Claude Skills by nuroctane

'Detects defense evasion techniques used by adversaries in endpoint logs

Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy

'Detects fileless malware and in-memory attacks that execute entirely

Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries

Detect Kerberos Golden Ticket forgery (e.g. Mimikatz-forged tickets) by analyzing

Detect and defend against indirect prompt injection hidden in web pages, documents,

'Detects insider data exfiltration by analyzing DLP policy violations,

Detect insider threat behavioral indicators including unusual data access,

Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS

'Identifies lateral movement techniques in enterprise networks by analyzing

Detect adversary lateral movement across networks using Splunk SPL queries

'Detect lateral movement in network traffic using Zeek (formerly Bro)

'Detect abuse of legitimate Windows binaries (LOLBins) used for living

Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including

Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, and dynamic detonation with network/filesystem monitoring. Use when vetting a new dependency, reviewing a package.json/package-lock.json during code review, checking lockfiles against a supply-chain advisory's known-bad versions, or investigating a host suspected of installing a trojanized package.

'Detect malicious scheduled task creation and modification using Sysmon

Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and in-memory detection of known Mimikatz modules. Use when threat hunting for T1003 credential access, triaging EDR/SIEM alerts on LSASS access, scoping compromise during incident response, or validating detection coverage in a purple team exercise.

Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft Defender for Storage. Use for storage security audits across subscriptions, responding to Defender for Storage anonymous-access alerts, verifying compliance controls, or setting security baselines when onboarding a subscription.

'Detects and analyzes malicious behavior in mobile applications through

Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frames, and deviations from communication baselines using ICS-aware IDS and deep packet inspection. Use when deploying IDS for Modbus OT networks, investigating unauthorized PLC register/coil changes, or responding to FrostyGoop-style Modbus attacks.

Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep packet inspection, using Zeek's Modbus analyzer, Suricata IDS with OT rules, and Python Markov chain models of normal transaction sequences. Use for deploying Modbus IDS in OT environments, baselining polling patterns, investigating suspicious Modbus traffic, or building function code allowlists.

Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal query volume/distribution, rate-limiting and perturbing outputs, and red-teaming your model's extractability. Use for a public or partner inference API needing cloning/inversion/membership-inference detection, or a pre-deployment red-team exercise to measure extraction risk.

Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs, detect anomalous behavior, and write custom scripts for organization-specific threats. Use for passive monitoring at network choke points, feeding SIEM/threat hunting with protocol metadata, or retrospective log analysis during incident response; not a substitute for inline IDS/IPS or host agents.

Detect network reconnaissance and port scanning using Suricata and Snort

Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB/LDAP signing, and flagging NTLMv2-to-NTLMv1 downgrades. Use for hunting credential relay in NTLM-enabled AD, investigating auth-source anomalies, building SIEM correlation rules, or responding to PetitPotam/DFSCoerce/PrinterBug alerts.

Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Token Protection conditional access policies. Use for impossible-travel or anomalous token-usage alerts, suspected session hijacking, sign-in log analysis, or configuring token-binding defenses in Azure/M365.

Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected, and correlating with credential-dumping indicators. Use when threat hunting for lateral movement via stolen NTLM hashes, triaging EDR/SIEM alerts on suspicious NTLM logons, scoping compromise during incident response, or validating detection coverage in a purple team exercise.

Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection queries for Splunk and Elastic SIEM. Use when investigating incidents involving stolen or replayed Kerberos tickets, building detection rules or threat hunting queries for ticket abuse, or validating SOC monitoring coverage for credential-theft attack techniques.

'Configures Fail2ban with custom filters and actions to detect port scanning

Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse. Use when threat hunting for T1068-style privilege escalation, triaging EDR/SIEM alerts on suspicious privilege changes, scoping compromise during incident response, or validating detection coverage in a purple team exercise.

Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux capabilities, and syscall patterns. Use when investigating a pod running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope. Keywords: allowPrivilegeEscalation, runAsRoot, capabilities, securityContext, OPA, Falco, audit log. Do n...

Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped

'Detects and analyzes process injection techniques used by malware including

Detect and prevent QR code phishing (quishing) attacks that embed

'Detects ransomware encryption activity in real time using entropy

'Detects early-stage ransomware indicators in network traffic before

Detect RDP brute force attacks by parsing Windows Security Event Logs

'Detects rootkit presence on compromised systems by identifying hidden

'Detecting data exfiltration attempts from AWS S3 buckets by analyzing

Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and

'Detects and prevents code injection attacks targeting serverless functions

Detect abuse of service accounts by hunting for anomalous interactive

Discover and inventory shadow API endpoints that operate outside

Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing

Detect and block spearphishing emails that use personalized, researched

Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection

'Detects sophisticated cyber-physical attacks that follow the Stuxnet

'Scans GitHub Actions workflows and CI/CD pipeline configurations for

Detect risky OAuth application consent grants in Azure AD / Microsoft