Plugins
2 plugins@anantha-236
Everything Claude Code Main
Complete collection of battle-tested Claude Code configs from an Anthropic hackathon winner - agents, skills, hooks, rules, and legacy command shims evolved over 10+ months of intensive daily use
100 skills · plugin
@samyakjhaveri
Sam Cc Setup
Portable core of Sam's Claude Code setup: native pre-commit hook enforcement (sentinel gate retired 2026-08-14), on-demand /validate, generic review agents, cross-model Codex review skills, and a /bootstrap-cc-setup skill that writes the always-loaded rules layer plugins cannot ship. For repos NOT bootstrapped by the Loam Copier template - a Loam-rendered project already carries most of this in .c
6 skills · plugin
Results for “rules”
40 skills
zhaoxuya520 Competition Mailbox Abuse
Trace mailbox abuse chains including OAuth consent, forwarding rules, delegate access, and message rerouting in a CTF sandbox environment.
12.8k · bundle
mukul975 Detecting Email Forwarding Rules Attack
Detect malicious email forwarding rules created by adversaries to maintain persistent access to email communications for intelligence collection and BEC attacks.
24.6k · bundle
mukul975 Implementing Siem Use Cases For Detection
Design, implement, test, and maintain SIEM detection rules mapped to MITRE ATT&CK across Splunk, Elastic, and Sentinel platforms.
24.6k · bundle
mukul975 Performing Threat Hunting With Yara Rules
Scan files, directories, and memory dumps using YARA rules to identify malware families, suspicious patterns, and IOC matches.
24.6k · bundle
mukul975 Hunting Evtx With Chainsaw
Hunt for threats in Windows Event Logs using Chainsaw, a fast Rust-based forensic tool that runs Sigma rules, keyword searches, and artifact analysis offline.
24.6k · bundle
mukul975 Correlating Security Events In Qradar
Correlates security events in IBM QRadar SIEM using AQL queries, custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources.
24.6k · bundle
More results
mukul975 Configuring Suricata For Network Monitoring
Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms.
24.6k · bundle
mukul975 Detecting Email Account Compromise
Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.
24.6k · bundle
mukul975 Detecting Container Escape Attempts
Detect container escape attempts using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.
24.6k · bundle
mukul975 Building Threat Hunt Hypothesis Framework
Transform threat intelligence and attack patterns into testable hunting hypotheses for proactive threat detection.
24.6k · bundle
mukul975 Detecting Kerberoasting Attacks
Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.
24.6k · bundle
mukul975 Detecting Business Email Compromise
Detect business email compromise (BEC) attacks using email gateway rules, behavioral analytics, and financial process controls.
24.6k · bundle
mukul975 Detecting Suspicious Powershell Execution
Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.
24.6k · bundle
mukul975 Hunting For Supply Chain Compromise
Hunt for supply chain compromise indicators including trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts.
24.6k · bundle
mukul975 Detecting Mimikatz Execution Patterns
Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.
24.6k · bundle
mukul975 Hunting For Registry Persistence Mechanisms
Hunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking in Windows environments.
24.6k · bundle
mukul975 Detecting Insider Threat Behaviors
Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.
24.6k · bundle
mukul975 Hunting For Scheduled Task Persistence
Hunt for adversary persistence via Windows Scheduled Tasks by analyzing task creation events, suspicious task actions, and unusual scheduling patterns.
24.6k · bundle
mukul975 Hunting For Unusual Network Connections
Hunt for unusual network connections by analyzing outbound traffic patterns, rare destinations, non-standard ports, and anomalous connection frequencies from endpoints.
24.6k · bundle
mukul975 Detecting Credential Dumping Techniques
Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules.
24.6k · bundle
mukul975 Extracting Windows Event Logs Artifacts
Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.
24.6k · bundle
mukul975 Building Incident Timeline With Timesketch
Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.
24.6k · bundle
mukul975 Implementing Security Monitoring With Datadog
Deploys Datadog Cloud SIEM, CSM, and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure.
24.6k · bundle
mukul975 Implementing Alert Fatigue Reduction
Reduces SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness.
24.6k · bundle
mukul975 Performing Threat Hunting With Elastic Siem
Proactively search for threats in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection.
24.6k · bundle
mukul975 Hunting For Registry Run Key Persistence
Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.
24.6k · bundle
mukul975 Detecting Container Runtime Threats With Falco
Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.
24.6k · bundle
mukul975 Extracting Iocs From Malware Samples
Extracts indicators of compromise (IOCs) from malware samples, including file hashes, network indicators, host artifacts, and behavioral patterns for threat intelligence sharing and detection rule creation.
24.6k · bundle
mukul975 Performing Purple Team Atomic Testing
Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs coverage gap analysis, and runs detection validation loops to measure blue team visibility.
24.6k · bundle
mukul975 Conducting Post Incident Lessons Learned
Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.
24.6k · bundle
zhaoxuya520 Threat Hunting
Guides blue-team threat hunting and detection engineering with hypothesis-driven workflows, Sigma/YARA rule creation, SIEM query design, and validation using Atomic Red Team in authorized environments.
12.8k · bundle
mukul975 Analyzing Kubernetes Audit Logs
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns.
24.6k · bundle
mukul975 Detecting Lateral Movement In Network
Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.
24.6k · bundle
mukul975 Analyzing Office365 Audit Logs For Compromise
Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.
24.6k · bundle
mukul975 Hunting For Lolbins Execution In Endpoint Logs
Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.
24.6k · bundle
google Detection Engineering Coverage Evaluation
Automates detection engineering workflows in Google SecOps by extracting threat intelligence, generating detection opportunities, simulating attacker behavior with synthetic events, evaluating rule coverage, and creating new YARA-L 2.0 rules to close gaps.
14.4k