← all publishers

micsapp

@micsapp source repo

Report this profile Claim this profile

• 3.2k skills
• 0 followers
• 3 repo stars
• last month last updated

1. ▌
   Implementing Ot Incident Response Playbook · micsapp bundle

   Develop and implement OT-specific incident response playbooks aligned with SANS PICERL framework, IEC 62443, and NIST SP 800-82 that address unique ICS challenges including safety-critical systems, limited downtime tolerance, and coordination between IT SOC, OT engineering, and plant operations teams.
   3 repo stars
2. ▌
   Implementing Privileged Access Workstation · micsapp bundle

   Design and implement Privileged Access Workstations (PAWs) with device hardening, just-in-time access, and integration with CyberArk or BeyondTrust for secure administrative operations.
   3 repo stars
3. ▌
   Implementing Privileged Session Monitoring · micsapp bundle

   Monitor and audit privileged user sessions including SSH, RDP, and database access. Tracks session metadata, records commands, detects anomalous activity, and enforces session policies for PAM compliance.
   3 repo stars
4. ▌
   Implementing Rapid7 Insightvm For Scanning · micsapp bundle

   Deploy and configure Rapid7 InsightVM Security Console and Scan Engines for authenticated and unauthenticated vulnerability scanning across enterprise environments.
   3 repo stars
5. ▌
   Implementing Rbac Hardening For Kubernetes · micsapp bundle

   Harden Kubernetes Role-Based Access Control by implementing least-privilege policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating external identity providers.
   3 repo stars
6. ▌
   Implementing Secret Scanning With Gitleaks · micsapp bundle

   This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for exposed credentials.
   3 repo stars
7. ▌
   Implementing Secrets Management With Vault · micsapp bundle

   This skill covers deploying HashiCorp Vault for centralized secrets management across cloud environments, including dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes integration. It addresses eliminating hardcoded credentials from application code and CI/CD pipelines by implementing short-lived, automatically rotated secrets.
   3 repo stars
8. ▌
   Implementing Sigstore For Software Signing · micsapp bundle

   Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic provenance for container images, binaries, and software artifacts. The practitioner configures OIDC-based identity binding, verifies signing events against the Rekor transparency log, and integrates signing workflows into CI/CD pipelines. Activates for requests involving software supply chain signing, keyless container signing, Sigstore deployment, or artifact provenance verification.
   3 repo stars
9. ▌
   Implementing Vulnerability Remediation Sla · micsapp bundle

   Vulnerability remediation SLAs define mandatory timeframes for patching or mitigating identified vulnerabilities based on severity, asset criticality, and exploit availability. Effective SLA programs
   3 repo stars
10. ▌
    Intercepting Mobile Traffic With Burpsuite · micsapp bundle

    Intercepts and analyzes HTTP/HTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, Burp Suite mobile proxy, API security testing, or mobile HTTPS analysis.
    3 repo stars
11. ▌
    Performing Access Review And Certification · micsapp bundle

    Conduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles. This skill covers review campaign design, reviewer selection, risk-based p
    3 repo stars
12. ▌
    Performing Authenticated Scan With Openvas · micsapp bundle

    Configure and execute authenticated vulnerability scans using OpenVAS/Greenbone Vulnerability Management with SSH and SMB credentials for comprehensive host-level assessment.
    3 repo stars
13. ▌
    Performing Cloud Log Forensics With Athena · micsapp bundle

    Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs for forensic investigation. Covers CREATE TABLE DDL with partition projection, forensic SQL queries for detecting unauthorized access, data exfiltration, lateral movement, and privilege escalation. Use when investigating AWS security incidents or building cloud-native forensic workflows at scale.
    3 repo stars
14. ▌
    Performing Dark Web Monitoring For Threats · micsapp bundle

    Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked cre
    3 repo stars
15. ▌
    Performing Deception Technology Deployment · micsapp bundle

    Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates. Use when SOC teams need early warning of lateral movement, credential abuse, or internal reconnaissance by deploying convincing traps across the network.
    3 repo stars
16. ▌
    Performing Dynamic Analysis Of Android App · micsapp bundle

    Performs runtime dynamic analysis of Android applications using Frida, Objection, and Android Debug Bridge to observe application behavior during execution, intercept function calls, modify runtime values, and identify vulnerabilities that static analysis misses. Use when testing Android apps for runtime security flaws, hooking sensitive methods, bypassing client-side protections, or analyzing obfuscated applications. Activates for requests involving Android dynamic analysis, runtime hooking, Frida Android instrumentation, or live app behavior analysis.
    3 repo stars
17. ▌
    Performing HTTP Parameter Pollution Attack · micsapp bundle

    Execute HTTP Parameter Pollution attacks to bypass input validation, WAF rules, and security controls by injecting duplicate parameters that are processed differently by front-end and back-end systems.
    3 repo stars
18. ▌
    Performing Network Packet Capture Analysis · micsapp bundle

    Perform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic, and establish evidence of data exfiltration or command-and-control activity.
    3 repo stars
19. ▌
    Performing OAUTH Scope Minimization Review · micsapp bundle

    Performs OAuth 2.0 scope minimization review to identify over-permissioned third-party application integrations, excessive API scopes, unused token grants, and risky OAuth consent patterns across identity providers and SaaS platforms. Activates for requests involving OAuth scope audit, API permission review, third-party app risk assessment, or consent grant minimization.
    3 repo stars
20. ▌
    Performing Privilege Escalation Assessment · micsapp bundle

    Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control. The tester enumerates misconfigurations, vulnerable services, kernel exploits, SUID binaries, unquoted service paths, and credential stores to demonstrate the full impact of an initial compromise. Activates for requests involving privilege escalation testing, local exploitation, post-compromise escalation, or OS-level security assessment.
    3 repo stars
21. ▌
    Performing Ssrf Vulnerability Exploitation · micsapp bundle

    Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters. Tests AWS/GCP/Azure metadata APIs (169.254.169.254), internal port scanning via HTTP, URL scheme bypass techniques, and DNS rebinding detection.
    3 repo stars
22. ▌
    Performing Web Application Firewall Bypass · micsapp bundle

    Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution, and payload obfuscation to deliver SQL injection, XSS, and other attack payloads past WAF detection rules.
    3 repo stars
23. ▌
    Scanning Kubernetes Manifests With Kubesec · micsapp bundle

    Perform security risk analysis on Kubernetes resource manifests using Kubesec to identify misconfigurations, privilege escalation risks, and deviations from security best practices.
    3 repo stars
24. ▌
    Testing For Business Logic Vulnerabilities · micsapp bundle

    Identifying flaws in application business logic that allow price manipulation, workflow bypass, and privilege escalation beyond what technical vulnerability scanners can detect.
    3 repo stars
25. ▌
    Testing For JSON Web Token Vulnerabilities · micsapp bundle

    Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.
    3 repo stars
26. ▌
    Document Sync · micsapp bundle

    A robust skill that analyzes your app's actual codebase, tech stack, configuration, and architecture to ensure ALL documentation is current and accurate. It never assumes—always verifies and compares the live system with every documentation file to detect code-doc drift and generate actionable updates.
    3 repo stars
27. ▌
    Builder · micsapp

    Hands-on implementation partner for creating tools, scripts, dashboards, and prototypes. Use when the user wants to build something tangible — apps, scripts, automations, or internal tools. Triggers include "build", "create tool", "make app", "implement", "prototype", "automate", or when the goal is working software.
    3 repo stars
28. ▌
    Exa Load Scale · micsapp

    Implement Exa load testing, auto-scaling, and capacity planning strategies. Use when running performance tests, configuring horizontal scaling, or planning capacity for Exa integrations. Trigger with phrases like "exa load test", "exa scale", "exa performance test", "exa capacity", "exa k6", "exa benchmark".
    3 repo stars
29. ▌
    Terraform State Manager · micsapp

    Manage terraform state manager operations. Auto-activating skill for DevOps Advanced. Triggers on: terraform state manager, terraform state manager Part of the DevOps Advanced skill category. Use when working with terraform state manager functionality. Trigger with phrases like "terraform state manager", "terraform manager", "terraform".
    3 repo stars
30. ▌
    Iso27001 Gap Analyzer · micsapp

    Analyze iso27001 gap analyzer operations. Auto-activating skill for Security Advanced. Triggers on: iso27001 gap analyzer, iso27001 gap analyzer Part of the Security Advanced skill category. Use when analyzing or auditing iso27001 gap analyzer. Trigger with phrases like "iso27001 gap analyzer", "iso27001 analyzer", "analyze iso27001 gap r".
    3 repo stars
31. ▌
    Log Analysis Security · micsapp

    Execute log analysis security operations. Auto-activating skill for Security Advanced. Triggers on: log analysis security, log analysis security Part of the Security Advanced skill category. Use when working with log analysis security functionality. Trigger with phrases like "log analysis security", "log security", "log".
    3 repo stars
32. ▌
    Accessibility Audit Runner · micsapp

    Run accessibility audit runner operations. Auto-activating skill for Frontend Development. Triggers on: accessibility audit runner, accessibility audit runner Part of the Frontend Development skill category. Use when analyzing or auditing accessibility audit runner. Trigger with phrases like "accessibility audit runner", "accessibility runner", "accessibility".
    3 repo stars
33. ▌
    Request Validator Generator · micsapp

    Generate request validator generator operations. Auto-activating skill for Backend Development. Triggers on: request validator generator, request validator generator Part of the Backend Development skill category. Use when working with request validator generator functionality. Trigger with phrases like "request validator generator", "request generator", "request".
    3 repo stars
34. ▌
    Feature Importance Analyzer · micsapp

    Analyze feature importance analyzer operations. Auto-activating skill for ML Training. Triggers on: feature importance analyzer, feature importance analyzer Part of the ML Training skill category. Use when analyzing or auditing feature importance analyzer. Trigger with phrases like "feature importance analyzer", "feature analyzer", "analyze feature importance r".
    3 repo stars
35. ▌
    Factory Pattern Creator · micsapp

    Create factory pattern creator operations. Auto-activating skill for Test Automation. Triggers on: factory pattern creator, factory pattern creator Part of the Test Automation skill category. Use when working with factory pattern creator functionality. Trigger with phrases like "factory pattern creator", "factory creator", "factory".
    3 repo stars
36. ▌
    Cpu Profiler Config · micsapp

    Configure cpu profiler config operations. Auto-activating skill for Performance Testing. Triggers on: cpu profiler config, cpu profiler config Part of the Performance Testing skill category. Use when configuring systems or services. Trigger with phrases like "cpu profiler config", "cpu config", "cpu".
    3 repo stars
37. ▌
    Airflow Operator Creator · micsapp

    Create airflow operator creator operations. Auto-activating skill for Data Pipelines. Triggers on: airflow operator creator, airflow operator creator Part of the Data Pipelines skill category. Use when working with airflow operator creator functionality. Trigger with phrases like "airflow operator creator", "airflow creator", "airflow".
    3 repo stars
38. ▌
    Youtube Digest · micsapp bundle

    This skill should be used when the user asks to "유튜브 정리", "영상 요약", "transcript 번역", "YouTube digest", "영상 퀴즈", or provides a YouTube URL for analysis. Extracts transcript, generates summary/insights/Korean translation, and tests comprehension with 9 quiz questions across 3 difficulty levels. Optional Deep Research for web-based follow-up.
    3 repo stars
39. ▌
    Aria Attribute Helper · micsapp

    Configure with aria attribute helper operations. Auto-activating skill for Frontend Development. Triggers on: aria attribute helper, aria attribute helper Part of the Frontend Development skill category. Use when working with aria attribute helper functionality. Trigger with phrases like "aria attribute helper", "aria helper", "aria".
    3 repo stars
40. ▌
    Code Splitting Helper · micsapp

    Configure with code splitting helper operations. Auto-activating skill for Frontend Development. Triggers on: code splitting helper, code splitting helper Part of the Frontend Development skill category. Use when working with code splitting helper functionality. Trigger with phrases like "code splitting helper", "code helper", "code".
    3 repo stars
41. ▌
    Redux Slice Generator · micsapp

    Generate redux slice generator operations. Auto-activating skill for Frontend Development. Triggers on: redux slice generator, redux slice generator Part of the Frontend Development skill category. Use when working with redux slice generator functionality. Trigger with phrases like "redux slice generator", "redux generator", "redux".
    3 repo stars
42. ▌
    Fastapi Router Creator · micsapp

    Create fastapi router creator operations. Auto-activating skill for Backend Development. Triggers on: fastapi router creator, fastapi router creator Part of the Backend Development skill category. Use when working with APIs or building integrations. Trigger with phrases like "fastapi router creator", "fastapi creator", "fastapi".
    3 repo stars
43. ▌
    Fastify Plugin Creator · micsapp

    Create fastify plugin creator operations. Auto-activating skill for Backend Development. Triggers on: fastify plugin creator, fastify plugin creator Part of the Backend Development skill category. Use when working with fastify plugin creator functionality. Trigger with phrases like "fastify plugin creator", "fastify creator", "fastify".
    3 repo stars
44. ▌
    Gin Middleware Creator · micsapp

    Create gin middleware creator operations. Auto-activating skill for Backend Development. Triggers on: gin middleware creator, gin middleware creator Part of the Backend Development skill category. Use when working with gin middleware creator functionality. Trigger with phrases like "gin middleware creator", "gin creator", "gin".
    3 repo stars
45. ▌
    Grpc Service Generator · micsapp

    Generate grpc service generator operations. Auto-activating skill for Backend Development. Triggers on: grpc service generator, grpc service generator Part of the Backend Development skill category. Use when working with grpc service generator functionality. Trigger with phrases like "grpc service generator", "grpc generator", "grpc".
    3 repo stars
46. ▌
    Cross Validation Setup · micsapp

    Configure cross validation setup operations. Auto-activating skill for ML Training. Triggers on: cross validation setup, cross validation setup Part of the ML Training skill category. Use when working with cross validation setup functionality. Trigger with phrases like "cross validation setup", "cross setup", "cross".
    3 repo stars
47. ▌
    Dataset Loader Creator · micsapp

    Create dataset loader creator operations. Auto-activating skill for ML Training. Triggers on: dataset loader creator, dataset loader creator Part of the ML Training skill category. Use when working with dataset loader creator functionality. Trigger with phrases like "dataset loader creator", "dataset creator", "dataset".
    3 repo stars
48. ▌
    Pyspark Transformer · micsapp

    Transform pyspark transformer operations. Auto-activating skill for Data Pipelines. Triggers on: pyspark transformer, pyspark transformer Part of the Data Pipelines skill category. Use when working with pyspark transformer functionality. Trigger with phrases like "pyspark transformer", "pyspark transformer", "pyspark".
    3 repo stars
49. ▌
    Complex Join Helper · micsapp

    Configure with complex join helper operations. Auto-activating skill for Data Analytics. Triggers on: complex join helper, complex join helper Part of the Data Analytics skill category. Use when working with complex join helper functionality. Trigger with phrases like "complex join helper", "complex helper", "complex".
    3 repo stars
50. ▌
    Dynamodb Table Designer · micsapp

    Build dynamodb table designer operations. Auto-activating skill for AWS Skills. Triggers on: dynamodb table designer, dynamodb table designer Part of the AWS Skills skill category. Use when working with dynamodb table designer functionality. Trigger with phrases like "dynamodb table designer", "dynamodb designer", "dynamodb".
    3 repo stars
51. ▌
    Step Functions Workflow · micsapp

    Manage step functions workflow operations. Auto-activating skill for AWS Skills. Triggers on: step functions workflow, step functions workflow Part of the AWS Skills skill category. Use when working with step functions workflow functionality. Trigger with phrases like "step functions workflow", "step workflow", "step".
    3 repo stars
52. ▌
    Bigquery View Generator · micsapp

    Generate bigquery view generator operations. Auto-activating skill for GCP Skills. Triggers on: bigquery view generator, bigquery view generator Part of the GCP Skills skill category. Use when working with bigquery view generator functionality. Trigger with phrases like "bigquery view generator", "bigquery generator", "bigquery".
    3 repo stars
53. ▌
    Cloud Tasks Queue Setup · micsapp

