@pilllesss/yorn 1.0.188 → 1.0.190

package/dist/skills/anthropic-cybersecurity-skills/README.md

@@ -1,1079 +1,12 @@
----
-name: anthropic-cybersecurity-skills
-description: |
-  Master directory and knowledge hub of 818 production-grade cybersecurity skills across 34 security domains.
-  Covers Cloud Security (AWS/Azure/GCP), Threat Hunting, Incident Response, DFIR, Malware Analysis,
-  Reverse Engineering, SOC Operations, IAM, API Security, Container/K8s Security, Web/Network Security,
-  Red Teaming, Cryptography, and AI/LLM Security.
-  Mapped to MITRE ATT&CK v19.1, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF, and MITRE F3.
-  Use when: investigating incidents, performing memory/disk forensics, analyzing malware, auditing cloud IAM,
-  hardening Kubernetes/Docker, threat hunting in EVTX/Zeek/Splunk logs, testing APIs/WAFs, reviewing cryptographic
-  protocols, or securing AI/LLM pipelines.
----
-
 # Anthropic Cybersecurity Skills Hub
 
-A structured repository of **818 production-grade cybersecurity skills** spanning **34 security domains**, aligned with the open agentskills.io standard and mapped across 6 industry frameworks (MITRE ATT&CK v19.1, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and MITRE F3).
-
-## How AI Agents Should Use This Skill
-
-1. **Locate the relevant domain & skill** from the domain catalog below or search the sub-folders inside this directory.
-2. **Open the specific sub-skill** using the `read` tool:
-   - File path: `<this_directory>/<skill-name>/SKILL.md`
-   - References & Standards: `<this_directory>/<skill-name>/references/standards.md`
-   - Workflows & Step-by-step: `<this_directory>/<skill-name>/references/workflows.md`
-   - Working Scripts: `<this_directory>/<skill-name>/scripts/`
-3. **Execute the verified practitioner workflow** step-by-step as prescribed in that sub-skill.
-
----
-
-## 34 Security Domains & Skill Index
-
-### AI SECURITY (14 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `assessing-vector-and-embedding-weaknesses` | `assessing-vector-and-embedding-weaknesses/SKILL.md` | Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector, FAISS) for embedding inversion, cross-tenant da... |
-| `auditing-mcp-servers-for-tool-poisoning` | `auditing-mcp-servers-for-tool-poisoning/SKILL.md` | Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant L... |
-| `continuous-llm-red-teaming-with-promptfoo` | `continuous-llm-red-teaming-with-promptfoo/SKILL.md` | Wires Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, O... |
-| `defending-llms-with-guardrails` | `defending-llms-with-guardrails/SKILL.md` | Deploys Llama Guard 3 safety classification, NeMo Guardrails programmable dialogue rails, and LLM Guard input/output ... |
-| `detecting-ai-model-prompt-injection-attacks` | `detecting-ai-model-prompt-injection-attacks/SKILL.md` | Detects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-base... |
-| `detecting-data-and-model-poisoning` | `detecting-data-and-model-poisoning/SKILL.md` | Identify poisoned training data and backdoored ML models across the pipeline using IBM's Adversarial Robustness Toolb... |
-| `detecting-indirect-prompt-injection` | `detecting-indirect-prompt-injection/SKILL.md` | Detect and defend against indirect prompt injection hidden in web pages, documents, and images consumed by an agent, ... |
-| `detecting-model-extraction-attacks` | `detecting-model-extraction-attacks/SKILL.md` | Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API ab... |
-| `implementing-llm-guardrails-for-security` | `implementing-llm-guardrails-for-security/SKILL.md` | 'Implements input/output validation guardrails for LLM applications using NVIDIA NeMo Guardrails (Colang), custom Pyt... |
-| `orchestrating-llm-attacks-with-pyrit` | `orchestrating-llm-attacks-with-pyrit/SKILL.md` | Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingO... |
-| `red-teaming-llms-with-garak` | `red-teaming-llms-with-garak/SKILL.md` | Runs NVIDIA garak probe suites (jailbreak, prompt injection, data leakage, toxicity, and more) against an LLM endpoin... |
-| `securing-agentic-ai-tool-invocation` | `securing-agentic-ai-tool-invocation/SKILL.md` | Implements defense-in-depth controls at an AI agent's tool-invocation boundary using tool allowlisting, least-privile... |
-| `testing-for-system-prompt-leakage` | `testing-for-system-prompt-leakage/SKILL.md` | Extracts LLM system prompts using direct requests, jailbreak/instruction-override framing, translation/encoding trick... |
-| `testing-prompt-injection-in-rag-pipelines` | `testing-prompt-injection-in-rag-pipelines/SKILL.md` | Probes Retrieval-Augmented Generation pipelines for indirect prompt injection via poisoned retrieved documents and em... |
-
-### API SECURITY (28 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `detecting-api-enumeration-attacks` | `detecting-api-enumeration-attacks/SKILL.md` | Detect API enumeration attacks (BOLA/IDOR, OWASP API1:2023) by writing SIEM detection rules that flag sequential or U... |
-| `detecting-broken-object-property-level-authorization` | `detecting-broken-object-property-level-authorization/SKILL.md` | Detect and test for OWASP API3:2023 Broken Object Property Level Authorization (BOPLA), covering excessive data expos... |
-| `detecting-shadow-api-endpoints` | `detecting-shadow-api-endpoints/SKILL.md` | Discover and inventory shadow API endpoints that operate outside documented OpenAPI/Swagger specs, using traffic anal... |
-| `exploiting-api-injection-vulnerabilities` | `exploiting-api-injection-vulnerabilities/SKILL.md` | Tests API parameters, headers, and request bodies for injection flaws — SQL injection, NoSQL injection, OS command in... |
-| `exploiting-broken-function-level-authorization` | `exploiting-broken-function-level-authorization/SKILL.md` | Tests APIs for Broken Function Level Authorization (OWASP API5:2023) by identifying admin and privileged endpoints, t... |
-| `exploiting-excessive-data-exposure-in-api` | `exploiting-excessive-data-exposure-in-api/SKILL.md` | Tests APIs for excessive data exposure (OWASP API3:2023) by intercepting raw API responses and comparing them against... |
-| `exploiting-jwt-algorithm-confusion-attack` | `exploiting-jwt-algorithm-confusion-attack/SKILL.md` | Exploits JWT algorithm confusion where the server's verification library trusts the alg named in the token header, by... |
-| `implementing-api-abuse-detection-with-rate-limiting` | `implementing-api-abuse-detection-with-rate-limiting/SKILL.md` | Implements API abuse detection using token bucket, sliding window, and fixed window rate-limiting algorithms backed b... |
-| `implementing-api-gateway-security-controls` | `implementing-api-gateway-security-controls/SKILL.md` | 'Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement p... |
-| `implementing-api-key-security-controls` | `implementing-api-key-security-controls/SKILL.md` | 'Implements secure API key generation with sufficient entropy, server-side hashing (SHA-256/bcrypt) instead of plaint... |
-| `implementing-api-rate-limiting-and-throttling` | `implementing-api-rate-limiting-and-throttling/SKILL.md` | 'Implements API rate limiting and throttling with token bucket, sliding window, and fixed window algorithms, configur... |
-| `implementing-api-schema-validation-security` | `implementing-api-schema-validation-security/SKILL.md` | Implements API schema validation using OpenAPI Specification and JSON Schema documents, enforced both at the API gate... |
-| `implementing-api-security-posture-management` | `implementing-api-security-posture-management/SKILL.md` | Implements API Security Posture Management (API-SPM) to continuously discover, classify, and risk-score APIs -- inclu... |
-| `implementing-api-security-testing-with-42crunch` | `implementing-api-security-testing-with-42crunch/SKILL.md` | Implements API security testing on the 42Crunch platform, combining API Audit for static analysis of OpenAPI definiti... |
-| `implementing-api-threat-protection-with-apigee` | `implementing-api-threat-protection-with-apigee/SKILL.md` | Implements API threat protection using Google Apigee reverse-proxy policies, including JSON/XML threat protection, OA... |
-| `performing-api-fuzzing-with-restler` | `performing-api-fuzzing-with-restler/SKILL.md` | 'Uses Microsoft RESTler to perform stateful REST API fuzzing: compiles an OpenAPI/Swagger spec into a RESTler grammar... |
-| `performing-api-inventory-and-discovery` | `performing-api-inventory-and-discovery/SKILL.md` | 'Performs API inventory and discovery to identify all API endpoints in an organization''s environment including docum... |
-| `performing-api-rate-limiting-bypass` | `performing-api-rate-limiting-bypass/SKILL.md` | 'Tests API rate limiting for bypass vulnerabilities using Python (requests/aiohttp) and Burp Suite Turbo Intruder to ... |
-| `performing-api-security-testing-with-postman` | `performing-api-security-testing-with-postman/SKILL.md` | 'Uses Postman to build structured API security test collections covering the OWASP API Security Top 10—authentication... |
-| `performing-graphql-depth-limit-attack` | `performing-graphql-depth-limit-attack/SKILL.md` | Execute and test GraphQL depth limit attacks using deeply nested recursive queries to identify denial-of-service vuln... |
-| `performing-graphql-introspection-attack` | `performing-graphql-introspection-attack/SKILL.md` | 'Performs GraphQL introspection attacks that extract the full API schema (types, queries, mutations, subscriptions, f... |
-| `performing-jwt-none-algorithm-attack` | `performing-jwt-none-algorithm-attack/SKILL.md` | Execute and test the JWT none algorithm attack, crafting tokens with the alg header set to none using PyJWT and an in... |
-| `performing-soap-web-service-security-testing` | `performing-soap-web-service-security-testing/SKILL.md` | Performs security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE, WS-S... |
-| `testing-api-authentication-weaknesses` | `testing-api-authentication-weaknesses/SKILL.md` | 'Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endp... |
-| `testing-api-for-broken-object-level-authorization` | `testing-api-for-broken-object-level-authorization/SKILL.md` | 'Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR, OWASP API1:2023) by intercepting API c... |
-| `testing-api-for-mass-assignment-vulnerability` | `testing-api-for-mass-assignment-vulnerability/SKILL.md` | 'Tests APIs for mass assignment (auto-binding), OWASP API3:2023, by identifying writable endpoints, adding undocument... |
-| `testing-oauth2-implementation-flaws` | `testing-oauth2-implementation-flaws/SKILL.md` | Tests OAuth 2.0 and OpenID Connect implementations for authorization code interception, redirect URI manipulation, CS... |
-| `testing-websocket-api-security` | `testing-websocket-api-security/SKILL.md` | Tests WebSocket API implementations for missing upgrade-handshake authentication, Cross-Site WebSocket Hijacking (CSW... |
-
-### APPLICATION SECURITY (4 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `implementing-devsecops-security-scanning` | `implementing-devsecops-security-scanning/SKILL.md` | 'Integrates SAST, DAST, and SCA into CI/CD pipelines using Semgrep for SAST, Trivy for SCA and container scanning, OW... |
-| `implementing-runtime-application-self-protection` | `implementing-runtime-application-self-protection/SKILL.md` | Deploy Runtime Application Self-Protection (RASP) agents to detect and block attacks from within application runtime,... |
-| `performing-fuzzing-with-aflplusplus` | `performing-fuzzing-with-aflplusplus/SKILL.md` | 'Performs coverage-guided fuzzing of compiled binaries with AFL++, instrumenting targets via afl-cc/afl-clang-fast, m... |
-| `performing-supply-chain-attack-simulation` | `performing-supply-chain-attack-simulation/SKILL.md` | Simulates and detects software supply chain attacks: typosquatting detection via Levenshtein distance against popular... |
-
-### BLOCKCHAIN SECURITY (2 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-ethereum-smart-contract-vulnerabilities` | `analyzing-ethereum-smart-contract-vulnerabilities/SKILL.md` | Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, inte... |
-| `auditing-foundry-smart-contract-security` | `auditing-foundry-smart-contract-security/SKILL.md` | Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Ad... |
-
-### CLOUD SECURITY (66 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-cloud-storage-access-patterns` | `analyzing-cloud-storage-access-patterns/SKILL.md` | Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, an... |
-| `analyzing-office365-audit-logs-for-compromise` | `analyzing-office365-audit-logs-for-compromise/SKILL.md` | Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegatio... |
-| `auditing-aws-s3-bucket-permissions` | `auditing-aws-s3-bucket-permissions/SKILL.md` | 'Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misc... |
-| `auditing-azure-active-directory-configuration` | `auditing-azure-active-directory-configuration/SKILL.md` | 'Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly... |
-| `auditing-cloud-with-cis-benchmarks` | `auditing-cloud-with-cis-benchmarks/SKILL.md` | Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools l... |
-| `auditing-gcp-iam-permissions` | `auditing-gcp-iam-permissions/SKILL.md` | 'Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service... |
-| `auditing-kubernetes-cluster-rbac` | `auditing-kubernetes-cluster-rbac/SKILL.md` | 'Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous... |
-| `auditing-terraform-infrastructure-for-security` | `auditing-terraform-infrastructure-for-security/SKILL.md` | 'Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Re... |
-| `building-cloud-siem-with-sentinel` | `building-cloud-siem-with-sentinel/SKILL.md` | Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), w... |
-| `conducting-cloud-penetration-testing` | `conducting-cloud-penetration-testing/SKILL.md` | 'This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud en... |
-| `detecting-aws-cloudtrail-anomalies` | `detecting-aws-cloudtrail-anomalies/SKILL.md` | Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis ... |
-| `detecting-aws-credential-exposure-with-trufflehog` | `detecting-aws-credential-exposure-with-trufflehog/SKILL.md` | 'Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog... |
-| `detecting-aws-guardduty-findings-automation` | `detecting-aws-guardduty-findings-automation/SKILL.md` | Build automated AWS GuardDuty finding response pipelines using EventBridge and Lambda to trigger real-time incident r... |
-| `detecting-aws-iam-privilege-escalation` | `detecting-aws-iam-privilege-escalation/SKILL.md` | Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissiv... |
-| `detecting-azure-lateral-movement` | `detecting-azure-lateral-movement/SKILL.md` | Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hu... |
-| `detecting-azure-service-principal-abuse` | `detecting-azure-service-principal-abuse/SKILL.md` | Detect Azure service principal abuse in Microsoft Entra ID using KQL detection queries (Sentinel/Splunk) against Azur... |
-| `detecting-azure-storage-account-misconfigurations` | `detecting-azure-storage-account-misconfigurations/SKILL.md` | Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encrypt... |
-| `detecting-cloud-threats-with-guardduty` | `detecting-cloud-threats-with-guardduty/SKILL.md` | 'Deploy and operationalize Amazon GuardDuty, covering protection plans for S3, EKS, EC2 runtime monitoring, and Lambd... |
-| `detecting-compromised-cloud-credentials` | `detecting-compromised-cloud-credentials/SKILL.md` | 'Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-trav... |
-| `detecting-cryptomining-in-cloud` | `detecting-cryptomining-in-cloud/SKILL.md` | 'This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in clou... |
-| `detecting-misconfigured-azure-storage` | `detecting-misconfigured-azure-storage/SKILL.md` | Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled l... |
-| `detecting-oauth-token-theft` | `detecting-oauth-token-theft/SKILL.md` | Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, ref... |
-| `detecting-s3-data-exfiltration-attempts` | `detecting-s3-data-exfiltration-attempts/SKILL.md` | 'Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, Guar... |
-| `detecting-serverless-function-injection` | `detecting-serverless-function-injection/SKILL.md` | 'Detects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Clou... |
-| `detecting-shadow-it-cloud-usage` | `detecting-shadow-it-cloud-usage/SKILL.md` | Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing proxy access logs, DNS query logs, and firewa... |
-| `detecting-suspicious-oauth-application-consent` | `detecting-suspicious-oauth-application-consent/SKILL.md` | Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs,... |
-| `emulating-cloud-attacks-with-stratus-red-team` | `emulating-cloud-attacks-with-stratus-red-team/SKILL.md` | Install and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped AWS, Azure, GCP, and Kubernetes attack tec... |
-| `enumerating-cloud-with-cloudfox` | `enumerating-cloud-with-cloudfox/SKILL.md` | Run CloudFox's read-only Describe/List/Get enumeration (all-checks, role-trusts, secrets, endpoints, and permissions ... |
-| `exploiting-aws-with-pacu` | `exploiting-aws-with-pacu/SKILL.md` | Runs the Pacu AWS exploitation framework end-to-end — session and credential setup, IAM enumeration, automated privil... |
-| `implementing-aws-config-rules-for-compliance` | `implementing-aws-config-rules-for-compliance/SKILL.md` | 'Implements AWS Config managed and custom rules for continuous compliance monitoring of AWS resources aligned to CIS ... |
-| `implementing-aws-macie-for-data-classification` | `implementing-aws-macie-for-data-classification/SKILL.md` | Enable and configure Amazon Macie via AWS CLI/Terraform to discover, classify, and protect sensitive data (PII, finan... |
-| `implementing-aws-nitro-enclave-security` | `implementing-aws-nitro-enclave-security/SKILL.md` | 'Build AWS Nitro Enclave confidential computing environments using nitro-cli to create enclave images, configure atte... |
-| `implementing-aws-security-hub` | `implementing-aws-security-hub/SKILL.md` | 'Deploy AWS Security Hub as a centralized CSPM platform, backed by AWS Config, aggregating findings from GuardDuty, I... |
-| `implementing-aws-security-hub-compliance` | `implementing-aws-security-hub-compliance/SKILL.md` | 'Deploy AWS Security Hub, backed by AWS Config, to aggregate findings from GuardDuty, Inspector, Macie, Firewall Mana... |
-| `implementing-azure-defender-for-cloud` | `implementing-azure-defender-for-cloud/SKILL.md` | 'Enable Microsoft Defender for Cloud (CSPM + CWPP) across VMs, containers, SQL, storage, and Key Vault, using Azure P... |
-| `implementing-cloud-dlp-for-data-protection` | `implementing-cloud-dlp-for-data-protection/SKILL.md` | 'Implement cloud DLP using Amazon Macie, Google Cloud DLP API, Microsoft Purview, Azure Information Protection, and N... |
-| `implementing-cloud-security-posture-management` | `implementing-cloud-security-posture-management/SKILL.md` | 'Continuously monitor multi-cloud environments (AWS, Azure, GCP) for misconfigurations, compliance violations, and se... |
-| `implementing-cloud-trail-log-analysis` | `implementing-cloud-trail-log-analysis/SKILL.md` | 'Implementing AWS CloudTrail log analysis for security monitoring, threat detection, and forensic investigation using... |
-| `implementing-cloud-waf-rules` | `implementing-cloud-waf-rules/SKILL.md` | 'Deploys and tunes Web Application Firewall rules on AWS WAF, Azure WAF, and Cloudflare, covering managed rule sets, ... |
-| `implementing-cloud-workload-protection` | `implementing-cloud-workload-protection/SKILL.md` | 'Implements cloud workload protection using boto3 and google-cloud APIs for runtime security monitoring, process anom... |
-| `implementing-gcp-binary-authorization` | `implementing-gcp-binary-authorization/SKILL.md` | Implements GCP Binary Authorization end to end, including creating KMS-backed attestors, Container Analysis notes, de... |
-| `implementing-gcp-organization-policy-constraints` | `implementing-gcp-organization-policy-constraints/SKILL.md` | Implements GCP Organization Policy constraints via gcloud and Terraform, such as restricting external IPs, resource l... |
-| `implementing-gcp-vpc-firewall-rules` | `implementing-gcp-vpc-firewall-rules/SKILL.md` | Implements and audits GCP VPC firewall rules using gcloud, covering auditing overly permissive rules, creating restri... |
-| `implementing-secrets-management-with-vault` | `implementing-secrets-management-with-vault/SKILL.md` | 'Deploy HashiCorp Vault for centralized secrets management, covering dynamic secret generation for databases and clou... |
-| `implementing-zero-trust-in-cloud` | `implementing-zero-trust-in-cloud/SKILL.md` | Guides zero trust implementation across AWS, Azure, and GCP per NIST SP 800-207 and BeyondCorp principles, covering i... |
-| `implementing-zero-trust-network-access` | `implementing-zero-trust-network-access/SKILL.md` | Configures Zero Trust Network Access (ZTNA) in AWS, Azure, and GCP using identity-aware proxies, micro-segmentation, ... |
-| `managing-cloud-identity-with-okta` | `managing-cloud-identity-with-okta/SKILL.md` | Implement Okta as a centralized cloud identity provider: configure SSO with AWS, Azure, and GCP, deploy phishing-resi... |
-| `performing-aws-account-enumeration-with-scout-suite` | `performing-aws-account-enumeration-with-scout-suite/SKILL.md` | Run the agentless, open-source ScoutSuite tool (via pip install and the `scout` CLI) against an AWS account to enumer... |
-| `performing-aws-privilege-escalation-assessment` | `performing-aws-privilege-escalation-assessment/SKILL.md` | 'Performing authorized privilege escalation assessments in AWS environments to identify IAM misconfigurations that al... |
-| `performing-cloud-asset-inventory-with-cartography` | `performing-cloud-asset-inventory-with-cartography/SKILL.md` | Run Cartography to sync AWS, GCP, or Azure resources into a Neo4j graph database, mapping relationships such as IAM p... |
-| `performing-cloud-forensics-with-aws-cloudtrail` | `performing-cloud-forensics-with-aws-cloudtrail/SKILL.md` | Investigate AWS account compromise by querying CloudTrail with boto3's LookupEvents or AWS Athena SQL over S3-deliver... |
-| `performing-cloud-log-forensics-with-athena` | `performing-cloud-log-forensics-with-athena/SKILL.md` | 'Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs for forensic investigation. Covers ... |
-| `performing-cloud-native-forensics-with-falco` | `performing-cloud-native-forensics-with-falco/SKILL.md` | 'Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawn... |
-| `performing-cloud-native-threat-hunting-with-aws-detective` | `performing-cloud-native-threat-hunting-with-aws-detective/SKILL.md` | Investigate AWS security incidents using Amazon Detective's behavior graphs, built from CloudTrail, VPC Flow Logs, Gu... |
-| `performing-cloud-penetration-testing-with-pacu` | `performing-cloud-penetration-testing-with-pacu/SKILL.md` | 'Run authorized AWS penetration tests with Pacu, the open-source AWS exploitation framework, to enumerate IAM configu... |
-| `performing-gcp-penetration-testing-with-gcpbucketbrute` | `performing-gcp-penetration-testing-with-gcpbucketbrute/SKILL.md` | Performs authorized GCP security testing using GCPBucketBrute to enumerate publicly accessible storage buckets, combi... |
-| `performing-gcp-security-assessment-with-forseti` | `performing-gcp-security-assessment-with-forseti/SKILL.md` | 'Performing comprehensive security assessments of Google Cloud Platform environments using Forseti Security, Security... |
-| `performing-serverless-function-security-review` | `performing-serverless-function-security-review/SKILL.md` | 'Performing security reviews of serverless functions across AWS Lambda, Azure Functions, and GCP Cloud Functions to i... |
-| `remediating-s3-bucket-misconfiguration` | `remediating-s3-bucket-misconfiguration/SKILL.md` | 'Provides step-by-step procedures for remediating Amazon S3 bucket misconfigurations that expose sensitive data: enab... |
-| `securing-api-gateway-with-aws-waf` | `securing-api-gateway-with-aws-waf/SKILL.md` | 'Secures AWS API Gateway endpoints with AWS WAF by configuring managed rule groups for OWASP Top 10 protection, custo... |
-| `securing-aws-iam-permissions` | `securing-aws-iam-permissions/SKILL.md` | 'Hardens AWS IAM configurations to enforce least-privilege access, covering IAM policy scoping, permission boundaries... |
-| `securing-aws-lambda-execution-roles` | `securing-aws-lambda-execution-roles/SKILL.md` | 'Hardens AWS Lambda execution roles by writing least-privilege IAM policies, applying permission boundaries, restrict... |
-| `securing-azure-with-microsoft-defender` | `securing-azure-with-microsoft-defender/SKILL.md` | 'Deploys and configures Microsoft Defender for Cloud as a CNAPP for Azure, multi-cloud, and hybrid environments: enab... |
-| `securing-container-registry-images` | `securing-container-registry-images/SKILL.md` | 'Secures container registry images (ECR, ACR, GCR, Docker Hub) by scanning with Trivy and Grype, signing with Cosign ... |
-| `securing-kubernetes-on-cloud` | `securing-kubernetes-on-cloud/SKILL.md` | 'Hardens managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, w... |
-| `securing-serverless-functions` | `securing-serverless-functions/SKILL.md` | 'Hardens serverless compute platforms (AWS Lambda, Azure Functions, Google Cloud Functions): least-privilege IAM role... |
-
-### COMPLIANCE GOVERNANCE (10 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `achieving-cmmc-level-2-compliance` | `achieving-cmmc-level-2-compliance/SKILL.md` | Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP... |
-| `conducting-cyber-risk-assessment-with-nist-800-30` | `conducting-cyber-risk-assessment-with-nist-800-30/SKILL.md` | Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a ri... |
-| `conducting-gdpr-compliance-assessment` | `conducting-gdpr-compliance-assessment/SKILL.md` | Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016... |
-| `executing-nist-rmf-authorization-to-operate` | `executing-nist-rmf-authorization-to-operate/SKILL.md` | Drive a federal system through the NIST Risk Management Framework (SP 800-37 Rev 2) to an Authorization to Operate (A... |
-| `implementing-gdpr-data-protection-controls` | `implementing-gdpr-data-protection-controls/SKILL.md` | Implements GDPR (EU 2016/679) technical and organizational measures — privacy by design/default, DPIAs, data subject ... |
-| `implementing-hipaa-security-rule-safeguards` | `implementing-hipaa-security-rule-safeguards/SKILL.md` | Implement the HIPAA Security Rule (45 CFR Part 164 Subpart C) to protect electronic protected health information (ePH... |
-| `implementing-iso-27001-information-security-management` | `implementing-iso-27001-information-security-management/SKILL.md` | Guides implementation of an ISO/IEC 27001:2022 Information Security Management System (ISMS) end to end: gap analysis... |
-| `implementing-pci-dss-compliance-controls` | `implementing-pci-dss-compliance-controls/SKILL.md` | Implements PCI DSS 4.0.1's 12 requirements across 6 control objectives for organizations that store, process, or tran... |
-| `managing-third-party-vendor-risk` | `managing-third-party-vendor-risk/SKILL.md` | Build and run a third-party/vendor risk management (TPRM) program aligned to NIST SP 800-161 C-SCRM: inventory and ti... |
-| `performing-nist-csf-maturity-assessment` | `performing-nist-csf-maturity-assessment/SKILL.md` | Conduct a NIST Cybersecurity Framework (CSF) 2.0 maturity assessment across the six core Functions (Govern, Identify,... |
-
-### CONTAINER SECURITY (33 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-kubernetes-audit-logs` | `analyzing-kubernetes-audit-logs/SKILL.md` | Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, priv... |
-| `auditing-kubernetes-rbac-privilege-escalation` | `auditing-kubernetes-rbac-privilege-escalation/SKILL.md` | Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can... |
-| `benchmarking-kubernetes-with-kube-bench` | `benchmarking-kubernetes-with-kube-bench/SKILL.md` | Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecti... |
-| `detecting-container-drift-at-runtime` | `detecting-container-drift-at-runtime/SKILL.md` | Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuratio... |
-| `detecting-container-escape-attempts` | `detecting-container-escape-attempts/SKILL.md` | Detects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensi... |
-| `detecting-container-escape-with-falco-rules` | `detecting-container-escape-with-falco-rules/SKILL.md` | Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output... |
-| `detecting-container-runtime-threats-with-falco` | `detecting-container-runtime-threats-with-falco/SKILL.md` | Deploys and operates Falco with the modern eBPF driver in Kubernetes and Docker, covering driver selection, Helm inst... |
-| `detecting-privilege-escalation-in-kubernetes-pods` | `detecting-privilege-escalation-in-kubernetes-pods/SKILL.md` | Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runti... |
-| `escaping-containers-to-host` | `escaping-containers-to-host/SKILL.md` | Exploits privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach th... |
-| `hardening-docker-containers-for-production` | `hardening-docker-containers-for-production/SKILL.md` | Hardens Dockerfiles, images, and per-container runtime settings against the CIS Docker Benchmark v1.8.0: non-root use... |
-| `hardening-docker-daemon-configuration` | `hardening-docker-daemon-configuration/SKILL.md` | Hardens the Docker daemon (dockerd) through /etc/docker/daemon.json with user namespace remapping, TLS client authent... |
-| `implementing-container-image-minimal-base-with-distroless` | `implementing-container-image-minimal-base-with-distroless/SKILL.md` | Reduces container attack surface by building application images on Google distroless base images that ship only the a... |
-| `implementing-container-network-policies-with-calico` | `implementing-container-network-policies-with-calico/SKILL.md` | Uses Calico's own policy CRDs beyond the upstream Kubernetes API - GlobalNetworkPolicy, HostEndpoint, NetworkSet, pol... |
-| `implementing-image-provenance-verification-with-cosign` | `implementing-image-provenance-verification-with-cosign/SKILL.md` | Signs and verifies container image provenance with Sigstore Cosign, covering key-based and keyless OIDC signing (Fulc... |
-| `implementing-kubernetes-network-policy-with-calico` | `implementing-kubernetes-network-policy-with-calico/SKILL.md` | Installs Calico as the cluster CNI and writes standard Kubernetes NetworkPolicy under it, covering default-deny basel... |
-| `implementing-kubernetes-pod-security-standards` | `implementing-kubernetes-pod-security-standards/SKILL.md` | Chooses and applies the correct Kubernetes Pod Security Standard (Privileged, Baseline, Restricted) for a workload: w... |
-| `implementing-network-policies-for-kubernetes` | `implementing-network-policies-for-kubernetes/SKILL.md` | Writes portable upstream Kubernetes NetworkPolicy YAML - default-deny-all, DNS egress, namespace and pod selector rul... |
-| `implementing-opa-gatekeeper-for-policy-enforcement` | `implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md` | Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes ConstraintTemplates with Rego plus in... |
-| `implementing-pod-security-admission-controller` | `implementing-pod-security-admission-controller/SKILL.md` | Configures and operates the Kubernetes Pod Security Admission (PSA) controller that enforces Pod Security Standards: ... |
-| `implementing-rbac-hardening-for-kubernetes` | `implementing-rbac-hardening-for-kubernetes/SKILL.md` | Hardens Kubernetes RBAC by designing least-privilege Roles and ClusterRoles, auditing RoleBindings, eliminating clust... |
-| `implementing-runtime-security-with-tetragon` | `implementing-runtime-security-with-tetragon/SKILL.md` | Implements eBPF-based runtime observability and in-kernel enforcement in Kubernetes with Cilium Tetragon, monitoring ... |
-| `implementing-supply-chain-security-with-in-toto` | `implementing-supply-chain-security-with-in-toto/SKILL.md` | Implements supply chain integrity verification for container builds with the in-toto framework: generating signing ke... |
-| `performing-container-escape-detection` | `performing-container-escape-detection/SKILL.md` | Audits container and pod configuration for escape-enabling misconfiguration using the Kubernetes Python client - priv... |
-| `performing-container-security-scanning-with-trivy` | `performing-container-security-scanning-with-trivy/SKILL.md` | Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clu... |
-| `performing-docker-bench-security-assessment` | `performing-docker-bench-security-assessment/SKILL.md` | Runs Docker Bench for Security, the open-source CIS Docker Benchmark audit script, across host configuration, daemon ... |
-| `performing-kubernetes-cis-benchmark-with-kube-bench` | `performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md` | Turns kube-bench output into a finished CIS Kubernetes Benchmark audit: interpreting PASS/FAIL/WARN per control, judg... |
-| `performing-kubernetes-etcd-security-assessment` | `performing-kubernetes-etcd-security-assessment/SKILL.md` | Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transpo... |
-| `performing-kubernetes-penetration-testing` | `performing-kubernetes-penetration-testing/SKILL.md` | Evaluates Kubernetes cluster security by actively simulating attacker techniques against the API server, kubelet, etc... |
-| `scanning-container-images-with-grype` | `scanning-container-images-with-grype/SKILL.md` | Scans container images, filesystems, and SBOMs for known CVEs with Anchore Grype, matching Syft-generated SBOM packag... |
-| `scanning-docker-images-with-trivy` | `scanning-docker-images-with-trivy/SKILL.md` | Scans a Docker image with Trivy for vulnerabilities in OS packages and language dependencies, misconfiguration, expos... |
-| `scanning-kubernetes-manifests-with-kubesec` | `scanning-kubernetes-manifests-with-kubesec/SKILL.md` | Scores Kubernetes resource manifests with Kubesec to flag misconfiguration and privilege-escalation risk before deplo... |
-| `securing-container-registry-with-harbor` | `securing-container-registry-with-harbor/SKILL.md` | Configures the security features of the Harbor open-source container registry - integrated Trivy scanning, Cosign and... |
-| `securing-helm-chart-deployments` | `securing-helm-chart-deployments/SKILL.md` | Secures Helm chart deployments by verifying chart signatures and provenance, rendering and linting templates for misc... |
-
-### CRYPTOGRAPHY (16 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `configuring-certificate-authority-with-openssl` | `configuring-certificate-authority-with-openssl/SKILL.md` | Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and... |
-| `configuring-hsm-for-key-storage` | `configuring-hsm-for-key-storage/SKILL.md` | Configures Hardware Security Modules for cryptographic key storage using the PKCS#11 standard interface, covering key... |
-| `configuring-tls-1-3-for-secure-communications` | `configuring-tls-1-3-for-secure-communications/SKILL.md` | Configures TLS 1.3 (RFC 8446) on servers, covering cipher suite and key-exchange group selection, and validates the r... |
-| `implementing-aes-encryption-for-data-at-rest` | `implementing-aes-encryption-for-data-at-rest/SKILL.md` | Guides implementing AES-256 encryption in GCM mode (FIPS 197) for files and data stores at rest, covering key derivat... |
-| `implementing-digital-signatures-with-ed25519` | `implementing-digital-signatures-with-ed25519/SKILL.md` | Implements digital signatures using the Ed25519 algorithm (Curve25519), covering key-pair generation, signing, signat... |
-| `implementing-end-to-end-encryption-for-messaging` | `implementing-end-to-end-encryption-for-messaging/SKILL.md` | Implements a simplified Signal Protocol-style end-to-end encryption scheme for messaging, covering key exchange, forw... |
-| `implementing-envelope-encryption-with-aws-kms` | `implementing-envelope-encryption-with-aws-kms/SKILL.md` | Implements envelope encryption with AWS KMS, encrypting data locally with a data encryption key (DEK) and protecting ... |
-| `implementing-jwt-signing-and-verification` | `implementing-jwt-signing-and-verification/SKILL.md` | Implements secure JWT (RFC 7519) signing and verification using HMAC-SHA256, RSA-PSS, ES256, and EdDSA, including tok... |
-| `implementing-rsa-key-pair-management` | `implementing-rsa-key-pair-management/SKILL.md` | Generates, stores, rotates, and manages RSA key pairs following NIST SP 800-57 guidelines, covering serialization for... |
-| `implementing-zero-knowledge-proof-for-authentication` | `implementing-zero-knowledge-proof-for-authentication/SKILL.md` | Implements the Schnorr identification protocol and a simplified Zero-Knowledge Password Proof (ZKPP) over the discret... |
-| `migrating-to-post-quantum-cryptography` | `migrating-to-post-quantum-cryptography/SKILL.md` | Build a cryptographic inventory/CBOM with OpenSSL 3.5+, deploy hybrid post-quantum key exchange (X25519MLKEM768) on T... |
-| `performing-cryptographic-audit-of-application` | `performing-cryptographic-audit-of-application/SKILL.md` | A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key man... |
-| `performing-hardware-security-module-integration` | `performing-hardware-security-module-integration/SKILL.md` | Integrates Hardware Security Modules (HSMs) via the PKCS#11 interface using python-pkcs11, performing key generation,... |
-| `performing-hash-cracking-with-hashcat` | `performing-hash-cracking-with-hashcat/SKILL.md` | Cracks password hashes with Hashcat, covering hash-type identification, dictionary/brute-force/rule-based attack mode... |
-| `performing-post-quantum-cryptography-migration` | `performing-post-quantum-cryptography-migration/SKILL.md` | 'Assesses organizational readiness for post-quantum cryptography migration per NIST FIPS 203/204/205 standards. Perfo... |
-| `performing-ssl-certificate-lifecycle-management` | `performing-ssl-certificate-lifecycle-management/SKILL.md` | Automates the full SSL/TLS certificate lifecycle, including generating Certificate Signing Requests, issuing, deployi... |
-
-### DATA PROTECTION (1 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `implementing-data-loss-prevention-with-microsoft-purview` | `implementing-data-loss-prevention-with-microsoft-purview/SKILL.md` | 'Implements DLP policies using Microsoft Purview PowerShell cmdlets and the Graph API to protect data across Exchange... |
-
-### DECEPTION TECHNOLOGY (6 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `deploying-active-directory-honeytokens` | `deploying-active-directory-honeytokens/SKILL.md` | 'Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake S... |
-| `deploying-cloud-deception-with-decoy-resources` | `deploying-cloud-deception-with-decoy-resources/SKILL.md` | Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to gener... |
-| `deploying-honeytokens-and-canarytokens` | `deploying-honeytokens-and-canarytokens/SKILL.md` | Plants Canarytokens-based decoy artifacts (honey credentials, DNS tokens, web-bug URLs, AWS keys, documents, kubeconf... |
-| `designing-adversary-engagement-with-mitre-engage` | `designing-adversary-engagement-with-mitre-engage/SKILL.md` | Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception ... |
-| `implementing-deception-based-detection-with-canarytoken` | `implementing-deception-based-detection-with-canarytoken/SKILL.md` | Deploys and monitors Canary Tokens via the Thinkst Canary REST API for deception-based breach detection, programmatic... |
-| `implementing-network-deception-with-honeypots` | `implementing-network-deception-with-honeypots/SKILL.md` | Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movemen... |
-
-### DEVSECOPS (18 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `building-devsecops-pipeline-with-gitlab-ci` | `building-devsecops-pipeline-with-gitlab-ci/SKILL.md` | Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container sc... |
-| `implementing-aqua-security-for-container-scanning` | `implementing-aqua-security-for-container-scanning/SKILL.md` | Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in con... |
-| `implementing-code-signing-for-artifacts` | `implementing-code-signing-for-artifacts/SKILL.md` | 'Implements code signing for build artifacts (binaries, packages, containers) using GPG, Sigstore, and platform-speci... |
-| `implementing-fuzz-testing-in-cicd-with-aflplusplus` | `implementing-fuzz-testing-in-cicd-with-aflplusplus/SKILL.md` | Integrates AFL++ coverage-guided fuzzing into CI/CD pipelines, covering harness construction, AFL++/AddressSanitizer/... |
-| `implementing-github-advanced-security-for-code-scanning` | `implementing-github-advanced-security-for-code-scanning/SKILL.md` | Configures GitHub Advanced Security (code scanning with CodeQL, secret scanning, dependency review, and Dependabot al... |
-| `implementing-infrastructure-as-code-security-scanning` | `implementing-infrastructure-as-code-security-scanning/SKILL.md` | 'Implements automated security scanning for Infrastructure as Code using Checkov, tfsec, and KICS to detect misconfig... |
-| `implementing-policy-as-code-with-open-policy-agent` | `implementing-policy-as-code-with-open-policy-agent/SKILL.md` | 'Implements policy-as-code enforcement with Open Policy Agent (OPA) and Gatekeeper for Kubernetes and CI/CD pipelines... |
-| `implementing-secret-scanning-with-gitleaks` | `implementing-secret-scanning-with-gitleaks/SKILL.md` | 'This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addre... |
-| `implementing-secrets-scanning-in-ci-cd` | `implementing-secrets-scanning-in-ci-cd/SKILL.md` | Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment |
-| `implementing-semgrep-for-custom-sast-rules` | `implementing-semgrep-for-custom-sast-rules/SKILL.md` | Write custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards, and... |
-| `integrating-dast-with-owasp-zap-in-pipeline` | `integrating-dast-with-owasp-zap-in-pipeline/SKILL.md` | Integrates OWASP ZAP (Zed Attack Proxy) into GitHub Actions and GitLab CI pipelines, covering baseline, full, and API... |
-| `integrating-sast-into-github-actions-pipeline` | `integrating-sast-into-github-actions-pipeline/SKILL.md` | Integrates CodeQL and Semgrep SAST scanning into GitHub Actions, covering scans on pull requests/pushes, rule tuning ... |
-| `performing-container-image-hardening` | `performing-container-image-hardening/SKILL.md` | 'Harden container images by minimizing attack surface, stripping unnecessary packages, implementing multi-stage build... |
-| `performing-sca-dependency-scanning-with-snyk` | `performing-sca-dependency-scanning-with-snyk/SKILL.md` | 'This skill covers implementing Software Composition Analysis (SCA) using Snyk to detect vulnerable open-source depen... |
-| `performing-threat-modeling-with-owasp-threat-dragon` | `performing-threat-modeling-with-owasp-threat-dragon/SKILL.md` | Uses OWASP Threat Dragon (web or desktop) to build data flow diagrams, identify threats with STRIDE, LINDDUN, CIA, DI... |
-| `scanning-containers-with-trivy-in-cicd` | `scanning-containers-with-trivy-in-cicd/SKILL.md` | 'Integrates Aqua Security''s Trivy scanner into CI/CD pipelines to detect OS package and application dependency CVEs,... |
-| `scanning-iac-and-images-with-trivy` | `scanning-iac-and-images-with-trivy/SKILL.md` | Scans container images, Infrastructure-as-Code (Terraform, CloudFormation, Kubernetes manifests, Dockerfile, Helm), f... |
-| `securing-github-actions-workflows` | `securing-github-actions-workflows/SKILL.md` | 'Hardens GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation: pinning a... |
-
-### DIGITAL FORENSICS (41 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `acquiring-disk-image-with-dd-and-dcfldd` | `acquiring-disk-image-with-dd-and-dcfldd/SKILL.md` | Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evide... |
-| `analyzing-browser-forensics-with-hindsight` | `analyzing-browser-forensics-with-hindsight/SKILL.md` | Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, ... |
-| `analyzing-disk-image-with-autopsy` | `analyzing-disk-image-with-autopsy/SKILL.md` | Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recover... |
-| `analyzing-docker-container-forensics` | `analyzing-docker-container-forensics/SKILL.md` | Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identi... |
-| `analyzing-email-headers-for-phishing-investigation` | `analyzing-email-headers-for-phishing-investigation/SKILL.md` | Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing emai... |
-| `analyzing-linux-kernel-rootkits` | `analyzing-linux-kernel-rootkits/SKILL.md` | Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modu... |
-| `analyzing-linux-system-artifacts` | `analyzing-linux-system-artifacts/SKILL.md` | Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuratio... |
-| `analyzing-lnk-file-and-jump-list-artifacts` | `analyzing-lnk-file-and-jump-list-artifacts/SKILL.md` | Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format pa... |
-| `analyzing-mft-for-deleted-file-recovery` | `analyzing-mft-for-deleted-file-recovery/SKILL.md` | Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT, and X-Ways Forensics to recover metadata and cont... |
-| `analyzing-outlook-pst-for-email-forensics` | `analyzing-outlook-pst-for-email-forensics/SKILL.md` | Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments... |
-| `analyzing-prefetch-files-for-execution-history` | `analyzing-prefetch-files-for-execution-history/SKILL.md` | Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to ... |
-| `analyzing-slack-space-and-file-system-artifacts` | `analyzing-slack-space-and-file-system-artifacts/SKILL.md` | Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or ... |
-| `analyzing-usb-device-connection-history` | `analyzing-usb-device-connection-history/SKILL.md` | Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device... |
-| `analyzing-windows-amcache-artifacts` | `analyzing-windows-amcache-artifacts/SKILL.md` | 'Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s AmcacheParser and Timeline Explorer to extract e... |
-| `analyzing-windows-lnk-files-for-artifacts` | `analyzing-windows-lnk-files-for-artifacts/SKILL.md` | Parse Windows LNK shortcut files to extract target paths, MAC timestamps, volume serial numbers, and machine identifi... |
-| `analyzing-windows-prefetch-with-python` | `analyzing-windows-prefetch-with-python/SKILL.md` | Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution histo... |
-| `analyzing-windows-registry-for-artifacts` | `analyzing-windows-registry-for-artifacts/SKILL.md` | Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, ... |
-| `analyzing-windows-shellbag-artifacts` | `analyzing-windows-shellbag-artifacts/SKILL.md` | Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and Shellbags Explorer to reconstruct folder browsin... |
-| `building-super-timelines-with-plaso` | `building-super-timelines-with-plaso/SKILL.md` | Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py, psort.py, and psteal.py CLI tools (fusing f... |
-| `extracting-browser-history-artifacts` | `extracting-browser-history-artifacts/SKILL.md` | Extracts and analyzes browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge using ... |
-| `extracting-credentials-from-memory-dump` | `extracting-credentials-from-memory-dump/SKILL.md` | Extracts cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps u... |
-| `extracting-windows-event-logs-artifacts` | `extracting-windows-event-logs-artifacts/SKILL.md` | Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral moveme... |
-| `generating-forensic-timelines-with-hayabusa` | `generating-forensic-timelines-with-hayabusa/SKILL.md` | Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronolog... |
-| `investigating-ransomware-attack-artifacts` | `investigating-ransomware-attack-artifacts/SKILL.md` | Forensically preserve memory and disk, collect ransom notes and encrypted file samples, and identify the ransomware v... |
-| `parsing-artifacts-with-eric-zimmerman-tools` | `parsing-artifacts-with-eric-zimmerman-tools/SKILL.md` | Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—... |
-| `performing-cloud-forensics-investigation` | `performing-cloud-forensics-investigation/SKILL.md` | Collect and analyze cloud forensic evidence using AWS CLI, Azure CLI, or gcloud to snapshot volumes, capture instance... |
-| `performing-cloud-storage-forensic-acquisition` | `performing-cloud-storage-forensic-acquisition/SKILL.md` | Perform forensic acquisition of cloud storage services including Google Drive, OneDrive, Dropbox, and Box by pulling ... |
-| `performing-file-carving-with-foremost` | `performing-file-carving-with-foremost/SKILL.md` | Recovers files from disk images and unallocated space using Foremost's header-footer signature carving, extracting ev... |
-| `performing-linux-log-forensics-investigation` | `performing-linux-log-forensics-investigation/SKILL.md` | Perform forensic investigation of Linux system logs including syslog, auth.log, systemd journal (via journalctl), ker... |
-| `performing-log-analysis-for-forensic-investigation` | `performing-log-analysis-for-forensic-investigation/SKILL.md` | Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines du... |
-| `performing-malware-persistence-investigation` | `performing-malware-persistence-investigation/SKILL.md` | Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives r... |
-| `performing-memory-forensics-with-volatility3` | `performing-memory-forensics-with-volatility3/SKILL.md` | Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connection... |
-| `performing-mobile-device-forensics-with-cellebrite` | `performing-mobile-device-forensics-with-cellebrite/SKILL.md` | Acquire and analyze mobile device data using Cellebrite UFED Touch/4PC, UFED Physical Analyzer, and open-source alter... |
-| `performing-network-forensics-with-wireshark` | `performing-network-forensics-with-wireshark/SKILL.md` | Capture and analyze network traffic using Wireshark and tshark to reconstruct network events from PCAP/PCAPNG files, ... |
-| `performing-network-packet-capture-analysis` | `performing-network-packet-capture-analysis/SKILL.md` | Perform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruc... |
-| `performing-sqlite-database-forensics` | `performing-sqlite-database-forensics/SKILL.md` | Performs forensic analysis of SQLite databases by examining B-tree page structures, recovering deleted records from f... |
-| `performing-steganography-detection` | `performing-steganography-detection/SKILL.md` | Detects and extracts hidden data embedded in images, audio, and other media files using steganalysis tools such as St... |
-| `performing-timeline-reconstruction-with-plaso` | `performing-timeline-reconstruction-with-plaso/SKILL.md` | Builds comprehensive forensic super-timelines using Plaso (log2timeline and psort) to correlate events across file sy... |
-| `performing-windows-artifact-analysis-with-eric-zimmerman-tools` | `performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md` | Performs comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite (KAPE, MF... |
-| `recovering-deleted-files-with-photorec` | `recovering-deleted-files-with-photorec/SKILL.md` | Recovers deleted files from disk images and storage media using PhotoRec's file signature-based carving engine, which... |
-| `triaging-windows-with-kape` | `triaging-windows-with-kape/SKILL.md` | Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event l... |
-
-### ENDPOINT SECURITY (17 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `configuring-host-based-intrusion-detection` | `configuring-host-based-intrusion-detection/SKILL.md` | 'Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and confi... |
-| `configuring-windows-defender-advanced-settings` | `configuring-windows-defender-advanced-settings/SKILL.md` | 'Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rul... |
-| `configuring-windows-event-logging-for-detection` | `configuring-windows-event-logging-for-detection/SKILL.md` | 'Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat d... |
-| `deploying-edr-agent-with-crowdstrike` | `deploying-edr-agent-with-crowdstrike/SKILL.md` | 'Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detectio... |
-| `deploying-osquery-for-endpoint-monitoring` | `deploying-osquery-for-endpoint-monitoring/SKILL.md` | 'Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processe... |
-| `detecting-evasion-techniques-in-endpoint-logs` | `detecting-evasion-techniques-in-endpoint-logs/SKILL.md` | 'Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, proce... |
-| `detecting-fileless-attacks-on-endpoints` | `detecting-fileless-attacks-on-endpoints/SKILL.md` | 'Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk... |
-| `hardening-linux-endpoint-with-cis-benchmark` | `hardening-linux-endpoint-with-cis-benchmark/SKILL.md` | 'Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, e... |
-| `hardening-windows-endpoint-with-cis-benchmark` | `hardening-windows-endpoint-with-cis-benchmark/SKILL.md` | 'Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surfac... |
-| `implementing-application-whitelisting-with-applocker` | `implementing-application-whitelisting-with-applocker/SKILL.md` | 'Implements application whitelisting using Windows AppLocker to restrict unauthorized software execution on endpoints... |
-| `implementing-disk-encryption-with-bitlocker` | `implementing-disk-encryption-with-bitlocker/SKILL.md` | 'Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthor... |
-| `implementing-endpoint-dlp-controls` | `implementing-endpoint-dlp-controls/SKILL.md` | 'Implements endpoint Data Loss Prevention (DLP) controls to detect and prevent sensitive data exfiltration through em... |
-| `implementing-file-integrity-monitoring-with-aide` | `implementing-file-integrity-monitoring-with-aide/SKILL.md` | Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline ... |
-| `implementing-memory-protection-with-dep-aslr` | `implementing-memory-protection-with-dep-aslr/SKILL.md` | 'Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Random... |
-| `implementing-usb-device-control-policy` | `implementing-usb-device-control-policy/SKILL.md` | 'Implements USB device control policies to restrict unauthorized removable media access on endpoints, preventing data... |
-| `performing-endpoint-forensics-investigation` | `performing-endpoint-forensics-investigation/SKILL.md` | 'Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifa... |
-| `performing-endpoint-vulnerability-remediation` | `performing-endpoint-vulnerability-remediation/SKILL.md` | 'Performs vulnerability remediation on endpoints by prioritizing CVEs based on risk scoring, deploying patches, apply... |
-
-### FIRMWARE ANALYSIS (1 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `performing-firmware-extraction-with-binwalk` | `performing-firmware-extraction-with-binwalk/SKILL.md` | 'Performs firmware image extraction and analysis using binwalk to identify embedded filesystems, compressed archives,... |
-
-### FIRMWARE SECURITY (1 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-uefi-bootkit-persistence` | `analyzing-uefi-bootkit-persistence/SKILL.md` | 'Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications, Secure Boot bypass, UEFI variable manipula... |
-
-### GOVERNANCE RISK COMPLIANCE (1 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `performing-soc2-type2-audit-preparation` | `performing-soc2-type2-audit-preparation/SKILL.md` | 'Automates SOC 2 Type II audit preparation including gap assessment against AICPA Trust Services Criteria (CC1-CC9), ... |
-
-### HARDWARE FIRMWARE SECURITY (4 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `auditing-uefi-firmware-with-chipsec` | `auditing-uefi-firmware-with-chipsec/SKILL.md` | Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Sec... |
-| `detecting-secure-boot-bypass` | `detecting-secure-boot-bypass/SKILL.md` | Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checki... |
-| `hunting-bootkits-in-efi-system-partition` | `hunting-bootkits-in-efi-system-partition/SKILL.md` | Baseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupte... |
-| `validating-tpm-measured-boot-attestation` | `validating-tpm-measured-boot-attestation/SKILL.md` | Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), repla... |
-
-### IDENTITY ACCESS MANAGEMENT (37 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `attacking-entra-id-with-roadtools` | `attacking-entra-id-with-roadtools/SKILL.md` | Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and acquire, exchange, and abuse tokens (including pri... |
-| `attacking-oauth-with-device-code-phishing` | `attacking-oauth-with-device-code-phishing/SKILL.md` | Run OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID, using TokenTactics-style t... |
-| `auditing-entra-id-with-aadinternals` | `auditing-entra-id-with-aadinternals/SKILL.md` | Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisiti... |
-| `building-identity-federation-with-saml-azure-ad` | `building-identity-federation-with-saml-azure-ad/SKILL.md` | Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Micr... |
-| `building-identity-governance-lifecycle-process` | `building-identity-governance-lifecycle-process/SKILL.md` | Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance,... |
-| `building-role-mining-for-rbac-optimization` | `building-role-mining-for-rbac-optimization/SKILL.md` | Apply bottom-up and top-down role mining techniques, including clustering algorithms and formal concept analysis, to ... |
-| `configuring-active-directory-tiered-model` | `configuring-active-directory-tiered-model/SKILL.md` | Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory, co... |
-| `configuring-ldap-security-hardening` | `configuring-ldap-security-hardening/SKILL.md` | Hardens LDAP directory services against credential harvesting, LDAP injection, anonymous binding, and channel-binding... |
-| `configuring-multi-factor-authentication-with-duo` | `configuring-multi-factor-authentication-with-duo/SKILL.md` | Deploys Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points, coveri... |
-| `configuring-oauth2-authorization-flow` | `configuring-oauth2-authorization-flow/SKILL.md` | Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Devi... |
-| `detecting-anomalous-authentication-patterns` | `detecting-anomalous-authentication-patterns/SKILL.md` | 'Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models t... |
-| `implementing-aws-iam-permission-boundaries` | `implementing-aws-iam-permission-boundaries/SKILL.md` | Configures AWS IAM permission boundaries that cap the maximum permissions an identity-based policy can grant to a use... |
-| `implementing-azure-ad-privileged-identity-management` | `implementing-azure-ad-privileged-identity-management/SKILL.md` | Configure Microsoft Entra Privileged Identity Management (PIM) to convert standing privileged assignments into eligib... |
-| `implementing-conditional-access-policies-azure-ad` | `implementing-conditional-access-policies-azure-ad/SKILL.md` | Configures Microsoft Entra ID (Azure AD) Conditional Access policies for zero trust access control, covering signal-b... |
-| `implementing-delinea-secret-server-for-pam` | `implementing-delinea-secret-server-for-pam/SKILL.md` | 'Implements Delinea Secret Server for privileged access management, covering secret vault configuration, role-based a... |
-| `implementing-google-workspace-admin-security` | `implementing-google-workspace-admin-security/SKILL.md` | 'Hardens a Google Workspace tenant via Admin Console configuration: phishing-resistant MFA enforcement, DLP policies,... |
-| `implementing-google-workspace-sso-configuration` | `implementing-google-workspace-sso-configuration/SKILL.md` | Configures SAML 2.0 single sign-on for Google Workspace against a third-party identity provider (Okta, Azure AD/Entra... |
-| `implementing-hashicorp-vault-dynamic-secrets` | `implementing-hashicorp-vault-dynamic-secrets/SKILL.md` | 'Configures HashiCorp Vault dynamic secrets engines for database credentials, AWS IAM keys, and PKI certificates, wit... |
-| `implementing-identity-governance-with-sailpoint` | `implementing-identity-governance-with-sailpoint/SKILL.md` | Deploys SailPoint IdentityNow or IdentityIQ for identity governance and administration, covering identity lifecycle m... |
-| `implementing-just-in-time-access-provisioning` | `implementing-just-in-time-access-provisioning/SKILL.md` | Implements Just-In-Time (JIT) access provisioning to eliminate standing privileges by granting temporary, time-bound ... |
-| `implementing-pam-for-database-access` | `implementing-pam-for-database-access/SKILL.md` | Deploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL, coverin... |
-| `implementing-passwordless-auth-with-microsoft-entra` | `implementing-passwordless-auth-with-microsoft-entra/SKILL.md` | 'Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business... |
-| `implementing-passwordless-authentication-with-fido2` | `implementing-passwordless-authentication-with-fido2/SKILL.md` | Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators, covering WebAuthn ... |
-| `implementing-privileged-access-management-with-cyberark` | `implementing-privileged-access-management-with-cyberark/SKILL.md` | Deploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across en... |
-| `implementing-privileged-session-monitoring` | `implementing-privileged-session-monitoring/SKILL.md` | 'Implements privileged session monitoring and recording using PAM solutions, focusing on CyberArk Privileged Session ... |
-| `implementing-saml-sso-with-okta` | `implementing-saml-sso-with-okta/SKILL.md` | Implement SAML 2.0 Single Sign-On using Okta as the Identity Provider, covering SP-initiated and IdP-initiated flows,... |
-| `implementing-scim-provisioning-with-okta` | `implementing-scim-provisioning-with-okta/SKILL.md` | Implement automated user lifecycle provisioning and deprovisioning using the SCIM 2.0 protocol with Okta as the ident... |
-| `implementing-zero-standing-privilege-with-cyberark` | `implementing-zero-standing-privilege-with-cyberark/SKILL.md` | Deploy CyberArk Secure Cloud Access (SCA) to eliminate standing privileges in AWS, Azure, and GCP by provisioning eph... |
-| `performing-access-recertification-with-saviynt` | `performing-access-recertification-with-saviynt/SKILL.md` | Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlem... |
-| `performing-access-review-and-certification` | `performing-access-review-and-certification/SKILL.md` | Designs and runs access review and certification campaigns-scoping, reviewer selection, risk-based prioritization, mi... |
-| `performing-entitlement-review-with-sailpoint-iiq` | `performing-entitlement-review-with-sailpoint-iiq/SKILL.md` | 'Runs entitlement review and access certification campaigns in SailPoint IdentityIQ, covering manager certifications,... |
-| `performing-oauth-scope-minimization-review` | `performing-oauth-scope-minimization-review/SKILL.md` | 'Performs OAuth 2.0 scope minimization review to identify over-permissioned third-party application integrations, exc... |
-| `performing-privileged-account-access-review` | `performing-privileged-account-access-review/SKILL.md` | Conducts systematic reviews of privileged accounts to validate access rights, identify excessive or stale permissions... |
-| `performing-privileged-account-discovery` | `performing-privileged-account-discovery/SKILL.md` | Discovers and inventories privileged accounts across enterprise infrastructure, including domain admins, local admins... |
-| `performing-service-account-audit` | `performing-service-account-audit/SKILL.md` | Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant acco... |
-| `performing-service-account-credential-rotation` | `performing-service-account-credential-rotation/SKILL.md` | Automates credential rotation for service accounts across Active Directory, cloud platforms, and application database... |
-| `post-exploiting-microsoft-graph-with-graphrunner` | `post-exploiting-microsoft-graph-with-graphrunner/SKILL.md` | Runs GraphRunner, a PowerShell post-exploitation toolset built on the Microsoft Graph API, to perform tenant recon, e... |
-
-### IDENTITY AND ACCESS MANAGEMENT (2 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `implementing-hardware-security-key-authentication` | `implementing-hardware-security-key-authentication/SKILL.md` | 'Builds a FIDO2/WebAuthn relying party server with the python-fido2 library, covering registration and authentication... |
-| `implementing-privileged-access-workstation` | `implementing-privileged-access-workstation/SKILL.md` | Design and implement Privileged Access Workstations (PAWs) using the tiered administration model, with device hardeni... |
-
-### IDENTITY SECURITY (1 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-active-directory-acl-abuse` | `analyzing-active-directory-acl-abuse/SKILL.md` | Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOw... |
-
-### INCIDENT RESPONSE (26 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-linux-audit-logs-for-intrusion` | `analyzing-linux-audit-logs-for-intrusion/SKILL.md` | 'Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthori... |
-| `analyzing-network-traffic-for-incidents` | `analyzing-network-traffic-for-incidents/SKILL.md` | 'Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including ... |
-| `analyzing-security-logs-with-splunk` | `analyzing-security-logs-with-splunk/SKILL.md` | 'Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through ... |
-| `building-incident-response-playbook` | `building-incident-response-playbook/SKILL.md` | Designs and documents structured incident response playbooks with step-by-step procedures per incident type, decision... |
-| `building-incident-timeline-with-timesketch` | `building-incident-timeline-with-timesketch/SKILL.md` | Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event... |
-| `building-malware-incident-communication-template` | `building-malware-incident-communication-template/SKILL.md` | Build structured communication templates for malware incidents (ransomware, wiper, trojan, worm), covering internal s... |
-| `collecting-indicators-of-compromise` | `collecting-indicators-of-compromise/SKILL.md` | 'Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security inci... |
-| `collecting-volatile-evidence-from-compromised-host` | `collecting-volatile-evidence-from-compromised-host/SKILL.md` | Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, n... |
-| `conducting-cloud-incident-response` | `conducting-cloud-incident-response/SKILL.md` | Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (Cloud... |
-| `conducting-malware-incident-response` | `conducting-malware-incident-response/SKILL.md` | Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection ve... |
-| `conducting-memory-forensics-with-volatility` | `conducting-memory-forensics-with-volatility/SKILL.md` | 'Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, n... |
-| `conducting-phishing-incident-response` | `conducting-phishing-incident-response/SKILL.md` | Respond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, asses... |
-| `conducting-post-incident-lessons-learned` | `conducting-post-incident-lessons-learned/SKILL.md` | Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce act... |
-| `containing-active-breach` | `containing-active-breach/SKILL.md` | 'Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed ... |
-| `detecting-email-account-compromise` | `detecting-email-account-compromise/SKILL.md` | Detect compromised O365 and Google Workspace email accounts by analyzing Unified Audit Logs and Azure AD sign-in logs... |
-| `eradicating-malware-from-infected-systems` | `eradicating-malware-from-infected-systems/SKILL.md` | Systematically map and remove malware, backdoors, and attacker persistence mechanisms (registry Run keys, scheduled t... |
-| `implementing-velociraptor-for-ir-collection` | `implementing-velociraptor-for-ir-collection/SKILL.md` | Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using V... |
-| `performing-active-directory-compromise-investigation` | `performing-active-directory-compromise-investigation/SKILL.md` | Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes,... |
-| `performing-cloud-incident-containment-procedures` | `performing-cloud-incident-containment-procedures/SKILL.md` | Execute cloud-native incident containment across AWS, Azure, and GCP using platform CLIs to revoke or disable comprom... |
-| `performing-disk-forensics-investigation` | `performing-disk-forensics-investigation/SKILL.md` | 'Conduct disk forensics investigations using forensic imaging, file system analysis, and timeline reconstruction, wit... |
-| `performing-insider-threat-investigation` | `performing-insider-threat-investigation/SKILL.md` | 'Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized ac... |
-| `performing-ransomware-response` | `performing-ransomware-response/SKILL.md` | 'Executes a structured ransomware incident response from detection through containment, forensic analysis, decryption... |
-| `testing-ransomware-recovery-procedures` | `testing-ransomware-recovery-procedures/SKILL.md` | Tests and validates ransomware recovery procedures - backup restore operations (e.g. with Restic), RTO/RPO target ver... |
-| `triaging-security-incident` | `triaging-security-incident/SKILL.md` | 'Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying inc... |
-| `triaging-security-incident-with-ir-playbook` | `triaging-security-incident-with-ir-playbook/SKILL.md` | Classifies and prioritizes security incidents using structured IR playbooks and SIEM/case-management queries (Splunk,... |
-| `validating-backup-integrity-for-recovery` | `validating-backup-integrity-for-recovery/SKILL.md` | Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, ... |
-
-### MALWARE ANALYSIS (39 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-android-malware-with-apktool` | `analyzing-android-malware-with-apktool/SKILL.md` | Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recover... |
-| `analyzing-bootkit-and-rootkit-samples` | `analyzing-bootkit-and-rootkit-samples/SKILL.md` | 'Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or U... |
-| `analyzing-cobalt-strike-beacon-configuration` | `analyzing-cobalt-strike-beacon-configuration/SKILL.md` | Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, ... |
-| `analyzing-cobaltstrike-malleable-c2-profiles` | `analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md` | Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs)... |
-| `analyzing-command-and-control-communication` | `analyzing-command-and-control-communication/SKILL.md` | 'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, c... |
-| `analyzing-golang-malware-with-ghidra` | `analyzing-golang-malware-with-ghidra/SKILL.md` | Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/ob... |
-| `analyzing-heap-spray-exploitation` | `analyzing-heap-spray-exploitation/SKILL.md` | Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellc... |
-| `analyzing-linux-elf-malware` | `analyzing-linux-elf-malware/SKILL.md` | 'Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, cont... |
-| `analyzing-macro-malware-in-office-documents` | `analyzing-macro-malware-in-office-documents/SKILL.md` | 'Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download ... |
-| `analyzing-malicious-pdf-with-peepdf` | `analyzing-malicious-pdf-with-peepdf/SKILL.md` | Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript... |
-| `analyzing-malware-behavior-with-cuckoo-sandbox` | `analyzing-malware-behavior-with-cuckoo-sandbox/SKILL.md` | 'Detonate malware samples in Cuckoo Sandbox to observe runtime behavior — process creation, file system and registry ... |
-| `analyzing-malware-persistence-with-autoruns` | `analyzing-malware-persistence-with-autoruns/SKILL.md` | Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows regis... |
-| `analyzing-malware-sandbox-evasion-techniques` | `analyzing-malware-sandbox-evasion-techniques/SKILL.md` | Detect sandbox and VM evasion techniques in malware samples by analyzing timing checks, VM/hypervisor artifact querie... |
-| `analyzing-memory-dumps-with-volatility` | `analyzing-memory-dumps-with-volatility/SKILL.md` | 'Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, i... |
-| `analyzing-network-covert-channels-in-malware` | `analyzing-network-covert-channels-in-malware/SKILL.md` | Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, stegano... |
-| `analyzing-network-traffic-of-malware` | `analyzing-network-traffic-of-malware/SKILL.md` | 'Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 prot... |
-| `analyzing-packed-malware-with-upx-unpacker` | `analyzing-packed-malware-with-upx-unpacker/SKILL.md` | 'Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that ... |
-| `analyzing-pdf-malware-with-pdfid` | `analyzing-pdf-malware-with-pdfid/SKILL.md` | 'Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploit... |
-| `analyzing-ransomware-encryption-mechanisms` | `analyzing-ransomware-encryption-mechanisms/SKILL.md` | 'Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess d... |
-| `analyzing-supply-chain-malware-artifacts` | `analyzing-supply-chain-malware-artifacts/SKILL.md` | Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sid... |
-| `deobfuscating-javascript-malware` | `deobfuscating-javascript-malware/SKILL.md` | Deobfuscates malicious JavaScript found in phishing pages, web skimmers, and dropper scripts by reversing encoding la... |
-| `deobfuscating-powershell-obfuscated-malware` | `deobfuscating-powershell-obfuscated-malware/SKILL.md` | Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDeco... |
-| `detecting-fileless-malware-techniques` | `detecting-fileless-malware-techniques/SKILL.md` | 'Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, regis... |
-| `detecting-process-injection-techniques` | `detecting-process-injection-techniques/SKILL.md` | 'Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing... |
-| `detecting-rootkit-activity` | `detecting-rootkit-activity/SKILL.md` | 'Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kerne... |
-| `extracting-config-from-agent-tesla-rat` | `extracting-config-from-agent-tesla-rat/SKILL.md` | Extracts embedded configuration from Agent Tesla RAT samples, including SMTP/FTP/Telegram exfiltration credentials, k... |
-| `extracting-iocs-from-malware-samples` | `extracting-iocs-from-malware-samples/SKILL.md` | Extracts indicators of compromise (IOCs) from malware samples, including file hashes, network indicators (IPs, domain... |
-| `performing-automated-malware-analysis-with-cape` | `performing-automated-malware-analysis-with-cape/SKILL.md` | Deploy and operate the CAPEv2 malware sandbox (a Cuckoo derivative) to run samples in a monitored Windows guest VM, c... |
-| `performing-dynamic-analysis-with-any-run` | `performing-dynamic-analysis-with-any-run/SKILL.md` | 'Perform interactive dynamic malware analysis using the ANY.RUN cloud sandbox to detonate samples, observe real-time ... |
-| `performing-firmware-malware-analysis` | `performing-firmware-malware-analysis/SKILL.md` | 'Analyzes firmware images for embedded malware, backdoors, and unauthorized modifications in routers, IoT devices, UE... |
-| `performing-malware-triage-with-yara` | `performing-malware-triage-with-yara/SKILL.md` | 'Performs rapid malware triage and classification using YARA rules that match file patterns, strings, byte sequences,... |
-| `performing-memory-forensics-with-volatility3-plugins` | `performing-memory-forensics-with-volatility3-plugins/SKILL.md` | Analyze memory dumps using Volatility3 plugins to detect injected code, rootkits, credential theft, and malware artif... |
-| `performing-static-malware-analysis-with-pe-studio` | `performing-static-malware-analysis-with-pe-studio/SKILL.md` | Performs static analysis of Windows PE malware samples using PEStudio to examine file headers, imports, strings, and ... |
-| `performing-yara-rule-development-for-detection` | `performing-yara-rule-development-for-detection/SKILL.md` | Develops precise YARA and YARA-X rules for malware detection by identifying unique strings, byte sequences, PE header... |
-| `reverse-engineering-android-malware-with-jadx` | `reverse-engineering-android-malware-with-jadx/SKILL.md` | 'Reverse engineers malicious Android APK files using the JADX decompiler to read Java/Kotlin source, inspect manifest... |
-| `reverse-engineering-dotnet-malware-with-dnspy` | `reverse-engineering-dotnet-malware-with-dnspy/SKILL.md` | 'Reverse engineers .NET malware samples using the dnSpy decompiler and debugger to read C#/VB.NET source, deobfuscate... |
-| `reverse-engineering-malware-with-ghidra` | `reverse-engineering-malware-with-ghidra/SKILL.md` | 'Reverse engineers malware binaries using NSA''s Ghidra disassembler and decompiler to study internal logic, cryptogr... |
-| `reverse-engineering-ransomware-encryption-routine` | `reverse-engineering-ransomware-encryption-routine/SKILL.md` | Reverse engineer ransomware encryption routines to identify cryptographic algorithms, key generation flaws, and poten... |
-| `reverse-engineering-rust-malware` | `reverse-engineering-rust-malware/SKILL.md` | Reverse engineers Rust-compiled malware using IDA Pro and Ghidra, covering techniques for non-null-terminated fat-poi... |
-
-### MOBILE SECURITY (13 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-ios-app-security-with-objection` | `analyzing-ios-app-security-with-objection/SKILL.md` | Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals ... |
-| `detecting-mobile-malware-behavior` | `detecting-mobile-malware-behavior/SKILL.md` | 'Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detecti... |
-| `exploiting-deeplink-vulnerabilities` | `exploiting-deeplink-vulnerabilities/SKILL.md` | 'Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to ide... |
-| `exploiting-insecure-data-storage-in-mobile` | `exploiting-insecure-data-storage-in-mobile/SKILL.md` | 'Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including... |
-| `implementing-mobile-application-management` | `implementing-mobile-application-management/SKILL.md` | 'Implements Mobile Application Management (MAM) policies to protect enterprise data on managed and unmanaged mobile d... |
-| `intercepting-mobile-traffic-with-burpsuite` | `intercepting-mobile-traffic-with-burpsuite/SKILL.md` | 'Intercepts and analyzes HTTP/HTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API ... |
-| `performing-android-app-static-analysis-with-mobsf` | `performing-android-app-static-analysis-with-mobsf/SKILL.md` | 'Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardc... |
-| `performing-dynamic-analysis-of-android-app` | `performing-dynamic-analysis-of-android-app/SKILL.md` | 'Performs runtime dynamic analysis of Android applications using Frida, Objection, and Android Debug Bridge to observ... |
-| `performing-ios-app-security-assessment` | `performing-ios-app-security-assessment/SKILL.md` | 'Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for r... |
-| `performing-mobile-app-certificate-pinning-bypass` | `performing-mobile-app-certificate-pinning-bypass/SKILL.md` | 'Bypasses SSL/TLS certificate pinning implementations in Android and iOS applications to enable traffic interception ... |
-| `reverse-engineering-ios-app-with-frida` | `reverse-engineering-ios-app-with-frida/SKILL.md` | 'Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encrypt... |
-| `testing-android-intents-for-vulnerabilities` | `testing-android-intents-for-vulnerabilities/SKILL.md` | 'Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unau... |
-| `testing-mobile-api-authentication` | `testing-mobile-api-authentication/SKILL.md` | 'Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, inse... |
-
-### NETWORK SECURITY (43 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-network-flow-data-with-netflow` | `analyzing-network-flow-data-with-netflow/SKILL.md` | Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing... |
-| `analyzing-network-packets-with-scapy` | `analyzing-network-packets-with-scapy/SKILL.md` | Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and d... |
-| `analyzing-network-traffic-with-wireshark` | `analyzing-network-traffic-with-wireshark/SKILL.md` | 'Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnos... |
-| `conducting-man-in-the-middle-attack-simulation` | `conducting-man-in-the-middle-attack-simulation/SKILL.md` | 'Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept... |
-| `configuring-network-segmentation-with-vlans` | `configuring-network-segmentation-with-vlans/SKILL.md` | 'Designs and implements VLAN-based (802.1Q) network segmentation on managed switches to isolate zones such as corpora... |
-| `configuring-pfsense-firewall-rules` | `configuring-pfsense-firewall-rules/SKILL.md` | 'Configures pfSense firewall rules, NAT policies, IPsec/OpenVPN tunnels, and traffic shaping to enforce network segme... |
-| `configuring-snort-ids-for-intrusion-detection` | `configuring-snort-ids-for-intrusion-detection/SKILL.md` | 'Installs, configures, and tunes Snort 3 to monitor network traffic for malicious activity using custom and community... |
-| `configuring-suricata-for-network-monitoring` | `configuring-suricata-for-network-monitoring/SKILL.md` | 'Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-... |
-| `detecting-arp-poisoning-in-network-traffic` | `detecting-arp-poisoning-in-network-traffic/SKILL.md` | Detect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARP Inspection (DAI), Wireshark packet analysis,... |
-| `detecting-command-and-control-over-dns` | `detecting-command-and-control-over-dns/SKILL.md` | 'Detect command-and-control (C2) traffic tunneled over DNS from tools like Iodine, dnscat2, dns2tcp, and Cobalt Strik... |
-| `detecting-dns-exfiltration-with-dns-query-analysis` | `detecting-dns-exfiltration-with-dns-query-analysis/SKILL.md` | Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomai... |
-| `detecting-exfiltration-over-dns-with-zeek` | `detecting-exfiltration-over-dns-with-zeek/SKILL.md` | Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains, oversized TXT/NULL records,... |
-| `detecting-lateral-movement-in-network` | `detecting-lateral-movement-in-network/SKILL.md` | 'Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB t... |
-| `detecting-lateral-movement-with-zeek` | `detecting-lateral-movement-with-zeek/SKILL.md` | 'Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log,... |
-| `detecting-network-anomalies-with-zeek` | `detecting-network-anomalies-with-zeek/SKILL.md` | Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTT... |
-| `detecting-network-scanning-with-ids-signatures` | `detecting-network-scanning-with-ids-signatures/SKILL.md` | Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection ru... |
-| `detecting-port-scanning-with-fail2ban` | `detecting-port-scanning-with-fail2ban/SKILL.md` | 'Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and ... |
-| `exploiting-bgp-hijacking-vulnerabilities` | `exploiting-bgp-hijacking-vulnerabilities/SKILL.md` | 'Analyzes and simulates BGP hijacking scenarios in authorized lab environments to assess route origin validation, RPK... |
-| `exploiting-ipv6-vulnerabilities` | `exploiting-ipv6-vulnerabilities/SKILL.md` | 'Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and I... |
-| `exploiting-smb-vulnerabilities-with-metasploit` | `exploiting-smb-vulnerabilities-with-metasploit/SKILL.md` | 'Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests ... |
-| `implementing-bgp-security-with-rpki` | `implementing-bgp-security-with-rpki/SKILL.md` | Implement RPKI-based BGP route origin validation by creating Route Origin Authorizations (ROAs) at RIRs (ARIN, RIPE, ... |
-| `implementing-browser-isolation-for-zero-trust` | `implementing-browser-isolation-for-zero-trust/SKILL.md` | 'Deploys remote browser isolation (RBI) as a core component of a Zero Trust architecture. Implements isolation polici... |
-| `implementing-ddos-mitigation-with-cloudflare` | `implementing-ddos-mitigation-with-cloudflare/SKILL.md` | Configure Cloudflare DDoS protection with managed rulesets, rate limiting, WAF rules, Bot Management, and origin prot... |
-| `implementing-network-access-control` | `implementing-network-access-control/SKILL.md` | 'Implements 802.1X port-based network access control using RADIUS authentication, PacketFence NAC, and switch configu... |
-| `implementing-network-access-control-with-cisco-ise` | `implementing-network-access-control-with-cisco-ise/SKILL.md` | Deploys Cisco Identity Services Engine (ISE) as a RADIUS policy server for 802.1X wired and wireless authentication, ... |
-| `implementing-network-intrusion-prevention-with-suricata` | `implementing-network-intrusion-prevention-with-suricata/SKILL.md` | Deploys and configures Suricata as an inline network intrusion prevention system, covering IPS mode setup (NFQueue), ... |
-| `implementing-network-segmentation-with-firewall-zones` | `implementing-network-segmentation-with-firewall-zones/SKILL.md` | Designs and implements network segmentation using firewall security zones, VLANs, inter-zone ACLs, and workload-level... |
-| `implementing-network-traffic-analysis-with-arkime` | `implementing-network-traffic-analysis-with-arkime/SKILL.md` | Queries Arkime (formerly Moloch) full packet capture via its API to search sessions, download PCAPs, detect C2 beacon... |
-| `implementing-network-traffic-baselining` | `implementing-network-traffic-baselining/SKILL.md` | Builds network traffic baselines from NetFlow/IPFIX CSV or JSON exports using Python pandas, computing hourly/daily v... |
-| `implementing-next-generation-firewall-with-palo-alto` | `implementing-next-generation-firewall-with-palo-alto/SKILL.md` | Configures and deploys Palo Alto Networks next-generation firewalls end-to-end, covering App-ID application-aware pol... |
-| `performing-arp-spoofing-attack-simulation` | `performing-arp-spoofing-attack-simulation/SKILL.md` | 'Simulates ARP spoofing/cache-poisoning attacks in authorized lab or pentest environments using arpspoof, Ettercap, a... |
-| `performing-bandwidth-throttling-attack-simulation` | `performing-bandwidth-throttling-attack-simulation/SKILL.md` | 'Simulate bandwidth throttling and network degradation attacks using tc, iperf3, and Scapy in authorized lab environm... |
-| `performing-dns-enumeration-and-zone-transfer` | `performing-dns-enumeration-and-zone-transfer/SKILL.md` | 'Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authori... |
-| `performing-network-traffic-analysis-with-tshark` | `performing-network-traffic-analysis-with-tshark/SKILL.md` | Automate network traffic analysis using tshark (Wireshark CLI) and pyshark to compute protocol distribution statistic... |
-| `performing-network-traffic-analysis-with-zeek` | `performing-network-traffic-analysis-with-zeek/SKILL.md` | Deploy Zeek (formerly Bro) as a passive network security monitor to generate structured logs of protocol metadata (HT... |
-| `performing-packet-injection-attack` | `performing-packet-injection-attack/SKILL.md` | 'Crafts and injects custom network packets using Scapy, hping3, and Nemesis during authorized security assessments to... |
-| `performing-ssl-stripping-attack` | `performing-ssl-stripping-attack/SKILL.md` | Simulates SSL stripping / HTTPS downgrade attacks using sslstrip, Bettercap, and mitmproxy in authorized lab environm... |
-| `performing-ssl-tls-inspection-configuration` | `performing-ssl-tls-inspection-configuration/SKILL.md` | Configure SSL/TLS break-and-inspect on next-generation firewalls and forward proxies to decrypt, inspect, and re-encr... |
-| `performing-ssl-tls-security-assessment` | `performing-ssl-tls-security-assessment/SKILL.md` | Assess SSL/TLS server configurations using the sslyze Python scanning library to evaluate supported protocol versions... |
-| `performing-vlan-hopping-attack` | `performing-vlan-hopping-attack/SKILL.md` | Simulates VLAN hopping attacks using switch spoofing and 802.1Q double tagging techniques in authorized lab environme... |
-| `performing-wifi-password-cracking-with-aircrack` | `performing-wifi-password-cracking-with-aircrack/SKILL.md` | 'Captures WPA/WPA2 handshakes and performs offline password cracking using aircrack-ng, hashcat, and dictionary attac... |
-| `performing-wireless-security-assessment-with-kismet` | `performing-wireless-security-assessment-with-kismet/SKILL.md` | Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encrypti... |
-| `scanning-network-with-nmap-advanced` | `scanning-network-with-nmap-advanced/SKILL.md` | 'Performs advanced network recon using Nmap''s Scripting Engine (NSE), timing controls, firewall/IDS evasion, and str... |
-
-### OFFENSIVE SECURITY (2 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `implementing-attack-surface-management` | `implementing-attack-surface-management/SKILL.md` | 'Implements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder, ht... |
-| `performing-binary-exploitation-analysis` | `performing-binary-exploitation-analysis/SKILL.md` | 'Analyze ELF binaries for memory-corruption vulnerabilities and build proof-of-concept exploits using pwntools, check... |
-
-### OT ICS SECURITY (28 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `detecting-anomalies-in-industrial-control-systems` | `detecting-anomalies-in-industrial-control-systems/SKILL.md` | Deploys anomaly detection for OT/ICS environments using machine learning on OT network baselines, physics-based proce... |
-| `detecting-attacks-on-historian-servers` | `detecting-attacks-on-historian-servers/SKILL.md` | 'Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL) using a Python det... |
-| `detecting-attacks-on-scada-systems` | `detecting-attacks-on-scada-systems/SKILL.md` | 'This skill covers detecting cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) systems includi... |
-| `detecting-dnp3-protocol-anomalies` | `detecting-dnp3-protocol-anomalies/SKILL.md` | Detect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmwa... |
-| `detecting-modbus-command-injection-attacks` | `detecting-modbus-command-injection-attacks/SKILL.md` | Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalou... |
-| `detecting-modbus-protocol-anomalies` | `detecting-modbus-protocol-anomalies/SKILL.md` | Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validat... |
-| `detecting-stuxnet-style-attacks` | `detecting-stuxnet-style-attacks/SKILL.md` | 'Detects sophisticated cyber-physical attacks that follow the Stuxnet pattern of modifying PLC logic while spoofing s... |
-| `implementing-conduit-security-for-ot-remote-access` | `implementing-conduit-security-for-ot-remote-access/SKILL.md` | 'Implements secure conduit architecture for OT remote access under the IEC 62443 zones-and-conduits model, deploying ... |
-| `implementing-dragos-platform-for-ot-monitoring` | `implementing-dragos-platform-for-ot-monitoring/SKILL.md` | Deploys and configures Dragos Platform sensors and detection analytics for OT/ICS network monitoring, using industria... |
-| `implementing-ics-firewall-with-tofino` | `implementing-ics-firewall-with-tofino/SKILL.md` | 'Deploys and configures Tofino industrial firewalls (Belden/Hirschmann) to protect SCADA systems and PLCs, using deep... |
-| `implementing-iec-62443-security-zones` | `implementing-iec-62443-security-zones/SKILL.md` | 'Designs security zones and conduits for industrial control systems (IACS) per IEC 62443-3-2 — risk-based zone partit... |
-| `implementing-nerc-cip-compliance-controls` | `implementing-nerc-cip-compliance-controls/SKILL.md` | 'Implements NERC CIP controls for Bulk Electric System (BES) cyber systems: asset categorization (CIP-002), electroni... |
-| `implementing-network-segmentation-for-ot` | `implementing-network-segmentation-for-ot/SKILL.md` | 'Implements OT network segmentation using VLANs, OT-aware firewalls, data diodes, and IEC 62443 zone/conduit architec... |
-| `implementing-ot-incident-response-playbook` | `implementing-ot-incident-response-playbook/SKILL.md` | 'Develops OT-specific incident response playbooks using a SANS PICERL-based Python engine that classifies incident se... |
-| `implementing-ot-network-traffic-analysis-with-nozomi` | `implementing-ot-network-traffic-analysis-with-nozomi/SKILL.md` | 'Deploy Nozomi Networks Guardian sensors for passive OT network traffic analysis, providing asset visibility, behavio... |
-| `implementing-patch-management-for-ot-systems` | `implementing-patch-management-for-ot-systems/SKILL.md` | 'Implements a structured patch management program for OT/ICS environments where IT-style patching can cause process d... |
-| `implementing-purdue-model-network-segmentation` | `implementing-purdue-model-network-segmentation/SKILL.md` | 'Implement network segmentation based on the Purdue Enterprise Reference Architecture (PERA) model, separating ICS ne... |
-| `performing-ics-asset-discovery-with-claroty` | `performing-ics-asset-discovery-with-claroty/SKILL.md` | 'Performs ICS/OT asset discovery with Claroty xDome, combining passive monitoring and Claroty Edge active queries to ... |
-| `performing-oil-gas-cybersecurity-assessment` | `performing-oil-gas-cybersecurity-assessment/SKILL.md` | Conduct cybersecurity assessments of upstream, midstream, and downstream oil and gas operations, covering pipeline SC... |
-| `performing-ot-network-security-assessment` | `performing-ot-network-security-assessment/SKILL.md` | 'This skill covers conducting comprehensive security assessments of Operational Technology (OT) networks including SC... |
-| `performing-ot-vulnerability-assessment-with-claroty` | `performing-ot-vulnerability-assessment-with-claroty/SKILL.md` | Perform OT vulnerability assessments using the Claroty xDome platform for asset discovery, risk scoring, and vulnerab... |
-| `performing-ot-vulnerability-scanning-safely` | `performing-ot-vulnerability-scanning-safely/SKILL.md` | 'Perform vulnerability scanning in OT/ICS environments safely using passive monitoring, native protocol queries, and ... |
-| `performing-plc-firmware-security-analysis` | `performing-plc-firmware-security-analysis/SKILL.md` | 'This skill covers analyzing Programmable Logic Controller (PLC) firmware for security vulnerabilities including hard... |
-| `performing-power-grid-cybersecurity-assessment` | `performing-power-grid-cybersecurity-assessment/SKILL.md` | Conduct cybersecurity assessments of power grid infrastructure spanning generation, transmission substations, distrib... |
-| `performing-s7comm-protocol-security-analysis` | `performing-s7comm-protocol-security-analysis/SKILL.md` | 'Perform security analysis of Siemens S7comm and S7CommPlus protocols used by SIMATIC S7 PLCs to identify vulnerabili... |
-| `performing-scada-hmi-security-assessment` | `performing-scada-hmi-security-assessment/SKILL.md` | 'Perform security assessments of SCADA Human-Machine Interface (HMI) systems to identify vulnerabilities in web-based... |
-| `securing-historian-server-in-ot-environment` | `securing-historian-server-in-ot-environment/SKILL.md` | 'Audits and hardens process historian servers (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environm... |
-| `securing-remote-access-to-ot-environment` | `securing-remote-access-to-ot-environment/SKILL.md` | 'Designs and configures secure remote access to OT/ICS environments for operators, engineers, and vendors: jump serve... |
-
-### OT SECURITY (1 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `monitoring-scada-modbus-traffic-anomalies` | `monitoring-scada-modbus-traffic-anomalies/SKILL.md` | 'Monitors Modbus TCP traffic on SCADA and ICS networks to detect anomalous function code usage, unauthorized register... |
-
-### PENETRATION TESTING (21 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `conducting-api-security-testing` | `conducting-api-security-testing/SKILL.md` | 'Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorizati... |
-| `conducting-external-reconnaissance-with-osint` | `conducting-external-reconnaissance-with-osint/SKILL.md` | Conduct external recon using OSINT techniques to map an organization's external attack surface without touching targe... |
-| `conducting-internal-network-penetration-test` | `conducting-internal-network-penetration-test/SKILL.md` | Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral... |
-| `conducting-mobile-app-penetration-test` | `conducting-mobile-app-penetration-test/SKILL.md` | 'Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security ... |
-| `conducting-network-penetration-test` | `conducting-network-penetration-test/SKILL.md` | 'Conducts comprehensive network penetration tests against authorized target environments by performing host discovery... |
-| `conducting-social-engineering-penetration-test` | `conducting-social-engineering-penetration-test/SKILL.md` | Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishi... |
-| `conducting-wireless-network-penetration-test` | `conducting-wireless-network-penetration-test/SKILL.md` | 'Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for ... |
-| `executing-active-directory-attack-simulation` | `executing-active-directory-attack-simulation/SKILL.md` | 'Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak cre... |
-| `executing-phishing-simulation-campaign` | `executing-phishing-simulation-campaign/SKILL.md` | 'Executes authorized phishing simulation campaigns to assess an organization''s susceptibility to email-based social ... |
-| `executing-red-team-exercise` | `executing-red-team-exercise/SKILL.md` | 'Run a stealthy, MITRE ATT&CK-mapped adversary emulation against an organization''s people, processes, and technology... |
-| `exploiting-sql-injection-vulnerabilities` | `exploiting-sql-injection-vulnerabilities/SKILL.md` | 'Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using ... |
-| `moving-laterally-with-netexec` | `moving-laterally-with-netexec/SKILL.md` | Use NetExec (nxc) to validate credentials, enumerate SMB shares/users/policy, password-spray safely across lockout th... |
-| `performing-active-directory-penetration-test` | `performing-active-directory-penetration-test/SKILL.md` | Conduct a focused Active Directory penetration test using BloodHound, Impacket, Certipy, Rubeus, and NetExec to enume... |
-| `performing-external-network-penetration-test` | `performing-external-network-penetration-test/SKILL.md` | Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructu... |
-| `performing-iot-security-assessment` | `performing-iot-security-assessment/SKILL.md` | 'Performs comprehensive security assessments of IoT devices and their ecosystems by testing hardware interfaces, firm... |
-| `performing-privilege-escalation-assessment` | `performing-privilege-escalation-assessment/SKILL.md` | 'Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privil... |
-| `performing-thick-client-application-penetration-test` | `performing-thick-client-application-penetration-test/SKILL.md` | Conduct a thick client application penetration test to identify insecure local storage, hardcoded credentials, DLL hi... |
-| `performing-vulnerability-scanning-with-nessus` | `performing-vulnerability-scanning-with-nessus/SKILL.md` | 'Performs authenticated and unauthenticated vulnerability scanning using Tenable Nessus to identify known vulnerabili... |
-| `performing-web-application-penetration-test` | `performing-web-application-penetration-test/SKILL.md` | 'Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) metho... |
-| `performing-wireless-network-penetration-test` | `performing-wireless-network-penetration-test/SKILL.md` | Execute a wireless network penetration test to assess WiFi security by capturing handshakes, cracking WPA2/WPA3 keys,... |
-| `testing-for-xss-vulnerabilities` | `testing-for-xss-vulnerabilities/SKILL.md` | Tests web applications for reflected, stored, and DOM-based Cross-Site Scripting by injecting JavaScript payloads wit... |
-
-### PHISHING DEFENSE (15 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-malicious-url-with-urlscan` | `analyzing-malicious-url-with-urlscan/SKILL.md` | URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP t... |
-| `building-phishing-reporting-button-workflow` | `building-phishing-reporting-button-workflow/SKILL.md` | Implement a phishing report button (Microsoft 365 built-in Report button or third-party like KnowBe4/Cofense) in emai... |
-| `detecting-business-email-compromise` | `detecting-business-email-compromise/SKILL.md` | Detect Business Email Compromise (BEC) fraud, where attackers impersonate executives or vendors to trick employees in... |
-| `detecting-business-email-compromise-with-ai` | `detecting-business-email-compromise-with-ai/SKILL.md` | Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style,... |
-| `detecting-qr-code-phishing-with-email-security` | `detecting-qr-code-phishing-with-email-security/SKILL.md` | Detect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link... |
-| `detecting-spearphishing-with-email-gateway` | `detecting-spearphishing-with-email-gateway/SKILL.md` | Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by con... |
-| `implementing-anti-phishing-training-program` | `implementing-anti-phishing-training-program/SKILL.md` | Guides designing, deploying, and measuring an anti-phishing security awareness program - baseline phishing simulation... |
-| `implementing-dmarc-dkim-spf-email-security` | `implementing-dmarc-dkim-spf-email-security/SKILL.md` | Configures SPF, DKIM, and DMARC DNS TXT records to authenticate outbound email, prevent domain spoofing, and enforce ... |
-| `implementing-email-sandboxing-with-proofpoint` | `implementing-email-sandboxing-with-proofpoint/SKILL.md` | Email sandboxing detonates suspicious attachments and URLs in isolated environments to detect zero-day malware and ev... |
-| `implementing-google-workspace-phishing-protection` | `implementing-google-workspace-phishing-protection/SKILL.md` | Configures Google Workspace advanced phishing and malware protection settings in the Admin Console — pre-delivery mes... |
-| `implementing-mimecast-targeted-attack-protection` | `implementing-mimecast-targeted-attack-protection/SKILL.md` | Deploys and configures Mimecast Targeted Threat Protection (TTP) modules -- URL Protect (click-time URL rewriting/ana... |
-| `implementing-proofpoint-email-security-gateway` | `implementing-proofpoint-email-security-gateway/SKILL.md` | Deploy and configure Proofpoint Email Protection as a secure email gateway to detect and block phishing, malware, BEC... |
-| `performing-adversary-in-the-middle-phishing-detection` | `performing-adversary-in-the-middle-phishing-detection/SKILL.md` | Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evi... |
-| `performing-dmarc-policy-enforcement-rollout` | `performing-dmarc-policy-enforcement-rollout/SKILL.md` | Execute a phased DMARC rollout by inventorying sending sources, configuring SPF/DKIM alignment, and progressing DNS p... |
-| `performing-phishing-simulation-with-gophish` | `performing-phishing-simulation-with-gophish/SKILL.md` | Deploy and run authorized phishing awareness campaigns with GoPhish, covering admin panel setup, SMTP sending profile... |
-
-### PRIVACY COMPLIANCE (2 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `implementing-gdpr-data-subject-access-request` | `implementing-gdpr-data-subject-access-request/SKILL.md` | 'Automates GDPR Data Subject Access Request (DSAR) workflows including identity verification, PII discovery across da... |
-| `performing-privacy-impact-assessment` | `performing-privacy-impact-assessment/SKILL.md` | 'Automates the Privacy Impact Assessment (PIA) workflow including data flow mapping, privacy risk scoring matrices, G... |
-
-### PURPLE TEAM (1 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `performing-purple-team-atomic-testing` | `performing-purple-team-atomic-testing/SKILL.md` | 'Executes Atomic Red Team tests mapped to MITRE ATT&CK via Invoke-AtomicRedTeam PowerShell, generates ATT&CK Navigato... |
-
-### RANSOMWARE DEFENSE (13 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-ransomware-payment-wallets` | `analyzing-ransomware-payment-wallets/SKILL.md` | 'Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletEx... |
-| `building-ransomware-playbook-with-cisa-framework` | `building-ransomware-playbook-with-cisa-framework/SKILL.md` | Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cyberse... |
-| `deploying-decoy-files-for-ransomware-detection` | `deploying-decoy-files-for-ransomware-detection/SKILL.md` | 'Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses s... |
-| `deploying-ransomware-canary-files` | `deploying-ransomware-canary-files/SKILL.md` | Deploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-valu... |
-| `detecting-ransomware-encryption-behavior` | `detecting-ransomware-encryption-behavior/SKILL.md` | 'Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring (Sysmon, watc... |
-| `detecting-ransomware-precursors-in-network` | `detecting-ransomware-precursors-in-network/SKILL.md` | 'Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access brok... |
-| `implementing-anti-ransomware-group-policy` | `implementing-anti-ransomware-group-policy/SKILL.md` | 'Configures Windows Group Policy Objects to block ransomware execution and lateral spread, covering AppLocker rules, ... |
