, judging which failures are genuine on a managed cluster, writing remediation, and packaging evidence for SOC 2 or PCI DSS. Use when conducting a scheduled compliance audit, triaging kube-bench results, deciding which controls are not applicable on EKS, GKE, or AKS, or producing hardening evidence for an auditor. Keywords: CIS Kubernetes Benchmark, control plane, remediation, compli...Votes: 0GitHub stars: 3
- Performing Kubernetes Etcd Security AssessmentAssesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation. Use when auditing or hardening a control plane, reviewing whether Secrets are encrypted at rest, or protecting etcd backups, since etcd stores Secrets, RBAC policy, and ConfigMaps in plaintext by default. Keywords: etcd, EncryptionConfiguration, encryption at rest, peer TLS, snapshot, backup, control plane. Do not us...Votes: 0GitHub stars: 3
- Performing Kubernetes Penetration TestingEvaluates Kubernetes cluster security by actively simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policy, and secrets, using kube-hunter, Kubescape, peirates, and manual kubectl exploitation to find paths to cluster compromise. Use for an authorized penetration test or hands-on validation that controls actually stop an attacker. Keywords: kube-hunter, Kubescape, peirates, kubelet 10250, anonymous auth, token theft, lateral movement, cluster takeover. ...Votes: 0GitHub stars: 3
- Performing Lateral Movement Detection'Detects lateral movement techniques including Pass-the-Hash, PsExec,Votes: 0GitHub stars: 3
- Performing Linux Log Forensics InvestigationPerform forensic investigation of Linux system logs including syslog,Votes: 0GitHub stars: 3
- Performing Log Analysis For Forensic InvestigationCollect, parse, and correlate system, application, and security logsVotes: 0GitHub stars: 3
- Performing Log Source Onboarding In SiemPerform structured log source onboarding into SIEM platforms (Splunk,Votes: 0GitHub stars: 3
- Performing Malware Hash Enrichment With VirustotalEnrich malware file hashes (MD5, SHA-1, SHA-256) using the VirusTotalVotes: 0GitHub stars: 3
- Performing Malware Persistence InvestigationSystematically investigate all persistence mechanisms on Windows andVotes: 0GitHub stars: 3
- Performing Malware Triage With Yara'Performs rapid malware triage and classification using YARA rules thatVotes: 0GitHub stars: 3
- Performing Memory Forensics With Volatility3Analyze volatile memory (RAM) dumps using the Volatility 3 frameworkVotes: 0GitHub stars: 3
- Performing Mobile Device Forensics With CellebriteAcquire and analyze mobile device data using Cellebrite UFED Touch/4PC, UFED Physical Analyzer, and open-source alternatives (ALEAPP, iLEAPP, MEAT, libimobiledevice) to extract communications, call logs, location data, and application artifacts. Use when extracting or recovering deleted evidence from smartphones or tablets during criminal, corporate, or employee-misuse investigations.Votes: 0GitHub stars: 3
- Performing Network Forensics With WiresharkCapture and analyze network traffic using Wireshark and tshark to reconstruct network events from PCAP/PCAPNG files, extract transferred files and credentials, and identify command-and-control communications. Use when analyzing captured traffic from a security incident, reconstructing data exfiltration, or finding network indicators of compromise during malware analysis.Votes: 0GitHub stars: 3
- Performing Network Packet Capture AnalysisPerform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic, and establish evidence of data exfiltration or command-and-control activity. Use when a PCAP file from an incident needs to be examined to prove lateral movement, malware delivery, or unauthorized access.Votes: 0GitHub stars: 3
- Performing Network Traffic Analysis With TsharkAutomate network traffic analysis using tshark (Wireshark CLI) and pyshark to compute protocol distribution statistics, detect suspicious flows such as port scans and beaconing, extract IOCs (IPs, domains, URLs), and identify DNS tunneling patterns from PCAP files. Use when scripted or repeatable analysis of packet captures is needed rather than interactive inspection.Votes: 0GitHub stars: 3
- Performing Network Traffic Analysis With ZeekDeploy Zeek (formerly Bro) as a passive network security monitor to generate structured logs of protocol metadata (HTTP, DNS, TLS, SSH, SMTP, FTP, and more), write custom detection scripts, and integrate outputs with SIEM platforms. Use when standing up continuous, high-fidelity network traffic monitoring for threat detection, anomaly identification, or forensic investigation beyond what raw PCAP analysis provides.Votes: 0GitHub stars: 3
- Performing Nist Csf Maturity AssessmentConduct a NIST Cybersecurity Framework (CSF) 2.0 maturity assessment across the six core Functions (Govern, Identify, Protect, Detect, Respond, Recover), scoring organizational posture against the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) and producing an improvement roadmap. Use when benchmarking an organization's cybersecurity program maturity or preparing a CSF-based gap analysis and remediation plan.Votes: 0GitHub stars: 3
- Performing Oil Gas Cybersecurity AssessmentConduct cybersecurity assessments of upstream, midstream, and downstream oil and gas operations, covering pipeline SCADA, refinery DCS, safety instrumented systems, and remote wellhead RTUs, and evaluate compliance with API 1164, TSA Pipeline Security Directives, and IEC 62443. Use when assessing a refinery, pipeline, or production facility or preparing for TSA/API compliance audits; not for IT-only or purely physical-security assessments.Votes: 0GitHub stars: 3
- Performing Osint With SpiderfootAutomate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting scan modes (footprint, investigate, passive) and parsing results for domains, IPs, emails, leaked credentials, and DNS records into a target intelligence profile. Use when mapping an organization's attack surface or profiling a target for threat intelligence.Votes: 0GitHub stars: 3
- Performing Ot Vulnerability Assessment With ClarotyPerform OT vulnerability assessments using the Claroty xDome platform for asset discovery, risk scoring, and vulnerability correlation, combining passive traffic-based identification and active safe device querying with CVE/ICS-CERT advisory correlation for remediation prioritization. Use for scheduled IEC 62443 or NERC CIP OT vulnerability assessments, initial xDome deployment, or generating CIP-010-4 compliance evidence; not for active PLC scanning or penetration testing.Votes: 0GitHub stars: 3
- Performing Phishing Simulation With GophishDeploy and run authorized phishing awareness campaigns with GoPhish, covering admin panel setup, SMTP sending profiles, email template and landing page creation, target user groups, and campaign reporting to measure click and credential-submission rates. Use when planning or executing a phishing simulation for employee security-awareness testing or measuring susceptibility to social engineering.Votes: 0GitHub stars: 3
- Performing Physical Intrusion AssessmentConduct authorized physical penetration testing against facilities, server rooms, and restricted areas using tailgating, RFID badge cloning, lock bypassing, rogue network device deployment, and security-guard procedure testing. Use as part of a full-scope red team engagement to evaluate physical security controls and their path to network access, always under signed client authorization.Votes: 0GitHub stars: 3
- Performing Power Grid Cybersecurity AssessmentConduct cybersecurity assessments of power grid infrastructure spanning generation, transmission substations, distribution, and EMS control centers, covering NERC CIP compliance verification, IEC 61850 (GOOSE/MMS) substation protocol analysis, and synchrophasor (PMU) network security against threats like Industroyer/CrashOverride. Use for periodic NERC CIP assessments, substation automation or EMS/SCADA security reviews, or regional entity compliance audits; not for non-BES systems or generic...Votes: 0GitHub stars: 3
- Performing Privilege Escalation On LinuxGuides manual enumeration and automated tooling to escalate from a low-privilegeVotes: 0GitHub stars: 3
- Performing Privileged Account Access ReviewConducts systematic reviews of privileged accounts to validate accessVotes: 0GitHub stars: 3
- Performing Privileged Account DiscoveryDiscovers and inventories privileged accounts across enterprise infrastructure,Votes: 0GitHub stars: 3