Security & Testing Agent Skills for Claude Desktop

Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy…

Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering…

Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous…

This skill teaches security teams how to detect and respond to unauthorized

Identify poisoned training data and backdoored models across the ML pipeline.

Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by…

Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query…

Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy

Probe a target for accidentally-served secret-bearing files in the web root — .git/, .env, .DS_Store, backup files, database dumps, key…

Detect Kerberos Golden Ticket forgery (e.g.

Detects insider data exfiltration by analyzing DLP policy violations,

Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS

Detect malicious scheduled task creation and modification using Sysmon

Detects and analyzes malicious behavior in mobile applications through

Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes…

Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis…

Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay…

Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path…

Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring…

Detect and prevent QR code phishing (quishing) attacks that embed