Contribute a skill

Library

Community-shared Detection Skills. Run them as-is, or fork one and adapt it to your environment.

  1. 1

    Network Recon Scanning

    triage/network-recon-scanning

    72

    exports

  2. 2

    Application AI Sensitive Data Exposure

    triage/application-ai-sensitive-data-exposure

    62

    exports

  3. 3

    Network Exposed Service Exploitation

    triage/network-exposed-service-exploitation

    55

    exports

  4. 4

    Application Data Exfiltration Oversharing

    triage/application-data-exfiltration-oversharing

    49

    exports

  5. 5

    Endpoint Execution Payload Delivery

    triage/endpoint-execution-payload-delivery

    47

    exports

  6. 6

    MFA Deepdive

    investigation/mfa-deepdive

    47

    exports

  7. 7

    Identity Authentication Abuse

    triage/identity-authentication-abuse

    43

    exports

  8. 8

    Cloud Recon Secret Harvest

    triage/cloud-recon-secret-harvest

    42

    exports

  9. 9

    MFA Fatigue Baseline

    triage/mfa-fatigue-baseline

    42

    exports

  10. 10

    Endpoint Destructive Impact

    triage/endpoint-destructive-impact

    37

    exports

  11. 11

    Endpoint Recon Lateral Movement

    triage/endpoint-recon-lateral-movement

    35

    exports

  12. 12

    Admin Role Duty Noise

    tuning/admin-role-duty-noise

    34

    exports

  13. 13

    Application AI Claude Code Context Poisoning

    triage/application-ai-claude-code-context-poisoning

    29

    exports

  14. 14

    Application AI Tooling Supply Chain

    triage/application-ai-tooling-supply-chain

    29

    exports

  15. 15

    Application Delivered Threat

    triage/application-delivered-threat

    25

    exports

  16. 16

    Application Control Policy Tampering

    triage/application-control-policy-tampering

    24

    exports

  17. 17

    Trusted Infrastructure Noise

    tuning/trusted-infrastructure-noise

    23

    exports

  18. 18

    Inbox Rule Abuse Triage

    triage/inbox-rule-abuse-triage

    22

    exports

  19. 19

    Risk Based Alerting

    triage/risk-based-alerting

    22

    exports

  20. 20

    AI Agent Incident Investigation

    investigation/ai-agent-incident-investigation

    21

    exports

  21. 21

    Business Email Compromise Investigation

    investigation/business-email-compromise-investigation

    21

    exports

  22. 22

    Lateral Movement Investigation

    investigation/lateral-movement-investigation

    21

    exports

  23. 23

    C2 Beacon Investigation

    investigation/c2-beacon-investigation

    20

    exports

  24. 24

    Kerberoasting Triage

    triage/kerberoasting-triage

    20

    exports

  25. 25

    Application AI Agent Action Abuse

    triage/application-ai-agent-action-abuse

    19

    exports

  26. 26

    Cloud IAM Privilege Persistence

    triage/cloud-iam-privilege-persistence

    19

    exports

  27. 27

    Data Exfiltration Investigation

    investigation/data-exfiltration-investigation

    19

    exports

  28. 28

    Suspicious MFA Enrollment Triage

    triage/suspicious-mfa-enrollment-triage

    19

    exports

  29. 29

    macOS Clickfix Loader

    triage/macos-clickfix-loader

    19

    exports

  30. 30

    Phishing Campaign Investigation

    investigation/phishing-campaign-investigation

    18

    exports

  31. 31

    Application AI Prompt Injection

    triage/application-ai-prompt-injection

    17

    exports

  32. 32

    Cloud Security Control Evasion

    triage/cloud-security-control-evasion

    17

    exports

  33. 33

    Identity Directory Reconnaissance

    triage/identity-directory-reconnaissance

    16

    exports

  34. 34

    Identity App Token Device Foothold

    triage/identity-app-token-device-foothold

    14

    exports

  35. 35

    Identity Privilege Account Provisioning

    triage/identity-privilege-account-provisioning

    14

    exports

  36. 36

    Application Account Auth Abuse

    triage/application-account-auth-abuse

    13

    exports

  37. 37

    Cloud Data Exfiltration Destruction

    triage/cloud-data-exfiltration-destruction

    13

    exports

  38. 38

    Endpoint Persistence Privesc

    triage/endpoint-persistence-privesc

    13

    exports

  39. 39

    Identity Control Tampering

    triage/identity-control-tampering

    13

    exports

  40. 40

    Service Account Noise

    tuning/service-account-noise

    13

    exports

  41. 41

    Application AI Guardrail Config Tampering

    triage/application-ai-guardrail-config-tampering

    12

    exports

  42. 42

    Application Web App Exploitation

    triage/application-web-app-exploitation

    12

    exports

  43. 43

    Endpoint Credential Theft

    triage/endpoint-credential-theft

    12

    exports

  44. 44

    Endpoint Defense Evasion Tampering

    triage/endpoint-defense-evasion-tampering

    12

    exports

  45. 45

    Network Egress Exfiltration

    triage/network-egress-exfiltration

    12

    exports

  46. 46

    Application AI Service Hijack

    triage/application-ai-service-hijack

    10

    exports

  47. 47

    Network Anonymized C2 Traffic

    triage/network-anonymized-c2-traffic

    10

    exports

  48. 48

    impossible-travel-triage

    triage/impossible-travel-triage

    10

    exports

  49. 49

    oauth-consent-phishing-investigation

    investigation/oauth-consent-phishing-investigation

    6

    exports

  50. 50

    impossible-travel-tuning

    tuning/impossible-travel-tuning

    5

    exports