Claude Skills by Undermybelt

OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its

'Automates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan,

'Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection

'Performs runtime mobile security exploration of iOS applications using Objection, a Frida-powered toolkit that

'Performs comprehensive security assessments of IoT devices and their ecosystems by testing hardware interfaces,

Analyze IP address reputation using the Shodan API to identify open ports, running services, known vulnerabilities,

'Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding,

ISO/IEC 27001:2022 is the international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). This skill covers the complete

Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid

Implement Just-In-Time (JIT) access provisioning to eliminate standing privileges by granting temporary, time-bound

'Exploits JWT algorithm confusion vulnerabilities where the server''s token verification library accepts the

Execute and test the JWT none algorithm attack to bypass signature verification by manipulating the alg header

JSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens used for authentication and authorization

Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization

'Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications,

Audit Kubernetes cluster security posture against CIS benchmarks using kube-bench with automated checks for control

'This skill covers hardening managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards,

Assess the security posture of Kubernetes etcd clusters by evaluating encryption at rest, TLS configuration,

Perform security risk analysis on Kubernetes resource manifests using Kubesec to identify misconfigurations,

Implement Kubernetes network segmentation using Calico NetworkPolicy and GlobalNetworkPolicy for zero-trust pod-to-pod

Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against

Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted

Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with

Perform Kerberoasting attacks using Impacket's GetUserSPNs to extract and crack Kerberos TGS tickets for Active

'Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based

'Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows,

Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs,

Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for

Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket

'Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log,

Harden LDAP directory services against common attacks including credential harvesting, LDAP injection, anonymous

'Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized

'Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware,

Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules),

Perform forensic investigation of Linux system logs including syslog, auth.log, systemd journal, kern.log, and

Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover

Hunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse

'Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process

Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while

Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32

'Implements input and output validation guardrails for LLM-powered applications to prevent prompt injection,

Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution,

Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines

Configure Fluentd and Fluent Bit for centralized log aggregation, routing, filtering, and enrichment across distributed

Build an append-only log integrity chain using SHA-256 hash chaining for tamper detection. Each log entry is

Perform structured log source onboarding into SIEM platforms by configuring collectors, parsers, normalization,

Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs

'Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download

'Executes malware samples in Cuckoo Sandbox to observe runtime behavior including process creation, file system