Security · PowerShell · For developers

Verify or select a SageMaker execution role before creating models, endpoints, or training jobs.

waybarrios/opencode-power-pack

Perform a systematic code review of all source files, focusing on security, performance, backwards compatibility, and design principles.

MichaelGrafnetter/DSInternals

Provides malware analysis and network traffic techniques for CTF challenges.

ljagiello/ctf-skills

Administer Windows Server systems. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus.

mukul975/Anthropic-Cybersecurity-Skills

Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and constrained language mode evasion using EDR telemetry (CrowdStrike, Microsoft…

mukul975/Anthropic-Cybersecurity-Skills

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing…

mukul975/Anthropic-Cybersecurity-Skills

Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft…

mukul975/Anthropic-Cybersecurity-Skills

Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

mukul975/Anthropic-Cybersecurity-Skills

Executes Atomic Red Team tests mapped to MITRE ATT&CK via Invoke-AtomicRedTeam PowerShell, generates ATT&CK Navigator coverage heatmaps, correlates results against Sigma rules, and runs detection…

mukul975/Anthropic-Cybersecurity-Skills

Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string…

mukul975/Anthropic-Cybersecurity-Skills

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques.

mukul975/Anthropic-Cybersecurity-Skills

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest…

mukul975/Anthropic-Cybersecurity-Skills

Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and…

mukul975/Anthropic-Cybersecurity-Skills

Detects WMI-based lateral movement (e.g. An agent skill from mukul975/Anthropic-Cybersecurity-Skills.

mukul975/Anthropic-Cybersecurity-Skills

AV/EDR evasion playbook for Windows. An agent skill from yaklang/hack-skills.

yaklang/hack-skills

Investigate a compromised or suspicious Windows host from on-disk artifacts -- triage collection, evidence of execution (Prefetch, Amcache, Shimcache, SRUM, UserAssist, BAM), the event-log…

trilwu/secskills

Expert knowledge for Azure Firmware Analysis development including best practices, security, integrations & coding patterns, and deployment.

MicrosoftDocs/Agent-Skills