← all publishers

micsapp

@micsapp source repo

Report this profile Claim this profile

• 3.2k skills
• 0 followers
• 3 repo stars
• last month last updated

1. ▌
   Vertex AI Pipeline Creator · micsapp

   Create vertex ai pipeline creator operations. Auto-activating skill for GCP Skills. Triggers on: vertex ai pipeline creator, vertex ai pipeline creator Part of the GCP Skills skill category. Use when working with vertex ai pipeline creator functionality. Trigger with phrases like "vertex ai pipeline creator", "vertex creator", "vertex".
   3 repo stars
2. ▌
   Circuit Breaker Setup · micsapp

   Configure circuit breaker setup operations. Auto-activating skill for API Integration. Triggers on: circuit breaker setup, circuit breaker setup Part of the API Integration skill category. Use when working with circuit breaker setup functionality. Trigger with phrases like "circuit breaker setup", "circuit setup", "circuit".
   3 repo stars
3. ▌
   Analyzing Azure Activity Logs For Threats · micsapp bundle

   Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.
   3 repo stars
4. ▌
   Analyzing IOS App Security With Objection · micsapp bundle

   Performs runtime mobile security exploration of iOS applications using Objection, a Frida-powered toolkit that enables security testers to interact with app internals without jailbreaking. Use when assessing iOS app security posture, bypassing client-side protections, dumping keychain items, inspecting filesystem storage, and evaluating runtime behavior. Activates for requests involving iOS security testing, Objection runtime analysis, Frida-based iOS assessment, or mobile runtime exploration.
   3 repo stars
5. ▌
   Analyzing Outlook Pst For Email Forensics · micsapp bundle

   Analyze Microsoft Outlook PST and OST files for email forensic evidence including message content, headers, attachments, deleted items, and metadata using libpff, pst-utils, and forensic email analysis tools for legal investigations and incident response.
   3 repo stars
6. ▌
   Analyzing Persistence Mechanisms In Linux · micsapp bundle

   Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring
   3 repo stars
7. ▌
   Analyzing Powershell Script Block Logging · micsapp bundle

   Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.
   3 repo stars
8. ▌
   Analyzing Windows Lnk Files For Artifacts · micsapp bundle

   Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.
   3 repo stars
9. ▌
   Building Threat Hunt Hypothesis Framework · micsapp bundle

   Build a systematic threat hunt hypothesis framework that transforms threat intelligence, attack patterns, and environmental data into testable hunting hypotheses.
   3 repo stars
10. ▌
    Conducting Domain Persistence With Dcsync · micsapp bundle

    Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.
    3 repo stars
11. ▌
    Conducting Full Scope Red Team Engagement · micsapp bundle

    Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities.
    3 repo stars
12. ▌
    Configuring Active Directory Tiered Model · micsapp bundle

    Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory. Covers Tier 0/1/2 separation, privileged access workstations (PAWs), administrative f
    3 repo stars
13. ▌
    Deploying Osquery For Endpoint Monitoring · micsapp bundle

    Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Use when building visibility into endpoint state, threat hunting across fleet, or implementing compliance monitoring. Activates for requests involving osquery deployment, endpoint visibility, fleet management, or SQL-based endpoint querying.
    3 repo stars
14. ▌
    Detecting Exfiltration Over Dns With Zeek · micsapp bundle

    Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains and anomalous query patterns
    3 repo stars
15. ▌
    Detecting Living Off The Land With Lolbas · micsapp bundle

    Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis
    3 repo stars
16. ▌
    Detecting Suspicious Powershell Execution · micsapp bundle

    Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.
    3 repo stars
17. ▌
    Eradicating Malware From Infected Systems · micsapp bundle

    Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.
    3 repo stars
18. ▌
    Exploiting Excessive Data Exposure In API · micsapp bundle

    Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. The tester intercepts API responses and analyzes them for leaked PII, internal identifiers, debug information, or sensitive business data that the UI does not display but the API transmits. This maps to OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving API data leakage testing, excessive data exposure, response filtering bypass, or API over-fetching.
    3 repo stars
19. ▌
    Exploiting JWT Algorithm Confusion Attack · micsapp bundle

    Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing a fixed algorithm. The tester manipulates the alg header to switch from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none to bypass signature verification, or exploits kid/jku/x5u header injection to supply attacker-controlled keys. Activates for requests involving JWT algorithm confusion, alg none attack, key confusion attack, or JWT signature bypass.
    3 repo stars
20. ▌
    Exploiting Race Condition Vulnerabilities · micsapp bundle

    Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate transactions, and exploit time-of-check-to-time-of-use flaws.
    3 repo stars
21. ▌
    Hunting For Command And Control Beaconing · micsapp bundle

    Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.
    3 repo stars
22. ▌
    Hunting For Unusual Service Installations · micsapp bundle

    Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.
    3 repo stars
23. ▌
    Implementing Anti Ransomware Group Policy · micsapp bundle

    Configures Windows Group Policy Objects (GPO) to prevent ransomware execution and limit its spread. Implements AppLocker rules, Software Restriction Policies, Controlled Folder Access, attack surface reduction rules, and network protection settings. Activates for requests involving Windows GPO hardening against ransomware, AppLocker configuration, Controlled Folder Access setup, or endpoint protection via Group Policy.
    3 repo stars
24. ▌
    Implementing Immutable Backup With Restic · micsapp bundle

    Implements immutable backup strategy using restic with S3-compatible storage and object lock for ransomware-resistant data protection. Automates backup creation, integrity verification via restic check --read-data, snapshot retention policy enforcement, and restore testing. Integrates with AWS S3 Object Lock, MinIO, and Backblaze B2 for WORM (Write Once Read Many) storage that prevents backup deletion or encryption by ransomware actors.
    3 repo stars
25. ▌
    Implementing JWT Signing And Verification · micsapp bundle

    JSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens used for authentication and authorization in web applications. This skill covers implementing secure JWT signing with HMAC-SHA256
    3 repo stars
26. ▌
    Implementing Mtls For Zero Trust Services · micsapp bundle

    Configures mutual TLS (mTLS) authentication between microservices using Python cryptography library for certificate generation and ssl module for TLS verification. Validates certificate chains, checks expiration, and audits mTLS deployment status. Use when implementing zero-trust service-to-service authentication.
    3 repo stars
27. ▌
    Implementing Nerc Cip Compliance Controls · micsapp bundle

    This skill covers implementing North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) compliance controls for Bulk Electric System (BES) cyber systems. It addresses asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), configuration management (CIP-010), supply chain risk management (CIP-013), and the 2025 updates including mandatory MFA for remote access and expanded low-impact asset requirements.
    3 repo stars
28. ▌
    Implementing Siem Use Cases For Detection · micsapp bundle

    Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across Splunk, Elastic, and Sentinel. Use when SOC teams need to expand detection coverage, formalize use case lifecycle management, or build a detection library aligned to organizational threat profile.
    3 repo stars
29. ▌
    Implementing Soar Automation With Phantom · micsapp bundle

    Implements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment actions, and incident response playbooks. Use when SOC teams need to reduce manual analyst work, standardize response procedures, or integrate multiple security tools into automated workflows.
    3 repo stars
30. ▌
    Investigating Ransomware Attack Artifacts · micsapp bundle

    Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.
    3 repo stars
31. ▌
    Monitoring Scada Modbus Traffic Anomalies · micsapp bundle

    Monitors Modbus TCP traffic on SCADA and ICS networks to detect anomalous function code usage, unauthorized register writes, and suspicious communication patterns. The analyst uses deep packet inspection with pymodbus, Scapy, and Zeek to baseline normal PLC/RTU communication behavior, then applies statistical and rule-based anomaly detection to identify reconnaissance, parameter manipulation, and denial-of-service attacks targeting Modbus devices on port 502. Activates for requests involving Modbus traffic analysis, SCADA network monitoring, ICS anomaly detection, PLC security monitoring, or OT network threat detection.
    3 repo stars
32. ▌
    Performing Alert Triage With Elastic Siem · micsapp bundle

    Perform systematic alert triage in Elastic Security SIEM to rapidly classify, prioritize, and investigate security alerts for SOC operations.
    3 repo stars
33. ▌
    Performing Arp Spoofing Attack Simulation · micsapp bundle

    Simulates ARP spoofing attacks in authorized lab or pentest environments using arpspoof, Ettercap, and Scapy to demonstrate man-in-the-middle risks, test network detection capabilities, and validate ARP inspection countermeasures.
    3 repo stars
34. ▌
    Performing Content Security Policy Bypass · micsapp bundle

    Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives, and policy injection techniques.
    3 repo stars
35. ▌
    Performing Credential Access With Lazagne · micsapp bundle

    Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
    3 repo stars
36. ▌
    Performing Indicator Lifecycle Management · micsapp bundle

    Indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes f
    3 repo stars
37. ▌
    Performing Kubernetes Penetration Testing · micsapp bundle

    Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools
    3 repo stars
38. ▌
    Performing Ot Network Security Assessment · micsapp bundle

    This skill covers conducting comprehensive security assessments of Operational Technology (OT) networks including SCADA systems, DCS architectures, and industrial control system communication paths. It addresses the Purdue Reference Model layers, identifies IT/OT convergence risks, evaluates firewall rules between zones, and maps industrial protocol traffic (Modbus, DNP3, OPC UA, EtherNet/IP) to detect misconfigurations, unauthorized connections, and attack surfaces in critical infrastructure.
    3 repo stars
39. ▌
    Performing Plc Firmware Security Analysis · micsapp bundle

    This skill covers analyzing Programmable Logic Controller (PLC) firmware for security vulnerabilities including hardcoded credentials, insecure update mechanisms, backdoor functions, memory corruption flaws, and undocumented debug interfaces. It addresses firmware extraction from common PLC platforms (Siemens S7, Allen-Bradley, Schneider Modicon), static analysis of firmware images, dynamic analysis in emulated environments, and comparison against known-good baselines to detect tampering.
    3 repo stars
40. ▌
    Performing Red Team Phishing With Gophish · micsapp bundle

    Automate GoPhish phishing simulation campaigns using the Python gophish library. Creates email templates with tracking pixels, configures SMTP sending profiles, builds target groups from CSV, launches campaigns, and analyzes results including open rates, click rates, and credential submission statistics for security awareness assessment.
    3 repo stars
41. ▌
    Performing Supply Chain Attack Simulation · micsapp bundle

    Simulate and detect software supply chain attacks including typosquatting detection via Levenshtein distance, dependency confusion testing against private registries, package hash verification with pip, and known vulnerability scanning with pip-audit.
    3 repo stars
42. ▌
    Performing Threat Hunting With Yara Rules · micsapp bundle

    Use YARA pattern-matching rules to hunt for malware, suspicious files, and indicators of compromise across filesystems and memory dumps. Covers rule authoring, yara-python scanning, and integration with threat intel feeds.
    3 repo stars
43. ▌
    Testing For Open Redirect Vulnerabilities · micsapp bundle

    Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters, bypass techniques, and exploitation chains for phishing and token theft.
    3 repo stars
44. ▌
    Testing For XML Injection Vulnerabilities · micsapp bundle

    Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.
    3 repo stars
45. ▌
    Testing For Xxe Injection Vulnerabilities · micsapp bundle

    Discovering and exploiting XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.
    3 repo stars
46. ▌
    Architecture Paradigms · micsapp

    Interactive selector and router for architecture paradigms. Use when selecting architecture patterns for new systems, comparing paradigm trade-offs, creating architecture decision records, evaluating architecture fit for team size and domain complexity, planning implementation roadmaps. Do not use when implementing a specific known paradigm - use the specific architecture-paradigm-* skill (hexagonal, layered, microservices, etc.) instead. reviewing existing architecture - use architecture-review instead. Use this skill BEFORE making architecture decisions. Check even if unsure about needs.
    3 repo stars
47. ▌
    Testing Quality Standards · micsapp bundle

