All categories
DevOps & Cloud
Deployment, cloud, containers, CI/CD, monitoring, and infrastructure
- 20,173
- 841
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse devops & cloud skills
Showing 13,297–13,320 of 20,173 skills
- Hunting For Living Off The Cloud TechniquesHunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse of Azure, AWS, GCP services, and SaaS platforms.Votes: 0GitHub stars: 61
- Hunting For Lateral Movement Via WmiDetect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI event subscription persistence.Votes: 0GitHub stars: 61
- Hunting For Domain Fronting C2 TrafficDetect domain fronting C2 traffic by analyzing SNI vs HTTP Host header mismatches in proxy logs and TLS certificate discrepancies using pyOpenSSL for certificate inspectionVotes: 0GitHub stars: 61
- Hunting For Dns Based PersistenceHunt for DNS-based persistence mechanisms including DNS hijacking, dangling CNAME records, wildcard DNS abuse, and unauthorized zone modifications using passive DNS databases, SecurityTrails API, and DNS audit log analysis.Votes: 0GitHub stars: 61
- Hunting For Defense Evasion Via TimestompingDetect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.Votes: 0GitHub stars: 61
- Hunting For Data Staging Before ExfiltrationDetect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetryVotes: 0GitHub stars: 61
- Hunting For Data Exfiltration IndicatorsHunt for data exfiltration through network traffic analysis, detecting unusual data flows, DNS tunneling, cloud storage uploads, and encrypted channel abuse.Votes: 0GitHub stars: 61
- Hunting For Command And Control BeaconingDetect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.Votes: 0GitHub stars: 61
- Hunting For Cobalt Strike BeaconsDetect Cobalt Strike beacon network activity using default TLS certificate signatures (serial 8BB00EE), JA3/JA3S/JARM fingerprints, HTTP C2 profile pattern matching, beacon jitter analysis, and named pipe detection via Zeek, Suricata, and Python PCAP analysis.Votes: 0GitHub stars: 61
- Hunting For Anomalous Powershell ExecutionHunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles. Activates for requests involving PowerShell threat hunting, script block analysis, encoded command detection, or AMSI bypass identification.Votes: 0GitHub stars: 61
- Hardening Linux Endpoint With Cis BenchmarkHardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.Votes: 0GitHub stars: 61
- Hardening Docker Daemon ConfigurationHarden the Docker daemon by configuring daemon.json with user namespace remapping, TLS authentication, rootless mode, and CIS benchmark controls.Votes: 0GitHub stars: 61
- Glass LinePhysical substrate layer for Plurigrid ASI — co-deployed fiber optic + geothermal infrastructure providing sensing, communication, energy, and materials extraction through a single bore.Votes: 0GitHub stars: 61
- Gay JuliaWide-gamut color sampling with splittable determinism using Pigeons.jlVotes: 0GitHub stars: 61
- Fuck Old PythonReject projects requiring Python < 3.13. Never downgrade, never poison the env.Votes: 0GitHub stars: 61
- ForesterJon Sterling's forester tool for tending mathematical forests — syntax, escaping, verbatim, tree files, skill2tree conversionVotes: 0GitHub stars: 61
- Exploiting Bgp Hijacking VulnerabilitiesAnalyzes and simulates BGP hijacking scenarios in authorized lab environments to assess route origin validation, RPKI deployment, and BGP monitoring defenses against prefix hijacking and route leak attacks on internet routing infrastructure.Votes: 0GitHub stars: 61
- Entropy Sim2realEntropy-driven sim2real transfer. Uses maximum entropy RL, domain randomization, and information-theoretic bridging to close the reality gap.Votes: 0GitHub stars: 61
- Detecting Wmi PersistenceDetect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.Votes: 0GitHub stars: 61
- Detecting T1055 Process Injection With SysmonDetect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.Votes: 0GitHub stars: 61
- Detecting S3 Data Exfiltration AttemptsDetecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.Votes: 0GitHub stars: 61
- Detecting Ransomware Encryption BehaviorDetects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral heuristics. Identifies mass file modification patterns, abnormal entropy spikes in written data, and suspicious process behavior characteristic of ransomware encryption routines. Activates for requests involving ransomware behavioral detection, entropy-based file monitoring, I/O anomaly detection, or real-time encryption activity alerting.Votes: 0GitHub stars: 61
- Detecting Privilege Escalation In Kubernetes PodsDetect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.Votes: 0GitHub stars: 61
- Detecting Port Scanning With Fail2banConfigures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatically banning offending IP addresses and alerting security teams to suspicious network probing.Votes: 0GitHub stars: 61