All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,691
- 1,321
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 20,377–20,400 of 31,691 skills
- Detecting Modbus Command Injection AttacksDetect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frames, and deviations from communication baselines using ICS-aware IDS and deep packet inspection. Use when deploying IDS for Modbus OT networks, investigating unauthorized PLC register/coil changes, or responding to FrostyGoop-style Modbus attacks.Votes: 0GitHub stars: 67
- Detecting Mobile Malware Behavior'Detects and analyzes malicious behavior in mobile applications throughVotes: 0GitHub stars: 67
- Detecting Misconfigured Azure StorageAudit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft Defender for Storage. Use for storage security audits across subscriptions, responding to Defender for Storage anonymous-access alerts, verifying compliance controls, or setting security baselines when onboarding a subscription.Votes: 0GitHub stars: 67
- Detecting Lateral Movement With SplunkDetect adversary lateral movement across networks using Splunk SPL queriesVotes: 0GitHub stars: 67
- Detecting Golden Ticket ForgeryDetect Kerberos Golden Ticket forgery (e.g. Mimikatz-forged tickets) by analyzingVotes: 0GitHub stars: 67
- Detecting Golden Ticket Attacks In Kerberos LogsDetect Golden Ticket attacks in Active Directory using Splunk and KQL queriesVotes: 0GitHub stars: 67
- Detecting Email Account CompromiseDetect compromised O365 and Google Workspace email accounts by analyzing Unified Audit Logs and Azure AD sign-in logs for impossible travel, inbox rule creation/deletion (Set-InboxRule, New-InboxRule), external mail forwarding rules, and unusual Microsoft Graph API access or OAuth token use. Use when investigating suspected business email compromise (BEC), account takeover, or mailbox persistence via malicious inbox rules.Votes: 0GitHub stars: 67
- Detecting Dll Sideloading AttacksDetect DLL side-loading and search-order hijacking (MITRE T1574) where adversaries plant malicious DLLs for legitimate signed applications to load, by analyzing Sysmon Event ID 7 DLL-load events, checking signatures/hashes against known-good versions, and flagging path anomalies with EDR tools like CrowdStrike, MDE, or SentinelOne. Use when investigating EDR alerts on unsigned DLLs, hunting for APT persistence via trojanized applications, or triaging incidents involving DLL hijacking.Votes: 0GitHub stars: 67
- Detecting Dcsync Attack In Active DirectoryDetect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions.Votes: 0GitHub stars: 67
- Detecting Credential Dumping TechniquesDetect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g. via Mimikatz) using Sysmon Event ID 10 process-access logging, Windows Security logs, and SIEM correlation rules. Use when hunting for credential-theft activity on Windows/Active Directory hosts or triaging EDR alerts on LSASS access.Votes: 0GitHub stars: 67
- Detecting Broken Object Property Level AuthorizationDetect and test for OWASP API3:2023 Broken Object Property Level AuthorizationVotes: 0GitHub stars: 67
- Detecting Azure Service Principal AbuseDetect Azure service principal abuse in Microsoft Entra ID using KQL detectionVotes: 0GitHub stars: 67
- Detecting Attacks On Historian Servers'Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GEVotes: 0GitHub stars: 67
- Detecting Api Enumeration AttacksDetect API enumeration attacks (BOLA/IDOR, OWASP API1:2023) by writing SIEMVotes: 0GitHub stars: 67
- Detecting Ai Model Prompt Injection AttacksDetects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer classification, flagging direct injections (system-prompt overrides, role-play escapes) and indirect injections (encoded payloads, obfuscation) per OWASP LLM Top 10 (LLM01:2025). Use for input validation layers in chatbots/agents/RAG pipelines, or for retrospectively classifying injection attempts in logs or incident investigations.Votes: 0GitHub stars: 67
- Deobfuscating Powershell Obfuscated MalwareSystematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or invocation tricks and you need to recover the underlying commands, dropped payloads, or C2 endpoints.Votes: 0GitHub stars: 67
- Configuring Tls 1 3 For Secure CommunicationsConfigures TLS 1.3 (RFC 8446) on servers, covering cipher suite andVotes: 0GitHub stars: 67
- Configuring Oauth2 Authorization FlowConfigures secure OAuth 2.0 authorization flows, including AuthorizationVotes: 0GitHub stars: 67
- Configuring Network Segmentation With Vlans'Designs and implements VLAN-based (802.1Q) network segmentation onVotes: 0GitHub stars: 67
- Configuring Multi Factor Authentication With DuoDeploys Cisco Duo multi-factor authentication across enterprise applications,Votes: 0GitHub stars: 67
- Configuring Ldap Security HardeningHardens LDAP directory services against credential harvesting, LDAPVotes: 0GitHub stars: 67
- Configuring Identity Aware Proxy With Google Iap'Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforceVotes: 0GitHub stars: 67
- Configuring Hsm For Key StorageConfigures Hardware Security Modules for cryptographic key storageVotes: 0GitHub stars: 67
- Configuring Certificate Authority With OpensslBuild a two-tier PKI Certificate Authority hierarchy (offline Root CAVotes: 0GitHub stars: 67