    Cross-plugin testing quality metrics and standards. Referenced by pensive:test-review and parseltongue:python-testing. testing standards, quality metrics, coverage thresholds, anti-patterns Use when: test quality evaluation, coverage thresholds, quality standards DO NOT use when: simple scripts without quality requirements.
    3 repo stars
48. ▌
    Writer · micsapp

    Professional writing assistant for PM documents. Use when the user needs to write, draft, or polish documents like briefs, updates, emails, or presentations. Triggers include "write", "draft", "document", "help me write", "create a brief", "polish this", or when producing any written deliverable.
    3 repo stars
49. ▌
    Image Optimization Helper · micsapp

    Configure with image optimization helper operations. Auto-activating skill for Frontend Development. Triggers on: image optimization helper, image optimization helper Part of the Frontend Development skill category. Use when working with image optimization helper functionality. Trigger with phrases like "image optimization helper", "image helper", "image".
    3 repo stars
50. ▌
    React Component Generator · micsapp

    Generate react component generator operations. Auto-activating skill for Frontend Development. Triggers on: react component generator, react component generator Part of the Frontend Development skill category. Use when working with react component generator functionality. Trigger with phrases like "react component generator", "react generator", "react".
    3 repo stars
51. ▌
    Confusion Matrix Generator · micsapp

    Generate confusion matrix generator operations. Auto-activating skill for ML Training. Triggers on: confusion matrix generator, confusion matrix generator Part of the ML Training skill category. Use when working with confusion matrix generator functionality. Trigger with phrases like "confusion matrix generator", "confusion generator", "confusion".
    3 repo stars
52. ▌
    Data Augmentation Pipeline · micsapp

    Process data augmentation pipeline operations. Auto-activating skill for ML Training. Triggers on: data augmentation pipeline, data augmentation pipeline Part of the ML Training skill category. Use when working with data augmentation pipeline functionality. Trigger with phrases like "data augmentation pipeline", "data pipeline", "data".
    3 repo stars
53. ▌
    Distributed Training Setup · micsapp

    Configure distributed training setup operations. Auto-activating skill for ML Training. Triggers on: distributed training setup, distributed training setup Part of the ML Training skill category. Use when working with distributed training setup functionality. Trigger with phrases like "distributed training setup", "distributed setup", "distributed".
    3 repo stars
54. ▌
    Feature Engineering Helper · micsapp

    Configure with feature engineering helper operations. Auto-activating skill for ML Training. Triggers on: feature engineering helper, feature engineering helper Part of the ML Training skill category. Use when working with feature engineering helper functionality. Trigger with phrases like "feature engineering helper", "feature helper", "feature".
    3 repo stars
55. ▌
    Cohort Analysis Creator · micsapp

    Create cohort analysis creator operations. Auto-activating skill for Data Analytics. Triggers on: cohort analysis creator, cohort analysis creator Part of the Data Analytics skill category. Use when working with cohort analysis creator functionality. Trigger with phrases like "cohort analysis creator", "cohort creator", "cohort".
    3 repo stars
56. ▌
    Funnel Analysis Builder · micsapp

    Build funnel analysis builder operations. Auto-activating skill for Data Analytics. Triggers on: funnel analysis builder, funnel analysis builder Part of the Data Analytics skill category. Use when working with funnel analysis builder functionality. Trigger with phrases like "funnel analysis builder", "funnel builder", "funnel".
    3 repo stars
57. ▌
    Ecs Task Definition Creator · micsapp

    Create ecs task definition creator operations. Auto-activating skill for AWS Skills. Triggers on: ecs task definition creator, ecs task definition creator Part of the AWS Skills skill category. Use when working with ecs task definition creator functionality. Trigger with phrases like "ecs task definition creator", "ecs creator", "ecs".
    3 repo stars
58. ▌
    Cloud Scheduler Job Creator · micsapp

    Create cloud scheduler job creator operations. Auto-activating skill for GCP Skills. Triggers on: cloud scheduler job creator, cloud scheduler job creator Part of the GCP Skills skill category. Use when working with cloud scheduler job creator functionality. Trigger with phrases like "cloud scheduler job creator", "cloud creator", "cloud".
    3 repo stars
59. ▌
    Bearer Token Validator · micsapp

    Validate bearer token validator operations. Auto-activating skill for API Development. Triggers on: bearer token validator, bearer token validator Part of the API Development skill category. Use when working with bearer token validator functionality. Trigger with phrases like "bearer token validator", "bearer validator", "bearer".
    3 repo stars
60. ▌
    Openapi Spec Generator · micsapp

    Generate openapi spec generator operations. Auto-activating skill for API Development. Triggers on: openapi spec generator, openapi spec generator Part of the API Development skill category. Use when working with APIs or building integrations. Trigger with phrases like "openapi spec generator", "openapi generator", "openapi".
    3 repo stars
61. ▌
    Request Body Validator · micsapp

    Validate request body validator operations. Auto-activating skill for API Development. Triggers on: request body validator, request body validator Part of the API Development skill category. Use when working with request body validator functionality. Trigger with phrases like "request body validator", "request validator", "request".
    3 repo stars
62. ▌
    REST Endpoint Designer · micsapp

    Build rest endpoint designer operations. Auto-activating skill for API Development. Triggers on: rest endpoint designer, rest endpoint designer Part of the API Development skill category. Use when working with rest endpoint designer functionality. Trigger with phrases like "rest endpoint designer", "rest designer", "rest".
    3 repo stars
63. ▌
    OAUTH Callback Handler · micsapp

    Manage oauth callback handler operations. Auto-activating skill for API Integration. Triggers on: oauth callback handler, oauth callback handler Part of the API Integration skill category. Use when working with oauth callback handler functionality. Trigger with phrases like "oauth callback handler", "oauth handler", "oauth".
    3 repo stars
64. ▌
    Webhook Sender Creator · micsapp

    Create webhook sender creator operations. Auto-activating skill for API Integration. Triggers on: webhook sender creator, webhook sender creator Part of the API Integration skill category. Use when working with webhook sender creator functionality. Trigger with phrases like "webhook sender creator", "webhook creator", "webhook".
    3 repo stars
65. ▌
    Docusaurus Config Setup · micsapp

    Configure docusaurus config setup operations. Auto-activating skill for Technical Documentation. Triggers on: docusaurus config setup, docusaurus config setup Part of the Technical Documentation skill category. Use when configuring systems or services. Trigger with phrases like "docusaurus config setup", "docusaurus setup", "docusaurus".
    3 repo stars
66. ▌
    Jsdoc Comment Generator · micsapp

    Generate jsdoc comment generator operations. Auto-activating skill for Technical Documentation. Triggers on: jsdoc comment generator, jsdoc comment generator Part of the Technical Documentation skill category. Use when working with jsdoc comment generator functionality. Trigger with phrases like "jsdoc comment generator", "jsdoc generator", "jsdoc".
    3 repo stars
67. ▌
    Migration Guide Creator · micsapp

    Create migration guide creator operations. Auto-activating skill for Technical Documentation. Triggers on: migration guide creator, migration guide creator Part of the Technical Documentation skill category. Use when working with migration guide creator functionality. Trigger with phrases like "migration guide creator", "migration creator", "migration".
    3 repo stars
68. ▌
    Mkdocs Config Generator · micsapp

    Generate mkdocs config generator operations. Auto-activating skill for Technical Documentation. Triggers on: mkdocs config generator, mkdocs config generator Part of the Technical Documentation skill category. Use when configuring systems or services. Trigger with phrases like "mkdocs config generator", "mkdocs generator", "mkdocs".
    3 repo stars
69. ▌
    Chart JS Config Creator · micsapp

