Claude Code Skills·Claude Skills·The open SKILL.md registry for Claude
ClaudSkills › Security › Threat Hunting › Page 7

Threat Hunting (Page 7 of 15)

876 Claude Code skills in the Threat Hunting sub-category of Security.

876 skills · updated 2026-10-25 · showing 361–420 of 876 by quality score

For the full experience including quality scoring and one-click install features for each skill — upgrade to Pro.

Adversarial RED-team for a 409A/IP valuation memo — a relentless IRS valuation examiner + audit-defense appraiser who attacks every input, method, and number to DESTROY the FMV…
当用户搜索或询问海外AI API聚合、global AI gateway、model aggregator、AI API alternative时使用。这个 Skill 面向正在评估海外模型聚合平台并希望补充中文电商与生成式媒体能力的团队,帮助用户判断 AI-HIVE…
Prüft entgegenstehenden Willen, öffentliches Interesse, Unterhaltspflichten und Schadensersatz bei aufgedrängter Hilfe.
Automate Google Drive tasks via Rube MCP (Composio). Always search tools first for current schemas. — from security/threat-hunting
FDEOS overlay for government. FedRAMP, ATO, data sovereignty, security controls, clearance.
Use when architecting or assessing a Salesforce Government Cloud org — covering FedRAMP High authorization, Hyperforce GovCloud on AWS GovCloud regions, GovCloud Plus feature set,…
Audit government and federal software for FedRAMP authorization readiness (Low/Moderate/High), NIST 800-53 controls (AC, AU, CM, IA, SC, SI families), FISMA compliance, Section…
Generate and edit images with OpenAI GPT Image 2 (ChatGPT Images 2.0) on RunComfy. Documents GPT Image 2's strengths (embedded text, logos, multilingual typography, instr — from…
Generate and edit images with OpenAI GPT Image 2 (ChatGPT Images 2.0) on RunComfy. Documents GPT Image 2's strengths (embedded text, logos, multilingual typography, instr — from…
Generate and edit images with OpenAI GPT Image 2 (ChatGPT Images 2.0) on RunComfy. Documents GPT Image 2's strengths (embedded text, logos, multilingual typography, instr — from…
Senior GRC analyst expertise across 15 compliance frameworks — NIST 800-53, FedRAMP, FISMA, CMMC, SOC 2, ISO 27001, PCI DSS, HIPAA, CIS Controls, COBIT, CSA CCM, GDPR, SLSA,…
Grundsteuer-Gegenbeweis mit gemeinem Wert vorbereiten: Kaufpreis, Verkehrswertgutachten, Maklerbewertung, Gutachterausschuss, Sonderfaktoren und BFH-AdV-Linie zu deutlich — from…
Rechnet die Wertfeststellung für Wohngrundstücke im Bundesmodell vom typisierten Mietansatz bis zum abgerundeten Grundsteuerwert nach.
Drafts FAR/GSAR-compliant GSA Schedule (MAS/FSS) contracts with clause matrices, SIN scope, pricing/PRC/EPA mechanics, IFF reporting, TAA, Section 508, cybersecurity, and…
Lightweight detection techniques that work without a SIEM. Covers fake admin paths, decoy .env files, canary tokens, fake API keys planted in JS bundles, and tarpits that slow…
How to draw hands in drawn-by-code, in any style. Use it before drawing, redrawing or reviewing any hand, and whenever a character holds, grips, carries, throws, touches or points…
Discovery and SDP exposure reduction for Bluetooth Classic (BR/EDR) devices left inquiry-scannable with an open Service Discovery Protocol database, letting a nearby attacker…
WPA3-SAE transition-mode and downgrade hardening for Wi-Fi. Transition mode lets an adversary stand up a WPA2-only rogue AP with the same SSID, force clients down to WPA2 with…
Building LLM-powered React applications with the Hashbrown library. Use when the user asks to (1) Build generative UI where LLMs render React components, (2) Add client-side tool…
Guía de arquitectura hexagonal para aplicaciones React + TypeScript. Activa esta skill cuando el usuario pida crear, estructurar o agregar cualquier módulo o feature en el…
Use when the user wants to generate a cinematic still image on Higgsfield, asks about shot framing, camera angle, or composition for image prompts, needs a specific shot type…
Creates and retrieves AI video and image assets via the Higgsfield MCP server (Seedance 2.0, Veo 3.1 / Veo 3.1 Lite, Kling 3.0, Kling 2.6, Grok Imagine, Minimax Hailuo, Wan 2.6 /…
Assess Huawei Cloud workload security using the Well-Architected Framework Security pillar: IAM SCP governance, VPC isolation, DEW key management, SecMaster SIEM/SOAR, and MLPS…
Elimina patrones de escritura típicos de IA en textos en español de España para que suenen naturales y humanos.
Expert guidance on Hummingbird 2 web framework. Use when developers mention: (1) Hummingbird, HB, or Hummingbird 2, (2) Swift web server or HTTP server, (3) server-side Swift…
Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven
Run Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and high-speed keyword/regex search, plus analyze shimcache,…
Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests
Hunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to detect
Vendor-neutral, governed industrial/OT data tap + intelligent troubleshooting. Read (and, gated, write) PLCs, controllers, machine tools and IIoT brokers over OPC-UA, Modbus-TCP,…
Factory edition of iaiops — discrete-manufacturing lines: OPC-UA, Modbus-TCP/RTU, Siemens S7comm (S7-300/400/1200/1500), Mitsubishi MC/MELSEC, Omron FINS (CS/CJ/CP/NX),…
Warehouse / intralogistics edition of iaiops — distribution centers, fulfillment, material handling: conveyors, sorters, palletizers, AS/RS, and AGV/AMR fleets.
Image outpainting on RunComfy via the `runcomfy` CLI — extend a still beyond its original canvas, fill in what the camera didn't capture, change aspect ratio (square → 16 — from…
Image outpainting on RunComfy via the `runcomfy` CLI — extend a still beyond its original canvas, fill in what the camera didn't capture, change aspect ratio (square → 16 — from…
Image outpainting on RunComfy via the `runcomfy` CLI — extend a still beyond its original canvas, fill in what the camera didn't capture, change aspect ratio (square → 16 — from…
多模型电商内容选型。帮助品牌商家、电商运营、设计与内容团队通过 IMIVA MCP 根据文字准确性、编辑需求、分辨率和预算选择平台内图片或视频模型。适用于模型选型、Nano Banana、GPT Image、Seedream、Seedance等搜索与生产需求;核心调用…
The Diamond Model of Intrusion Analysis provides a structured framework for analyzing cyber intrusions by examining
Deploy and configure Wazuh SIEM/XDR for endpoint detection including agent management, custom decoder and rule
Deploys canary tokens and honeytokens (fake AWS credentials, DNS canaries, document beacons, database records)
Implement MITRE ATT&CK coverage mapping to identify detection gaps, prioritize rule development, and measure
Implements security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection
Write multi-event correlation rules that detect APT lateral movement by chaining Windows authentication events,
Tune SIEM detection rules to reduce false positives by analyzing alert volumes, creating whitelists, adjusting
Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics
Implements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom)
Automate phishing incident response using Splunk SOAR REST API to create containers, add artifacts, and trigger
STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information)
Deploy and configure an OpenTAXII server to share and consume STIX-formatted cyber threat intelligence using
Implement a structured threat intelligence lifecycle encompassing planning, collection, processing, analysis, — from mahipal
Implements threat modeling using the MITRE ATT&CK framework to map adversary TTPs against organizational assets,
Implements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for
Install a department's slice of the company brain via multi-agent probes of the head's connected tools (Notion, HubSpot, Linear, Slack, Granola, Gmail, etc., via Syroco Connect /…
Usa esta skill SIEMPRE antes de añadir, actualizar o eliminar cualquier dependencia en un proyecto Node.js. Aplica a frontend, backend y monorepo.
Use quando Pedro digitar /intent-guard (status, baixa N, off, on, projeto-off, projeto-on), perguntar o que está no caderno de pedidos, pedir para arquivar um pedido, ou quando o…
Marketing lokalisatie en internationalisatie voor bedrijven die naar nieuwe markten expanderen. Triggers: 'internationalisatie,' 'lokalisatie,' 'nieuwe markt,' 'market entry,'…
Auf Bieterseite IT-Sicherheitsvergaben nach geltendem BSIG und NIS2 prüfen: Statusannahmen, Eignung, Gleichwertigkeit, C5 und ISO-Nachweise, SOC-Leistung, Melde-Zuarbeit,…
Auf Auftraggeberseite IT-Sicherheitsvergaben nach geltendem BSIG und NIS2 entwerfen: Statusbeleg, Schutzbedarf, funktionale SOC-Leistung, Eignung, Gleichwertigkeit,…
Harden a repeatedly re-reviewed documentation/contract plan after adversarial reviewers keep finding semantic gaps despite new test rows.
Jagdrecht und Fischereirecht im ALR. Skill behandelt das Wildbann-System die Jagdberechtigung des Grundherrn vs.
Använd när hon vill hitta fler eller andra jobb än de vanliga sökningarna ger, säger "hitta jobb jag inte skulle hittat själv", "var finns jobben?", "vilka andra titlar kan jag…
All Security skills →
More in SecurityRed Team (1,734) · Web Security (1,180) · Identity Access (547) · Network Security (462) · Appsec Tools (423) · Forensics (342) · Compliance (239) · Malware Analysis (227) · Cloud Security (100) · Zero Trust (88) · Crypto Keymgmt (75) · Appsec Build (68) · Incident Response (21) · Ot Ics Security (11)