Claude Skills by yanacuti1121

'Detects and analyzes fileless malware that operates entirely in memory

Detect Golden Ticket attacks in Active Directory by analyzing Kerberos

Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769

'Detects insider data exfiltration by analyzing DLP policy violations,

Detect insider threat behavioral indicators including unusual data access,

Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS

'Identifies lateral movement techniques in enterprise networks by analyzing

Detect adversary lateral movement across networks using Splunk SPL queries

'Detect lateral movement in network traffic using Zeek (formerly Bro)

'Detect abuse of legitimate Windows binaries (LOLBins) used for living

Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including

'Detect malicious scheduled task creation and modification using Sysmon

Detect Mimikatz execution through command-line patterns, LSASS access

'Detecting misconfigured Azure Storage accounts including publicly accessible

'Detects and analyzes malicious behavior in mobile applications through

'Detect command injection attacks against Modbus TCP/RTU protocol in

'This skill covers detecting anomalies in Modbus/TCP and Modbus RTU communications

'Deploys and configures Zeek (formerly Bro) network security monitor

Detect network reconnaissance and port scanning using Suricata and Snort

'Detect NTLM relay attacks through Windows Security Event correlation

'Detects and responds to OAuth token theft and replay attacks in cloud

Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns,

Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event

'Configures Fail2ban with custom filters and actions to detect port scanning

Detect privilege escalation attempts including token manipulation, UAC

Detect and prevent privilege escalation in Kubernetes pods by monitoring

Detect process hollowing (T1055.012) by analyzing memory-mapped sections,

'Detects and analyzes process injection techniques used by malware including

Detect and prevent QR code phishing (quishing) attacks that bypass traditional

'Detects ransomware encryption activity in real time using entropy analysis,

'Detects early-stage ransomware indicators in network traffic before

Detect RDP brute force attacks by analyzing Windows Security Event Logs

'Detects rootkit presence on compromised systems by identifying hidden

'Detecting data exfiltration attempts from AWS S3 buckets by analyzing

'Detects and prevents code injection attacks targeting serverless functions

Detect abuse of service accounts through anomalous interactive logons,

Discover and inventory shadow API endpoints that operate outside documented

Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing

Spearphishing targets specific individuals using personalized, researched

Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection

'This skill covers detecting sophisticated cyber-physical attacks that

'Scans GitHub Actions workflows and CI/CD pipeline configurations for

Detect risky OAuth application consent grants in Azure AD / Microsoft

Detect suspicious PowerShell execution patterns including encoded commands,

Detect OS credential dumping techniques targeting LSASS memory, SAM database,

Detect process injection techniques (T1055) including classic DLL injection,

Detect abuse of elevation control mechanisms including UAC bypass, sudo

'Detects typosquatting attacks in npm and PyPI package registries by

Detect WMI event subscription persistence by analyzing Sysmon Event IDs