Agent skills by mukul975

Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and

Systematically audit AWS S3 bucket permissions to identify publicly

Auditing Microsoft Entra ID (Azure Active Directory) configuration to

Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous…

Auditing Google Cloud Platform IAM permissions to identify overly permissive

Auditing Kubernetes cluster RBAC configurations to identify overly permissive

Auditing Terraform infrastructure-as-code for security misconfigurations

Monitors Certificate Transparency (CT) logs to detect unauthorized certificate

Automates the enrichment of raw indicators of compromise with multi-source

Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate transparency logs, WHOIS records, and IP enrichment to map…

Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable…

Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for…

Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks. Use…

Build effective detection rules using Splunk Search Processing Language

Builds vendor-agnostic detection rules using the Sigma rule format for

Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security templates. Use when…

Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federation models (AD FS, password hash sync, pass-through auth, third-party…

Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests, periodic…

Builds real-time incident response dashboards in Splunk, Elastic, or

Designs and documents structured incident response playbooks with step-by-step

Build collaborative forensic incident timelines using Timesketch to ingest,

Build an automated pipeline that ingests raw IOCs (URLs, IPs, domains,

Build an automated IOC enrichment pipeline on OpenCTI (STIX 2.1 native

Build structured communication templates for malware incidents (ransomware,