cyber-security-operations

Cyber Security Operations

Authorized Use

This skill covers dual-use offensive and defensive techniques. Offensive playbooks (red-team, penetration testing, credential access, C2, social-engineering simulation) are for engagements you own or have explicit written authorization to test. Before any offensive technique, confirm scope, a signed rules-of-engagement, and authority (tasks/engagement-intake.md), and document every action for the engagement record. Defensive, detection, forensic, and compliance playbooks assume you operate on systems you are responsible for.

Core Rule

Route, do not improvise. This skill does not contain techniques inline - it dispatches to one self-contained playbook under playbooks/. Every recommendation names the objective, the strategy basis, the technique's ATT&CK/D3FEND/NIST mapping, and the verification or detection path.

First Pass

1. Restate the objective: what outcome, on which systems, by when.
2. Classify the task into one category:
   • detection-hunting - detection engineering, threat hunting, SIEM analytics.
   • soc-incident-response - SOC operations, triage, incident response, containment.
   • dfir-forensics - disk/memory/network forensics, evidence acquisition, custody.
   • malware-analysis - static/dynamic analysis, reverse engineering, deobfuscation.
   • threat-intelligence - CTI, TTP mapping, actor tracking, IOC work.
   • cloud-container-security - cloud posture, Kubernetes/container, cloud IR.
   • network-wireless-security - network defense, traffic analysis, wireless.
   • application-api-security - web/app/API testing and hardening, OWASP.
   • identity-access-zerotrust - IAM, AD/Entra, zero-trust, credential protection.
   • ot-ics-security - OT/ICS/SCADA, historian, industrial protocols.
   • endpoint-mobile-security - endpoint hardening, EDR, mobile.
   • vuln-supplychain-devsecops - vulnerability management, supply chain, CI/CD security.
   • offensive-security - red-team, penetration testing, C2, social-engineering simulation.
   • crypto-ai-emerging - cryptography, AI security, blockchain, deception.
   • compliance-governance - CMMC/NIST/ISO, risk, privacy, audit.
3. For any offensive-security task, confirm first (tasks/engagement-intake.md). No scope, no action.
4. Route to one playbook: open references/INDEX.md, then references/index/.md, and match a single playbook by name, tags, or ATT&CK technique ID. Do not read every playbook - locate one.
5. Read playbooks///PLAYBOOK.md and its local references/, scripts/, and assets/. Follow it exactly.
6. Execute with the loop: observe -> orient -> decide -> act -> verify. Each finding updates the plan. If the objective needs another technique, return to step 2.
7. Close with the right artifact (templates/): a forensic evidence report for DFIR, an engagement record for offensive work, a detection or remediation note otherwise.