mukul975

mukul975/Anthropic-Cybersecurity-Skills

Plugin Claude Code

Plugin marketplace listing 1 plugin: cybersecurity-skills.

mukul975/Anthropic-Cybersecurity-Skills

Plugin Claude Code

818 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more.

mukul975/Anthropic-Cybersecurity-Skills

Instructions file GitHub Copilot

Instructions for mukul975/Anthropic-Cybersecurity-Skills, covering copilot instructions for anthropic-cybersecurity-skills, quick facts, repository structure, build & development and prerequisites.

mukul975/Anthropic-Cybersecurity-Skills

Instructions file CodexOpenCode

Instructions for mukul975/Anthropic-Cybersecurity-Skills, covering agents.md, what this repository is, reading a skill, changing a skill and writing a description.

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths.

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence, covering boot sector analysis, UEFI module inspection, and anti-rootkit detection. Use when compromise survives OS reinstallation or antivirus/EDR fails to detect…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, and infrastructure (primary servers, fallback domains, dead drops). Use after reverse engineering reveals network traffic needing protocol analysis or when building…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when…

mukul975/Anthropic-Cybersecurity-Skills

Skill Claude CodeCodex

Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security…