Best red teaming and adversary simulation skills, page 3

Hardens LDAP directory services against credential harvesting, LDAP injection, anonymous binding, and channel-binding bypass by enforcing LDAPS, channel binding, and LDAP signing.

mukul975/Anthropic-Cybersecurity-Skills

Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach.

mukul975/Anthropic-Cybersecurity-Skills

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g.

mukul975/Anthropic-Cybersecurity-Skills

Detect Kerberos Golden Ticket forgery (e.g. An agent skill from mukul975/Anthropic-Cybersecurity-Skills.

mukul975/Anthropic-Cybersecurity-Skills

Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to…

mukul975/Anthropic-Cybersecurity-Skills

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

mukul975/Anthropic-Cybersecurity-Skills

Detects domain fronting C2 traffic by analyzing SNI-vs-HTTP-Host-header mismatches in proxy logs and inspecting TLS certificate discrepancies with pyOpenSSL.

mukul975/Anthropic-Cybersecurity-Skills

Detects WMI-based lateral movement (e.g. An agent skill from mukul975/Anthropic-Cybersecurity-Skills.

mukul975/Anthropic-Cybersecurity-Skills

Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event ID 4624 logon type 3 with NTLMSSP authentication, flagging IP-to-hostname mismatches, Responder/LLMNR poisoning signatures…

mukul975/Anthropic-Cybersecurity-Skills

Hunts for MITRE ATT&CK T1098 account manipulation - shadow admin creation, SID history injection, group membership changes, and credential modifications - by analyzing Windows Security Event Log IDs…

mukul975/Anthropic-Cybersecurity-Skills

Implementing AWS CloudTrail log analysis for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration to identify unauthorized…

mukul975/Anthropic-Cybersecurity-Skills

Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.

mukul975/Anthropic-Cybersecurity-Skills

Enumerate and audit Active Directory forest trust relationships using Impacket for SID filtering analysis, trust key extraction, cross-forest SID history abuse detection, and inter-realm Kerberos…

mukul975/Anthropic-Cybersecurity-Skills

Expert guidance for deep security incident and entity investigations in Google SecOps.

google/skills

Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's…

mukul975/Anthropic-Cybersecurity-Skills

Perform Kerberoasting, a post-exploitation technique that enumerates Active Directory service accounts with Service Principal Names (SPNs), requests their Kerberos TGS tickets, and cracks the…

mukul975/Anthropic-Cybersecurity-Skills

Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts.

mukul975/Anthropic-Cybersecurity-Skills

Wireless / 802.11 attack methodology for red team engagements and wireless security assessments.

SnailSploit/Claude-Red

Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized…

mukul975/Anthropic-Cybersecurity-Skills

Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations

mukul975/Anthropic-Cybersecurity-Skills

Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation…

mukul975/Anthropic-Cybersecurity-Skills

Connects AI agents to remote Windows desktop applications on Amazon WorkSpaces Applications (AppStream 2.0) through the managed Agent Access MCP server, and guides reliable desktop automation.

aws/agent-toolkit-for-aws

A skill your agent uses when the user wants to automatically harden a guardrail, classifier, content filter, prompt, or API they own by running attack and defense together as a closed loop, not just…

gaasher/Agent-Loop-Skills

Runs the Pacu AWS exploitation framework end-to-end — session and credential setup, IAM enumeration, automated privilege-escalation scanning via iamprivescscan, and persistence/backdooring modules…

mukul975/Anthropic-Cybersecurity-Skills

Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false…

mukul975/Anthropic-Cybersecurity-Skills

Runs NVIDIA garak probe suites (jailbreak, prompt injection, data leakage, toxicity, and more) against an LLM endpoint - Hugging Face models, OpenAI-compatible APIs, or Bedrock - then interprets the…

mukul975/Anthropic-Cybersecurity-Skills

A skill your agent uses when about to take any outward or offensive action (request, payload, persistence, lateral movement, exfil, or feeding captured traffic to the model) — to decide detection…

hypnguyen1209/offensive-claude

AV/EDR evasion playbook for Windows. An agent skill from yaklang/hack-skills.

yaklang/hack-skills

Penetration test and red team report writing methodology. An agent skill from SnailSploit/Claude-Red.

SnailSploit/Claude-Red

Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity investigations.

microsoft/GitHub-Copilot-for-Azure

Catalogue of prompt framings that determine whether an agent refuses or performs specification search, and the harness for probing them.

brycewang-stanford/Auto-Empirical-Research-Skills

Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step.

transilienceai/communitytools

Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red…

mukul975/Anthropic-Cybersecurity-Skills

Residual re-identification RISK CHECK on text you have ALREADY redacted (defensive, dual-use).

glebis/claude-skills

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or…

mukul975/Anthropic-Cybersecurity-Skills

Investigate security incidents in Amazon Web Services -- reconstruct attacker activity from CloudTrail, VPC Flow Logs, and GuardDuty, anchor the investigation on the compromised principal (access…

trilwu/secskills

Investigate a compromised or suspicious Windows host from on-disk artifacts -- triage collection, evidence of execution (Prefetch, Amcache, Shimcache, SRUM, UserAssist, BAM), the event-log…

trilwu/secskills

Navigate security work by MITRE ATT&CK tactic and technique — resolve a technique ID or name to the right skill, map a threat intel report or adversary emulation plan to procedures, and run the…

trilwu/secskills

Provisions, connects, migrates, and operates Amazon RDS for Db2.

aws/agent-toolkit-for-aws

Enumerates Active Directory trust relationships and exploits them for cross-domain and cross-forest privilege escalation.

blacklanternsecurity/red-run

Read-only SLA-readiness, availability, and cost review of Amazon FSx for Windows File Server.

aws/tools-for-devops-agent

Generates Records of Processing Activities automatically from IT system inventories including Active Directory, cloud service catalogs, API gateway logs, and database schemas.

mukul975/Privacy-Data-Protection-Skills

Analyze blast radius, attack paths, and threat landscape across your AI infrastructure.

LeoYeAI/openclaw-master-skills

Investigate security incidents in Microsoft Azure (resource and subscription control plane) -- reconstruct attacker activity from the Azure Activity Log and resource/data-plane diagnostic logs…

trilwu/secskills

Guide an OpenART agent or contributor through planning, running, extending, and debugging the framework.

AI45Lab/OpenART

A skill your agent uses whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed…

jeremylongshore/tons-of-skills-marketplace

Rapid ISE endpoint investigation and quarantine workflow - endpoint lookup, auth history, posture review, human-authorized quarantine, ServiceNow Security Incident.

automateyournetwork/netclaw

Network forensics evidence collection and analysis during security incidents.

LeoYeAI/openclaw-master-skills