Навыков: 4 624. Сортировка по числу звёзд.
Detects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azur...
Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refres...
Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket u...
Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and netw...
Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall pa...
Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker a...
Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking...
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing proxy access logs, DNS query logs, and firewall/...
Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit log...
Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned acti...
Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, an...
Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR...
Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by...
Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using...
Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein...
Security detection use cases for identifying threats across network, endpoint, identity, cloud, application, and email v...
Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SI...
Security review aligned with OWASP Top 10:2025. Auto-detects backend (.NET) and frontend (Angular/TypeScript) from proje...
Security audit with Sentinel. Checks for vulnerabilities, secrets, dependencies, and security best practices. Use before...
Security checklist for C#/.NET backend (ASP.NET Core, EF Core, Event Sourcing). Covers secrets management, input validat...
Laravel Fortify headless authentication backend development. Activate when implementing authentication features includin...
Security review of a change's branch, after code integrity. It runs the NFDR's dependency audit and answers every adviso...
This skill should be used when the user asks to "implement device auth", "add device authorization", "authenticate deskt...
デバイスクレデンシャル（Device Credential）機能の開発・修正を行う際に使用。デバイスシークレット発行、JWT Bearer Grant、CIBAデバイス認証、セキュリティ実装時に役立つ。
Verify device legitimacy and app integrity using DeviceCheck (DCDevice per-device bits) and App Attest (DCAppAttestServi...
Audit or restructure technical development posts and series for factual support, causal links, chronology, novelty, and...
Audit one feature read-only for security, performance, or simplification risks. Use for one bounded audit axis; not for...
Segurança de infraestrutura e pipeline — Trivy, Falco, CrowdSec, Fail2Ban, WAF, TLS, IAM, secrets, OWASP, Security Hub....
Expert en DevSecOps avancé (SAST, DAST, SCA, container scanning, policy-as-code, GitGuardian, supply chain security, SBO...
Use when "query Dewey Data", "deweydata.io", "SafeGraph places/patterns/spend", "Advan foot traffic", "POI / points of i...
Scan codebase for security vulnerabilities using parallel auditor agents. Standalone — works without .planning/ state. C...
Audit, write, or revise a data flow diagram (DFD). Use when asked to draw or model how data moves through a system, when...
Use when assessing DHCP security on an authorized network or lab. Covers rogue DHCP servers, DHCP starvation, option inj...
Debug and verify the three-layer defense against internal content leaking into user-visible messages.
De-identify DICOM medical images by removing PHI tags for research sharing, with audit logging and study-linkage preserv...
Analyze git diffs for risk scoring, reviewer recommendations, and change classification
Analyze git diffs for risk scoring, reviewer recommendations, and change classification. Use when preparing a PR, review...
Security-focused code review for PRs, commits, and diffs.
Compare two versions of a codebase to identify security implications of changes. Use when reviewing protocol upgrades, v...
Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame fo...
Audits supplied sanitized directory-service governance evidence for durable control and persistence exposure without con...
Architect DirectX 12 rendering engines with root signatures, resource barriers, command queues, and DXR ray tracing.
Drive responsible disclosure of a proven finding to a CVE. Package the report, find the vendor contact, report privately...
Install or set up from the source-backed instructions: