Anthropic-Cybersecurity-Skills for Codex

Skills (200)

• abusing-dpapi-for-credential-access — Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the…
• abusing-shadow-credentials-for-privesc — Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when…
• achieving-cmmc-level-2-compliance — Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant…
• acquiring-disk-image-with-dd-and-dcfldd — Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for…
• analyzing-active-directory-acl-abuse — Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths
• analyzing-android-malware-with-apktool — Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code…
• analyzing-api-gateway-access-logs — Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating…
• analyzing-apt-group-with-mitre-navigator — Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find…
• analyzing-azure-activity-logs-for-threats — Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use…
• analyzing-bootkit-and-rootkit-samples — Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence, covering boot sector analysis, UEFI module inspection, and anti-rootkit detection. Use when compromise…
• analyzing-browser-forensics-with-hindsight — Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX…
• analyzing-campaign-attribution-evidence — Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language…
• analyzing-certificate-transparency-for-phishing — Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.
• analyzing-cloud-storage-access-patterns — Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and…
• analyzing-cobalt-strike-beacon-configuration — Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.
• analyzing-cobaltstrike-malleable-c2-profiles — Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network…
• analyzing-command-and-control-communication — Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, and infrastructure (primary servers, fallback domains, dead drops). Use after reverse engineering reveals…
• analyzing-cyber-kill-chain — Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when…
• analyzing-disk-image-with-autopsy — Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports…
• analyzing-dns-logs-for-exfiltration — Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify…
• analyzing-docker-container-forensics — Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.
• analyzing-email-headers-for-phishing-investigation — Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC results to confirm or rule out sender spoofing. Use when triaging a suspicious or reported email…
• analyzing-ethereum-smart-contract-vulnerabilities — Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to Ethereum mainnet.
• analyzing-golang-malware-with-ghidra — Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when…
• analyzing-heap-spray-exploitation — Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.
• analyzing-indicators-of-compromise
• analyzing-ios-app-security-with-objection
• analyzing-kubernetes-audit-logs
• analyzing-linux-audit-logs-for-intrusion
• analyzing-linux-elf-malware
• analyzing-linux-kernel-rootkits
• analyzing-linux-system-artifacts
• analyzing-lnk-file-and-jump-list-artifacts
• analyzing-macro-malware-in-office-documents
• analyzing-malicious-pdf-with-peepdf
• analyzing-malicious-url-with-urlscan
• analyzing-malware-behavior-with-cuckoo-sandbox
• analyzing-malware-family-relationships-with-malpedia
• analyzing-malware-persistence-with-autoruns
• analyzing-malware-sandbox-evasion-techniques
• analyzing-memory-dumps-with-volatility
• analyzing-memory-forensics-with-lime-and-volatility
• analyzing-mft-for-deleted-file-recovery
• analyzing-network-covert-channels-in-malware
• analyzing-network-flow-data-with-netflow
• analyzing-network-packets-with-scapy
• analyzing-network-traffic-for-incidents
• analyzing-network-traffic-of-malware
• analyzing-network-traffic-with-wireshark
• analyzing-office365-audit-logs-for-compromise
• analyzing-outlook-pst-for-email-forensics
• analyzing-packed-malware-with-upx-unpacker
• analyzing-pdf-malware-with-pdfid
• analyzing-persistence-mechanisms-in-linux
• analyzing-powershell-empire-artifacts
• analyzing-powershell-script-block-logging
• analyzing-prefetch-files-for-execution-history
• analyzing-ransomware-encryption-mechanisms
• analyzing-ransomware-leak-site-intelligence
• analyzing-ransomware-network-indicators
• analyzing-ransomware-payment-wallets
• analyzing-sbom-for-supply-chain-vulnerabilities
• analyzing-security-logs-with-splunk
• analyzing-slack-space-and-file-system-artifacts
• analyzing-supply-chain-malware-artifacts
• analyzing-threat-actor-ttps-with-mitre-attack
• analyzing-threat-actor-ttps-with-mitre-navigator
• analyzing-threat-intelligence-feeds
• analyzing-threat-landscape-with-misp
• analyzing-tls-certificate-transparency-logs
• analyzing-typosquatting-domains-with-dnstwist
• analyzing-uefi-bootkit-persistence
• analyzing-usb-device-connection-history
• analyzing-web-server-logs-for-intrusion
• analyzing-windows-amcache-artifacts
• analyzing-windows-event-logs-in-splunk
• analyzing-windows-lnk-files-for-artifacts
• analyzing-windows-prefetch-with-python
• analyzing-windows-registry-for-artifacts
• analyzing-windows-shellbag-artifacts
• assessing-vector-and-embedding-weaknesses
• attacking-entra-id-with-roadtools
• attacking-oauth-with-device-code-phishing
• auditing-aws-s3-bucket-permissions
• auditing-azure-active-directory-configuration
• auditing-cloud-with-cis-benchmarks
• auditing-entra-id-with-aadinternals
• auditing-foundry-smart-contract-security
• auditing-gcp-iam-permissions
• auditing-kubernetes-cluster-rbac
• auditing-kubernetes-rbac-privilege-escalation
• auditing-mcp-servers-for-tool-poisoning
• auditing-terraform-infrastructure-for-security
• auditing-tls-certificate-transparency-logs
• auditing-uefi-firmware-with-chipsec
• automating-ioc-enrichment
• benchmarking-kubernetes-with-kube-bench
• building-adversary-infrastructure-tracking-system
• building-attack-pattern-library-from-cti-reports
• building-automated-malware-submission-pipeline
• building-c2-infrastructure-with-sliver-framework
• building-c2-redirector-infrastructure
• building-cloud-siem-with-sentinel
• building-detection-rule-with-splunk-spl
• building-detection-rules-with-sigma
• building-devsecops-pipeline-with-gitlab-ci
• building-identity-federation-with-saml-azure-ad
• building-identity-governance-lifecycle-process
• building-incident-response-dashboard
• building-incident-response-playbook
• building-incident-timeline-with-timesketch
• building-ioc-defanging-and-sharing-pipeline
• building-ioc-enrichment-pipeline-with-opencti
• building-malware-incident-communication-template
• building-patch-tuesday-response-process
• building-phishing-reporting-button-workflow
• building-ransomware-playbook-with-cisa-framework
• building-red-team-c2-infrastructure-with-havoc
• building-role-mining-for-rbac-optimization
• building-soc-escalation-matrix
• building-soc-metrics-and-kpi-tracking
• building-soc-playbook-for-ransomware
• building-super-timelines-with-plaso
• building-threat-actor-profile-from-osint
• building-threat-feed-aggregation-with-misp
• building-threat-hunt-hypothesis-framework
• building-threat-intelligence-enrichment-in-splunk
• building-threat-intelligence-feed-integration
• building-threat-intelligence-platform
• building-vulnerability-aging-and-sla-tracking
• building-vulnerability-dashboard-with-defectdojo
• building-vulnerability-exception-tracking-system
• building-vulnerability-scanning-workflow
• bypassing-authentication-with-forced-browsing
• coercing-authentication-with-coercer-petitpotam
• collecting-indicators-of-compromise
• collecting-open-source-intelligence
• collecting-threat-intelligence-with-misp
• collecting-volatile-evidence-from-compromised-host
• conducting-api-security-testing
• conducting-cloud-incident-response
• conducting-cloud-penetration-testing
• conducting-cyber-risk-assessment-with-nist-800-30
• conducting-domain-persistence-with-dcsync
• conducting-external-reconnaissance-with-osint
• conducting-full-scope-red-team-engagement
• conducting-gdpr-compliance-assessment
• conducting-internal-network-penetration-test
• conducting-internal-reconnaissance-with-bloodhound-ce
• conducting-malware-incident-response
• conducting-man-in-the-middle-attack-simulation
• conducting-memory-forensics-with-volatility
• conducting-mobile-app-penetration-test
• conducting-network-penetration-test
• conducting-pass-the-ticket-attack
• conducting-phishing-incident-response
• conducting-post-incident-lessons-learned
• conducting-social-engineering-penetration-test
• conducting-social-engineering-pretext-call
• conducting-spearphishing-simulation-campaign
• conducting-wireless-network-penetration-test
• configuring-active-directory-tiered-model
• configuring-aws-verified-access-for-ztna
• configuring-certificate-authority-with-openssl
• configuring-host-based-intrusion-detection
• configuring-hsm-for-key-storage
• configuring-identity-aware-proxy-with-google-iap
• configuring-ldap-security-hardening
• configuring-microsegmentation-for-zero-trust
• configuring-multi-factor-authentication-with-duo
• configuring-network-segmentation-with-vlans
• configuring-oauth2-authorization-flow
• configuring-pfsense-firewall-rules
• configuring-snort-ids-for-intrusion-detection
• configuring-suricata-for-network-monitoring
• configuring-tls-1-3-for-secure-communications
• configuring-windows-defender-advanced-settings
• configuring-windows-event-logging-for-detection
• configuring-zscaler-private-access-for-ztna
• containing-active-breach
• continuous-llm-red-teaming-with-promptfoo
• correlating-security-events-in-qradar
• correlating-threat-campaigns
• defending-llms-with-guardrails
• deobfuscating-javascript-malware
• deobfuscating-powershell-obfuscated-malware
• deploying-active-directory-honeytokens
• deploying-cloud-deception-with-decoy-resources
• deploying-cloudflare-access-for-zero-trust
• deploying-decoy-files-for-ransomware-detection
• deploying-edr-agent-with-crowdstrike
• deploying-honeytokens-and-canarytokens
• deploying-osquery-for-endpoint-monitoring
• deploying-palo-alto-prisma-access-zero-trust
• deploying-ransomware-canary-files
• deploying-software-defined-perimeter
• deploying-tailscale-for-zero-trust-vpn
• designing-adversary-engagement-with-mitre-engage
• detecting-ai-model-prompt-injection-attacks
• detecting-anomalies-in-industrial-control-systems