Agent skills for Grok Build

Detect abuse of legitimate Windows binaries (LOLBins) used for living

This skill enables Claude to detect potential memory leaks and analyze memory usage patterns in code.

Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and…

Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network…

Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes…

Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis…

Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs…

Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns…

This skill enables Claude to detect and resolve performance bottlenecks in applications.

This skill enables Claude to automatically detect performance regressions in a CI/CD pipeline.

Configures Fail2ban with custom filters and actions to detect port scanning

Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring…

Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped

Detect and prevent QR code phishing (quishing) attacks that embed

Detect RDP brute force attacks by parsing Windows Security Event Logs

Detects and prevents code injection attacks targeting serverless functions

Detect and block spearphishing emails that use personalized, researched

Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection

Scans GitHub Actions workflows and CI/CD pipeline configurations for

Detect risky OAuth application consent grants in Azure AD / Microsoft

Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands,