Security & Testing Agent Skills for Claude Code

Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the…

Detects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensitive host mounts, and…

Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering…

This skill teaches security teams how to detect and respond to unauthorized

Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by…

Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query…

Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy

Probe a target for accidentally-served secret-bearing files in the web root — .git/, .env, .DS_Store, backup files, database dumps, key…

Detect Kerberos Golden Ticket forgery (e.g.

Detects insider data exfiltration by analyzing DLP policy violations,

Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS

Detect malicious scheduled task creation and modification using Sysmon

Detects and analyzes malicious behavior in mobile applications through

Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes…

Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis…

Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay…

Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path…

Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring…

Detect and prevent QR code phishing (quishing) attacks that embed

Detects ransomware encryption activity in real time using entropy