ftrout
User16 advanced, customizable Claude Code skills for security operations teams: triage, detection engineering, threat hunting, phishing and malware analysis, DFIR, threat intel, vulnerability management, cloud and identity investigations.
Categories
Indexed Skills (15)
cloud-incident-investigation
Investigate suspected compromise in AWS, Azure, or GCP: find the right logs (CloudTrail, AzureActivity, Entra audit, GCP Cloud Audit Logs), reconstruct what an identity or access key did, spot the high-signal control-plane events (access key creation, role assumption chains, StopLogging, PutBucketPolicy, role assignments, Key Vault reads, setIamPolicy, service account key creation), size the blast radius, and contain safely (rotate, deny, SCP, revoke) while preserving evidence. Use it whenever someone mentions a leaked or exposed access key, a GuardDuty / Defender for Cloud / Security Command Center finding, an unexpected cloud bill, a public bucket, an unknown IAM user or role, "someone logged into the console", "who created this resource", or pastes CloudTrail, Activity Log, or audit log JSON, even if they do not say "incident". Also use it for post-hoc "what did this credential touch" reviews.
detection-engineering
Design, write, test, tune, deploy, and review detection rules through their full lifecycle, with Sigma as the canonical rule format and conversion to Splunk SPL, Sentinel/Defender KQL, Elastic EQL/ES|QL, or Chronicle YARA-L. Use it whenever someone wants to "write a detection", "build a rule for", "alert on", "turn this report/hunt/purple-team gap into a detection", "review this Sigma rule", "why is this rule so noisy", "tune the false positives", "map this rule to ATT&CK", or pastes a Sigma/KQL/SPL rule and asks whether it is any good. Also use it when a threat report, an incident lesson, or a hunt result implies a detection that nobody has written yet, even if the user only asks "how would we catch this next time".
identity-threat-investigation
Investigate a suspected account or identity compromise in Entra ID (Azure AD), Okta, Google Workspace, or on-prem Active Directory: analyze sign-in logs for impossible travel, new country or ASN, MFA fatigue, legacy auth, token replay and AiTM session hijack; check risky OAuth consent grants, MFA method changes, mailbox rules, and privilege changes; spot AD attack indicators (Kerberoasting, AS-REP roasting, DCSync, golden and silver tickets, NTDS theft); and contain in the right order (reset, revoke sessions, disable, remove consent, krbtgt double reset) without breaking the business. Use it whenever someone says a user "got phished", "clicked the link", "approved an MFA prompt they didn't request", reports a risky sign-in or Identity Protection / Okta ThreatInsight alert, asks "is this account compromised", pastes sign-in or Security event log exports, or mentions a suspicious inbox rule, unknown app consent, or new Global Admin, even if the word "identity" never appears.
ioc-extraction
Extract, normalize, defang/refang, classify, and de-duplicate indicators of compromise (IPs, domains, URLs, hashes, emails, file paths, registry keys, CVEs, wallet addresses) from any unstructured text such as threat intel reports, vendor advisories, phishing emails, pasted logs, PDFs, or chat messages, then produce a clean, machine-readable indicator list with context and an enrichment plan. Use this whenever the user pastes or points at a report, advisory, email, or blob of text and wants the indicators out of it, asks to "pull the IOCs", "defang these", "make a blocklist", "turn this into a watchlist", "what should we block from this report", or needs indicators formatted for a SIEM, EDR, firewall, TIP, or STIX bundle. Also use it when someone asks whether a list of indicators is well-formed or contains noise.
log-forensics
Investigate an incident from logs: pick the Windows Security/System/PowerShell/Sysmon event IDs, Linux auth/audit/systemd/cron/shell-history artifacts, and web server or proxy logs that answer the question, normalize time zones, merge everything into one UTC super-timeline, pivot user to host to process to network, and preserve evidence properly. Use it whenever someone pastes or points at exported logs (CSV, JSON, EVTX exports, auth.log, access.log), asks "what happened on this host", "when did they get in", "what did this account do", "build a timeline", "which event IDs should I pull", or needs a forensic narrative for an incident report, even if they never say forensics.
malware-triage
Safe static triage of a suspicious file, hash, or sandbox report without ever executing it: hash lookups, file type by magic, entropy and packing indicators, PE/ELF/LNK/PDF/Office/archive metadata, interesting strings and IOCs, sandbox report interpretation (Tria.ge, ANY.RUN, VMRay, Hybrid Analysis, CAPE, Joe), capability and MITRE ATT&CK assessment, YARA rule drafting, and hand-off to detection and incident work. Use it whenever someone asks "what is this file", "is this hash bad", "can you look at this sample / attachment / binary / script / DLL / LNK / ISO", pastes a VirusTotal or sandbox result, wants a YARA rule, or an EDR alert names an unknown executable, even if they never say the word malware.
mitre-attack-mapping
Map observed adversary behaviour to MITRE ATT&CK tactics, techniques and sub-techniques with evidence, rationale, and confidence, then produce a mapping table and an ATT&CK Navigator layer JSON. Use it whenever someone asks "what ATT&CK techniques is this", "map this to ATT&CK", "tag this with TTPs", "build a Navigator layer / heat map", "which techniques does our detection coverage miss", or pastes an incident timeline, threat report, sandbox report, Sigma rule set, or purple-team results and wants them expressed in ATT&CK terms. Also use it to check an existing mapping for over-mapping, wrong tactics, or stale technique IDs, and to diff a threat-profile layer against a detection-coverage layer.
phishing-analysis
Analyze a reported or suspicious email end to end: Received chain and SPF/DKIM/DMARC alignment, sender and Reply-To and display-name mismatches, lookalike domains, URL and redirector analysis, QR codes, HTML smuggling, attachment triage, lure classification (BEC/invoice, credential harvest, callback/TOAD, MFA push, package delivery, HR/payroll), verdict, blast radius, and response actions. Use it whenever someone pastes headers or an .eml, says "is this phishing", "a user reported this email", "check these headers", "is this sender legit", "who else got this", asks why DMARC failed, wants a phishing triage note, or forwards a suspicious invoice, voicemail, DocuSign, MFA, delivery, or payroll-change message, even if they never use the word phishing.
purple-team-exercise
Plan and run a purple-team detection-validation exercise: a controlled, cooperative test of whether your telemetry and detections would see a chosen set of adversary behaviors, not an attack. Use it to turn a threat profile or an incident into scenarios, pick ATT&CK techniques, map each to public adversary-emulation content by name or ID (Atomic Red Team, MITRE CALDERA, Stratus Red Team, MITRE ATT&CK Evaluations emulation plans), write rules of engagement and a safety and comms plan, define expected telemetry per technique, score each as alerted / logged-only / not-visible, measure time-to-detect, and convert the gaps into a detection backlog. Reach for it when someone says "purple team", "detection validation", "adversary emulation", "run some atomics", "test our detections", "MITRE coverage assessment", "are we detecting X", "validate the SOC", or asks to build a scorecard or an exercise plan. This skill contains no attack commands and never runs the tests; it plans, coordinates, and scores.
siem-query-authoring
Turn an investigative question, a hunt hypothesis, or an indicator list into a correct, efficient query for the team's SIEM: Microsoft Sentinel / Defender XDR (KQL), Splunk (SPL with CIM), Elastic (KQL, EQL, ES|QL over ECS), Google SecOps / Chronicle (UDM search, YARA-L), or Athena / BigQuery SQL over CloudTrail, VPC flow and audit logs. Use it whenever someone asks to "write a query", "search the SIEM for", "check if any host talked to", "find logons from", "translate this SPL to KQL", "why does my query return nothing / time out", or hands over an IOC list (typically the CSV from `ioc-extraction`) that needs to become a retro-hunt. Also use it when another skill needs a query run: backtests for `detection-engineering`, hunt queries for `threat-hunting`, scoping for `incident-triage`.
soar-playbook-design
Design safe security automation playbooks for a SOAR platform (Microsoft Sentinel automation rules and Logic Apps, Splunk SOAR, Cortex XSOAR, Tines, Shuffle): triggers, enrichment, decision logic, containment behind human-approval gates, idempotency, rate limits, rollback, error handling, dry-run testing, and metrics, expressed in a vendor-agnostic JSON definition that a bundled linter checks. Use this whenever someone wants to "automate" an alert response, asks for a playbook, workflow, automation rule, Logic App, story, or runbook-as-code, wants to auto-block, auto-isolate, auto-disable, or auto-close anything, asks "is this automation safe", or wants an existing playbook reviewed or translated between platforms. Design and review only; it never executes actions.
threat-hunting
Plan, run, and write up hypothesis-driven threat hunts (PEAK / TaHiTI style): turn a threat report, an ATT&CK technique, a coverage gap, an anomaly, or "something feels off" into a testable hypothesis with data sources, queries, expected benign volume, an analysis technique (stacking, prevalence, baselining, clustering, sequencing, outliers), success criteria, and hand-offs. Use it whenever someone says "hunt for", "go look for", "is anyone doing X in our environment", "what should we hunt this week", "build a hunt from this report", "stack these values", "what is rare here", "baseline this data source", or hands over a CSV/JSONL export and asks what stands out. Also use it when a report or a purple-team result implies behaviour that no alert covers, even if nobody says the word hunt.
threat-intel-analysis
Turn raw threat intelligence (vendor reports, ISAC bulletins, CISA/CERT advisories, STIX bundles, MISP events, social-media threads, leak-site posts, dark-web chatter) into actionable products: extract TTPs and indicators, grade the source with the Admiralty code, assess relevance against the organisation's threat profile and PIRs, apply the Diamond Model, and write flash alerts, actor profiles, and weekly digests with TLP markings plus concrete detection and hunt asks. Use it whenever someone pastes or links a threat report and asks "is this relevant to us", "what should we do about this", "summarise this for the SOC / leadership", "write up this actor", "what is in this STIX bundle", "build our threat profile", "draft this week's intel digest", or wants to know whether an intel claim is credible.
vulnerability-triage
Prioritise vulnerabilities and produce a ranked remediation plan using CVSS v3.1/v4.0, EPSS, CISA KEV, exploit maturity, asset exposure and criticality, compensating controls, and business context, with tiers (P1..P4), SLAs, risk statements, and asset-owner communications. Use it whenever someone shares a scanner export, a CVE list, a vendor advisory, a "should we patch this now" question, a KEV notification, or a Patch Tuesday summary and wants to know what to fix first, how urgent a specific CVE is for their environment, what to do when a system cannot be patched, how to write a risk acceptance or exception, or how to explain a vulnerability decision to an asset owner or executive. Also use it to tune a scoring model or SLA policy.
skill-template
Replace this with what the skill does AND when to use it. List the phrases, artifacts, and situations that should trigger it, including cases where the user does not name the task explicitly. Keep under 1024 characters. Be a little pushy; Claude under-triggers skills.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.