    Create chart js config creator operations. Auto-activating skill for Visual Content. Triggers on: chart js config creator, chart js config creator Part of the Visual Content skill category. Use when configuring systems or services. Trigger with phrases like "chart js config creator", "chart creator", "chart".
    3 repo stars
70. ▌
    Test Skill · micsapp

    Test skill for E2E validation. Trigger with "run test skill" or "execute test". Use this skill when testing skill activation and tool permissions.
    3 repo stars
71. ▌
    Analyzing Browser Forensics With Hindsight · micsapp bundle

    Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.
    3 repo stars
72. ▌
    Analyzing Lnk File And Jump List Artifacts · micsapp bundle

    Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.
    3 repo stars
73. ▌
    Analyzing Packed Malware With Upx Unpacker · micsapp bundle

    Identifies and unpacks UPX-packed and other packed malware samples to expose the original executable code for static analysis. Covers both standard UPX unpacking and handling modified UPX headers that prevent automated decompression. Activates for requests involving malware unpacking, UPX decompression, packer removal, or preparing packed samples for analysis.
    3 repo stars
74. ▌
    Analyzing Ransomware Encryption Mechanisms · micsapp bundle

    Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and support recovery efforts. Covers AES, RSA, ChaCha20, and hybrid encryption schemes. Activates for requests involving ransomware cryptanalysis, encryption analysis, key recovery assessment, or ransomware decryption feasibility.
    3 repo stars
75. ▌
    Auditing Tls Certificate Transparency Logs · micsapp bundle

    Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned domains. Uses the crt.sh API and direct CT log querying based on RFC 6962 to build continuous monitoring pipelines that catch rogue certificates, track CA behavior, and map the external attack surface. Activates for requests involving certificate transparency monitoring, CT log auditing, subdomain discovery via certificates, or certificate issuance alerting.
    3 repo stars
76. ▌
    Building Devsecops Pipeline With Gitlab CI · micsapp bundle

    Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.
    3 repo stars
77. ▌
    Building Incident Timeline With Timesketch · micsapp bundle

    Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.
    3 repo stars
78. ▌
    Building Role Mining For Rbac Optimization · micsapp bundle

    Apply bottom-up and top-down role mining techniques to discover optimal RBAC roles from existing user-permission assignments, reducing role explosion and enforcing least privilege.
    3 repo stars
79. ▌
    Building Threat Feed Aggregation With Misp · micsapp bundle

    Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate, and distribute threat intelligence feeds from multiple sources for centralized IOC management and automated SIEM integration.
    3 repo stars
80. ▌
    Conducting Social Engineering Pretext Call · micsapp bundle

    Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.
    3 repo stars
81. ▌
    Configuring Host Based Intrusion Detection · micsapp bundle

    Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC/Wazuh deployment, or host-based detection.
    3 repo stars
82. ▌
    Deploying Cloudflare Access For Zero Trust · micsapp bundle

    Deploying Cloudflare Access with Cloudflare Tunnel to provide zero trust access to self-hosted and private applications, configuring identity-aware access policies, device posture checks, and WARP client enrollment for VPN replacement.
    3 repo stars
83. ▌
    Detecting Arp Poisoning In Network Traffic · micsapp bundle

    Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom monitoring scripts to protect against man-in-the-middle interception.
    3 repo stars
84. ▌
    Detecting Modbus Command Injection Attacks · micsapp bundle

    Detect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines using ICS-aware IDS and protocol deep packet inspection.
    3 repo stars
85. ▌
    Detecting Ransomware Precursors In Network · micsapp bundle

    Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involving pre-ransomware detection, network-based ransomware indicators, or early warning ransomware monitoring.
    3 repo stars
86. ▌
    Detecting Spearphishing With Email Gateway · micsapp bundle

    Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint,
    3 repo stars
87. ▌
    Exploiting Insecure Data Storage In Mobile · micsapp bundle

    Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including unencrypted databases, world-readable files, insecure SharedPreferences, plaintext credential storage, and improper keychain/keystore usage. Use when performing mobile penetration testing focused on OWASP M9 (Insecure Data Storage) or assessing compliance with MASVS-STORAGE requirements. Activates for requests involving mobile data storage security, local storage exploitation, SharedPreferences analysis, or mobile data leakage assessment.
    3 repo stars
88. ▌
    Exploiting Nosql Injection Vulnerabilities · micsapp bundle

    Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.
    3 repo stars
89. ▌
    Hardening Docker Containers For Production · micsapp bundle

    Hardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce leas
    3 repo stars
90. ▌
    Hunting For Anomalous Powershell Execution · micsapp bundle

    Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles. Activates for requests involving PowerShell threat hunting, script block analysis, encoded command detection, or AMSI bypass identification.
    3 repo stars
91. ▌
    Implementing API Gateway Security Controls · micsapp bundle

    Implements security controls at the API gateway layer including authentication enforcement, rate limiting, request validation, IP allowlisting, TLS termination, and threat protection. The engineer configures API gateways (Kong, AWS API Gateway, Azure APIM, Apigee) to act as a centralized security enforcement point that validates, throttles, and monitors all API traffic before it reaches backend services. Activates for requests involving API gateway security, API management security, gateway authentication, or centralized API protection.
    3 repo stars
92. ▌
    Implementing AWS Iam Permission Boundaries · micsapp bundle

    Configure IAM permission boundaries in AWS to delegate role creation to developers while enforcing maximum privilege limits set by the security team.
    3 repo stars
93. ▌
    Implementing Cloud Dlp For Data Protection · micsapp bundle

    Implementing Cloud Data Loss Prevention (DLP) using Amazon Macie, Azure Information Protection, and Google Cloud DLP API to discover, classify, and protect sensitive data across cloud storage, databases, and data pipelines.
    3 repo stars
94. ▌
    Implementing Delinea Secret Server For Pam · micsapp bundle

    Implements Delinea Secret Server for privileged access management (PAM) including secret vault configuration, role-based access policies, automated password rotation, session recording, and integration with Active Directory and cloud platforms. Activates for requests involving PAM deployment, privileged credential vaulting, secret server administration, or password rotation automation.
    3 repo stars
95. ▌
    Implementing Dmarc Dkim Spf Email Security · micsapp bundle

    SPF, DKIM, and DMARC form the three pillars of email authentication. Together they prevent domain spoofing, validate message integrity, and define policies for handling unauthenticated mail. Proper im
    3 repo stars
96. ▌
    Implementing Endpoint Detection With Wazuh · micsapp bundle

    Deploy and configure Wazuh SIEM/XDR for endpoint detection including agent management, custom decoder and rule XML creation, alert querying via the Wazuh REST API, and automated response actions.
    3 repo stars
97. ▌
    Implementing Gdpr Data Protection Controls · micsapp bundle

    The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's comprehensive data protection law governing the collection, processing, storage, and transfer of personal data. This skill cover
    3 repo stars
98. ▌
    Implementing Log Integrity With Blockchain · micsapp bundle

    Build an append-only log integrity chain using SHA-256 hash chaining for tamper detection. Each log entry is hashed with the previous entry's hash to create a blockchain-like structure where modifying any entry invalidates all subsequent hashes. Implements log ingestion, chain verification, tamper detection with pinpoint identification, and periodic checkpoint anchoring to external timestamping services.
    3 repo stars
99. ▌
    Implementing Mitre Attack Coverage Mapping · micsapp bundle

    Implement MITRE ATT&CK coverage mapping to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.
    3 repo stars
100. ▌
     Implementing Mobile Application Management · micsapp bundle

     Implements Mobile Application Management (MAM) policies to protect enterprise data on managed and unmanaged mobile devices through app-level controls including data loss prevention, selective wipe, app configuration, and containerization. Use when securing corporate apps on BYOD devices, implementing Intune App Protection Policies, or enforcing data separation between personal and work apps. Activates for requests involving MAM deployment, app protection policies, mobile containerization, or BYOD security.
     3 repo stars