Claude Skills by yanacuti1121

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS

'Identifies lateral movement techniques in enterprise networks by analyzing

Detect adversary lateral movement across networks using Splunk SPL queries

'Detect lateral movement in network traffic using Zeek (formerly Bro)

'Detect abuse of legitimate Windows binaries (LOLBins) used for living

Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including

'Detect malicious scheduled task creation and modification using Sysmon

Detect Mimikatz execution through command-line patterns, LSASS access

'Detecting misconfigured Azure Storage accounts including publicly accessible

'Detects and analyzes malicious behavior in mobile applications through

'Detect command injection attacks against Modbus TCP/RTU protocol in

'This skill covers detecting anomalies in Modbus/TCP and Modbus RTU communications

'Deploys and configures Zeek (formerly Bro) network security monitor

Detect network reconnaissance and port scanning using Suricata and Snort

'Detect NTLM relay attacks through Windows Security Event correlation

'Detects and responds to OAuth token theft and replay attacks in cloud

Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns,

Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event

'Configures Fail2ban with custom filters and actions to detect port scanning

Detect privilege escalation attempts including token manipulation, UAC

Detect and prevent privilege escalation in Kubernetes pods by monitoring

Detect process hollowing (T1055.012) by analyzing memory-mapped sections,

'Detects and analyzes process injection techniques used by malware including

Detect and prevent QR code phishing (quishing) attacks that bypass traditional

'Detects ransomware encryption activity in real time using entropy analysis,

'Detects early-stage ransomware indicators in network traffic before

Detect RDP brute force attacks by analyzing Windows Security Event Logs

'Detects rootkit presence on compromised systems by identifying hidden

'Detecting data exfiltration attempts from AWS S3 buckets by analyzing

'Detects and prevents code injection attacks targeting serverless functions

Detect abuse of service accounts through anomalous interactive logons,

Discover and inventory shadow API endpoints that operate outside documented

Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing

Spearphishing targets specific individuals using personalized, researched

Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection

'This skill covers detecting sophisticated cyber-physical attacks that

'Scans GitHub Actions workflows and CI/CD pipeline configurations for

Detect risky OAuth application consent grants in Azure AD / Microsoft

Detect suspicious PowerShell execution patterns including encoded commands,

Detect OS credential dumping techniques targeting LSASS memory, SAM database,

Detect process injection techniques (T1055) including classic DLL injection,

Detect abuse of elevation control mechanisms including UAC bypass, sudo

'Detects typosquatting attacks in npm and PyPI package registries by

Detect WMI event subscription persistence by analyzing Sysmon Event IDs

How to install and use codebase-memory-mcp — a single-binary MCP server that indexes a codebase into a persistent tree-sitter + Hybrid-LSP knowledge graph (158 languages), answering structural queries (call graph, dead code, HTTP/gRPC/GraphQL route linking, ADRs, Cypher-like queries) in sub-millisecond time with ~10x fewer tokens than file-by-file grep/read exploration. Triggers on: 'index this codebase', 'codebase memory mcp', 'code knowledge graph', 'find callers of', 'call graph', 'dead co...

Verifiable credential lifecycle management for agent identity. Issue, verify, revoke credentials, DID document key rotation, credential schema validation, and W3C VC data model compliance. Sources: microsoft/did-sdk-js, W3C VC spec.

W3C Decentralized Identifier (DID) resolution and cross-agent identity verification. DID document resolution, method routing, key extraction from DID documents, and mutual authentication between Swarm Bus agents. Sources: decentralized-identity/did-resolver.

Disaggregated prefill/decode — separate GPU pools for compute-bound prefill and memory-bound decode. KV cache transfer via NIXL (RDMA/TCP). NVIDIA Dynamo (stack-above) vs llm-d (K8s-native). 6x DeepSeek-R1 on GB200+Dynamo. 30–40% cost savings on $2M+ inference budgets. Sources: rohitg00/ai-engineering-from-scratch (Apache-2.0).

Instrument and debug distributed systems with tracing — OpenTelemetry setup, span creation, context propagation (W3C traceparent), sampling strategy, exporter configuration (Jaeger/Tempo/Honeycomb/Datadog), and correlating traces with logs. Use when asked to "add tracing", "OpenTelemetry", "OTel", "distributed trace", "trace propagation", "traceparent header", "find slow span", "Jaeger", "Tempo", "Honeycomb", "why is this request slow across services", or "trace ID in logs". Do NOT use for: m...

Build production-grade Docker images — multi-stage builds, layer caching, non-root user, minimal base images, .dockerignore, health checks, docker-compose for local dev, BuildKit secrets, and image size audit. Use when asked about "Docker", "Dockerfile", "multi-stage build", "Docker image too large", "non-root Docker", "Docker layer cache", "docker-compose", "Docker health check", "BuildKit", ".dockerignore", "Docker security", "distroless", or "container image best practices". Do NOT use for...