Security & Testing Agent Skills for Grok Build

Proactively hunts for Advanced Persistent Threat (APT) activity within

Detect Cobalt Strike beacon command-and-control traffic using default TLS certificate signatures (serial 8BB00EE), JA3/JA3S/JARM…

Hunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via large/frequent TXT…

Hunt for DCOM-based lateral movement (MITRE ATT&CK T1021.003) by detecting

Detects DNS tunneling and covert-channel data exfiltration by analyzing

Hunts for adversary abuse of legitimate cloud services (Azure, AWS, GCP,

Proactively hunts for adversary abuse of legitimate, signed system binaries

Hunts for registry-based persistence mechanisms (MITRE T1547) in Windows

Runs a hypothesis-driven threat hunt for Windows Scheduled Task persistence (T1053), guiding SIEM/EDR queries against task creation events…

Runs a hypothesis-driven threat hunt for supply-chain compromise (T1195) by querying SIEM/EDR logs for trojanized software updates…

Hunts for adversary persistence and execution via Windows scheduled tasks (T1053.005) by analyzing Security Event ID 4698 task-creation…

Hunts for MITRE ATT&CK T1098 account manipulation - shadow admin creation, SID history injection, group membership changes, and credential…

Detects suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event log Event ID 7045, analyzing service…

Runs a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing file creation in web…

Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing.

Audit the union of every IAM policy attached to one principal for privilege-escalation paths that no single statement reveals, and for…

Automates binary reverse engineering, decompilation, and vulnerability analysis using IDA Pro and MCP tool integration.

Accelerates binary analysis and security research by integrating IDA Pro’s powerful decompilation and static analysis tools with AI.

IDA Pro Python scripting for reverse engineering.

Use when building an identity service or handling the account lifecycle.

This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken…