180 tagged mitre-attack, measured the same way as everything else here.
Browse within: malware-analysis 134detection-engineering 125reverse-engineering 121dfir 119cybersecurity 86threat-intelligence 53incident-response 46threat-hunting 46ctf 41stix 41ioc 36mcp-server 34bun 33penetration-testing 30
Skill Claude CodeCodex
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
threadlinqs-cmd/intelthreadlinqs-mcp
Skill Claude CodeCodex
Operate the Threadlinqs Intelligence MCP server — 73 threat-intelligence tools covering threats, detection rules in Splunk SPL / Microsoft KQL / Sigma, IOCs, threat actors, CVE/CWE enrichment, MITRE ATT&CK coverage and prediction, C2 infrastructure, the correlation graph, and STIX 2.1 / ATT&CK Navigator export. Use…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: