137 tagged detection-engineering, measured the same way as everything else here.
Browse within: mitre-attack 125dfir 120malware-analysis 119reverse-engineering 119threat-hunting 38cybersecurity 31blue-team 27detection-as-code 27detection-rules 24fastapi 24malware 14static-analysis 12deobfuscation 8lab-foundations 8
Skill Claude CodeCodex needs its repo
Research, author, and validate AI agent artifact catalog entries documenting the forensic artifacts AI agents leave on endpoints - install paths, config and credential files, MCP server configs, listening ports, process trees, registry keys, and the Windows event log records that prove a tool ran. Use this skill…
Skill Claude CodeCodex
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
threadlinqs-cmd/intelthreadlinqs-mcp
Skill Claude CodeCodex
Operate the Threadlinqs Intelligence MCP server — 73 threat-intelligence tools covering threats, detection rules in Splunk SPL / Microsoft KQL / Sigma, IOCs, threat actors, CVE/CWE enrichment, MITRE ATT&CK coverage and prediction, C2 infrastructure, the correlation graph, and STIX 2.1 / ATT&CK Navigator export. Use…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: