All authors
Claude Skills by plurigrid
github.com/plurigrid2,535 skills6 installs3,507 views
- Detecting Insider Data Exfiltration Via DlpDetects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data loss prevention.Votes: 0GitHub stars: 61
- Detecting Insider Threat BehaviorsDetect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.Votes: 0GitHub stars: 61
- Detecting Insider Threat With UebaImplement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and detect insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access patterns.Votes: 0GitHub stars: 61
- Detecting Kerberoasting AttacksDetect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.Votes: 0GitHub stars: 61
- Detecting Lateral Movement In NetworkIdentifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.Votes: 0GitHub stars: 61
- Detecting Lateral Movement With SplunkDetect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.Votes: 0GitHub stars: 61
- Detecting Lateral Movement With ZeekDetect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.Votes: 0GitHub stars: 61
- Detecting Living Off The Land AttacksDetect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.Votes: 0GitHub stars: 61
- Detecting Living Off The Land With LolbasDetect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysisVotes: 0GitHub stars: 61
- Detecting Malicious Scheduled Tasks With SysmonDetect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job ...Votes: 0GitHub stars: 61
- Detecting Mimikatz Execution PatternsDetect Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.Votes: 0GitHub stars: 61
- Detecting Misconfigured Azure StorageDetecting misconfigured Azure Storage accounts including publicly accessible blob containers, missing encryption settings, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft Defender for Storage.Votes: 0GitHub stars: 61
- Detecting Mobile Malware BehaviorDetects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.Votes: 0GitHub stars: 61
- Detecting Modbus Command Injection AttacksDetect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines using ICS-aware IDS and protocol deep packet inspection.Votes: 0GitHub stars: 61
- Detecting Modbus Protocol AnomaliesThis skill covers detecting anomalies in Modbus/TCP and Modbus RTU communications in industrial control systems. It addresses function code monitoring, register range validation, timing analysis, unauthorized client detection, and deep packet inspection for malformed Modbus frames. The skill leverages Zeek with Modbus protocol analyzers, Suricata IDS with OT rules, and custom Python-based detection using Markov chain models for normal Modbus transaction sequences.Votes: 0GitHub stars: 61
- Detecting Network Anomalies With ZeekDeploys and configures Zeek (formerly Bro) network security monitor to passively analyze network traffic, generate structured logs, detect anomalous behavior, and create custom detection scripts for threat hunting and incident response.Votes: 0GitHub stars: 61
- Detecting Network Scanning With Ids SignaturesDetect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.Votes: 0GitHub stars: 61
- Detecting Ntlm Relay With Event CorrelationDetect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.Votes: 0GitHub stars: 61
- Detecting Oauth Token TheftDetects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly detection. Covers access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates for requests involving OAuth token theft detection, token replay prevention, Azure AD conditional access token protection, or cloud identity attack investigation.Votes: 0GitHub stars: 61
- Detecting Pass The Hash AttacksDetect Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons with NTLM where Kerberos is expected, and correlating with credential dumping.Votes: 0GitHub stars: 61
- Detecting Pass The Ticket AttacksDetect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEMVotes: 0GitHub stars: 61
- Detecting Port Scanning With Fail2banConfigures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatically banning offending IP addresses and alerting security teams to suspicious network probing.Votes: 0GitHub stars: 61
- Detecting Privilege Escalation AttemptsDetect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.Votes: 0GitHub stars: 61
- Detecting Privilege Escalation In Kubernetes PodsDetect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.Votes: 0GitHub stars: 61
- Detecting Process Hollowing TechniqueDetect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.Votes: 0GitHub stars: 61
- Detecting Process Injection TechniquesDetects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.Votes: 0GitHub stars: 61
- Detecting Qr Code Phishing With Email SecurityDetect and prevent QR code phishing (quishing) attacks that bypass traditional email security by embedding malicious URLs in QR code images within emails.Votes: 0GitHub stars: 61
- Detecting Ransomware Encryption BehaviorDetects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral heuristics. Identifies mass file modification patterns, abnormal entropy spikes in written data, and suspicious process behavior characteristic of ransomware encryption routines. Activates for requests involving ransomware behavioral detection, entropy-based file monitoring, I/O anomaly detection, or real-time encryption activity alerting.Votes: 0GitHub stars: 61
- Detecting Ransomware Precursors In NetworkDetects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests inv...Votes: 0GitHub stars: 61
- Detecting Rdp Brute Force AttacksDetect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.Votes: 0GitHub stars: 61
- Detecting Rootkit ActivityDetects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques. Activates for requests involving rootkit detection, hidden process discovery, kernel integrity checking, or system call hook analysis.Votes: 0GitHub stars: 61
- Detecting S3 Data Exfiltration AttemptsDetecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.Votes: 0GitHub stars: 61
- Detecting Serverless Function InjectionDetects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source poisoning, malicious layer injection, runtime command execution, and IAM privilege escalation via function modification. The analyst combines static analysis of function code, CloudTrail event correlation, runtime behavior monitoring, and IAM policy auditing to identify injection vectors across the expanded serverless attack surface including AP...Votes: 0GitHub stars: 61
- Detecting Service Account AbuseDetect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.Votes: 0GitHub stars: 61
- Detecting Shadow Api EndpointsDiscover and inventory shadow API endpoints that operate outside documented specifications using traffic analysis, code scanning, and API discovery platforms.Votes: 0GitHub stars: 61
- Detecting Shadow It Cloud UsageDetect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern analysis and domain classification.Votes: 0GitHub stars: 61
- Detecting Spearphishing With Email GatewaySpearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint,Votes: 0GitHub stars: 61
- Detecting Sql Injection Via Waf LogsAnalyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates multi-stage injection attempts, and generates incident reports with OWASP classification.Votes: 0GitHub stars: 61
- Detecting Stuxnet Style AttacksThis skill covers detecting sophisticated cyber-physical attacks that follow the Stuxnet attack pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation from operators. It addresses PLC logic integrity monitoring, physics-based process anomaly detection, engineering workstation compromise indicators, USB-borne attack vectors, and multi-stage attack chain detection spanning IT-to-OT lateral movement through to process manipulation.Votes: 0GitHub stars: 61
- Detecting Supply Chain Attacks In Ci CdScans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.Votes: 0GitHub stars: 61
- Detecting Suspicious Oauth Application ConsentDetect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.Votes: 0GitHub stars: 61
- Detecting Suspicious Powershell ExecutionDetect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.Votes: 0GitHub stars: 61
- Detecting T1003 Credential Dumping With EdrDetect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.Votes: 0GitHub stars: 61
- Detecting T1055 Process Injection With SysmonDetect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.Votes: 0GitHub stars: 61
- Detecting T1548 Abuse Elevation Control MechanismDetect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.Votes: 0GitHub stars: 61
- Detecting Typosquatting Packages In Npm PypiDetects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages have disproportionately low usage compared to their legitimate targets. The analyst queries the PyPI JSON API and npm registry API to gather package metadata for automated compar...Votes: 0GitHub stars: 61
- Detecting Wmi PersistenceDetect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.Votes: 0GitHub stars: 61
- Developer Growth AnalysisAnalyzes your recent Claude Code chat history to identify coding patterns,Votes: 0GitHub stars: 61
- Differential ReviewSecurity-focused code review of diffs and pull requests using Trail of Bits expertise.Votes: 0GitHub stars: 61
- Dimensional AnalysisAnnotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling. Use when someone asks to annotate units in a codebase, perform a dimensional analysis, or find vulnerabilities in a DeFi protocol, offchain code, or other blockchain-related codebase with arithmetic. Prevents dimensional mismatches and catches formula bugs early.Votes: 0GitHub stars: 61