Packs
1 packResults for “ato”
14 skills
mukul975 performing-threat-emulation-with-atomic-red-team
Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage.
24.6k · bundle
mukul975 performing-purple-team-atomic-testing
Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs coverage gap analysis, and runs detection validation loops to measure blue team visibility.
24.6k · bundle
mukul975 executing-nist-rmf-authorization-to-operate
Guide federal systems through the NIST Risk Management Framework (SP 800-37 Rev 2) to achieve an Authorization to Operate (ATO), covering categorization, control selection, assessment, and continuous monitoring.
24.6k · bundle
zhaoxuya520 threat-hunting
Guides blue-team threat hunting and detection engineering with hypothesis-driven workflows, Sigma/YARA rule creation, SIEM query design, and validation using Atomic Red Team in authorized environments.
12.8k · bundle
More results
yanacuti1121 memory-gc
Session-end memory garbage collector. Promotes valuable L2 session facts to L1 atomic memory, wipes L2, and rotates oversized audit logs. Run at end of session to prevent context inflation and storage bloat.
2
mukul975 implementing-siem-use-cases-for-detection
Design, implement, test, and maintain SIEM detection rules mapped to MITRE ATT&CK across Splunk, Elastic, and Sentinel platforms.
24.6k · bundle
microsoft microsoft-azure-webjobs-extensions-authentication-events-dot
Extend Microsoft Entra ID authentication flows with custom claims, attribute collection, and OTP delivery using Azure Functions triggers.
2.7k
mukul975 performing-false-positive-reduction-in-siem
Systematically reduce SIEM false positives through rule tuning, threshold adjustment, correlation refinement, and threat intelligence enrichment to combat alert fatigue.
24.6k · bundle
shulkwisec ad-assessment
Active Directory security audit using the MITRE ATT&CK framework. Full domain enumeration, trust mapping, GPO analysis, ACL abuse paths, ADCS attacks (ESC1-ESC8), delegation abuse (constrained/unconstrained/RBCD), fine-grained password policies, LAPS deployment, service account security, and Kerberos configuration. Uses enum4linux-ng, netexec, impacket, ldapsearch, certipy-ad, bloodhound-python, and rpcclient. Produces attack path diagrams, prioritized risk register, and PoCs. Chains into /gh-export for issue filing.
21
luokai0 cognito
Builds, configures, and manages AWS Cognito user pools, identity pools, authentication flows, and integrations with other AWS services.
10 · bundle
luokai0 azure-auth
Implements Microsoft Entra ID authentication for React SPAs using MSAL.js and validates JWTs in Cloudflare Workers with jose, covering Authorization Code Flow with PKCE and common error fixes.
10 · bundle
mukul975 performing-purple-team-exercise
Coordinates purple team exercises by running MITRE ATT&CK-mapped attack scenarios with real-time detection testing and collaborative gap remediation.
24.6k · bundle
mukul975 mapping-mitre-attack-techniques
Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization.
24.6k · bundle
kk20300113-png design-review
Designer's eye QA: finds visual inconsistency, spacing issues, hierarchy problems, AI slop patterns, and slow interactions — then fixes them. Iteratively fixes issues in source code, committing each fix atomically and re-verifying with before/after screenshots. For plan-mode design review (before implementation), use /plan-design-review. Use when asked to "audit the design", "visual QA", "check if it looks good", or "design polish". Proactively suggest when the user mentions visual inconsistencies or wants to polish the look of a live site. (gstack)
0