-| `implementing-honeypot-for-ransomware-detection` | `implementing-honeypot-for-ransomware-detection/SKILL.md` | 'Deploys canary files, honeypot shares, and decoy systems to detect ransomware activity at the earliest possible stag... |
-| `implementing-immutable-backup-with-restic` | `implementing-immutable-backup-with-restic/SKILL.md` | 'Implements ransomware-resistant backups using restic with S3-compatible Object Lock (AWS S3, MinIO, Backblaze B2), a... |
-| `implementing-ransomware-backup-strategy` | `implementing-ransomware-backup-strategy/SKILL.md` | 'Designs a ransomware-resilient backup strategy using the 3-2-1-1-0 methodology (3 copies, 2 media types, 1 offsite, ... |
-| `implementing-ransomware-kill-switch-detection` | `implementing-ransomware-kill-switch-detection/SKILL.md` | 'Analyzes ransomware kill switch mechanisms, including mutex-based execution guards, domain-based kill switches (e.g.... |
-| `performing-ransomware-tabletop-exercise` | `performing-ransomware-tabletop-exercise/SKILL.md` | 'Plans and facilitates tabletop exercises simulating ransomware incidents, using realistic scenarios based on threat ... |
-| `recovering-from-ransomware-attack` | `recovering-from-ransomware-attack/SKILL.md` | 'Executes structured ransomware incident recovery following NIST/CISA frameworks: environment isolation, forensic evi... |
-
-### RED TEAM (2 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `performing-active-directory-forest-trust-attack` | `performing-active-directory-forest-trust-attack/SKILL.md` | Enumerate and audit Active Directory forest trust relationships using Impacket for SID filtering analysis, trust key ... |
-| `performing-red-team-with-covenant` | `performing-red-team-with-covenant/SKILL.md` | Conducts red team operations using the Covenant C2 framework for authorized adversary simulation, covering listener s... |
-
-### RED TEAMING (33 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `abusing-dpapi-for-credential-access` | `abusing-dpapi-for-credential-access/SKILL.md` | Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, K... |
-| `abusing-shadow-credentials-for-privesc` | `abusing-shadow-credentials-for-privesc/SKILL.md` | Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Cred... |
-| `building-c2-infrastructure-with-sliver-framework` | `building-c2-infrastructure-with-sliver-framework/SKILL.md` | Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol li... |
-| `building-c2-redirector-infrastructure` | `building-c2-redirector-infrastructure/SKILL.md` | Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filte... |
-| `building-red-team-c2-infrastructure-with-havoc` | `building-red-team-c2-infrastructure-with-havoc/SKILL.md` | Deploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMB listeners, Nginx redirectors, and Demon agent... |
-| `coercing-authentication-with-coercer-petitpotam` | `coercing-authentication-with-coercer-petitpotam/SKILL.md` | Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) v... |
-| `conducting-domain-persistence-with-dcsync` | `conducting-domain-persistence-with-dcsync/SKILL.md` | Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domai... |
-| `conducting-full-scope-red-team-engagement` | `conducting-full-scope-red-team-engagement/SKILL.md` | Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, ... |
-| `conducting-internal-reconnaissance-with-bloodhound-ce` | `conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md` | Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHo... |
-| `conducting-pass-the-ticket-attack` | `conducting-pass-the-ticket-attack/SKILL.md` | Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromi... |
-| `conducting-social-engineering-pretext-call` | `conducting-social-engineering-pretext-call/SKILL.md` | Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engine... |
-| `conducting-spearphishing-simulation-campaign` | `conducting-spearphishing-simulation-campaign/SKILL.md` | Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (H... |
-| `executing-red-team-engagement-planning` | `executing-red-team-engagement-planning/SKILL.md` | Build the foundational red team engagement plan - scope definition, Rules of Engagement (restrictions, communication ... |
-| `exploiting-active-directory-certificate-services-esc1` | `exploiting-active-directory-certificate-services-esc1/SKILL.md` | Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as hig... |
-| `exploiting-active-directory-with-bloodhound` | `exploiting-active-directory-with-bloodhound/SKILL.md` | BloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintend... |
-| `exploiting-adcs-with-certipy` | `exploiting-adcs-with-certipy/SKILL.md` | Use Certipy to enumerate AD CS certificate authorities and templates over LDAP/RPC, then exploit ESC1-ESC16 misconfig... |
-| `exploiting-constrained-delegation-abuse` | `exploiting-constrained-delegation-abuse/SKILL.md` | Exploits Kerberos Constrained Delegation misconfigurations in Active Directory using Impacket's findDelegation.py and... |
-| `exploiting-kerberoasting-with-impacket` | `exploiting-kerberoasting-with-impacket/SKILL.md` | Performs Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py to request Kerberos TGS tickets for S... |
-| `exploiting-ms17-010-eternalblue-vulnerability` | `exploiting-ms17-010-eternalblue-vulnerability/SKILL.md` | Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementatio... |
-| `exploiting-nopac-cve-2021-42278-42287` | `exploiting-nopac-cve-2021-42278-42287/SKILL.md` | Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278 sAMAccountName spoofing plus CVE-2021-... |
-| `exploiting-zerologon-vulnerability-cve-2020-1472` | `exploiting-zerologon-vulnerability-cve-2020-1472/SKILL.md` | Exploits the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol using Impacket to reset a domain... |
-| `mapping-attack-paths-with-bloodhound-ce` | `mapping-attack-paths-with-bloodhound-ce/SKILL.md` | Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edi... |
-| `operating-havoc-c2` | `operating-havoc-c2/SKILL.md` | Deploy a Havoc C2 team server with Yaotl malleable profiles, generate evasive Demon agents using indirect syscalls an... |
-| `operating-sliver-c2` | `operating-sliver-c2/SKILL.md` | Stand up a Sliver C2 server and mTLS listeners, generate cross-platform implants and beacons, and run post-exploitati... |
-| `performing-active-directory-bloodhound-analysis` | `performing-active-directory-bloodhound-analysis/SKILL.md` | Use BloodHound and SharpHound (or AzureHound) to enumerate Active Directory relationships and graph attack paths from... |
-| `performing-credential-access-with-lazagne` | `performing-credential-access-with-lazagne/SKILL.md` | Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords f... |
-| `performing-initial-access-with-evilginx3` | `performing-initial-access-with-evilginx3/SKILL.md` | Perform authorized initial access using EvilGinx3 adversary-in-the-middle phishing framework to capture session token... |
-| `performing-kerberoasting-attack` | `performing-kerberoasting-attack/SKILL.md` | Perform Kerberoasting, a post-exploitation technique that enumerates Active Directory service accounts with Service P... |
-| `performing-lateral-movement-with-wmiexec` | `performing-lateral-movement-with-wmiexec/SKILL.md` | Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiex... |
-| `performing-open-source-intelligence-gathering` | `performing-open-source-intelligence-gathering/SKILL.md` | Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collec... |
-| `performing-physical-intrusion-assessment` | `performing-physical-intrusion-assessment/SKILL.md` | Conduct authorized physical penetration testing against facilities, server rooms, and restricted areas using tailgati... |
-| `performing-privilege-escalation-on-linux` | `performing-privilege-escalation-on-linux/SKILL.md` | Guides manual enumeration and automated tooling to escalate from a low-privilege Linux user to root by exploiting mis... |
-| `relaying-ntlm-for-adcs-esc8` | `relaying-ntlm-for-adcs-esc8/SKILL.md` | Uses Impacket's ntlmrelayx.py with a coercion tool (PetitPotam, Coercer, printerbug) to relay NTLM authentication fro... |
-
-### SECURITY OPERATIONS (28 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-api-gateway-access-logs` | `analyzing-api-gateway-access-logs/SKILL.md` | 'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, creden... |
-| `analyzing-azure-activity-logs-for-threats` | `analyzing-azure-activity-logs-for-threats/SKILL.md` | 'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative ope... |
-| `analyzing-memory-forensics-with-lime-and-volatility` | `analyzing-memory-forensics-with-lime-and-volatility/SKILL.md` | 'Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 f... |
-| `analyzing-powershell-script-block-logging` | `analyzing-powershell-script-block-logging/SKILL.md` | Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded pay... |
-| `analyzing-tls-certificate-transparency-logs` | `analyzing-tls-certificate-transparency-logs/SKILL.md` | 'Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate is... |
-| `analyzing-web-server-logs-for-intrusion` | `analyzing-web-server-logs-for-intrusion/SKILL.md` | Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web s... |
-| `detecting-beaconing-patterns-with-zeek` | `detecting-beaconing-patterns-with-zeek/SKILL.md` | 'Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT li... |
-| `detecting-insider-data-exfiltration-via-dlp` | `detecting-insider-data-exfiltration-via-dlp/SKILL.md` | 'Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies,... |
-| `detecting-sql-injection-via-waf-logs` | `detecting-sql-injection-via-waf-logs/SKILL.md` | Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit ... |
-| `detecting-supply-chain-attacks-in-ci-cd` | `detecting-supply-chain-attacks-in-ci-cd/SKILL.md` | 'Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned ... |
-| `extracting-memory-artifacts-with-rekall` | `extracting-memory-artifacts-with-rekall/SKILL.md` | 'Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalie... |
-| `hunting-credential-stuffing-attacks` | `hunting-credential-stuffing-attacks/SKILL.md` | 'Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, pa... |
-| `implementing-canary-tokens-for-network-intrusion` | `implementing-canary-tokens-for-network-intrusion/SKILL.md` | 'Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lat... |
-| `implementing-ebpf-security-monitoring` | `implementing-ebpf-security-monitoring/SKILL.md` | 'Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network co... |
-| `implementing-endpoint-detection-with-wazuh` | `implementing-endpoint-detection-with-wazuh/SKILL.md` | Deploys and configures Wazuh SIEM/XDR for endpoint detection, covering agent authentication and management, custom de... |
-| `implementing-honeytokens-for-breach-detection` | `implementing-honeytokens-for-breach-detection/SKILL.md` | 'Deploys canary tokens and honeytokens (fake AWS credentials, DNS canaries, document beacons, database records) that ... |
-| `implementing-log-forwarding-with-fluentd` | `implementing-log-forwarding-with-fluentd/SKILL.md` | Configures Fluent Bit as an endpoint log forwarder and Fluentd as the central aggregator for centralized log collecti... |
-| `implementing-log-integrity-with-blockchain` | `implementing-log-integrity-with-blockchain/SKILL.md` | Builds an append-only log integrity chain using SHA-256 hash chaining, where each entry incorporates the previous ent... |
-| `implementing-mtls-for-zero-trust-services` | `implementing-mtls-for-zero-trust-services/SKILL.md` | 'Configures mutual TLS (mTLS) authentication between microservices using Python cryptography library for certificate ... |
-| `implementing-security-chaos-engineering` | `implementing-security-chaos-engineering/SKILL.md` | 'Implements security chaos engineering experiments that deliberately disable or degrade security controls to verify d... |
-| `implementing-security-monitoring-with-datadog` | `implementing-security-monitoring-with-datadog/SKILL.md` | 'Implements security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection to... |
-| `implementing-siem-correlation-rules-for-apt` | `implementing-siem-correlation-rules-for-apt/SKILL.md` | Write multi-event correlation rules in Splunk SPL and Sigma format that detect APT lateral movement by chaining Windo... |
-| `implementing-siem-use-case-tuning` | `implementing-siem-use-case-tuning/SKILL.md` | Tune SIEM detection rules in Splunk and Elastic to reduce false positives by analyzing alert volumes, creating contex... |
-| `implementing-soar-playbook-for-phishing` | `implementing-soar-playbook-for-phishing/SKILL.md` | Automates phishing incident response by calling the Splunk SOAR (Phantom) REST API to create containers, attach artif... |
-| `implementing-syslog-centralization-with-rsyslog` | `implementing-syslog-centralization-with-rsyslog/SKILL.md` | Configure rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation, generating ... |
-| `performing-dns-tunneling-detection` | `performing-dns-tunneling-detection/SKILL.md` | 'Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspect... |
-| `performing-red-team-phishing-with-gophish` | `performing-red-team-phishing-with-gophish/SKILL.md` | Automates GoPhish phishing simulation campaigns using the Python gophish library, creating email templates with track... |
-| `performing-ssrf-vulnerability-exploitation` | `performing-ssrf-vulnerability-exploitation/SKILL.md` | Tests web application URL parameters for Server-Side Request Forgery by probing cloud metadata endpoints (AWS/GCP/Azu... |
-
-### SOC OPERATIONS (35 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-dns-logs-for-exfiltration` | `analyzing-dns-logs-for-exfiltration/SKILL.md` | 'Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 chann... |
-| `analyzing-windows-event-logs-in-splunk` | `analyzing-windows-event-logs-in-splunk/SKILL.md` | 'Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escal... |
-| `building-automated-malware-submission-pipeline` | `building-automated-malware-submission-pipeline/SKILL.md` | 'Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and email... |
-| `building-detection-rule-with-splunk-spl` | `building-detection-rule-with-splunk-spl/SKILL.md` | Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify securi... |
-| `building-detection-rules-with-sigma` | `building-detection-rules-with-sigma/SKILL.md` | 'Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms includ... |
-| `building-incident-response-dashboard` | `building-incident-response-dashboard/SKILL.md` | 'Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership ... |
-| `building-soc-escalation-matrix` | `building-soc-escalation-matrix/SKILL.md` | Build a structured SOC escalation matrix defining severity tiers, response SLAs, tiered escalation paths, and notific... |
-| `building-soc-metrics-and-kpi-tracking` | `building-soc-metrics-and-kpi-tracking/SKILL.md` | 'Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respon... |
-| `building-soc-playbook-for-ransomware` | `building-soc-playbook-for-ransomware/SKILL.md` | 'Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradicati... |
-| `building-threat-intelligence-enrichment-in-splunk` | `building-threat-intelligence-enrichment-in-splunk/SKILL.md` | Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collec... |
-| `building-threat-intelligence-feed-integration` | `building-threat-intelligence-feed-integration/SKILL.md` | 'Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat inte... |
-| `building-vulnerability-scanning-workflow` | `building-vulnerability-scanning-workflow/SKILL.md` | 'Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, priori... |
-| `correlating-security-events-in-qradar` | `correlating-security-events-in-qradar/SKILL.md` | 'Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and o... |
-| `detecting-entra-offensive-tools-in-graph-logs` | `detecting-entra-offensive-tools-in-graph-logs/SKILL.md` | Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics using KQL to fingerprint... |
-| `hunting-saas-sso-token-abuse` | `hunting-saas-sso-token-abuse/SKILL.md` | Hunts for stolen-session and OAuth/PRT token replay (T1550.001) by correlating Microsoft Entra ID SigninLogs SessionI... |
-| `implementing-alert-fatigue-reduction` | `implementing-alert-fatigue-reduction/SKILL.md` | 'Implements strategies to reduce SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, impleme... |
-| `implementing-mitre-attack-coverage-mapping` | `implementing-mitre-attack-coverage-mapping/SKILL.md` | Implement MITRE ATT&CK coverage mapping to identify detection gaps, prioritize rule development, and measure SOC dete... |
-| `implementing-siem-use-cases-for-detection` | `implementing-siem-use-cases-for-detection/SKILL.md` | 'Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mappe... |
-| `implementing-soar-automation-with-phantom` | `implementing-soar-automation-with-phantom/SKILL.md` | 'Implements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to... |
-| `implementing-soar-playbook-with-palo-alto-xsoar` | `implementing-soar-playbook-with-palo-alto-xsoar/SKILL.md` | Build automated incident response playbooks in Cortex XSOAR (Demisto) using its YAML playbook structure, integration ... |
-| `implementing-threat-modeling-with-mitre-attack` | `implementing-threat-modeling-with-mitre-attack/SKILL.md` | 'Implements threat modeling using the MITRE ATT&CK framework to map adversary TTPs against organizational assets, ass... |
-| `implementing-ticketing-system-for-incidents` | `implementing-ticketing-system-for-incidents/SKILL.md` | 'Implements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for struct... |
-| `investigating-insider-threat-indicators` | `investigating-insider-threat-indicators/SKILL.md` | 'Investigates insider threat indicators including data exfiltration attempts, unauthorized access patterns, policy vi... |
-| `investigating-phishing-email-incident` | `investigating-phishing-email-incident/SKILL.md` | 'Investigates phishing email incidents from initial user report through header analysis, URL/attachment detonation, i... |
-| `performing-alert-triage-with-elastic-siem` | `performing-alert-triage-with-elastic-siem/SKILL.md` | Perform systematic alert triage in Elastic Security SIEM—classifying, prioritizing, and investigating alerts using Ki... |
-| `performing-deception-technology-deployment` | `performing-deception-technology-deployment/SKILL.md` | 'Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypass... |
-| `performing-false-positive-reduction-in-siem` | `performing-false-positive-reduction-in-siem/SKILL.md` | Reduces SIEM false positives through systematic rule tuning, threshold adjustment, correlation logic refinement, allo... |
-| `performing-ioc-enrichment-automation` | `performing-ioc-enrichment-automation/SKILL.md` | 'Automates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan, MI... |
-| `performing-lateral-movement-detection` | `performing-lateral-movement-detection/SKILL.md` | 'Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spre... |
-| `performing-log-source-onboarding-in-siem` | `performing-log-source-onboarding-in-siem/SKILL.md` | Perform structured log source onboarding into SIEM platforms (Splunk, Elastic, Sentinel, QRadar, or similar) by prior... |
-| `performing-purple-team-exercise` | `performing-purple-team-exercise/SKILL.md` | 'Performs purple team exercises by coordinating red team adversary emulation with blue team detection validation usin... |
-| `performing-soc-tabletop-exercise` | `performing-soc-tabletop-exercise/SKILL.md` | 'Performs tabletop exercises for SOC teams simulating security incidents through discussion-based scenarios to test i... |
-| `performing-threat-hunting-with-elastic-siem` | `performing-threat-hunting-with-elastic-siem/SKILL.md` | 'Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline inve... |
-| `performing-user-behavior-analytics` | `performing-user-behavior-analytics/SKILL.md` | 'Performs User and Entity Behavior Analytics (UEBA) to detect anomalous user activities including impossible travel, ... |
-| `triaging-security-alerts-in-splunk` | `triaging-security-alerts-in-splunk/SKILL.md` | 'Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correla... |
-
-### SOCIAL ENGINEERING DEFENSE (1 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `detecting-deepfake-audio-in-vishing-attacks` | `detecting-deepfake-audio-in-vishing-attacks/SKILL.md` | Detect AI-generated deepfake audio used in voice phishing (vishing) by extracting spectral features (MFCC, spectral c... |
-
-### SUPPLY CHAIN SECURITY (8 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-sbom-for-supply-chain-vulnerabilities` | `analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md` | 'Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities... |
-| `detecting-dependency-confusion` | `detecting-dependency-confusion/SKILL.md` | Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enum... |
-| `detecting-malicious-npm-packages` | `detecting-malicious-npm-packages/SKILL.md` | Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using Gua... |
-| `detecting-typosquatting-packages` | `detecting-typosquatting-packages/SKILL.md` | Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, usi... |
