All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,691
- 1,321
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 20,329–20,352 of 31,691 skills
- Implementing Api Key Security Controls'Implements secure API key generation with sufficient entropy, server-sideVotes: 0GitHub stars: 67
- Implementing Aes Encryption For Data At RestGuides implementing AES-256 encryption in GCM mode (FIPS 197) for files and data stores at rest, covering key derivation, IV/nonce management, and authenticated encryption. Use when deploying or configuring encryption for data at rest, establishing controls to meet compliance requirements, or reviewing an implementation during a security assessment.Votes: 0GitHub stars: 67
- Hunting For Unusual Service InstallationsDetects suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event log Event ID 7045, analyzing service binary paths, and flagging indicators of persistence mechanisms via Sysmon/EDR telemetry. Use when hunting for new-service persistence after a suspected compromise, when Event ID 7045 fires for an unfamiliar service, or during incident response to enumerate service-based persistence on Windows hosts.Votes: 0GitHub stars: 67
- Hunting For T1098 Account ManipulationHunts for MITRE ATT&CK T1098 account manipulation - shadow admin creation, SID history injection, group membership changes, and credential modifications - by analyzing Windows Security Event Log IDs 4738, 4728, 4732, 4756, 4670, and 5136. Use when investigating suspected privilege persistence in Active Directory, after detecting anomalous group/credential changes, or during incident response to trace account tampering.Votes: 0GitHub stars: 67
- Hunting For Suspicious Scheduled TasksHunts for adversary persistence and execution via Windows scheduled tasks (T1053.005) by analyzing Security Event ID 4698 task-creation events, suspicious task properties, and unusual execution patterns from schtasks.exe/at.exe. Use after detecting schtasks or at.exe in process creation logs, during incident response to enumerate persistence on compromised hosts, or when Event ID 4698 fires for an unusual task.Votes: 0GitHub stars: 67
- Hunting For Startup Folder PersistenceDetects T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, cross-referencing Autoruns entries, and running a Python watchdog script for real-time filesystem monitoring. Use when hunting for malware or implants that survive reboot via startup-folder placement, or when validating autoruns/EDR findings against known-good startup baselines.Votes: 0GitHub stars: 67
- Hunting For Shadow Copy DeletionRuns a hypothesis-driven threat hunt for Volume Shadow Copy deletion (T1490) by querying SIEM/EDR telemetry for vssadmin, wmic shadowcopy, and PowerShell shadow-copy-deletion commands. Use when hunting for ransomware preparation or anti-forensics activity, after threat intel flags active campaigns, or when alerts trigger on shadow-copy deletion commands.Votes: 0GitHub stars: 67
- Hunting For Dcsync AttacksDetect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse.Votes: 0GitHub stars: 67
- Hunting For Dcom Lateral Movement'Hunt for DCOM-based lateral movement (MITRE ATT&CK T1021.003) by detectingVotes: 0GitHub stars: 67
- Hardening Docker Containers For ProductionHardens Dockerfiles, images, and per-container runtime settings against the CIS Docker Benchmark v1.8.0: non-root users, dropped capabilities, read-only root filesystem, seccomp and AppArmor profiles, and minimal multi-stage builds, validated with docker-bench-security, Hadolint, and Dockle. Use when preparing a container or Dockerfile for production, or auditing images and runtime flags against CIS Docker controls. Keywords: Dockerfile, USER, --cap-drop, read-only rootfs, seccomp, AppArmor, ...Votes: 0GitHub stars: 67
- Extracting Windows Event Logs ArtifactsExtract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw,Votes: 0GitHub stars: 67
- Extracting Credentials From Memory DumpExtracts cached credentials, password hashes, Kerberos tickets, andVotes: 0GitHub stars: 67
- Extracting Config From Agent Tesla RatExtracts embedded configuration from Agent Tesla RAT samples, includingVotes: 0GitHub stars: 67
- Extracting Browser History ArtifactsExtracts and analyzes browser history, cookies, cache, downloads, andVotes: 0GitHub stars: 67
- Exploiting Zerologon Vulnerability Cve 2020 1472Exploits the Zerologon vulnerability (CVE-2020-1472) in the NetlogonVotes: 0GitHub stars: 67
- Exploiting Vulnerabilities With Metasploit FrameworkUses the Metasploit Framework (msfconsole and its exploit, auxiliary,Votes: 0GitHub stars: 67
- Exploiting Type Juggling VulnerabilitiesExploits PHP type juggling vulnerabilities caused by loose (==) comparisonVotes: 0GitHub stars: 67
- Exploiting Template Injection VulnerabilitiesDetects and exploits Server-Side Template Injection (SSTI) vulnerabilitiesVotes: 0GitHub stars: 67
- Exploiting Server Side Request ForgeryIdentifying and exploiting SSRF vulnerabilities to access internal services,Votes: 0GitHub stars: 67
- Exploiting Nosql Injection VulnerabilitiesDetects and exploits NoSQL injection vulnerabilities in MongoDB, CouchDB,Votes: 0GitHub stars: 67
- Exploiting Nopac Cve 2021 42278 42287Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278Votes: 0GitHub stars: 67
- Exploiting Ms17 010 Eternalblue VulnerabilityDetects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's ms17_010_eternalblue/ms17_010_psexec modules for exploitation. Use during authorized red-team engagements or penetration tests against legacy Windows environments with unpatched SMBv1 to gain remote code execution.Votes: 0GitHub stars: 67
- Exploiting Mass Assignment In Rest ApisDiscovers and exploits mass assignment (autobinding) in REST APIs by injecting unexpected or hidden parameters (e.g. role, isAdmin, plan) into create/update requests, using Burp Suite Intruder, Arjun, and param-miner to find bindable fields on ORM-backed endpoints (Rails, Django, Laravel, Spring). Use when testing REST APIs for privilege escalation or authorization bypass via unintended parameter binding.Votes: 0GitHub stars: 67
- Exploiting Kerberoasting With ImpacketPerforms Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py to request Kerberos TGS tickets for SPN-registered service accounts, then cracks the extracted RC4/AES-encrypted hashes offline to recover service account credentials. Use during authorized Active Directory penetration tests or red-team engagements for credential access against service accounts via Kerberos ticket-granting-service requests.Votes: 0GitHub stars: 67