← all publishers

theheavenlyd3mon

@theheavenlyd3mon source repo

Report this profile Claim this profile

• 1.1k skills
• 0 followers
• 28 repo stars
• 2 weeks ago last updated

1. ▌
   Performing Web Application Firewall Bypass · theheavenlyd3mon bundle

   Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution, and payload obfuscation to deliver SQL injection, XSS, and other attack payloads past WAF detection rules.
   28 repo stars
2. ▌
   Testing For Business Logic Vulnerabilities · theheavenlyd3mon bundle

   Identifying flaws in application business logic that allow price manipulation, workflow bypass, and privilege escalation beyond what technical vulnerability scanners can detect.
   28 repo stars
3. ▌
   Testing For JSON Web Token Vulnerabilities · theheavenlyd3mon bundle

   Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.
   28 repo stars
4. ▌
   Performing Active Directory Bloodhound Analysis · theheavenlyd3mon bundle

   Use BloodHound and SharpHound to enumerate Active Directory relationships and identify attack paths from compromised users to Domain Admin.
   28 repo stars
5. ▌
   Performing Active Directory Forest Trust Attack · theheavenlyd3mon bundle

   Enumerate and audit Active Directory forest trust relationships using impacket for SID filtering analysis, trust key extraction, cross-forest SID history abuse detection, and inter-realm Kerberos ticket assessment.
   28 repo stars
6. ▌
   Performing Hardware Security Module Integration · theheavenlyd3mon bundle

   Integrate Hardware Security Modules (HSMs) using PKCS#11 interface for cryptographic key management, signing operations, and secure key storage with python-pkcs11, AWS CloudHSM, and YubiHSM2.
   28 repo stars
7. ▌
   Performing Ssl Certificate Lifecycle Management · theheavenlyd3mon bundle

   SSL/TLS certificate lifecycle management encompasses the full process of requesting, issuing, deploying, monitoring, renewing, and revoking X.509 certificates. Poor certificate management is a leading
   28 repo stars
8. ▌
   Performing Wifi Password Cracking With Aircrack · theheavenlyd3mon bundle

   Captures WPA/WPA2 handshakes and performs offline password cracking using aircrack-ng, hashcat, and dictionary attacks during authorized wireless security assessments to evaluate passphrase strength and wireless network security posture.
   28 repo stars
9. ▌
   Implementing JWT Signing And Verification · theheavenlyd3mon bundle

   JSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens used for authentication and authorization in web applications. This skill covers implementing secure JWT signing with HMAC-SHA256
   28 repo stars
10. ▌
    Implementing Mtls For Zero Trust Services · theheavenlyd3mon bundle

    Configures mutual TLS (mTLS) authentication between microservices using Python cryptography library for certificate generation and ssl module for TLS verification. Validates certificate chains, checks expiration, and audits mTLS deployment status. Use when implementing zero-trust service-to-service authentication.
    28 repo stars
11. ▌
    Implementing Rsa Key Pair Management · theheavenlyd3mon bundle

    RSA (Rivest-Shamir-Adleman) is the most widely deployed asymmetric cryptographic algorithm, used for digital signatures, key exchange, and encryption. This skill covers generating, storing, rotating,
    28 repo stars
12. ▌
    Performing Privacy Impact Assessment · theheavenlyd3mon bundle

    Automates the Privacy Impact Assessment (PIA) workflow including data flow mapping, privacy risk scoring matrices, GDPR Article 35 DPIA and CCPA/CPRA alignment checks, data inventory cataloging, and remediation tracking. Implements the NIST Privacy Framework PRAM methodology and ICO DPIA guidance for systematic identification and mitigation of privacy risks across processing activities. Use when conducting privacy assessments for new systems, evaluating regulatory compliance posture, or building automated privacy governance programs.
    28 repo stars
13. ▌
    Investigating Phishing Email Incident · theheavenlyd3mon bundle

    Investigates phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires full incident investigation to determine scope and impact.
    28 repo stars
14. ▌
    Building Phishing Reporting Button Workflow · theheavenlyd3mon bundle

    Implement a phishing report button in email clients with automated triage workflow that analyzes user-reported suspicious emails and provides feedback to reporters.
    28 repo stars
15. ▌
    Configuring Network Segmentation With Vlans · theheavenlyd3mon bundle

    Designs and implements VLAN-based network segmentation on managed switches to isolate network zones, enforce access control between segments, and reduce the attack surface by limiting lateral movement paths in enterprise network environments.
    28 repo stars
16. ▌
    Configuring Suricata For Network Monitoring · theheavenlyd3mon bundle

    Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.
    28 repo stars
17. ▌
    Configuring Zscaler Private Access For Ztna · theheavenlyd3mon bundle

    Configuring Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring access policies based on user identity and device posture, and integrating with IdPs.
    28 repo stars
18. ▌
    Detecting AI Model Prompt Injection Attacks · theheavenlyd3mon bundle

    Detects prompt injection attacks targeting LLM-based applications using a multi-layered defense combining regex pattern matching for known attack signatures, heuristic scoring for structural anomalies, and transformer-based classification with DeBERTa models. The detector analyzes user inputs before they reach the LLM, flagging direct injections (system prompt overrides, role-play escapes, instruction hijacking) and indirect injections (encoded payloads, multi-language obfuscation, delimiter-based escapes). Based on the OWASP LLM Top 10 (LLM01:2025 Prompt Injection) and Simon Willison's prompt injection taxonomy. Activates for requests involving prompt injection detection, LLM input sanitization, AI security scanning, or prompt attack classification.
    28 repo stars
19. ▌
    Detecting Anomalous Authentication Patterns · theheavenlyd3mon bundle

    Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs. Activates for requests involving authentication anomaly detection, login behavior analysis, UEBA implementation, or suspicious sign-in investigation.
    28 repo stars
20. ▌
    Detecting Business Email Compromise With AI · theheavenlyd3mon bundle

    Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.
    28 repo stars
21. ▌
    Detecting Dcsync Attack In Active Directory · theheavenlyd3mon bundle

    Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.
    28 repo stars
22. ▌
    Detecting Deepfake Audio In Vishing Attacks · theheavenlyd3mon bundle

    Detects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models. Supports batch analysis of audio files, generates confidence scores, and produces forensic reports. Activates for requests involving deepfake voice detection, vishing investigation, AI-generated speech analysis, voice cloning detection, or audio authenticity verification.
    28 repo stars
23. ▌
    Detecting Insider Data Exfiltration Via Dlp · theheavenlyd3mon bundle

    Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data loss prevention.
    28 repo stars
24. ▌
    Detecting Ntlm Relay With Event Correlation · theheavenlyd3mon bundle

    Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
    28 repo stars
25. ▌
    Detecting T1003 Credential Dumping With Edr · theheavenlyd3mon bundle

    Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.
    28 repo stars
26. ▌
    Hunting For Registry Persistence Mechanisms · theheavenlyd3mon bundle

    Hunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking in Windows environments.
    28 repo stars
27. ▌
    Implementing Disk Encryption With Bitlocker · theheavenlyd3mon bundle

    Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthorized access in case of device loss or theft. Use when deploying encryption for compliance requirements, securing mobile workstations, or implementing data protection controls across the enterprise. Activates for requests involving BitLocker encryption, disk encryption, TPM configuration, or data-at-rest protection.
    28 repo stars
28. ▌
    Implementing Runtime Security With Tetragon · theheavenlyd3mon bundle

    Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and policy enforcement.
    28 repo stars
29. ▌
    Implementing Siem Correlation Rules For Apt · theheavenlyd3mon bundle

    Write multi-event correlation rules that detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts. Uses Splunk SPL and Sigma rule format to correlate Event IDs 4624, 4648, 4688, and Sysmon Events 1/3 within sliding time windows to surface attack sequences invisible to single-event detections.
    28 repo stars
30. ▌
    Implementing Ticketing System For Incidents · theheavenlyd3mon bundle

    Implements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for structured incident tracking, SLA management, escalation workflows, and compliance documentation. Use when SOC teams need formalized incident lifecycle management with automated ticket creation, assignment routing, and resolution tracking.
    28 repo stars
31. ▌
    Implementing Velociraptor For Ir Collection · theheavenlyd3mon bundle

    Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments.
    28 repo stars
32. ▌
    Integrating Dast With Owasp Zap In Pipeline · theheavenlyd3mon bundle

    This skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic Application Security Testing in CI/CD pipelines. It addresses configuring baseline, full, and API scans against running applications, interpreting ZAP findings, tuning scan policies, and establishing DAST quality gates in GitHub Actions and GitLab CI.
    28 repo stars
33. ▌
    Performing Agentless Vulnerability Scanning · theheavenlyd3mon bundle

    Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without installing endpoint agents.
    28 repo stars
34. ▌
    Performing Authenticated Vulnerability Scan · theheavenlyd3mon bundle

    Authenticated (credentialed) vulnerability scanning uses valid system credentials to log into target hosts and perform deep inspection of installed software, patches, configurations, and security sett
    28 repo stars
35. ▌
    Performing Dmarc Policy Enforcement Rollout · theheavenlyd3mon bundle

    Execute a phased DMARC rollout from p=none monitoring through p=quarantine to p=reject enforcement, ensuring all legitimate email sources are authenticated before blocking unauthorized senders.
    28 repo stars
36. ▌
    Performing Endpoint Forensics Investigation · theheavenlyd3mon bundle

    Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Use when investigating security incidents, collecting evidence for legal proceedings, or analyzing endpoint compromise scope. Activates for requests involving endpoint forensics, memory analysis, disk forensics, or incident investigation.
    28 repo stars
37. ▌
    Performing False Positive Reduction In Siem · theheavenlyd3mon bundle

    Perform systematic SIEM false positive reduction through rule tuning, threshold adjustment, correlation refinement, and threat intelligence enrichment to combat alert fatigue.
    28 repo stars
38. ▌
    Performing Phishing Simulation With Gophish · theheavenlyd3mon bundle

    GoPhish is an open-source phishing simulation framework used by security teams to conduct authorized phishing awareness campaigns. It provides campaign management, email template creation, landing pag
    28 repo stars
39. ▌
    Performing Ssl Tls Inspection Configuration · theheavenlyd3mon bundle

    Configure SSL/TLS inspection on network security devices to decrypt, inspect, and re-encrypt HTTPS traffic for threat detection while managing certificates, exemptions, and privacy compliance.
    28 repo stars
40. ▌
    Performing Threat Hunting With Elastic Siem · theheavenlyd3mon bundle

    Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection. Use when SOC teams need to hunt for specific ATT&CK techniques, investigate anomalous behaviors, or validate detection coverage gaps using Elasticsearch and Kibana Security.
    28 repo stars
41. ▌
    Securing Historian Server In Ot Environment · theheavenlyd3mon bundle

    This skill covers hardening and securing process historian servers (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environments. It addresses network placement across Purdue levels, access control for historian interfaces, data replication through DMZ using data diodes or PI-to-PI connectors, SQL injection prevention in historian queries, and integrity protection of process data used for safety analysis, regulatory reporting, and process optimization.
    28 repo stars
42. ▌
    Testing Android Intents For Vulnerabilities · theheavenlyd3mon bundle

    Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.
    28 repo stars
43. ▌
    Analyzing Threat Actor Ttps With Mitre Navigator · theheavenlyd3mon bundle

    Map advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti Python library. The analyst queries STIX/TAXII data for group-technique associations, generates Navigator layer files for visualization, and compares defensive coverage against adversary profiles. Activates for requests involving APT TTP mapping, ATT&CK Navigator layers, threat actor profiling, or MITRE technique coverage analysis.
    28 repo stars
44. ▌
    Building Attack Pattern Library From Cti Reports · theheavenlyd3mon bundle

    Extract and catalog attack patterns from cyber threat intelligence reports into a structured STIX-based library mapped to MITRE ATT&CK for detection engineering and threat-informed defense.
    28 repo stars
45. ▌
    Building C2 Infrastructure With Sliver Framework · theheavenlyd3mon bundle

    Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.
    28 repo stars
46. ▌
    Building Malware Incident Communication Template · theheavenlyd3mon bundle

    Build structured communication templates for malware incidents including stakeholder notifications, executive briefings, technical advisories, and regulatory disclosures with severity-based escalation procedures.
    28 repo stars
47. ▌
    Exploiting Zerologon Vulnerability Cve 2020 1472 · theheavenlyd3mon bundle

    Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account password to empty.
    28 repo stars
48. ▌
    Performing Mobile App Certificate Pinning Bypass · theheavenlyd3mon bundle

    Bypasses SSL/TLS certificate pinning implementations in Android and iOS applications to enable traffic interception during authorized security assessments. Covers OkHttp, TrustManager, NSURLSession, and third-party pinning library bypass techniques using Frida, Objection, and custom scripts. Activates for requests involving certificate pinning bypass, SSL pinning defeat, mobile TLS interception, or proxy-resistant app testing.
    28 repo stars
49. ▌
    Performing Threat Emulation With Atomic Red Team · theheavenlyd3mon bundle

    Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.
    28 repo stars
50. ▌
    Hardening Docker Containers For Production · theheavenlyd3mon bundle

    Hardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce leas
    28 repo stars
51. ▌
    Implementing API Gateway Security Controls · theheavenlyd3mon bundle

    Implements security controls at the API gateway layer including authentication enforcement, rate limiting, request validation, IP allowlisting, TLS termination, and threat protection. The engineer configures API gateways (Kong, AWS API Gateway, Azure APIM, Apigee) to act as a centralized security enforcement point that validates, throttles, and monitors all API traffic before it reaches backend services. Activates for requests involving API gateway security, API management security, gateway authentication, or centralized API protection.
    28 repo stars
52. ▌
    Implementing AWS Iam Permission Boundaries · theheavenlyd3mon bundle

    Configure IAM permission boundaries in AWS to delegate role creation to developers while enforcing maximum privilege limits set by the security team.
    28 repo stars
53. ▌
    Implementing Cloud Dlp For Data Protection · theheavenlyd3mon bundle

    Implementing Cloud Data Loss Prevention (DLP) using Amazon Macie, Azure Information Protection, and Google Cloud DLP API to discover, classify, and protect sensitive data across cloud storage, databases, and data pipelines.
    28 repo stars
54. ▌
    Implementing Privileged Access Workstation · theheavenlyd3mon bundle

    Design and implement Privileged Access Workstations (PAWs) with device hardening, just-in-time access, and integration with CyberArk or BeyondTrust for secure administrative operations.
    28 repo stars
55. ▌
    Implementing Privileged Session Monitoring · theheavenlyd3mon bundle

    Implements privileged session monitoring and recording using Privileged Access Management (PAM) solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source alternatives. Covers session recording configuration, keystroke logging, real-time monitoring, risk-based session analysis, and compliance audit trail generation. Activates for requests involving privileged session recording, PAM session monitoring, CyberArk PSM configuration, administrator activity monitoring, or compliance session auditing.
    28 repo stars
56. ▌
    Implementing Rbac Hardening For Kubernetes · theheavenlyd3mon bundle

    Harden Kubernetes Role-Based Access Control by implementing least-privilege policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating external identity providers.
    28 repo stars
57. ▌
    Implementing Secrets Management With Vault · theheavenlyd3mon bundle

    This skill covers deploying HashiCorp Vault for centralized secrets management across cloud environments, including dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes integration. It addresses eliminating hardcoded credentials from application code and CI/CD pipelines by implementing short-lived, automatically rotated secrets.
    28 repo stars
58. ▌
    Implementing Sigstore For Software Signing · theheavenlyd3mon bundle

    Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic provenance for container images, binaries, and software artifacts. The practitioner configures OIDC-based identity binding, verifies signing events against the Rekor transparency log, and integrates signing workflows into CI/CD pipelines. Activates for requests involving software supply chain signing, keyless container signing, Sigstore deployment, or artifact provenance verification.
    28 repo stars
59. ▌
    Performing Cloud Log Forensics With Athena · theheavenlyd3mon bundle

    Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs for forensic investigation. Covers CREATE TABLE DDL with partition projection, forensic SQL queries for detecting unauthorized access, data exfiltration, lateral movement, and privilege escalation. Use when investigating AWS security incidents or building cloud-native forensic workflows at scale.
    28 repo stars
60. ▌
    Scanning Kubernetes Manifests With Kubesec · theheavenlyd3mon bundle

    Perform security risk analysis on Kubernetes resource manifests using Kubesec to identify misconfigurations, privilege escalation risks, and deviations from security best practices.
    28 repo stars
61. ▌
    Conducting Spearphishing Simulation Campaign · theheavenlyd3mon bundle

    Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craf
    28 repo stars
62. ▌
    Conducting Wireless Network Penetration Test · theheavenlyd3mon bundle

    Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive portal bypasses, evil twin attacks, WPA2/WPA3 handshake capture, rogue access point detection, and client-side attacks. The tester evaluates wireless authentication, network segmentation, and the effectiveness of wireless intrusion detection systems. Activates for requests involving wireless pentest, WiFi security assessment, WPA2/WPA3 testing, or rogue access point detection.
    28 repo stars
63. ▌
    Configuring Microsegmentation For Zero Trust · theheavenlyd3mon bundle

    Configure microsegmentation policies to enforce least-privilege workload-to-workload access using tools like VMware NSX, Illumio, and Calico, preventing lateral movement in zero trust architectures.
    28 repo stars
64. ▌
    Deploying Palo Alto Prisma Access Zero Trust · theheavenlyd3mon bundle

    Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.
    28 repo stars
65. ▌
    Detecting Typosquatting Packages In NPM Pypi · theheavenlyd3mon bundle

    Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages have disproportionately low usage compared to their legitimate targets. The analyst queries the PyPI JSON API and npm registry API to gather package metadata for automated comparison. Activates for requests involving package typosquatting detection, dependency confusion analysis, malicious package identification, or software supply chain threat hunting in package registries.
    28 repo stars
66. ▌
    Hunting For Data Staging Before Exfiltration · theheavenlyd3mon bundle

    Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry
    28 repo stars
67. ▌
    Hunting For Defense Evasion Via Timestomping · theheavenlyd3mon bundle

    Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.
    28 repo stars
68. ▌
    Implementing API Security Posture Management · theheavenlyd3mon bundle

    Implement API Security Posture Management to continuously discover, classify, and score APIs based on risk while enforcing security policies across the API lifecycle.
    28 repo stars
69. ▌
    Implementing Ddos Mitigation With Cloudflare · theheavenlyd3mon bundle

    Configure Cloudflare DDoS protection with managed rulesets, rate limiting, WAF rules, Bot Management, and origin protection to mitigate volumetric, protocol, and application-layer attacks.
    28 repo stars
70. ▌
    Implementing Memory Protection With Dep Aslr · theheavenlyd3mon bundle

    Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent memory corruption attacks. Use when hardening endpoints against buffer overflow exploits, ROP chains, and code injection. Activates for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG configuration.
    28 repo stars
71. ▌
    Implementing Network Policies For Kubernetes · theheavenlyd3mon bundle

    Kubernetes NetworkPolicies provide pod-level network segmentation by defining ingress and egress rules that control traffic flow between pods, namespaces, and external endpoints. Combined with CNI plu
    28 repo stars
72. ▌
    Implementing Patch Management For Ot Systems · theheavenlyd3mon bundle

    This skill covers implementing a structured patch management program for OT/ICS environments where traditional IT patching approaches can cause process disruption or safety hazards. It addresses vendor compatibility testing, risk-based patch prioritization, staged deployment through test environments, maintenance window coordination, rollback procedures, and compensating controls when patches cannot be applied due to operational constraints or vendor restrictions.
    28 repo stars
73. ▌
    Performing Dns Enumeration And Zone Transfer · theheavenlyd3mon bundle

    Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.
    28 repo stars
74. ▌
    Performing External Network Penetration Test · theheavenlyd3mon bundle

    Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance, scanning, exploitation, and reporting.
    28 repo stars
75. ▌
    Performing Linux Log Forensics Investigation · theheavenlyd3mon bundle

    Perform forensic investigation of Linux system logs including syslog, auth.log, systemd journal, kern.log, and application logs to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised Linux systems.
    28 repo stars
76. ▌
    Performing S7comm Protocol Security Analysis · theheavenlyd3mon bundle

    Perform security analysis of Siemens S7comm and S7CommPlus protocols used by SIMATIC S7 PLCs to identify vulnerabilities including replay attacks, integrity bypass, unauthorized CPU stop commands, and program download manipulation exploiting weaknesses in S7-300, S7-400, S7-1200, and S7-1500 controllers.
    28 repo stars
77. ▌
    Performing Sca Dependency Scanning With Snyk · theheavenlyd3mon bundle

    This skill covers implementing Software Composition Analysis (SCA) using Snyk to detect vulnerable open-source dependencies in CI/CD pipelines. It addresses scanning package manifests and lockfiles, automated fix pull request generation, license compliance checking, continuous monitoring of deployed applications, and integration with GitHub, GitLab, and Jenkins pipelines.
    28 repo stars
78. ▌
    Performing Soap Web Service Security Testing · theheavenlyd3mon bundle

    Perform security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE, WS-Security bypass, and SOAPAction spoofing.
    28 repo stars
79. ▌
    Triaging Vulnerabilities With Ssvc Framework · theheavenlyd3mon bundle

    Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.
    28 repo stars
80. ▌
    Performing Android App Static Analysis With Mobsf · theheavenlyd3mon bundle

    Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application. Use when assessing Android APK/AAB files for security vulnerabilities before deployment, during penetration testing, or as part of CI/CD security gates. Activates for requests involving Android static analysis, MobSF scanning, APK security assessment, or mobile application code review.
    28 repo stars
81. ▌
    Performing Bandwidth Throttling Attack Simulation · theheavenlyd3mon bundle

    Simulates bandwidth throttling and network degradation attacks using tc, iperf3, and Scapy in authorized environments to test quality-of-service controls, application resilience, and network monitoring detection of traffic manipulation attacks.
    28 repo stars
82. ▌
    Performing Static Malware Analysis With Pe Studio · theheavenlyd3mon bundle

    Performs static analysis of Windows PE (Portable Executable) malware samples using PEStudio to examine file headers, imports, strings, resources, and indicators without executing the binary. Identifies suspicious characteristics including packing, anti-analysis techniques, and malicious imports. Activates for requests involving static malware analysis, PE file inspection, Windows executable analysis, or pre-execution malware triage.
    28 repo stars
83. ▌
    Reverse Engineering Ransomware Encryption Routine · theheavenlyd3mon bundle

    Reverse engineer ransomware encryption routines to identify cryptographic algorithms, key generation flaws, and potential decryption opportunities using static and dynamic analysis.
    28 repo stars
84. ▌
    Detecting AWS Guardduty Findings Automation · theheavenlyd3mon bundle

    Automate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.
    28 repo stars
85. ▌
    Detecting Container Escape With Falco Rules · theheavenlyd3mon bundle

    Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.
    28 repo stars
86. ▌
    Hardening Linux Endpoint With Cis Benchmark · theheavenlyd3mon bundle

    Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.
    28 repo stars
87. ▌
    Hunting For Living Off The Cloud Techniques · theheavenlyd3mon bundle

    Hunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse of Azure, AWS, GCP services, and SaaS platforms.
    28 repo stars
88. ▌
    Implementing API Schema Validation Security · theheavenlyd3mon bundle

    Implement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts and prevent injection, data exposure, and mass assignment attacks.
    28 repo stars
89. ▌
    Implementing Cisa Zero Trust Maturity Model · theheavenlyd3mon bundle

    Implement the CISA Zero Trust Maturity Model v2.0 across the five pillars of identity, devices, networks, applications, and data to achieve progressive organizational zero trust maturity.
    28 repo stars
90. ▌
    Performing Docker Bench Security Assessment · theheavenlyd3mon bundle

    Docker Bench for Security is an open-source script that checks dozens of common best practices around deploying Docker containers in production. Based on the CIS Docker Benchmark, it audits host confi
    28 repo stars
91. ▌
    Acquiring Disk Image With Dd And Dcfldd · theheavenlyd3mon bundle

    Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.
    28 repo stars
92. ▌
    Investigating Insider Threat Indicators · theheavenlyd3mon bundle

    Investigates insider threat indicators including data exfiltration attempts, unauthorized access patterns, policy violations, and pre-departure behaviors using SIEM analytics, DLP alerts, and HR data correlation. Use when SOC teams receive insider threat referrals from HR, detect anomalous data movement by employees, or need to build investigation timelines for potential insider threats.
    28 repo stars
93. ▌
    Performing Disk Forensics Investigation · theheavenlyd3mon bundle

    Conducts disk forensics investigations using forensic imaging, file system analysis, artifact recovery, and timeline reconstruction to support incident response cases. Utilizes tools such as FTK Imager, Autopsy, and The Sleuth Kit for evidence acquisition, deleted file recovery, and artifact examination. Activates for requests involving disk forensics, hard drive analysis, forensic imaging, file recovery, evidence acquisition, or digital forensic investigation.
    28 repo stars
94. ▌
    Analyzing Typosquatting Domains With Dnstwist · theheavenlyd3mon bundle

    Detect typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations and identify registered lookalike domains targeting your organization.
    28 repo stars
95. ▌
    Building Ioc Enrichment Pipeline With Opencti · theheavenlyd3mon bundle

    OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its native data model. This skill covers building an automated IOC enrichment pipeline using O
    28 repo stars
96. ▌
    Building Threat Intelligence Feed Integration · theheavenlyd3mon bundle

    Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.
    28 repo stars
97. ▌
    Conducting External Reconnaissance With Osint · theheavenlyd3mon bundle

    Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.
    28 repo stars
98. ▌
    Configuring Snort Ids For Intrusion Detection · theheavenlyd3mon bundle

    Installs, configures, and tunes Snort 3 intrusion detection system to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins on authorized network segments.
    28 repo stars
99. ▌
    Configuring Tls 1 3 For Secure Communications · theheavenlyd3mon bundle

    TLS 1.3 (RFC 8446) is the latest version of the Transport Layer Security protocol, providing significant improvements over TLS 1.2 in both security and performance. It reduces handshake latency to 1-R
    28 repo stars
100. ▌
     Detecting Evasion Techniques In Endpoint Logs · theheavenlyd3mon bundle

     Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.
     28 repo stars