Results for “security-events”

Configures Windows Advanced Audit Policy, event log sizes, and Windows Event Forwarding to generate high-fidelity security events for threat detection and SIEM ingestion.

Triages security incidents by classifying type, assigning severity based on business impact, enriching with threat intelligence, and routing to appropriate response teams using NIST SP 800-61r3 and SANS PICERL frameworks.

安全专家入口。用于 Codex CLI 的 $expert-security 调用。 适用于威胁建模、漏洞评估、安全代码审查、安全架构设计、DevSecOps、安全运营、事件响应、合规审计和完整安全健康评估。 触发词：安全专家、威胁建模、STRIDE、OWASP、SAST、DAST、SBOM、漏洞评估、代码审计、事件响应、合规审计、SOC、等保、GDPR、PIPL、隐私政策审查

Secure Laravel applications with best practices for authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and deployment configurations.

Implements layered security for Flutter apps: code obfuscation, certificate pinning, secure storage, encryption, biometric authentication, and root/jailbreak detection.

Implements security-sensitive changes with conservative trust boundaries, secret protection, tests, and verification.

Investigate security incidents by correlating Windows event logs, firewall, proxy, and authentication data using Splunk SPL queries and Enterprise Security.

Use this skill for auth boundaries, input validation, secrets, RLS, injection risks, destructive-action review. Trigger when the task involves security work related to Security Hardening, production implementation, audits, debugging, strategy, or validation.

Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations.

Detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement by analyzing Windows Security, System, and Sysmon event logs in Splunk using SPL queries mapped to MITRE ATT&CK techniques.

Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, and auditing SMB and LDAP signing enforcement.

Create, enrich, and share threat intelligence events on a MISP platform using PyMISP, including IOC management, feed integration, STIX export, and community sharing workflows.

Automated security auditing covering SAST, DAST, dependency scanning, secret detection, container hardening, and compliance checks before deployments or when integrating new dependencies.

Provides a comprehensive security checklist and code patterns for authentication, input validation, secrets management, SQL injection prevention, XSS, CSRF, rate limiting, and sensitive data exposure.

Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status, and suspicious authentication patterns across the domain.

Audit authentication, token handling, PII protection, and anti-cheat in QuizVerse.

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Security Review

Provides a security checklist and code patterns for authentication, input validation, secrets management, SQL injection prevention, XSS, CSRF, rate limiting, and sensitive data handling.

Laravel 安全最佳实践，涵盖认证/授权、验证、CSRF、批量赋值、文件上传、密钥、速率限制和安全部署。

Hardens Laravel applications against common vulnerabilities with guidance on authentication, authorization, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.

Use this skill when implementing any feature that touches user data, auth, APIs, file uploads, pe...

Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach, using network segmentation, endpoint isolation, credential revocation, and access control modifications.

Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case.

Guides blue-team threat hunting and detection engineering with hypothesis-driven workflows, Sigma/YARA rule creation, SIEM query design, and validation using Atomic Red Team in authorized environments.

Ensure HIPAA compliance when handling PHI (Protected Health Information). Use when writing code that accesses user health data, check-ins, journal entries, or any sensitive information. Activates for audit logging, data access, security events, and compliance questions.

Query AWS CloudTrail events with boto3, build statistical baselines of normal API activity, and detect anomalies such as unusual event sources, geographic anomalies, high-frequency API calls, and first-time API usage patterns.

Detect DCOM-based lateral movement by correlating Sysmon process creation and network connection events, WMI event analysis, and RPC endpoint mapper traffic to identify abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects.

Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.