killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A workflow for analyzing AWS S3, Google Cloud Storage, and Azure Blob Storage audit logs to find unusual access patterns. These services store files online, and audit logs record who accessed them, when, and how.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A guide to extracting and examining Cobalt Strike Beacon settings from Windows executable files or memory dumps. Cobalt Strike is a security testing tool often misused by attackers, and Beacon is its remotely controlled payload.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A security-analysis tool for reading Cobalt Strike configuration files and identifying how its command-and-control traffic is shaped. Cobalt Strike is a penetration-testing platform that can also be misused by attackers.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A cybersecurity analysis workflow for reading Cobalt Strike Malleable C2 profiles, which control how an attack tool's Beacon traffic is disguised and how it behaves. It extracts communication and process-injection details and can produce network-detection rules.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A method for examining how malware communicates with its command-and-control server, the system that sends it instructions and receives data.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A framework for analyzing an intrusion through the seven stages of the Lockheed Martin Cyber Kill Chain, from reconnaissance to the attacker’s final objective.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A Chinese-language workflow for using Autopsy, a digital-forensics application, to examine a forensic disk image. A disk image is a copy of a storage device preserved for investigation.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A security-analysis workflow for finding suspicious use of DNS, the system that translates domain names into network addresses. It looks for signs of DNS tunnelling, where data is hidden in DNS requests, as well as algorithmically generated domains and hidden command channels.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A procedure for investigating compromised Docker containers by examining their images, filesystem layers, volumes, logs, processes, network connections, and runtime traces. Docker is software that runs applications in isolated containers.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
An email-forensics guide for tracing where a suspicious message came from and checking whether its sender details are genuine. It uses SPF, DKIM, and DMARC, which are standards that help verify email senders.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A security-analysis guide for Solidity smart contracts, which are programs that run on the Ethereum blockchain. It uses Slither and Mythril to inspect contract code and execution paths for vulnerabilities.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A malware-analysis workflow for examining Go programs with Ghidra, a reverse-engineering tool, including stripped or obfuscated compiled files.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A security-analysis skill for finding possible heap-spray attacks in a computer’s memory dump. A heap-spray attack fills large memory areas with repeated data to increase the chance that harmful code runs through a software vulnerability.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A guide for investigating indicators of compromise, or signs such as suspicious IP addresses, domains, URLs, file fingerprints, and email addresses. It combines information from several security-intelligence services.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A security-testing guide for Objection, a tool that lets testers inspect and interact with an iOS app while it is running. It uses Frida and can work with jailbroken devices or specially prepared app packages.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A guide and code example for reading Kubernetes API-server audit logs, which record requests made to a Kubernetes cluster. It identifies events such as entering containers, accessing secrets, changing permissions, creating privileged containers, and anonymous access.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A guide for reading Linux auditd logs, which record security-relevant system activity. It uses standard search tools and Python to identify suspicious access, commands, and processes.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A guide for examining Linux ELF files, the executable format used by Linux programs. It covers static inspection, runtime tracing, and reverse engineering of malware on x86-64, ARM, and MIPS systems.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A guide for checking Linux memory and system data for kernel rootkits, which are malicious programs that hide inside the operating system core. It compares different system views and uses forensic and scanning tools.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A guide to examining Linux system traces such as login records, scheduled tasks, shell history, and system settings for signs of intrusion or unauthorized activity.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A guide to examining Windows shortcut files and Jump Lists, which record recently opened files and some application activity. It uses forensic tools and manual file-format analysis to collect evidence from Windows systems.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A malware-analysis workflow for examining harmful VBA macros embedded in Microsoft Word, Excel, and PowerPoint files. It uses tools that extract, decode, and inspect the macros and their attack chain.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A Chinese-language skill for examining suspicious PDF files with peepdf, pdfid, and pdf-parser. It is intended for static malware analysis, which studies a file without running it.
killvxk/cybersecurity-skills-zh
Skill Claude CodeCodex
A guide for investigating suspicious web addresses with URLScan.io, a service that opens a URL in an isolated browser and records its screenshot, page structure, network requests, scripts, and redirects.