aibot88 CybersecurityPlaybooks
24 curated offensive security playbooks adapted from the Anthropic-Cybersecurity-Skills community project (Apache-2.0). Each playbook is operator-grade with actual tool commands, MITRE ATT&CK mappings, and detection indicators.
Playbook Index
Red Team (11 playbooks)
| Playbook | File | ATT&CK | Tools |
|---|---|---|---|
| Kerberoasting with Impacket | reference/RedTeam/Kerberoasting.md |
T1558.003 | impacket, hashcat |
| BloodHound CE Reconnaissance | reference/RedTeam/BloodhoundRecon.md |
T1087.002 | bloodhound-python, SharpHound |
| Full-Scope Red Team Engagement | reference/RedTeam/FullScopeEngagement.md |
Multiple | Full kill-chain |
| Sliver C2 Infrastructure | reference/RedTeam/SliverC2.md |
T1071.001 | Sliver Framework |
| AD Certificate Services ESC1 | reference/RedTeam/ADCertServicesESC1.md |
T1649 | Certipy |
| Zerologon (CVE-2020-1472) | reference/RedTeam/Zerologon.md |
T1210 | impacket |
| NoPac (CVE-2021-42278/42287) | reference/RedTeam/NoPac.md |
T1068 | noPac.py |
| DCSync Persistence | reference/RedTeam/DCSync.md |
T1003.006 | mimikatz, impacket |
| WMIExec Lateral Movement | reference/RedTeam/WMIExec.md |
T1047 | impacket |
| LaZagne Credential Access | reference/RedTeam/LaZagne.md |
T1555 | LaZagne |
| Linux Privilege Escalation | reference/RedTeam/LinuxPrivEsc.md |
T1548 | linpeas, GTFOBins |
Penetration Testing (5 playbooks)
| Playbook | File | ATT&CK | Tools |
|---|---|---|---|
| Metasploit Framework | reference/PenetrationTesting/MetasploitFramework.md |
Multiple | msfconsole |
| Privilege Escalation Assessment | reference/PenetrationTesting/PrivEscAssessment.md |
T1068 | winpeas, linpeas |
| API Security (OWASP Top 10) | reference/PenetrationTesting/APISecurity.md |
Multiple | Burp, Postman |
| Kubernetes Pentesting | reference/PenetrationTesting/KubernetesPentest.md |
Multiple | kubectl, kube-hunter |
Network Security (4 playbooks)
| Playbook | File | ATT&CK | Tools |
|---|---|---|---|
| Advanced Nmap Scanning | reference/NetworkSecurity/NmapAdvanced.md |
T1046 | nmap, NSE |
| DNS Enumeration & Zone Transfer | reference/NetworkSecurity/DNSEnumeration.md |
T1590.002 | dig, dnsenum |
| SMB Exploitation | reference/NetworkSecurity/SMBExploitation.md |
T1210 | metasploit, crackmapexec |
| WiFi Cracking with Aircrack | reference/NetworkSecurity/WifiCracking.md |
T1557 | aircrack-ng |
Web Application Security (3 playbooks)
| Playbook | File | ATT&CK | Tools |
|---|---|---|---|
| SQL Injection with sqlmap | reference/WebAppSecurity/SQLInjection.md |
T1190 | sqlmap |
| Server-Side Request Forgery | reference/WebAppSecurity/SSRF.md |
T1190 | Burp Suite |
| HTTP Request Smuggling | reference/WebAppSecurity/HTTPSmuggling.md |
T1190 | Burp Suite |
Forensics & Malware Analysis (2 playbooks)
| Playbook | File | ATT&CK | Tools |
|---|---|---|---|
| Memory Credential Extraction | reference/Forensics/MemoryCredentials.md |
T1003 | Volatility3 |
| Cobalt Strike Beacon Analysis | reference/Forensics/CobaltStrikeAnalysis.md |
T1071.001 | CobaltStrikeParser |
Usage with Talon (Kali MCP)
These playbooks are designed to work with the Talon MCP server (SSH to Kali VM at 10.0.0.50). When a playbook references a tool command, execute it via the Kali MCP:
User: "Run a kerberoasting attack against the lab domain"
-> Load reference/RedTeam/Kerberoasting.md
-> Execute commands via Kali MCP (SSH to 10.0.0.50)
-> Follow the playbook phases: Enumerate -> Request TGS -> Crack -> Validate
Usage with Ehud (Pentest Agent)
Ehud can reference these playbooks during penetration testing engagements:
User: "Have Ehud test the Active Directory environment"
-> Ehud loads relevant playbooks (Kerberoasting, BloodHound, DCSync, etc.)
-> Executes structured assessment following ATT&CK kill chain
-> Generates findings mapped to MITRE techniques
Legal Notice
All playbooks are for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal.
Attribution
Playbooks adapted from mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0 License). Original author: Mahipal Jangra.