Agent skills by mukul975

Query a MISP (Malware Information Sharing Platform) instance via PyMISP

Queries Certificate Transparency logs via crt.sh and pycrtsh to detect

Generate domain permutations with dnstwist and check DNS resolution

Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,

Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code,…

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect…

Detect dangerous ACL misconfigurations in Active Directory using ldap3

Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and…

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare…

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

Analyzes bootkit and advanced rootkit malware infecting the Master

Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and…

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware…

Monitor Certificate Transparency logs using crt.sh and Certstream to

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g.…

Extract and analyze Cobalt Strike beacon configuration from PE files

Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and…

Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building…

Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

Investigate compromised Docker containers by analyzing images, layers,