    Configure cloud tasks queue setup operations. Auto-activating skill for GCP Skills. Triggers on: cloud tasks queue setup, cloud tasks queue setup Part of the GCP Skills skill category. Use when working with cloud tasks queue setup functionality. Trigger with phrases like "cloud tasks queue setup", "cloud setup", "cloud".
    3 repo stars
54. ▌
    Firestore Index Creator · micsapp

    Create firestore index creator operations. Auto-activating skill for GCP Skills. Triggers on: firestore index creator, firestore index creator Part of the GCP Skills skill category. Use when working with firestore index creator functionality. Trigger with phrases like "firestore index creator", "firestore creator", "firestore".
    3 repo stars
55. ▌
    Firewall Rule Generator · micsapp

    Generate firewall rule generator operations. Auto-activating skill for GCP Skills. Triggers on: firewall rule generator, firewall rule generator Part of the GCP Skills skill category. Use when working with firewall rule generator functionality. Trigger with phrases like "firewall rule generator", "firewall generator", "firewall".
    3 repo stars
56. ▌
    Service Account Manager · micsapp

    Manage service account manager operations. Auto-activating skill for GCP Skills. Triggers on: service account manager, service account manager Part of the GCP Skills skill category. Use when working with service account manager functionality. Trigger with phrases like "service account manager", "service manager", "service".
    3 repo stars
57. ▌
    API Testing Helper · micsapp

    Assist with api testing helper operations. Auto-activating skill for API Development. Triggers on: api testing helper, api testing helper Part of the API Development skill category. Use when working with APIs or building integrations. Trigger with phrases like "api testing helper", "api helper", "api".
    3 repo stars
58. ▌
    HTTP Method Helper · micsapp

    Configure with http method helper operations. Auto-activating skill for API Development. Triggers on: http method helper, http method helper Part of the API Development skill category. Use when working with http method helper functionality. Trigger with phrases like "http method helper", "http helper", "http".
    3 repo stars
59. ▌
    Retry Logic Helper · micsapp

    Assist with retry logic helper operations. Auto-activating skill for API Integration. Triggers on: retry logic helper, retry logic helper Part of the API Integration skill category. Use when working with retry logic helper functionality. Trigger with phrases like "retry logic helper", "retry helper", "retry".
    3 repo stars
60. ▌
    Azure Drawio MCP Diagramming · micsapp bundle

    Create and edit architecture diagrams using Draw.io MCP (`drawio/create_diagram`) with reliable Azure icon rendering guidance and troubleshooting. compatibility Requires Python 3 and internet access to refresh the icon catalog (periodic, not per-run).
    3 repo stars
61. ▌
    Analyzing Android Malware With Apktool · micsapp bundle

    Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection.
    3 repo stars
62. ▌
    Analyzing Memory Dumps With Volatility · micsapp bundle

    Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.
    3 repo stars
63. ▌
    Analyzing Windows Event Logs In Splunk · micsapp bundle

    Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.
    3 repo stars
64. ▌
    Analyzing Windows Prefetch With Python · micsapp bundle

    Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
    3 repo stars
65. ▌
    Conducting Mobile App Penetration Test · micsapp bundle

    Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify vulnerabilities in data storage, network communication, authentication, cryptography, and platform-specific security controls. The tester performs static analysis of application binaries, dynamic analysis at runtime, and API security testing to evaluate the complete mobile attack surface. Activates for requests involving mobile app pentest, iOS security assessment, Android security testing, or OWASP MASTG assessment.
    3 repo stars
66. ▌
    Deploying Active Directory Honeytokens · micsapp bundle

    Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing AD deception defenses for detecting lateral movement, credential theft, and reconnaissance.
    3 repo stars
67. ▌
    Deploying Tailscale For Zero Trust Vpn · micsapp bundle

    Deploy and configure Tailscale as a WireGuard-based zero trust mesh VPN with identity-aware access controls, ACLs, and exit nodes for secure peer-to-peer connectivity.
    3 repo stars
68. ▌
    Detecting Attacks On Historian Servers · micsapp bundle

    Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition, Wonderware) that sit at the IT/OT boundary and serve as pivot points for lateral movement between enterprise and control networks, including data manipulation, unauthorized queries, and exploitation of historian-specific vulnerabilities.
    3 repo stars
69. ▌
    Detecting AWS Iam Privilege Escalation · micsapp bundle

    Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations
    3 repo stars
70. ▌
    Detecting Beaconing Patterns With Zeek · micsapp bundle

    Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Pandas DataFrames, calculates inter-arrival time standard deviation, and flags periodic connections with low jitter. Use when hunting for command-and-control callbacks in network data.
    3 repo stars
71. ▌
    Detecting Bluetooth Low Energy Attacks · micsapp bundle

    Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception. Uses Ubertooth One and nRF52840 sniffers for packet capture, the bleak Python library for GATT service enumeration, and crackle for BLE encryption cracking. Use when assessing IoT device BLE security, monitoring for BLE-based attacks on wireless infrastructure, or performing authorized BLE penetration testing. Activates for requests involving BLE security assessment, Ubertooth sniffing, GATT enumeration, or BLE replay detection.
    3 repo stars
72. ▌
    Detecting Cloud Threats With Guardduty · micsapp bundle

    This skill teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads. It covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity levels, and building automated response workflows using EventBridge and Lambda.
    3 repo stars
73. ▌
    Detecting Command And Control Over Dns · micsapp bundle

    Detects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. Activates for requests involving DNS-based C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or DGA domain classification.
    3 repo stars
74. ▌
    Detecting Lateral Movement With Splunk · micsapp bundle

    Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.
    3 repo stars
75. ▌
    Detecting Process Injection Techniques · micsapp bundle

    Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.
    3 repo stars
76. ▌
    Executing Phishing Simulation Campaign · micsapp bundle

    Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.
    3 repo stars
77. ▌
    Executing Red Team Engagement Planning · micsapp bundle

    Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins.
    3 repo stars
78. ▌
    Exploiting Kerberoasting With Impacket · micsapp bundle

    Perform Kerberoasting attacks using Impacket's GetUserSPNs to extract and crack Kerberos TGS tickets for Active Directory service accounts.
    3 repo stars
79. ▌
    Exploiting Server Side Request Forgery · micsapp bundle

    Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.
    3 repo stars
80. ▌
    Extracting Config From Agent Tesla Rat · micsapp bundle

    Extract embedded configuration from Agent Tesla RAT samples including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints using .NET decompilation and memory analysis.
    3 repo stars
81. ▌
    Generating Threat Intelligence Reports · micsapp bundle

    Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.
    3 repo stars
82. ▌
    Hunting For Domain Fronting C2 Traffic · micsapp bundle

    Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header mismatches in proxy logs and TLS certificate discrepancies using pyOpenSSL for certificate inspection
    3 repo stars
83. ▌
    Hunting For Scheduled Task Persistence · micsapp bundle

    Hunt for adversary persistence via Windows Scheduled Tasks by analyzing task creation events, suspicious task actions, and unusual scheduling patterns.
    3 repo stars
84. ▌
    Hunting For Startup Folder Persistence · micsapp bundle

    Detect T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, analyzing autoruns entries, and using Python watchdog for real-time filesystem monitoring.
    3 repo stars
85. ▌
    Hunting For Suspicious Scheduled Tasks · micsapp bundle

    Hunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious task properties, and unusual execution patterns that indicate T1053.005 abuse.
    3 repo stars
86. ▌
    Hunting For T1098 Account Manipulation · micsapp bundle

    Hunt for MITRE ATT&CK T1098 account manipulation including shadow admin creation, SID history injection, group membership changes, and credential modifications using Windows Security Event Logs.
    3 repo stars
87. ▌
    Implementing API Key Security Controls · micsapp bundle

    Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for storage, enforces per-key scoping and rate limiting, monitors for leaked keys in public repositories, and builds key rotation workflows. Activates for requests involving API key management, API key security, key rotation policy, or API credential protection.
    3 repo stars
88. ▌
    Implementing Attack Surface Management · micsapp bundle

    Implements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain enumeration, service fingerprinting, and exposure scoring. Includes a weighted risk scoring algorithm based on OWASP attack surface analysis methodology and the Relative Attack Surface Quotient (RSQ). Use when building continuous ASM programs or performing external reconnaissance for security assessments.
    3 repo stars
89. ▌
    Implementing Cloud Workload Protection · micsapp bundle

    Implements cloud workload protection using boto3 and google-cloud APIs for runtime security monitoring, process anomaly detection, and file integrity checking on EC2/GCE instances. Scans for cryptomining, reverse shells, and unauthorized binaries. Use when building runtime security controls for cloud compute workloads.
    3 repo stars
90. ▌
    Implementing Patch Management Workflow · micsapp bundle

    Patch management is the systematic process of identifying, testing, deploying, and verifying software updates to remediate vulnerabilities across an organization's IT infrastructure. An effective patc
    3 repo stars
91. ▌
    Implementing Secrets Scanning In CI CD · micsapp bundle

    Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment
    3 repo stars
92. ▌
    Implementing Usb Device Control Policy · micsapp bundle

    Implements USB device control policies to restrict unauthorized removable media access on endpoints, preventing data exfiltration and malware introduction via USB devices. Use when deploying device control via Group Policy, Intune, or EDR platforms to enforce USB restrictions. Activates for requests involving USB control, removable media policy, device control, or data loss prevention via USB.
    3 repo stars
93. ▌
    Implementing Zero Trust Network Access · micsapp bundle

    Implementing Zero Trust Network Access (ZTNA) in cloud environments by configuring identity-aware proxies, micro-segmentation, continuous verification with conditional access policies, and replacing traditional VPN-based access with BeyondCorp-style architectures across AWS, Azure, and GCP.
    3 repo stars
94. ▌
    Performing AI Driven Osint Correlation · micsapp bundle

    Use AI and LLM-based reasoning to correlate findings across multiple OSINT sources—username enumeration, email lookups, social media profiles, domain records, breach databases, and dark-web mentions—into unified intelligence profiles with confidence scoring and link analysis.
    3 repo stars
95. ▌
    Performing API Inventory And Discovery · micsapp bundle

    Performs API inventory and discovery to identify all API endpoints in an organization's environment including documented, undocumented, shadow, zombie, and deprecated APIs. The tester uses passive traffic analysis, active scanning, DNS enumeration, JavaScript analysis, and cloud resource inventory to build a comprehensive API catalog. Maps to OWASP API9:2023 Improper Inventory Management. Activates for requests involving API discovery, shadow API detection, API inventory audit, or attack surface mapping.
    3 repo stars
96. ▌
    Performing Directory Traversal Testing · micsapp bundle

    Testing web applications for path traversal vulnerabilities that allow reading or writing arbitrary files on the server by manipulating file path parameters.
    3 repo stars
97. ▌
    Performing GRAPHQL Security Assessment · micsapp bundle

    Assessing GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-service vulnerabilities during authorized security tests.
    3 repo stars
98. ▌
    Performing IOS App Security Assessment · micsapp bundle

    Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain extraction for credential analysis, and IPA static analysis for binary-level review. Use when conducting authorized iOS penetration tests, evaluating mobile app security posture against OWASP MASTG, or assessing iOS app data protection and transport security controls. Activates for requests involving iOS app pentesting, Frida-based iOS instrumentation, mobile app SSL pinning bypass, or IPA reverse engineering.
    3 repo stars
99. ▌
    Performing Ssl Tls Security Assessment · micsapp bundle

    Assess SSL/TLS server configurations using the sslyze Python library to evaluate cipher suites, certificate chains, protocol versions, HSTS headers, and known vulnerabilities like Heartbleed and ROBOT.
    3 repo stars
100. ▌
     Recovering Deleted Files With Photorec · micsapp bundle

     Recover deleted files from disk images and storage media using PhotoRec's file signature-based carving engine regardless of file system damage.
     3 repo stars