Best security operations skills, page 4

Implement MITRE ATT&CK coverage mapping to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.

mukul975/Anthropic-Cybersecurity-Skills

Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens, correlating Azure…

mukul975/Anthropic-Cybersecurity-Skills

Executes Atomic Red Team tests mapped to MITRE ATT&CK via Invoke-AtomicRedTeam PowerShell, generates ATT&CK Navigator coverage heatmaps, correlates results against Sigma rules, and runs detection…

mukul975/Anthropic-Cybersecurity-Skills

Hunt for specific IOCs across your environment. An agent skill from dandye/ai-runbooks.

dandye/ai-runbooks

Kubernetes alert triage — dedup via YT search, deep control plane investigation, auto-escalation for recurring/flapping/control-plane alerts.

papadopouloskyriakos/agentic-chatops

Application security defense knowledge for builders. An agent skill from telagod/code-abyss.

telagod/code-abyss

Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity.

mukul975/Anthropic-Cybersecurity-Skills

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and…

mukul975/Anthropic-Cybersecurity-Skills

Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and…

mukul975/Anthropic-Cybersecurity-Skills

Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection.

mukul975/Anthropic-Cybersecurity-Skills

Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing.

mukul975/Anthropic-Cybersecurity-Skills

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g.

mukul975/Anthropic-Cybersecurity-Skills

Detect Kerberos Golden Ticket forgery (e.g. An agent skill from mukul975/Anthropic-Cybersecurity-Skills.

mukul975/Anthropic-Cybersecurity-Skills

Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to…

mukul975/Anthropic-Cybersecurity-Skills

Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection queries for Splunk and Elastic SIEM.

mukul975/Anthropic-Cybersecurity-Skills

Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and…

mukul975/Anthropic-Cybersecurity-Skills

Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical…

mukul975/Anthropic-Cybersecurity-Skills

Run Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and high-speed keyword/regex search, plus analyze shimcache, SRUM, and event-log…

mukul975/Anthropic-Cybersecurity-Skills

Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events.

mukul975/Anthropic-Cybersecurity-Skills

Detect data-staging activity (MITRE ATT&CK T1074) by analyzing EDR/Sysmon process-creation and file-system telemetry (Event ID 4688, Sysmon 1/11) for 7-Zip/RAR/tar archive creation, unusual temp or…

mukul975/Anthropic-Cybersecurity-Skills

Hunts for DNS-based persistence mechanisms such as DNS hijacking, dangling CNAME records enabling subdomain takeover, wildcard DNS abuse, and unauthorized zone or NS delegation changes, using…

mukul975/Anthropic-Cybersecurity-Skills

Detects process injection techniques (MITRE T1055) — including CreateRemoteThread injection, process hollowing, and DLL injection — by analyzing Sysmon Event IDs 8 (CreateRemoteThread) and 10…

mukul975/Anthropic-Cybersecurity-Skills

Detects T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, cross-referencing Autoruns entries, and running a Python watchdog script for…

mukul975/Anthropic-Cybersecurity-Skills

Detects suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event log Event ID 7045, analyzing service binary paths, and flagging indicators of persistence mechanisms…

mukul975/Anthropic-Cybersecurity-Skills

Implementing AWS CloudTrail log analysis for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration to identify unauthorized…

mukul975/Anthropic-Cybersecurity-Skills

Implements security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud…

mukul975/Anthropic-Cybersecurity-Skills

Tune SIEM detection rules in Splunk and Elastic to reduce false positives by analyzing alert volumes, creating context-aware exclusion lists, adjusting thresholds against environmental baselines…

mukul975/Anthropic-Cybersecurity-Skills

Use YARA pattern-matching rules to hunt for malware, suspicious files, and indicators of compromise across filesystems and memory dumps.

mukul975/Anthropic-Cybersecurity-Skills

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response.

aiskillstore/marketplace

Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps.

google/skills

Expert guidance for proactive threat hunting in Google SecOps.

google/skills

Expert guidance for deep security incident and entity investigations in Google SecOps.

google/skills

Expert guidance for security alert triage in Google SecOps. An agent skill from google/skills.

google/skills

Guide rapid triage and initial response to security incidents following NIST SP 800-61 methodology.

briiirussell/cybersecurity-skills

Engineer and audit SIEM detection rules — log source coverage, Sigma / KQL / SPL / Elastic query authoring, MITRE ATT&CK mapping, false-positive tuning, and detection-as-code workflows.

briiirussell/cybersecurity-skills

Build, run, and improve a Security Operations Center — alert prioritization, runbook authoring, escalation criteria, on-call structure, alert tuning workflow, MTTD / MTTR / fidelity KPIs, analyst…

briiirussell/cybersecurity-skills

Conduct proactive, hypothesis-driven threat hunts — search SIEM / EDR / logs for adversaries who haven't tripped an alert yet.

briiirussell/cybersecurity-skills

Deploys and configures Wazuh SIEM/XDR for endpoint detection, covering agent authentication and management, custom decoder and rule XML creation, alert querying via the Wazuh REST API, rule testing…

mukul975/Anthropic-Cybersecurity-Skills

蓝队与紫队工程：检测规则编写、SIEM/EDR 调优、事件响应、数字取证、威胁狩猎、ATT&CK 映射、紫队演练闭环。Use when writing Sigma/YARA detection rules, tuning SIEM noise, responding to security incidents, conducting forensic analysis, hunting…

telagod/code-abyss

Blue-team CLI threat hunt over Windows Event Logs. An agent skill from ptn1411/skill.

ptn1411/skill

Scan Linux systems for persistence mechanisms including crontab/systemd entries, LDPRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorizedkeys backdoors, then…

mukul975/Anthropic-Cybersecurity-Skills

Deploy Runtime Application Self-Protection (RASP) agents to detect and block attacks from within application runtime, covering OpenRASP integration, attack pattern detection, and security policy…

mukul975/Anthropic-Cybersecurity-Skills

Blue-team release-gate analysis for smart contract deployment and upgrade readiness.

quillai-network/quillshield_skills

Rank a SIEM or EDR alert queue before a human opens it. An agent skill from mrmps/classifier-dev.

mrmps/classifier-dev

Domain-specific: SAP Commerce, OpenSearch detection, WordPress validation, enterprise search.

notque/vexjoy-agent

Automates the end-to-end detection engineering workflow in Google SecOps using MCP tools.

google/skills

Conduct proactive, hypothesis-driven threat hunting. An agent skill from dandye/ai-runbooks.

dandye/ai-runbooks

Analyze and guide security incident response, investigation, and remediation processes.

jeremylongshore/tons-of-skills-marketplace