-| `detecting-typosquatting-packages-in-npm-pypi` | `detecting-typosquatting-packages-in-npm-pypi/SKILL.md` | 'Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levensht... |
-| `generating-and-analyzing-sboms` | `generating-and-analyzing-sboms/SKILL.md` | Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype,... |
-| `implementing-sigstore-for-software-signing` | `implementing-sigstore-for-software-signing/SKILL.md` | 'Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log ver... |
-| `verifying-build-provenance-with-slsa-sigstore` | `verifying-build-provenance-with-slsa-sigstore/SKILL.md` | Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-att... |
-
-### THREAT DETECTION (7 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `detecting-credential-dumping-techniques` | `detecting-credential-dumping-techniques/SKILL.md` | Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g. via Mimikatz) using Sysmon Event I... |
-| `detecting-golden-ticket-forgery` | `detecting-golden-ticket-forgery/SKILL.md` | Detect Kerberos Golden Ticket forgery (e.g. Mimikatz-forged tickets) by analyzing Windows Event ID 4769 for RC4 encry... |
-| `detecting-insider-threat-with-ueba` | `detecting-insider-threat-with-ueba/SKILL.md` | Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch to build behavioral baselines, cal... |
-| `detecting-living-off-the-land-attacks` | `detecting-living-off-the-land-attacks/SKILL.md` | 'Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creatio... |
-| `detecting-living-off-the-land-with-lolbas` | `detecting-living-off-the-land-with-lolbas/SKILL.md` | Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via proc... |
-| `detecting-pass-the-ticket-attacks` | `detecting-pass-the-ticket-attacks/SKILL.md` | Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticke... |
-| `detecting-rdp-brute-force-attacks` | `detecting-rdp-brute-force-attacks/SKILL.md` | Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon ... |
-
-### THREAT HUNTING (58 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-persistence-mechanisms-in-linux` | `analyzing-persistence-mechanisms-in-linux/SKILL.md` | Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile ... |
-| `analyzing-powershell-empire-artifacts` | `analyzing-powershell-empire-artifacts/SKILL.md` | Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Mo... |
-| `analyzing-ransomware-network-indicators` | `analyzing-ransomware-network-indicators/SKILL.md` | Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfi... |
-| `building-threat-hunt-hypothesis-framework` | `building-threat-hunt-hypothesis-framework/SKILL.md` | Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypothes... |
-| `detecting-dcsync-attack-in-active-directory` | `detecting-dcsync-attack-in-active-directory/SKILL.md` | Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract pa... |
-| `detecting-dll-sideloading-attacks` | `detecting-dll-sideloading-attacks/SKILL.md` | Detect DLL side-loading and search-order hijacking (MITRE T1574) where adversaries plant malicious DLLs for legitimat... |
-| `detecting-email-forwarding-rules-attack` | `detecting-email-forwarding-rules-attack/SKILL.md` | Detect malicious inbox/mail-flow forwarding rules that adversaries create to maintain persistent access to email comm... |
-| `detecting-golden-ticket-attacks-in-kerberos-logs` | `detecting-golden-ticket-attacks-in-kerberos-logs/SKILL.md` | Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries against domain controller event logs, l... |
-| `detecting-insider-threat-behaviors` | `detecting-insider-threat-behaviors/SKILL.md` | Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, p... |
-| `detecting-kerberoasting-attacks` | `detecting-kerberoasting-attacks/SKILL.md` | Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769) targeting service acco... |
-| `detecting-lateral-movement-with-splunk` | `detecting-lateral-movement-with-splunk/SKILL.md` | Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB t... |
-| `detecting-malicious-scheduled-tasks-with-sysmon` | `detecting-malicious-scheduled-tasks-with-sysmon/SKILL.md` | 'Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe)... |
-| `detecting-mimikatz-execution-patterns` | `detecting-mimikatz-execution-patterns/SKILL.md` | Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash i... |
-| `detecting-ntlm-relay-with-event-correlation` | `detecting-ntlm-relay-with-event-correlation/SKILL.md` | Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, id... |
-| `detecting-pass-the-hash-attacks` | `detecting-pass-the-hash-attacks/SKILL.md` | Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM... |
-| `detecting-privilege-escalation-attempts` | `detecting-privilege-escalation-attempts/SKILL.md` | Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquo... |
-| `detecting-process-hollowing-technique` | `detecting-process-hollowing-technique/SKILL.md` | Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and pare... |
-| `detecting-service-account-abuse` | `detecting-service-account-abuse/SKILL.md` | Detect abuse of service accounts by hunting for anomalous interactive logons, privilege escalation, and lateral movem... |
-| `detecting-suspicious-powershell-execution` | `detecting-suspicious-powershell-execution/SKILL.md` | Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and con... |
-| `detecting-t1003-credential-dumping-with-edr` | `detecting-t1003-credential-dumping-with-edr/SKILL.md` | Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM database, NTDS.dit, and cached credentials... |
-| `detecting-t1055-process-injection-with-sysmon` | `detecting-t1055-process-injection-with-sysmon/SKILL.md` | Detect process injection techniques (T1055) - including DLL injection, process hollowing, and APC injection - by anal... |
-| `detecting-t1548-abuse-elevation-control-mechanism` | `detecting-t1548-abuse-elevation-control-mechanism/SKILL.md` | Detect abuse of elevation control mechanisms (T1548), including Windows UAC bypass via auto-elevating binaries like f... |
-| `detecting-wmi-persistence` | `detecting-wmi-persistence/SKILL.md` | Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for maliciou... |
-| `fleet-hunting-with-velociraptor` | `fleet-hunting-with-velociraptor/SKILL.md` | Deploy a Velociraptor server and agents, then author VQL (Velociraptor Query Language) artifacts and run them as flee... |
-| `hunting-evtx-with-chainsaw` | `hunting-evtx-with-chainsaw/SKILL.md` | Run Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and... |
-| `hunting-for-anomalous-powershell-execution` | `hunting-for-anomalous-powershell-execution/SKILL.md` | 'Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), ... |
-| `hunting-for-beaconing-with-frequency-analysis` | `hunting-for-beaconing-with-frequency-analysis/SKILL.md` | Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter... |
-| `hunting-for-cobalt-strike-beacons` | `hunting-for-cobalt-strike-beacons/SKILL.md` | Detect Cobalt Strike beacon command-and-control traffic using default TLS certificate signatures (serial 8BB00EE), JA... |
-| `hunting-for-command-and-control-beaconing` | `hunting-for-command-and-control-beaconing/SKILL.md` | Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to ... |
-| `hunting-for-data-exfiltration-indicators` | `hunting-for-data-exfiltration-indicators/SKILL.md` | Hunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via... |
-| `hunting-for-data-staging-before-exfiltration` | `hunting-for-data-staging-before-exfiltration/SKILL.md` | Detect data-staging activity (MITRE ATT&CK T1074) by analyzing EDR/Sysmon process-creation and file-system telemetry ... |
-| `hunting-for-dcom-lateral-movement` | `hunting-for-dcom-lateral-movement/SKILL.md` | 'Hunt for DCOM-based lateral movement (MITRE ATT&CK T1021.003) by detecting abuse of MMC20.Application, ShellBrowserW... |
-| `hunting-for-dcsync-attacks` | `hunting-for-dcsync-attacks/SKILL.md` | Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replicati... |
-| `hunting-for-defense-evasion-via-timestomping` | `hunting-for-defense-evasion-via-timestomping/SKILL.md` | 'Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in ... |
-| `hunting-for-dns-based-persistence` | `hunting-for-dns-based-persistence/SKILL.md` | Hunts for DNS-based persistence mechanisms such as DNS hijacking, dangling CNAME records enabling subdomain takeover,... |
-| `hunting-for-dns-tunneling-with-zeek` | `hunting-for-dns-tunneling-with-zeek/SKILL.md` | Detects DNS tunneling and covert-channel data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queri... |
-| `hunting-for-domain-fronting-c2-traffic` | `hunting-for-domain-fronting-c2-traffic/SKILL.md` | Detects domain fronting C2 traffic by analyzing SNI-vs-HTTP-Host-header mismatches in proxy logs and inspecting TLS c... |
-| `hunting-for-lateral-movement-via-wmi` | `hunting-for-lateral-movement-via-wmi/SKILL.md` | Detects WMI-based lateral movement (e.g. wmic process call create, Win32_Process.Create()) by analyzing Windows Event... |
-| `hunting-for-living-off-the-cloud-techniques` | `hunting-for-living-off-the-cloud-techniques/SKILL.md` | Hunts for adversary abuse of legitimate cloud services (Azure, AWS, GCP, and SaaS platforms) for command-and-control,... |
-| `hunting-for-living-off-the-land-binaries` | `hunting-for-living-off-the-land-binaries/SKILL.md` | Proactively hunts for adversary abuse of legitimate, signed system binaries (LOLBins) used to execute malicious paylo... |
-| `hunting-for-lolbins-execution-in-endpoint-logs` | `hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md` | Hunts for LOLBins (Living Off the Land Binaries) abuse, mapped to MITRE T1218, by analyzing endpoint process-creation... |
-| `hunting-for-ntlm-relay-attacks` | `hunting-for-ntlm-relay-attacks/SKILL.md` | Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event ID 4624 logon type 3 with NTLMSSP authenticat... |
-| `hunting-for-persistence-mechanisms-in-windows` | `hunting-for-persistence-mechanisms-in-windows/SKILL.md` | Systematically hunts for adversary persistence mechanisms across Windows endpoints, covering registry Run/RunOnce key... |
-| `hunting-for-persistence-via-wmi-subscriptions` | `hunting-for-persistence-via-wmi-subscriptions/SKILL.md` | Hunts for adversary persistence via WMI event subscriptions (MITRE T1546.003) by monitoring the creation of WMI event... |
-| `hunting-for-process-injection-techniques` | `hunting-for-process-injection-techniques/SKILL.md` | Detects process injection techniques (MITRE T1055) — including CreateRemoteThread injection, process hollowing, and D... |
-| `hunting-for-registry-persistence-mechanisms` | `hunting-for-registry-persistence-mechanisms/SKILL.md` | Hunts for registry-based persistence mechanisms (MITRE T1547) in Windows environments, including Run/RunOnce keys, Wi... |
-| `hunting-for-registry-run-key-persistence` | `hunting-for-registry-run-key-persistence/SKILL.md` | Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries ... |
-| `hunting-for-scheduled-task-persistence` | `hunting-for-scheduled-task-persistence/SKILL.md` | Runs a hypothesis-driven threat hunt for Windows Scheduled Task persistence (T1053), guiding SIEM/EDR queries against... |
-| `hunting-for-shadow-copy-deletion` | `hunting-for-shadow-copy-deletion/SKILL.md` | Runs a hypothesis-driven threat hunt for Volume Shadow Copy deletion (T1490) by querying SIEM/EDR telemetry for vssad... |
-| `hunting-for-spearphishing-indicators` | `hunting-for-spearphishing-indicators/SKILL.md` | Hunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to detect targeted... |
-| `hunting-for-startup-folder-persistence` | `hunting-for-startup-folder-persistence/SKILL.md` | Detects T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, ... |
-| `hunting-for-supply-chain-compromise` | `hunting-for-supply-chain-compromise/SKILL.md` | Runs a hypothesis-driven threat hunt for supply-chain compromise (T1195) by querying SIEM/EDR logs for trojanized sof... |
-| `hunting-for-suspicious-scheduled-tasks` | `hunting-for-suspicious-scheduled-tasks/SKILL.md` | Hunts for adversary persistence and execution via Windows scheduled tasks (T1053.005) by analyzing Security Event ID ... |
-| `hunting-for-t1098-account-manipulation` | `hunting-for-t1098-account-manipulation/SKILL.md` | Hunts for MITRE ATT&CK T1098 account manipulation - shadow admin creation, SID history injection, group membership ch... |
-| `hunting-for-unusual-network-connections` | `hunting-for-unusual-network-connections/SKILL.md` | Runs a hypothesis-driven threat hunt for command-and-control activity (T1071) by querying SIEM/EDR network telemetry ... |
-| `hunting-for-unusual-service-installations` | `hunting-for-unusual-service-installations/SKILL.md` | Detects suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event log Event ID 7045, ... |
-| `hunting-for-webshell-activity` | `hunting-for-webshell-activity/SKILL.md` | Runs a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing fil... |
-| `performing-threat-hunting-with-yara-rules` | `performing-threat-hunting-with-yara-rules/SKILL.md` | 'Use YARA pattern-matching rules to hunt for malware, suspicious files, and indicators of compromise across filesyste... |
-
-### THREAT INTELLIGENCE (52 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `analyzing-apt-group-with-mitre-navigator` | `analyzing-apt-group-with-mitre-navigator/SKILL.md` | Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-l... |
-| `analyzing-campaign-attribution-evidence` | `analyzing-campaign-attribution-evidence/SKILL.md` | Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model ... |
-| `analyzing-certificate-transparency-for-phishing` | `analyzing-certificate-transparency-for-phishing/SKILL.md` | Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates,... |
-| `analyzing-cyber-kill-chain` | `analyzing-cyber-kill-chain/SKILL.md` | 'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adver... |
-| `analyzing-indicators-of-compromise` | `analyzing-indicators-of-compromise/SKILL.md` | 'Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to ... |
-| `analyzing-malware-family-relationships-with-malpedia` | `analyzing-malware-family-relationships-with-malpedia/SKILL.md` | Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YAR... |
-| `analyzing-ransomware-leak-site-intelligence` | `analyzing-ransomware-leak-site-intelligence/SKILL.md` | Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting dat... |
-| `analyzing-threat-actor-ttps-with-mitre-attack` | `analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md` | Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage he... |
-| `analyzing-threat-actor-ttps-with-mitre-navigator` | `analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md` | 'Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to ... |
-| `analyzing-threat-intelligence-feeds` | `analyzing-threat-intelligence-feeds/SKILL.md` | 'Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, ... |
-| `analyzing-threat-landscape-with-misp` | `analyzing-threat-landscape-with-misp/SKILL.md` | Query a MISP (Malware Information Sharing Platform) instance via PyMISP to compute event statistics, IOC type breakdo... |
-| `analyzing-typosquatting-domains-with-dnstwist` | `analyzing-typosquatting-domains-with-dnstwist/SKILL.md` | Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and ... |
-| `auditing-tls-certificate-transparency-logs` | `auditing-tls-certificate-transparency-logs/SKILL.md` | 'Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT ... |
-| `automating-ioc-enrichment` | `automating-ioc-enrichment/SKILL.md` | 'Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR pl... |
-| `building-adversary-infrastructure-tracking-system` | `building-adversary-infrastructure-tracking-system/SKILL.md` | Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) tha... |
-| `building-attack-pattern-library-from-cti-reports` | `building-attack-pattern-library-from-cti-reports/SKILL.md` | Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and... |
-| `building-ioc-defanging-and-sharing-pipeline` | `building-ioc-defanging-and-sharing-pipeline/SKILL.md` | Build an automated pipeline that ingests raw IOCs (URLs, IPs, domains, emails), normalizes and deduplicates them, the... |
-| `building-ioc-enrichment-pipeline-with-opencti` | `building-ioc-enrichment-pipeline-with-opencti/SKILL.md` | Build an automated IOC enrichment pipeline on OpenCTI (STIX 2.1 native threat intel platform) using its internal enri... |
-| `building-threat-actor-profile-from-osint` | `building-threat-actor-profile-from-osint/SKILL.md` | Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and ... |
-| `building-threat-feed-aggregation-with-misp` | `building-threat-feed-aggregation-with-misp/SKILL.md` | Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correl... |
-| `building-threat-intelligence-platform` | `building-threat-intelligence-platform/SKILL.md` | Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, ... |
-| `collecting-open-source-intelligence` | `collecting-open-source-intelligence/SKILL.md` | 'Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack ... |
-| `collecting-threat-intelligence-with-misp` | `collecting-threat-intelligence-with-misp/SKILL.md` | Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmaticall... |
-| `correlating-threat-campaigns` | `correlating-threat-campaigns/SKILL.md` | 'Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify uni... |
-| `evaluating-threat-intelligence-platforms` | `evaluating-threat-intelligence-platforms/SKILL.md` | 'Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including fee... |
-| `generating-threat-intelligence-reports` | `generating-threat-intelligence-reports/SKILL.md` | 'Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to sp... |
-| `hunting-advanced-persistent-threats` | `hunting-advanced-persistent-threats/SKILL.md` | 'Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driv... |
-| `implementing-diamond-model-analysis` | `implementing-diamond-model-analysis/SKILL.md` | The Diamond Model of Intrusion Analysis provides a structured framework for analyzing cyber intrusions by examining f... |
-| `implementing-security-information-sharing-with-stix2` | `implementing-security-information-sharing-with-stix2/SKILL.md` | 'Create, validate, and share STIX 2.1 threat intelligence objects (indicators, malware, campaigns, relationships, bun... |
-| `implementing-stix-taxii-feed-integration` | `implementing-stix-taxii-feed-integration/SKILL.md` | Implements a STIX 2.1/TAXII 2.1 threat-intelligence feed consumer and producer in Python, covering TAXII server disco... |
-| `implementing-taxii-server-with-opentaxii` | `implementing-taxii-server-with-opentaxii/SKILL.md` | Deploy and configure a TAXII 2.1 server (Medallion) with Docker, publish and consume STIX 2.1 bundles across collecti... |
-| `implementing-threat-intelligence-lifecycle-management` | `implementing-threat-intelligence-lifecycle-management/SKILL.md` | Build out a full CTI program around the six-phase threat intelligence lifecycle (direction, collection, processing, a... |
-| `managing-intelligence-lifecycle` | `managing-intelligence-lifecycle/SKILL.md` | 'Manages the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processin... |
-| `mapping-mitre-attack-techniques` | `mapping-mitre-attack-techniques/SKILL.md` | 'Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-technique... |
-| `modeling-threats-with-opencti` | `modeling-threats-with-opencti/SKILL.md` | Deploy OpenCTI (Filigran) via Docker Compose and use the pycti Python client to model threat actors, intrusion sets, ... |
-| `monitoring-darkweb-sources` | `monitoring-darkweb-sources/SKILL.md` | 'Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets... |
-| `operationalizing-misp-threat-feeds` | `operationalizing-misp-threat-feeds/SKILL.md` | Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress... |
-| `performing-ai-driven-osint-correlation` | `performing-ai-driven-osint-correlation/SKILL.md` | Use AI/LLM-based reasoning with Sherlock, theHarvester, and SpiderFoot to correlate OSINT findings—usernames, emails,... |
-| `performing-brand-monitoring-for-impersonation` | `performing-brand-monitoring-for-impersonation/SKILL.md` | Monitor for brand impersonation attacks across domains, social media, mobile apps, and dark web channels to detect ph... |
-| `performing-dark-web-monitoring-for-threats` | `performing-dark-web-monitoring-for-threats/SKILL.md` | Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark w... |
-| `performing-indicator-lifecycle-management` | `performing-indicator-lifecycle-management/SKILL.md` | Tracks IOCs through discovery, enrichment/validation (VirusTotal, Shodan, passive DNS), deployment to SIEM/IDS watchl... |
-| `performing-ip-reputation-analysis-with-shodan` | `performing-ip-reputation-analysis-with-shodan/SKILL.md` | Analyze IP address reputation using the Shodan API to identify open ports, running services, known vulnerabilities, a... |
-| `performing-malware-hash-enrichment-with-virustotal` | `performing-malware-hash-enrichment-with-virustotal/SKILL.md` | Enrich malware file hashes (MD5, SHA-1, SHA-256) using the VirusTotal API v3 to retrieve multi-engine detection rates... |
