Agent skills for Windsurf (legacy)

Detect adversary lateral movement across networks using Splunk SPL queries

Detect lateral movement in network traffic using Zeek (formerly Bro)

Detect abuse of legitimate Windows binaries (LOLBins) used for living

Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and…

Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network…

Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes…

Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis…

Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs…

This skill enables Claude to automatically detect performance regressions in a CI/CD pipeline.

Configures Fail2ban with custom filters and actions to detect port scanning

Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring…

Detect and prevent QR code phishing (quishing) attacks that embed

Detect RDP brute force attacks by parsing Windows Security Event Logs

Detects and prevents code injection attacks targeting serverless functions

Detect and block spearphishing emails that use personalized, researched

Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection

Scans GitHub Actions workflows and CI/CD pipeline configurations for

Detect risky OAuth application consent grants in Azure AD / Microsoft

Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands,

Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM

Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon