← all publishers

micsapp

@micsapp source repo

Report this profile Claim this profile

• 3.2k skills
• 0 followers
• 3 repo stars
• last month last updated

1. ▌
   Configuring Suricata For Network Monitoring · micsapp bundle

   Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.
   3 repo stars
2. ▌
   Configuring Zscaler Private Access For Ztna · micsapp bundle

   Configuring Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring access policies based on user identity and device posture, and integrating with IdPs.
   3 repo stars
3. ▌
   Deobfuscating Powershell Obfuscated Malware · micsapp bundle

   Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.
   3 repo stars
4. ▌
   Detecting AI Model Prompt Injection Attacks · micsapp bundle

   Detects prompt injection attacks targeting LLM-based applications using a multi-layered defense combining regex pattern matching for known attack signatures, heuristic scoring for structural anomalies, and transformer-based classification with DeBERTa models. The detector analyzes user inputs before they reach the LLM, flagging direct injections (system prompt overrides, role-play escapes, instruction hijacking) and indirect injections (encoded payloads, multi-language obfuscation, delimiter-based escapes). Based on the OWASP LLM Top 10 (LLM01:2025 Prompt Injection) and Simon Willison's prompt injection taxonomy. Activates for requests involving prompt injection detection, LLM input sanitization, AI security scanning, or prompt attack classification.
   3 repo stars
5. ▌
   Detecting Anomalous Authentication Patterns · micsapp bundle

   Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs. Activates for requests involving authentication anomaly detection, login behavior analysis, UEBA implementation, or suspicious sign-in investigation.
   3 repo stars
6. ▌
   Detecting AWS Guardduty Findings Automation · micsapp bundle

   Automate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.
   3 repo stars
7. ▌
   Detecting Business Email Compromise With AI · micsapp bundle

   Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.
   3 repo stars
8. ▌
   Detecting Container Escape With Falco Rules · micsapp bundle

   Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.
   3 repo stars
9. ▌
   Detecting Dcsync Attack In Active Directory · micsapp bundle

   Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.
   3 repo stars
10. ▌
    Detecting Deepfake Audio In Vishing Attacks · micsapp bundle

    Detects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models. Supports batch analysis of audio files, generates confidence scores, and produces forensic reports. Activates for requests involving deepfake voice detection, vishing investigation, AI-generated speech analysis, voice cloning detection, or audio authenticity verification.
    3 repo stars
11. ▌
    Detecting Insider Data Exfiltration Via Dlp · micsapp bundle

    Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data loss prevention.
    3 repo stars
12. ▌
    Detecting Ntlm Relay With Event Correlation · micsapp bundle

    Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
    3 repo stars
13. ▌
    Detecting T1003 Credential Dumping With Edr · micsapp bundle

    Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.
    3 repo stars
14. ▌
    Exploiting Active Directory With Bloodhound · micsapp bundle

    BloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments. Red teams use BloodHound to identify attac
    3 repo stars
15. ▌
    Hardening Linux Endpoint With Cis Benchmark · micsapp bundle

    Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.
    3 repo stars
16. ▌
    Hunting For Living Off The Cloud Techniques · micsapp bundle

    Hunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse of Azure, AWS, GCP services, and SaaS platforms.
    3 repo stars
17. ▌
    Hunting For Registry Persistence Mechanisms · micsapp bundle

    Hunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking in Windows environments.
    3 repo stars
18. ▌
    Implementing Anti Phishing Training Program · micsapp bundle

    Security awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positiv
    3 repo stars
19. ▌
    Implementing API Schema Validation Security · micsapp bundle

    Implement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts and prevent injection, data exposure, and mass assignment attacks.
    3 repo stars
20. ▌
    Implementing Cisa Zero Trust Maturity Model · micsapp bundle

    Implement the CISA Zero Trust Maturity Model v2.0 across the five pillars of identity, devices, networks, applications, and data to achieve progressive organizational zero trust maturity.
    3 repo stars
21. ▌
    Implementing Disk Encryption With Bitlocker · micsapp bundle

    Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthorized access in case of device loss or theft. Use when deploying encryption for compliance requirements, securing mobile workstations, or implementing data protection controls across the enterprise. Activates for requests involving BitLocker encryption, disk encryption, TPM configuration, or data-at-rest protection.
    3 repo stars
22. ▌
    Implementing Runtime Security With Tetragon · micsapp bundle

    Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and policy enforcement.
    3 repo stars
23. ▌
    Implementing Siem Correlation Rules For Apt · micsapp bundle

    Write multi-event correlation rules that detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts. Uses Splunk SPL and Sigma rule format to correlate Event IDs 4624, 4648, 4688, and Sysmon Events 1/3 within sliding time windows to surface attack sequences invisible to single-event detections.
    3 repo stars
24. ▌
    Implementing Ticketing System For Incidents · micsapp bundle

    Implements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for structured incident tracking, SLA management, escalation workflows, and compliance documentation. Use when SOC teams need formalized incident lifecycle management with automated ticket creation, assignment routing, and resolution tracking.
    3 repo stars
25. ▌
    Implementing Velociraptor For Ir Collection · micsapp bundle

    Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments.
    3 repo stars
26. ▌
    Integrating Dast With Owasp Zap In Pipeline · micsapp bundle

    This skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic Application Security Testing in CI/CD pipelines. It addresses configuring baseline, full, and API scans against running applications, interpreting ZAP findings, tuning scan policies, and establishing DAST quality gates in GitHub Actions and GitLab CI.
    3 repo stars
27. ▌
    Performing Agentless Vulnerability Scanning · micsapp bundle

    Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without installing endpoint agents.
    3 repo stars
28. ▌
    Performing Authenticated Vulnerability Scan · micsapp bundle

    Authenticated (credentialed) vulnerability scanning uses valid system credentials to log into target hosts and perform deep inspection of installed software, patches, configurations, and security sett
    3 repo stars
29. ▌
    Performing Dmarc Policy Enforcement Rollout · micsapp bundle

    Execute a phased DMARC rollout from p=none monitoring through p=quarantine to p=reject enforcement, ensuring all legitimate email sources are authenticated before blocking unauthorized senders.
    3 repo stars
30. ▌
    Performing Docker Bench Security Assessment · micsapp bundle

    Docker Bench for Security is an open-source script that checks dozens of common best practices around deploying Docker containers in production. Based on the CIS Docker Benchmark, it audits host confi
    3 repo stars
31. ▌
    Performing Endpoint Forensics Investigation · micsapp bundle

    Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Use when investigating security incidents, collecting evidence for legal proceedings, or analyzing endpoint compromise scope. Activates for requests involving endpoint forensics, memory analysis, disk forensics, or incident investigation.
    3 repo stars
32. ▌
    Performing False Positive Reduction In Siem · micsapp bundle

    Perform systematic SIEM false positive reduction through rule tuning, threshold adjustment, correlation refinement, and threat intelligence enrichment to combat alert fatigue.
    3 repo stars
33. ▌
    Performing Firmware Extraction With Binwalk · micsapp bundle

    Performs firmware image extraction and analysis using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis for detecting encrypted or compressed regions, recursive extraction of nested archives, SquashFS/CramFS/JFFS2 filesystem mounting, and string analysis for credential and configuration discovery. Activates for requests involving firmware reverse engineering, IoT device analysis, embedded system security assessment, or router/camera firmware extraction.
    3 repo stars
34. ▌
    Performing Ics Asset Discovery With Claroty · micsapp bundle

    Perform comprehensive ICS/OT asset discovery using Claroty xDome platform, leveraging passive monitoring, Claroty Edge active queries, and integration ecosystem to gain full visibility into industrial control system assets including PLCs, RTUs, HMIs, and network infrastructure across Purdue Model levels.
    3 repo stars
35. ▌
    Performing Network Forensics With Wireshark · micsapp bundle

    Capture and analyze network traffic using Wireshark and tshark to reconstruct network events, extract artifacts, and identify malicious communications.
    3 repo stars
36. ▌
    Performing Oil Gas Cybersecurity Assessment · micsapp bundle

    This skill covers conducting cybersecurity assessments specific to oil and gas facilities including upstream (exploration/production), midstream (pipeline/transport), and downstream (refining/distribution) operations. It addresses SCADA systems controlling pipeline operations, DCS for refinery process control, safety instrumented systems for hazardous processes, remote terminal units at unmanned wellhead sites, and compliance with API 1164, TSA Pipeline Security Directives, IEC 62443, and NIST Cybersecurity Framework for critical infrastructure.
    3 repo stars
37. ▌
    Performing Ot Vulnerability Scanning Safely · micsapp bundle

    Perform vulnerability scanning in OT/ICS environments safely using passive monitoring, native protocol queries, and carefully controlled active scanning with Tenable OT Security to identify vulnerabilities without disrupting industrial processes or crashing legacy controllers.
    3 repo stars
38. ▌
    Performing Phishing Simulation With Gophish · micsapp bundle

    GoPhish is an open-source phishing simulation framework used by security teams to conduct authorized phishing awareness campaigns. It provides campaign management, email template creation, landing pag
    3 repo stars
39. ▌
    Performing Privileged Account Access Review · micsapp bundle

    Conduct systematic reviews of privileged accounts to validate access rights, identify excessive permissions, and enforce least privilege across PAM infrastructure.
    3 repo stars
40. ▌
    Performing Ssl Tls Inspection Configuration · micsapp bundle

    Configure SSL/TLS inspection on network security devices to decrypt, inspect, and re-encrypt HTTPS traffic for threat detection while managing certificates, exemptions, and privacy compliance.
    3 repo stars
41. ▌
    Performing Threat Hunting With Elastic Siem · micsapp bundle

    Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection. Use when SOC teams need to hunt for specific ATT&CK techniques, investigate anomalous behaviors, or validate detection coverage gaps using Elasticsearch and Kibana Security.
    3 repo stars
42. ▌
    Performing Web Application Penetration Test · micsapp bundle

    Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses Burp Suite as the primary interception proxy alongside manual testing techniques to find flaws that automated scanners miss. Activates for requests involving web app pentest, OWASP testing, application security assessment, or web vulnerability testing.
    3 repo stars
43. ▌
    Securing Historian Server In Ot Environment · micsapp bundle

    This skill covers hardening and securing process historian servers (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environments. It addresses network placement across Purdue levels, access control for historian interfaces, data replication through DMZ using data diodes or PI-to-PI connectors, SQL injection prevention in historian queries, and integrity protection of process data used for safety analysis, regulatory reporting, and process optimization.
    3 repo stars
44. ▌
    Testing Android Intents For Vulnerabilities · micsapp bundle

    Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.
    3 repo stars
45. ▌
    Triaging Security Incident With Ir Playbook · micsapp bundle

    Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.
    3 repo stars
46. ▌
    Competitive Analysis · micsapp

    Research competitors and compare positioning, messaging, content strategy, and market presence. Use when analyzing a competitor, building battlecards, identifying content gaps, comparing feature messaging, or preparing competitive positioning recommendations.
    3 repo stars
47. ▌
    Plugin Creator · micsapp

    Create, validate, and publish Claude Code plugins and marketplaces. Use this skill when building plugins with commands, agents, hooks, MCP servers, or skills.
    3 repo stars
48. ▌
    Skills Manager · micsapp bundle

    Universal consolidation & audit skill for Claude Code skills. Analyzes project state, detects redundancies, and safely manages skills with backup, confirmations, and rollback capabilities. Never assumes without verifying actual code and usage patterns.
    3 repo stars
49. ▌
    Adk Agent Builder · micsapp bundle

    Build production-ready AI agents using Google's Agent Development Kit with AI assistant integration, React patterns, multi-agent orchestration, and comprehensive tool libraries. Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.
    3 repo stars
50. ▌
    Exa Cost Tuning · micsapp

    Optimize Exa costs through tier selection, sampling, and usage monitoring. Use when analyzing Exa billing, reducing API costs, or implementing usage monitoring and budget alerts. Trigger with phrases like "exa cost", "exa billing", "reduce exa costs", "exa pricing", "exa expensive", "exa budget".
    3 repo stars
51. ▌
    Exa Hello World · micsapp

    Create a minimal working Exa example. Use when starting a new Exa integration, testing your setup, or learning basic Exa API patterns. Trigger with phrases like "exa hello world", "exa example", "exa quick start", "simple exa code".
    3 repo stars
52. ▌
    Exa Rate Limits · micsapp

    Implement Exa rate limiting, backoff, and idempotency patterns. Use when handling rate limit errors, implementing retry logic, or optimizing API request throughput for Exa. Trigger with phrases like "exa rate limit", "exa throttling", "exa 429", "exa retry", "exa backoff".
    3 repo stars
53. ▌
    Consul Service Discovery · micsapp

    Manage consul service discovery operations. Auto-activating skill for DevOps Advanced. Triggers on: consul service discovery, consul service discovery Part of the DevOps Advanced skill category. Use when working with consul service discovery functionality. Trigger with phrases like "consul service discovery", "consul discovery", "consul".
    3 repo stars
54. ▌
    Fluentd Config Generator · micsapp

    Generate fluentd config generator operations. Auto-activating skill for DevOps Advanced. Triggers on: fluentd config generator, fluentd config generator Part of the DevOps Advanced skill category. Use when configuring systems or services. Trigger with phrases like "fluentd config generator", "fluentd generator", "fluentd".
    3 repo stars
55. ▌
    Terraform Module Creator · micsapp

    Create terraform module creator operations. Auto-activating skill for DevOps Advanced. Triggers on: terraform module creator, terraform module creator Part of the DevOps Advanced skill category. Use when working with terraform module creator functionality. Trigger with phrases like "terraform module creator", "terraform creator", "terraform".
    3 repo stars
56. ▌
    Vault Secrets Integrator · micsapp

    Configure vault secrets integrator operations. Auto-activating skill for DevOps Advanced. Triggers on: vault secrets integrator, vault secrets integrator Part of the DevOps Advanced skill category. Use when working with vault secrets integrator functionality. Trigger with phrases like "vault secrets integrator", "vault integrator", "vault".
    3 repo stars
57. ▌
    Cloud Security Posture · micsapp

    Manage cloud security posture operations. Auto-activating skill for Security Advanced. Triggers on: cloud security posture, cloud security posture Part of the Security Advanced skill category. Use when working with cloud security posture functionality. Trigger with phrases like "cloud security posture", "cloud posture", "cloud".
    3 repo stars
58. ▌
    Coverage Report Analyzer · micsapp

    Analyze coverage report analyzer operations. Auto-activating skill for Test Automation. Triggers on: coverage report analyzer, coverage report analyzer Part of the Test Automation skill category. Use when analyzing or auditing coverage report analyzer. Trigger with phrases like "coverage report analyzer", "coverage analyzer", "analyze coverage report r".
    3 repo stars
59. ▌
    Report Template Generator · micsapp

    Generate report template generator operations. Auto-activating skill for Data Analytics. Triggers on: report template generator, report template generator Part of the Data Analytics skill category. Use when working with report template generator functionality. Trigger with phrases like "report template generator", "report generator", "report".
    3 repo stars
60. ▌
    Window Function Generator · micsapp

    Generate window function generator operations. Auto-activating skill for Data Analytics. Triggers on: window function generator, window function generator Part of the Data Analytics skill category. Use when working with window function generator functionality. Trigger with phrases like "window function generator", "window generator", "window".
    3 repo stars
61. ▌
    Cloudfront Distribution Setup · micsapp

    Configure cloudfront distribution setup operations. Auto-activating skill for AWS Skills. Triggers on: cloudfront distribution setup, cloudfront distribution setup Part of the AWS Skills skill category. Use when working with cloudfront distribution setup functionality. Trigger with phrases like "cloudfront distribution setup", "cloudfront setup", "cloudfront".
    3 repo stars
62. ▌
    API Rate Limiting Config · micsapp

    Configure api rate limiting config operations. Auto-activating skill for API Development. Triggers on: api rate limiting config, api rate limiting config Part of the API Development skill category. Use when working with APIs or building integrations. Trigger with phrases like "api rate limiting config", "api config", "api".
    3 repo stars
63. ▌
    GRAPHQL Mutation Builder · micsapp

    Build graphql mutation builder operations. Auto-activating skill for API Development. Triggers on: graphql mutation builder, graphql mutation builder Part of the API Development skill category. Use when working with graphql mutation builder functionality. Trigger with phrases like "graphql mutation builder", "graphql builder", "graphql".
    3 repo stars
64. ▌
    GRAPHQL Schema Generator · micsapp

    Generate graphql schema generator operations. Auto-activating skill for API Development. Triggers on: graphql schema generator, graphql schema generator Part of the API Development skill category. Use when working with graphql schema generator functionality. Trigger with phrases like "graphql schema generator", "graphql generator", "graphql".
    3 repo stars
65. ▌
    Server Sent Events Setup · micsapp

    Configure server sent events setup operations. Auto-activating skill for API Integration. Triggers on: server sent events setup, server sent events setup Part of the API Integration skill category. Use when working with server sent events setup functionality. Trigger with phrases like "server sent events setup", "server setup", "server".
    3 repo stars
66. ▌
    Websocket Client Creator · micsapp

    Create websocket client creator operations. Auto-activating skill for API Integration. Triggers on: websocket client creator, websocket client creator Part of the API Integration skill category. Use when working with websocket client creator functionality. Trigger with phrases like "websocket client creator", "websocket creator", "websocket".
    3 repo stars
67. ▌
    Code Of Conduct Generator · micsapp

    Generate code of conduct generator operations. Auto-activating skill for Technical Documentation. Triggers on: code of conduct generator, code of conduct generator Part of the Technical Documentation skill category. Use when working with code of conduct generator functionality. Trigger with phrases like "code of conduct generator", "code generator", "code".
    3 repo stars
68. ▌
    Ascii Art Diagram Creator · micsapp

    Create ascii art diagram creator operations. Auto-activating skill for Visual Content. Triggers on: ascii art diagram creator, ascii art diagram creator Part of the Visual Content skill category. Use when working with ascii art diagram creator functionality. Trigger with phrases like "ascii art diagram creator", "ascii creator", "ascii".
    3 repo stars
69. ▌
    Data Visualization Helper · micsapp

    Configure with data visualization helper operations. Auto-activating skill for Visual Content. Triggers on: data visualization helper, data visualization helper Part of the Visual Content skill category. Use when working with data visualization helper functionality. Trigger with phrases like "data visualization helper", "data helper", "data".
    3 repo stars
70. ▌
    Network Diagram Generator · micsapp

    Generate network diagram generator operations. Auto-activating skill for Visual Content. Triggers on: network diagram generator, network diagram generator Part of the Visual Content skill category. Use when working with network diagram generator functionality. Trigger with phrases like "network diagram generator", "network generator", "network".
    3 repo stars
71. ▌
    Analyzing Cobalt Strike Beacon Configuration · micsapp bundle

    Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.
    3 repo stars
72. ▌
    Analyzing Cobaltstrike Malleable C2 Profiles · micsapp bundle

    Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate network detection signatures.
    3 repo stars
73. ▌
    Analyzing Malware Sandbox Evasion Techniques · micsapp bundle

    Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports
    3 repo stars
74. ▌
    Analyzing Network Covert Channels In Malware · micsapp bundle

    Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 and data exfiltration.
    3 repo stars
75. ▌
    Conducting Internal Network Penetration Test · micsapp bundle

    Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escalation vectors, and sensitive data exposure within the corporate network.
    3 repo stars
76. ▌
    Conducting Spearphishing Simulation Campaign · micsapp bundle

    Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craf
    3 repo stars
77. ▌
    Conducting Wireless Network Penetration Test · micsapp bundle

    Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive portal bypasses, evil twin attacks, WPA2/WPA3 handshake capture, rogue access point detection, and client-side attacks. The tester evaluates wireless authentication, network segmentation, and the effectiveness of wireless intrusion detection systems. Activates for requests involving wireless pentest, WiFi security assessment, WPA2/WPA3 testing, or rogue access point detection.
    3 repo stars
78. ▌
    Configuring Microsegmentation For Zero Trust · micsapp bundle

    Configure microsegmentation policies to enforce least-privilege workload-to-workload access using tools like VMware NSX, Illumio, and Calico, preventing lateral movement in zero trust architectures.
    3 repo stars
79. ▌
    Deploying Palo Alto Prisma Access Zero Trust · micsapp bundle

    Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.
    3 repo stars
80. ▌
    Detecting Typosquatting Packages In NPM Pypi · micsapp bundle

    Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages have disproportionately low usage compared to their legitimate targets. The analyst queries the PyPI JSON API and npm registry API to gather package metadata for automated comparison. Activates for requests involving package typosquatting detection, dependency confusion analysis, malicious package identification, or software supply chain threat hunting in package registries.
    3 repo stars
81. ▌
    Executing Active Directory Attack Simulation · micsapp bundle

    Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.
    3 repo stars
82. ▌
    Exploiting Prototype Pollution In Javascript · micsapp bundle

    Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.
    3 repo stars
83. ▌
    Hunting For Data Staging Before Exfiltration · micsapp bundle

    Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry
    3 repo stars
84. ▌
    Hunting For Defense Evasion Via Timestomping · micsapp bundle

    Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.
    3 repo stars
85. ▌
    Implementing Aes Encryption For Data At REST · micsapp bundle

    AES (Advanced Encryption Standard) is a symmetric block cipher standardized by NIST (FIPS 197) used to protect classified and sensitive data. This skill covers implementing AES-256 encryption in GCM m
    3 repo stars
86. ▌
    Implementing API Security Posture Management · micsapp bundle

    Implement API Security Posture Management to continuously discover, classify, and score APIs based on risk while enforcing security policies across the API lifecycle.
    3 repo stars
87. ▌
    Implementing AWS Config Rules For Compliance · micsapp bundle

    Implementing AWS Config rules for continuous compliance monitoring of AWS resources, deploying managed and custom rules aligned to CIS and PCI DSS frameworks, configuring automatic remediation with SSM Automation, and aggregating compliance data across accounts.
    3 repo stars
88. ▌
    Implementing Ddos Mitigation With Cloudflare · micsapp bundle

    Configure Cloudflare DDoS protection with managed rulesets, rate limiting, WAF rules, Bot Management, and origin protection to mitigate volumetric, protocol, and application-layer attacks.
    3 repo stars
89. ▌
    Implementing Digital Signatures With Ed25519 · micsapp bundle

    Ed25519 is a high-performance digital signature algorithm using the Edwards curve Curve25519. It provides 128-bit security with 64-byte signatures and 32-byte keys, offering significant advantages ove
    3 repo stars
90. ▌
    Implementing Google Workspace Admin Security · micsapp bundle

    Implements comprehensive Google Workspace security hardening including admin console configuration, phishing-resistant MFA enforcement, DLP policies, email authentication (SPF/DKIM/DMARC), OAuth app control, and external sharing restrictions. Activates for requests involving Google Workspace hardening, G Suite security configuration, or cloud office security administration.
    3 repo stars
91. ▌
    Implementing Hashicorp Vault Dynamic Secrets · micsapp bundle

    Implements HashiCorp Vault dynamic secrets engines for database credentials, AWS IAM keys, and PKI certificates with automatic generation, lease management, and credential rotation to eliminate static secrets in application configurations. Activates for requests involving Vault secrets engine configuration, dynamic database credentials, ephemeral cloud credentials, or automated secret rotation.
    3 repo stars
92. ▌
    Implementing Memory Protection With Dep Aslr · micsapp bundle

    Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent memory corruption attacks. Use when hardening endpoints against buffer overflow exploits, ROP chains, and code injection. Activates for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG configuration.
    3 repo stars
93. ▌
    Implementing Network Policies For Kubernetes · micsapp bundle

    Kubernetes NetworkPolicies provide pod-level network segmentation by defining ingress and egress rules that control traffic flow between pods, namespaces, and external endpoints. Combined with CNI plu
    3 repo stars
94. ▌
    Implementing Patch Management For Ot Systems · micsapp bundle

    This skill covers implementing a structured patch management program for OT/ICS environments where traditional IT patching approaches can cause process disruption or safety hazards. It addresses vendor compatibility testing, risk-based patch prioritization, staged deployment through test environments, maintenance window coordination, rollback procedures, and compensating controls when patches cannot be applied due to operational constraints or vendor restrictions.
    3 repo stars
95. ▌
    Performing Active Directory Penetration Test · micsapp bundle

    Conduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise.
    3 repo stars
96. ▌
    Performing API Security Testing With Postman · micsapp bundle

    Uses Postman to perform structured API security testing by building collections that test for OWASP API Security Top 10 vulnerabilities including authentication bypass, authorization flaws, injection, and data exposure. The tester creates environments with multiple user roles, writes test scripts for automated security validation, and integrates Postman with OWASP ZAP and Newman for CI/CD security testing. Activates for requests involving Postman security testing, API security collection, automated API testing, or OWASP API testing with Postman.
    3 repo stars
97. ▌
    Performing Cloud Native Forensics With Falco · micsapp bundle

    Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use when building container runtime security or investigating k8s cluster compromises.
    3 repo stars
98. ▌
    Performing Dns Enumeration And Zone Transfer · micsapp bundle

    Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.
    3 repo stars
99. ▌
    Performing External Network Penetration Test · micsapp bundle

    Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance, scanning, exploitation, and reporting.
    3 repo stars
100. ▌
     Performing Linux Log Forensics Investigation · micsapp bundle

     Perform forensic investigation of Linux system logs including syslog, auth.log, systemd journal, kern.log, and application logs to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised Linux systems.
     3 repo stars