-| `performing-malware-ioc-extraction` | `performing-malware-ioc-extraction/SKILL.md` | Malware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise... |
-| `performing-osint-with-spiderfoot` | `performing-osint-with-spiderfoot/SKILL.md` | Automate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting ... |
-| `performing-paste-site-monitoring-for-credentials` | `performing-paste-site-monitoring-for-credentials/SKILL.md` | Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using a... |
-| `performing-threat-emulation-with-atomic-red-team` | `performing-threat-emulation-with-atomic-red-team/SKILL.md` | 'Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loa... |
-| `performing-threat-intelligence-sharing-with-misp` | `performing-threat-intelligence-sharing-with-misp/SKILL.md` | Uses PyMISP (the official MISP REST API library) to create events with structured IOCs (IPs, domains, hashes, URLs), ... |
-| `performing-threat-landscape-assessment-for-sector` | `performing-threat-landscape-assessment-for-sector/SKILL.md` | Conducts a sector-specific threat landscape assessment (financial, healthcare, energy, government, etc.) by profiling... |
-| `processing-stix-taxii-feeds` | `processing-stix-taxii-feeds/SKILL.md` | 'Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-na... |
-| `profiling-threat-actor-groups` | `profiling-threat-actor-groups/SKILL.md` | 'Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by a... |
-| `tracking-threat-actor-infrastructure` | `tracking-threat-actor-infrastructure/SKILL.md` | Discovers and maps adversary-controlled infrastructure (C2 servers, phishing domains, exploit-kit hosts, bulletproof ... |
-
-### VULNERABILITY MANAGEMENT (25 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `building-patch-tuesday-response-process` | `building-patch-tuesday-response-process/SKILL.md` | Establish a repeatable operational process for triaging, testing, and deploying Microsoft Patch Tuesday security upda... |
-| `building-vulnerability-aging-and-sla-tracking` | `building-vulnerability-aging-and-sla-tracking/SKILL.md` | Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-... |
-| `building-vulnerability-dashboard-with-defectdojo` | `building-vulnerability-dashboard-with-defectdojo/SKILL.md` | Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanne... |
-| `building-vulnerability-exception-tracking-system` | `building-vulnerability-exception-tracking-system/SKILL.md` | Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating control... |
-| `exploiting-vulnerabilities-with-metasploit-framework` | `exploiting-vulnerabilities-with-metasploit-framework/SKILL.md` | Uses the Metasploit Framework (msfconsole and its exploit, auxiliary, and post-exploitation modules) to validate that... |
-| `implementing-attack-path-analysis-with-xm-cyber` | `implementing-attack-path-analysis-with-xm-cyber/SKILL.md` | Deploys XM Cyber's continuous exposure management platform to build attack graphs that chain vulnerabilities, misconf... |
-| `implementing-cloud-vulnerability-posture-management` | `implementing-cloud-vulnerability-posture-management/SKILL.md` | Implement multi-cloud CSPM to detect cloud-native misconfigurations and vulnerabilities (IAM over-permissions, expose... |
-| `implementing-continuous-security-validation-with-bas` | `implementing-continuous-security-validation-with-bas/SKILL.md` | Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach, AttackIQ, Picus, Cymulate, Pentera, or SCYTH... |
-| `implementing-epss-score-for-vulnerability-prioritization` | `implementing-epss-score-for-vulnerability-prioritization/SKILL.md` | Queries FIRST's Exploit Prediction Scoring System (EPSS) API to fetch exploitation-probability and percentile scores ... |
-| `implementing-patch-management-workflow` | `implementing-patch-management-workflow/SKILL.md` | Patch management is the systematic process of identifying, testing, deploying, and verifying software updates to reme... |
-| `implementing-rapid7-insightvm-for-scanning` | `implementing-rapid7-insightvm-for-scanning/SKILL.md` | Deploy and configure Rapid7 InsightVM Security Console and Scan Engines, including scan templates, credentialed scann... |
-| `implementing-vulnerability-management-with-greenbone` | `implementing-vulnerability-management-with-greenbone/SKILL.md` | Deploy and operate Greenbone/OpenVAS vulnerability management using the python-gvm library over the Greenbone Managem... |
-| `implementing-vulnerability-remediation-sla` | `implementing-vulnerability-remediation-sla/SKILL.md` | Design a vulnerability remediation SLA program covering asset tiering, a severity-based SLA matrix, exception process... |
-| `implementing-vulnerability-sla-breach-alerting` | `implementing-vulnerability-sla-breach-alerting/SKILL.md` | Build an automated SLA breach alerting system for vulnerability remediation, including a database schema for SLA trac... |
-| `performing-active-directory-vulnerability-assessment` | `performing-active-directory-vulnerability-assessment/SKILL.md` | Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfiguration... |
-| `performing-agentless-vulnerability-scanning` | `performing-agentless-vulnerability-scanning/SKILL.md` | Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-base... |
-| `performing-asset-criticality-scoring-for-vulns` | `performing-asset-criticality-scoring-for-vulns/SKILL.md` | Build a multi-factor asset criticality scoring model—incorporating data sensitivity, business function dependency, re... |
-| `performing-authenticated-scan-with-openvas` | `performing-authenticated-scan-with-openvas/SKILL.md` | Configure and execute authenticated (credentialed) vulnerability scans using OpenVAS/Greenbone Vulnerability Manageme... |
-| `performing-authenticated-vulnerability-scan` | `performing-authenticated-vulnerability-scan/SKILL.md` | Plan and run authenticated (credentialed) vulnerability scans with scanners such as Nessus, Qualys, OpenVAS, or Rapid... |
-| `performing-cve-prioritization-with-kev-catalog` | `performing-cve-prioritization-with-kev-catalog/SKILL.md` | Fetch and parse the CISA Known Exploited Vulnerabilities (KEV) catalog, enrich it with EPSS scores and CVSS metrics, ... |
-| `performing-web-application-scanning-with-nikto` | `performing-web-application-scanning-with-nikto/SKILL.md` | Runs Nikto, an open-source web server and web application scanner, to test over 7,000 potentially dangerous files/pro... |
-| `performing-web-application-vulnerability-triage` | `performing-web-application-vulnerability-triage/SKILL.md` | Triages web application vulnerability findings from DAST/SAST scanners such as Burp Suite and ZAP, using the OWASP Ri... |
-| `prioritizing-vulnerabilities-with-cvss-scoring` | `prioritizing-vulnerabilities-with-cvss-scoring/SKILL.md` | The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incid... |
-| `scanning-infrastructure-with-nessus` | `scanning-infrastructure-with-nessus/SKILL.md` | Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infr... |
-| `triaging-vulnerabilities-with-ssvc-framework` | `triaging-vulnerabilities-with-ssvc-framework/SKILL.md` | Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision... |
-
-### WEB APPLICATION SECURITY (42 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `bypassing-authentication-with-forced-browsing` | `bypassing-authentication-with-forced-browsing/SKILL.md` | Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing au... |
-| `exploiting-broken-link-hijacking` | `exploiting-broken-link-hijacking/SKILL.md` | Discovers and exploits broken link hijacking by spidering a site (Burp Suite Spider, Scrapy, curl scraping), extracti... |
-| `exploiting-http-request-smuggling` | `exploiting-http-request-smuggling/SKILL.md` | Detects and exploits HTTP request smuggling caused by Content-Length/Transfer-Encoding parsing discrepancies between ... |
-| `exploiting-idor-vulnerabilities` | `exploiting-idor-vulnerabilities/SKILL.md` | Identifies and exploits Insecure Direct Object Reference (IDOR) vulnerabilities by manipulating object identifiers (n... |
-| `exploiting-insecure-deserialization` | `exploiting-insecure-deserialization/SKILL.md` | Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to ac... |
-| `exploiting-mass-assignment-in-rest-apis` | `exploiting-mass-assignment-in-rest-apis/SKILL.md` | Discovers and exploits mass assignment (autobinding) in REST APIs by injecting unexpected or hidden parameters (e.g. ... |
-| `exploiting-nosql-injection-vulnerabilities` | `exploiting-nosql-injection-vulnerabilities/SKILL.md` | Detects and exploits NoSQL injection vulnerabilities in MongoDB, CouchDB, and similar databases to demonstrate authen... |
-| `exploiting-oauth-misconfiguration` | `exploiting-oauth-misconfiguration/SKILL.md` | Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token ... |
-| `exploiting-prototype-pollution-in-javascript` | `exploiting-prototype-pollution-in-javascript/SKILL.md` | Detects and exploits JavaScript prototype pollution vulnerabilities in client-side and server-side (Node.js) applicat... |
-| `exploiting-race-condition-vulnerabilities` | `exploiting-race-condition-vulnerabilities/SKILL.md` | Detects and exploits race condition (TOCTOU) vulnerabilities in web applications using Burp Suite's Turbo Intruder ex... |
-| `exploiting-server-side-request-forgery` | `exploiting-server-side-request-forgery/SKILL.md` | Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network r... |
-| `exploiting-sql-injection-with-sqlmap` | `exploiting-sql-injection-with-sqlmap/SKILL.md` | Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized pe... |
-| `exploiting-template-injection-vulnerabilities` | `exploiting-template-injection-vulnerabilities/SKILL.md` | Detects and exploits Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other... |
-| `exploiting-type-juggling-vulnerabilities` | `exploiting-type-juggling-vulnerabilities/SKILL.md` | Exploits PHP type juggling vulnerabilities caused by loose (==) comparison operators to bypass authentication, defeat... |
-| `exploiting-websocket-vulnerabilities` | `exploiting-websocket-vulnerabilities/SKILL.md` | Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure me... |
-| `implementing-web-application-logging-with-modsecurity` | `implementing-web-application-logging-with-modsecurity/SKILL.md` | Configure ModSecurity WAF with the OWASP Core Rule Set (CRS) for web application audit logging, tuning SecRuleEngine,... |
-| `performing-blind-ssrf-exploitation` | `performing-blind-ssrf-exploitation/SKILL.md` | Detect and exploit blind Server-Side Request Forgery (SSRF) using out-of-band techniques such as Burp Collaborator DN... |
-| `performing-clickjacking-attack-test` | `performing-clickjacking-attack-test/SKILL.md` | Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting proof-of... |
-| `performing-content-security-policy-bypass` | `performing-content-security-policy-bypass/SKILL.md` | Analyze Content-Security-Policy headers and bypass them to achieve cross-site scripting by exploiting unsafe-inline/u... |
-| `performing-csrf-attack-simulation` | `performing-csrf-attack-simulation/SKILL.md` | Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit auth... |
-| `performing-directory-traversal-testing` | `performing-directory-traversal-testing/SKILL.md` | Test web applications for path traversal and Local/Remote File Inclusion vulnerabilities by manipulating file path pa... |
-| `performing-graphql-security-assessment` | `performing-graphql-security-assessment/SKILL.md` | Assessing GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-servic... |
-| `performing-http-parameter-pollution-attack` | `performing-http-parameter-pollution-attack/SKILL.md` | Executes HTTP Parameter Pollution attacks that inject duplicate request parameters to bypass input validation, WAF ru... |
-| `performing-second-order-sql-injection` | `performing-second-order-sql-injection/SKILL.md` | Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later... |
-| `performing-security-headers-audit` | `performing-security-headers-audit/SKILL.md` | Auditing HTTP security headers including CSP, HSTS, X-Frame-Options, and cookie attributes to identify missing or mis... |
-| `performing-subdomain-enumeration-with-subfinder` | `performing-subdomain-enumeration-with-subfinder/SKILL.md` | Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the atta... |
-| `performing-web-application-firewall-bypass` | `performing-web-application-firewall-bypass/SKILL.md` | Bypasses Web Application Firewall protections using encoding tricks, HTTP method manipulation, parameter pollution, a... |
-| `performing-web-cache-deception-attack` | `performing-web-cache-deception-attack/SKILL.md` | Executes web cache deception attacks by exploiting path normalization discrepancies between CDN/reverse-proxy caching... |
-| `performing-web-cache-poisoning-attack` | `performing-web-cache-poisoning-attack/SKILL.md` | Exploiting web cache mechanisms to serve malicious content to other users by poisoning cached responses through unkey... |
-| `testing-api-security-with-owasp-top-10` | `testing-api-security-with-owasp-top-10/SKILL.md` | Systematically assesses REST, GraphQL, and gRPC API endpoints against the OWASP API Security Top 10 (2023) using Burp... |
-| `testing-cors-misconfiguration` | `testing-cors-misconfiguration/SKILL.md` | Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data ... |
-| `testing-for-broken-access-control` | `testing-for-broken-access-control/SKILL.md` | Systematically tests web applications and APIs for broken access control (OWASP A01:2021), including privilege escala... |
-| `testing-for-business-logic-vulnerabilities` | `testing-for-business-logic-vulnerabilities/SKILL.md` | Manually identifies flaws in application business logic - price manipulation, multi-step workflow bypass, and privile... |
-| `testing-for-email-header-injection` | `testing-for-email-header-injection/SKILL.md` | Tests web application email functionality (contact forms, password reset, newsletter subscriptions) for CRLF/SMTP hea... |
-| `testing-for-host-header-injection` | `testing-for-host-header-injection/SKILL.md` | Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache ... |
-| `testing-for-json-web-token-vulnerabilities` | `testing-for-json-web-token-vulnerabilities/SKILL.md` | Tests JWT implementations for algorithm confusion, "none" algorithm bypass, kid/jku parameter injection, and weak sec... |
-| `testing-for-open-redirect-vulnerabilities` | `testing-for-open-redirect-vulnerabilities/SKILL.md` | Identifies and exploits open redirect vulnerabilities by analyzing URL redirection parameters (next, url, redirect, r... |
-| `testing-for-sensitive-data-exposure` | `testing-for-sensitive-data-exposure/SKILL.md` | Identifying sensitive data exposure vulnerabilities including API key leakage, PII in responses, insecure storage, an... |
-| `testing-for-xml-injection-vulnerabilities` | `testing-for-xml-injection-vulnerabilities/SKILL.md` | Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to ide... |
-| `testing-for-xss-vulnerabilities-with-burpsuite` | `testing-for-xss-vulnerabilities-with-burpsuite/SKILL.md` | Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater to... |
-| `testing-for-xxe-injection-vulnerabilities` | `testing-for-xxe-injection-vulnerabilities/SKILL.md` | Discovering and exploiting XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfi... |
-| `testing-jwt-token-security` | `testing-jwt-token-security/SKILL.md` | Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization... |
-
-### WIRELESS SECURITY (2 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `detecting-bluetooth-low-energy-attacks` | `detecting-bluetooth-low-energy-attacks/SKILL.md` | 'Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeratio... |
-| `performing-bluetooth-security-assessment` | `performing-bluetooth-security-assessment/SKILL.md` | Assess Bluetooth Low Energy (BLE) device security using Python's bleak asyncio library to discover nearby devices, en... |
-
-### ZERO TRUST (1 skills)
-
-| Skill Name | Path | Description |
-|---|---|---|
-| `implementing-zero-trust-with-beyondcorp` | `implementing-zero-trust-with-beyondcorp/SKILL.md` | Configures Google BeyondCorp Enterprise Identity-Aware Proxy (IAP) as the access enforcement point for web applicatio... |
+This directory contains **818 specialized cybersecurity skills** across 34 security domains (Cloud Security, DFIR, Threat Hunting, Malware Analysis, IAM, Container Security, Penetration Testing, Reverse Engineering, SOC Operations, Cryptography, AI Security, etc.).
 
-### ZERO TRUST ARCHITECTURE (17 skills)
+## Instructions for AI Agents
 
-| Skill Name | Path | Description |
-|---|---|---|
-| `configuring-aws-verified-access-for-ztna` | `configuring-aws-verified-access-for-ztna/SKILL.md` | Configure AWS Verified Access to provide VPN-less zero trust network access to internal apps, combining identity trus... |
-| `configuring-identity-aware-proxy-with-google-iap` | `configuring-identity-aware-proxy-with-google-iap/SKILL.md` | 'Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce per-request identity verification on Comput... |
-| `configuring-microsegmentation-for-zero-trust` | `configuring-microsegmentation-for-zero-trust/SKILL.md` | Configures microsegmentation policies to enforce least-privilege workload-to-workload access using tools such as VMwa... |
-| `configuring-zscaler-private-access-for-ztna` | `configuring-zscaler-private-access-for-ztna/SKILL.md` | 'Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App C... |
-| `deploying-cloudflare-access-for-zero-trust` | `deploying-cloudflare-access-for-zero-trust/SKILL.md` | Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-awar... |
-| `deploying-palo-alto-prisma-access-zero-trust` | `deploying-palo-alto-prisma-access-zero-trust/SKILL.md` | Deploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ... |
-| `deploying-software-defined-perimeter` | `deploying-software-defined-perimeter/SKILL.md` | Deploys a Software-Defined Perimeter per the CSA v2.0 specification, configuring Single Packet Authorization, mutual ... |
-| `deploying-tailscale-for-zero-trust-vpn` | `deploying-tailscale-for-zero-trust-vpn/SKILL.md` | Deploys and configures Tailscale (or self-hosted Headscale) as a WireGuard-based zero trust mesh VPN, setting up iden... |
-| `implementing-beyondcorp-zero-trust-access-model` | `implementing-beyondcorp-zero-trust-access-model/SKILL.md` | 'Implement Google''s BeyondCorp zero trust access model using Cloud IAP, Access Context Manager, Endpoint Verificatio... |
-| `implementing-cisa-zero-trust-maturity-model` | `implementing-cisa-zero-trust-maturity-model/SKILL.md` | Assess, gap-analyze, and progressively implement the CISA Zero Trust Maturity Model v2.0 across five pillars (Identit... |
-| `implementing-device-posture-assessment-in-zero-trust` | `implementing-device-posture-assessment-in-zero-trust/SKILL.md` | 'Implements device posture assessment as a zero trust access control by integrating endpoint health signals from Crow... |
-| `implementing-identity-verification-for-zero-trust` | `implementing-identity-verification-for-zero-trust/SKILL.md` | Implements continuous, risk-adaptive identity verification for zero trust using phishing-resistant MFA (FIDO2/WebAuth... |
-| `implementing-microsegmentation-with-guardicore` | `implementing-microsegmentation-with-guardicore/SKILL.md` | 'Implements microsegmentation with Akamai Guardicore Segmentation to map application dependencies, visualize east-wes... |
-| `implementing-zero-trust-dns-with-nextdns` | `implementing-zero-trust-dns-with-nextdns/SKILL.md` | Configure NextDNS as an encrypted (DoH/DoT) zero trust DNS resolver that blocks malicious, phishing, and cryptojackin... |
-| `implementing-zero-trust-for-saas-applications` | `implementing-zero-trust-for-saas-applications/SKILL.md` | Secures SaaS apps (Microsoft 365, Google Workspace, Salesforce, Slack) via CASB/SSPM deployment, conditional access p... |
-| `implementing-zero-trust-network-access-with-zscaler` | `implementing-zero-trust-network-access-with-zscaler/SKILL.md` | Configures Zero Trust Network Access using Zscaler Private Access (ZPA) to broker identity-based, context-aware conne... |
-| `implementing-zero-trust-with-hashicorp-boundary` | `implementing-zero-trust-with-hashicorp-boundary/SKILL.md` | Installs and configures HashiCorp Boundary as a default-deny, identity-aware proxy for infrastructure access, includi... |
+Follow this simple discovery and execution guide:
 
+1. **Explore Skills Directory**: Use the `ls` tool on this directory (or `find` to filter by keyword like `volatility`, `kerberos`, `aws`, `azure`, `docker`, `ransomware`, `phishing`) to find the relevant skill folder.
+2. **Pick the Relevant Skill**: Select the specific skill folder matching the task.
+3. **Read the Skill Guide**: Use the `read` tool to inspect `<skill-folder>/SKILL.md` (as well as `references/` and `scripts/` inside that folder).
+4. **Execute**: Follow the practitioner workflows, commands, and verification steps detailed in that skill file.