Agent skills for Claude Code

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX

Monitor and analyze ransomware group data leak sites (DLS) to track victim

Auditing Microsoft Entra ID (Azure Active Directory) configuration to

Extract and catalog attack patterns from cyber threat intelligence reports

Builds vendor-agnostic detection rules using the Sigma rule format for

Implement a phishing report button in email clients with automated triage

Build a vulnerability exception and risk acceptance tracking system with

Performs memory forensics analysis using Volatility 3 to extract evidence

This skill covers deploying anomaly detection systems for industrial

Detect and prevent API enumeration attacks including BOLA and IDOR exploitation

Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection,

This skill covers detecting cyber attacks targeting Supervisory Control

Detect unusual API call patterns in AWS CloudTrail logs using boto3,

Detects and analyzes Bluetooth Low Energy (BLE) security attacks including

Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch

Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including

ISO/IEC 27001:2022 is the international standard for establishing, implementing,

Build network traffic baselines from NetFlow/IPFIX data using Python

This skill covers hardening GitHub Actions workflows against supply