26zl/cybersec-toolkit

26zl/cybersec-toolkit · .claude/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md · Create forensically sound bit-for-bit disk images using dd and dcfldd

26zl/cybersec-toolkit · .claude/skills/add-tool/SKILL.md · Use when adding a new cybersecurity tool to this installer. Walks through editing the right module file, adding to…

26zl/cybersec-toolkit · .claude/skills/ai-llm-security-review/SKILL.md · Use for AI/LLM security assessments, prompt injection, RAG security, agent/tool permissioning, model supply chain, LLM…

26zl/cybersec-toolkit · .claude/skills/ai-threat-testing/SKILL.md · Offensive AI security testing and exploitation framework. Systematically tests LLM applications for OWASP Top 10…

26zl/cybersec-toolkit · .claude/skills/analyzing-active-directory-acl-abuse/SKILL.md · Detect dangerous ACL misconfigurations in Active Directory using ldap3

26zl/cybersec-toolkit · .claude/skills/analyzing-android-malware-with-apktool/SKILL.md · Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source

26zl/cybersec-toolkit · .claude/skills/analyzing-api-gateway-access-logs/SKILL.md · 'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect

26zl/cybersec-toolkit · .claude/skills/analyzing-apt-group-with-mitre-navigator/SKILL.md · Analyze advanced persistent threat (APT) group techniques using MITRE

26zl/cybersec-toolkit · .claude/skills/analyzing-azure-activity-logs-for-threats/SKILL.md · 'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

26zl/cybersec-toolkit · .claude/skills/analyzing-bootkit-and-rootkit-samples/SKILL.md · 'Analyzes bootkit and advanced rootkit malware that infects the Master

26zl/cybersec-toolkit · .claude/skills/analyzing-browser-forensics-with-hindsight/SKILL.md · Analyze Chromium-based browser artifacts using Hindsight to extract browsing

26zl/cybersec-toolkit · .claude/skills/analyzing-campaign-attribution-evidence/SKILL.md · Campaign attribution analysis involves systematically evaluating evidence

26zl/cybersec-toolkit · .claude/skills/analyzing-certificate-transparency-for-phishing/SKILL.md · Monitor Certificate Transparency logs using crt.sh and Certstream to

26zl/cybersec-toolkit · .claude/skills/analyzing-cloud-storage-access-patterns/SKILL.md · Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage

26zl/cybersec-toolkit · .claude/skills/analyzing-cobalt-strike-beacon-configuration/SKILL.md · Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure,

26zl/cybersec-toolkit · .claude/skills/analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md · Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike

26zl/cybersec-toolkit · .claude/skills/analyzing-command-and-control-communication/SKILL.md · 'Analyzes malware command-and-control (C2) communication protocols to

26zl/cybersec-toolkit · .claude/skills/analyzing-cyber-kill-chain/SKILL.md · 'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

26zl/cybersec-toolkit · .claude/skills/analyzing-disk-image-with-autopsy/SKILL.md · Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and

26zl/cybersec-toolkit · .claude/skills/analyzing-dns-logs-for-exfiltration/SKILL.md · 'Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

26zl/cybersec-toolkit · .claude/skills/analyzing-docker-container-forensics/SKILL.md · Investigate compromised Docker containers by analyzing images, layers,

26zl/cybersec-toolkit · .claude/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md · Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify

26zl/cybersec-toolkit · .claude/skills/analyzing-ethereum-smart-contract-vulnerabilities/SKILL.md · Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy,

26zl/cybersec-toolkit · .claude/skills/analyzing-golang-malware-with-ghidra/SKILL.md · Reverse engineer Go-compiled malware using Ghidra with specialized scripts

26zl/cybersec-toolkit · .claude/skills/analyzing-heap-spray-exploitation/SKILL.md · Detect and analyze heap spray attacks in memory dumps using Volatility3