Gives an AI agent the step-by-step workflow a senior security analyst follows, covering when to use each technique, what to check first, how to run it and how to verify the result. Covers incident response, forensics, threat intelligence, malware analysis, penetration testing and red teaming.
@mukul975A Claude Code plugin with agents, commands and reference skills for penetration testing, covering Active Directory attacks, exploit lookup, MITRE ATT&CK mapping, wordlists and pentest report writing.
@mukul975Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials)…
@mukul975Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev…
@mukul975Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence…
@mukul975Active Directory attack reference — BloodHound Cypher queries, Kerberos attack decision tree, ACE/ACL abuse, ADCS ESC1-8, and AD…
@mukul975Detect dangerous ACL misconfigurations in Active Directory using ldap3
@mukul975Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and…
@mukul975Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect
@mukul975Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap…
@mukul975Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query
@mukul975Analyzes bootkit and advanced rootkit malware infecting the Master
@mukul975Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached…
@mukul975Active Directory and Windows domain attack specialist. Use for Kerberoasting, AS-REP roasting, DCSync, BloodHound enumeration,…
@mukul975API security testing specialist for REST, GraphQL, gRPC, and WebSocket APIs. Handles BOLA/IDOR, mass assignment, authentication…
@mukul975Defensive security and hardening specialist. Creates detection rules, hardens Linux/Windows systems, writes Sigma rules,…
@mukul975Command and control infrastructure specialist for authorized red team operations. Handles Sliver C2 framework, Havoc C2,…
@mukul975Cloud penetration testing specialist for AWS, Azure, and GCP. Handles IAM enumeration, privilege escalation, S3 bucket abuse,…
@mukul975Compliance and security standards assessment specialist. Handles CIS benchmarks, PCI-DSS controls, NIST CSF, SOC2, GDPR technical…
@mukul975Container and Kubernetes security specialist. Handles Docker escape techniques, Kubernetes RBAC abuse, service account token…
@mukul975Cryptography and TLS security specialist. Handles TLS configuration auditing, JWT algorithm confusion, padding oracle attacks,…
@mukul975Digital forensics and incident response specialist. Handles triage, memory acquisition with AVML/LiME, Volatility analysis, log…
@mukul975Antivirus and EDR evasion specialist for authorized red team engagements. Handles AMSI bypass, payload obfuscation,…
@mukul975Exploitation specialist for gaining initial access. Use when exploiting CVEs, running Metasploit modules, using searchsploit,…
@mukul975IoT and embedded systems security specialist. Handles firmware extraction and analysis, hardcoded credential discovery, UART/JTAG…
@mukul975Route an attack vector to the appropriate specialist agent — usage: /project:attack <target> <vector>
@mukul975Start a new engagement for a target — verifies scope, creates evidence directories, and launches recon agent
@mukul975Run an ATT&CK-based threat hunt with a specific hypothesis
@mukul975Incident response workflow — triage, evidence collection, timeline, and IOC extraction
@mukul975Post-exploitation workflow after getting shell access — privesc, credential harvest, lateral movement
@mukul975Generate a professional penetration test report from all evidence files
@mukul975Is this you? Claim your profilePut a plugin at the top of Plugins, from $9
