yanacuti1121/Yana-AI - الصفحة ١٤

detecting-service-account-abuse

Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.

لغة النص الأصلي: الإنجليزية

detecting-shadow-api-endpoints

Discover and inventory shadow API endpoints that operate outside documented specifications using traffic analysis, code scanning, and API discovery platforms.

لغة النص الأصلي: الإنجليزية

detecting-shadow-it-cloud-usage

Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern analysis and domain classification.

لغة النص الأصلي: الإنجليزية

detecting-spearphishing-with-email-gateway

Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint,

لغة النص الأصلي: الإنجليزية

detecting-sql-injection-via-waf-logs

Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates…

لغة النص الأصلي: الإنجليزية

detecting-stuxnet-style-attacks

This skill covers detecting sophisticated cyber-physical attacks that follow the Stuxnet attack pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation from operators. It addresses PLC logic integrity monitoring, physics-based…

لغة النص الأصلي: الإنجليزية

detecting-supply-chain-attacks-in-ci-cd

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use…

لغة النص الأصلي: الإنجليزية

detecting-suspicious-oauth-application-consent

Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.

لغة النص الأصلي: الإنجليزية

detecting-suspicious-powershell-execution

Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.

لغة النص الأصلي: الإنجليزية

detecting-t1003-credential-dumping-with-edr

Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.

لغة النص الأصلي: الإنجليزية

detecting-t1055-process-injection-with-sysmon

Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.

لغة النص الأصلي: الإنجليزية

detecting-t1548-abuse-elevation-control-mechanism

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.

لغة النص الأصلي: الإنجليزية

detecting-typosquatting-packages-in-npm-pypi

Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and…

لغة النص الأصلي: الإنجليزية

detecting-wmi-persistence

Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.

لغة النص الأصلي: الإنجليزية

did-credential-lifecycle

Verifiable credential lifecycle management for agent identity. Issue, verify, revoke credentials, DID document key rotation, credential schema validation, and W3C VC data model compliance. Sources: microsoft/did-sdk-js, W3C VC spec.

لغة النص الأصلي: الإنجليزية

did-resolver-patterns

W3C Decentralized Identifier (DID) resolution and cross-agent identity verification. DID document resolution, method routing, key extraction from DID documents, and mutual authentication between Swarm Bus agents. Sources: decentralized-identity/did-resolver.

لغة النص الأصلي: الإنجليزية

distributed-tracing

Instrument and debug distributed systems with tracing — OpenTelemetry setup, span creation, context propagation (W3C traceparent), sampling strategy, exporter configuration (Jaeger/Tempo/Honeycomb/Datadog), and correlating traces with logs. Use when asked to…

لغة النص الأصلي: الإنجليزية

docker-patterns

Build production-grade Docker images — multi-stage builds, layer caching, non-root user, minimal base images, .dockerignore, health checks, docker-compose for local dev, BuildKit secrets, and image size audit. Use when asked about "Docker", "Dockerfile",…

لغة النص الأصلي: الإنجليزية

durable-task-queues

Durable background job and task queue patterns for AI agent systems. BullMQ Redis-backed queues with concurrency + rate limiting, Inngest event-driven durable functions, Trigger.dev background tasks, dead-letter queue patterns, and job failure diagnostics.…

لغة النص الأصلي: الإنجليزية

dynamic-workflow-mode

Task-local harness system — declare owns/consumes/produces/pass-fail before dispatch, extract to shared skill when repeated. Use instead of inline ad-hoc steps for any task spanning >1 session or >3 files. Triggers on: 'dynamic workflow', 'task harness',…

لغة النص الأصلي: لغات متعددة

ebpf-syscall-monitoring

Monitor and intercept Linux kernel syscalls from agent processes using eBPF (Extended Berkeley Packet Filter). Real-time syscall filtering, PID-based policy enforcement, cgroups v2 throttling, and seccomp profile generation.

لغة النص الأصلي: الإنجليزية

ecc-agentshield

Security scanner cho Claude Code config — quét CLAUDE.md, settings.json, hooks, MCP servers, agents tìm lỗ hổng bảo mật. 1282 tests, 102 static analysis rules.

لغة النص الأصلي: الفيتنامية

ecc-guide

Navigation guide cho ECC — onboarding, tìm skills/agents/commands phù hợp, setup, troubleshooting. Dùng khi cần hỏi 'làm X với ECC như thế nào?'

لغة النص الأصلي: الفيتنامية

ecc-key-management

Elliptic curve cryptography for agent key pairs and command signing. EC key generation (secp256k1/p256), ECDSA sign/verify, ECDH shared secret, DER/PEM encoding, and hardware-safe key storage patterns. Sources: indutny/elliptic.

لغة النص الأصلي: الإنجليزية

ecc-tools-cost-audit

Audit cost overrun cho ECC Tools GitHub App — investigate runaway PR creation, quota bypass, premium-model leakage, duplicate jobs, billing spikes.

لغة النص الأصلي: الفيتنامية

envoy-proxy-patterns

Envoy L7 proxy filter chains, xDS dynamic configuration, rate limiting, request mirroring, and Lua/WASM filter patterns for sidecar-level traffic control in agent networks. Sources: envoyproxy/envoy (Apache-2.0).

لغة النص الأصلي: الإنجليزية

eradicating-malware-from-infected-systems

Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.

لغة النص الأصلي: الإنجليزية

error-handling

Design structured application error handling — error type hierarchy, error codes, propagation strategy (throw vs return), user-facing vs internal messages, HTTP error response format, async error safety, and React error boundaries. Use when asked to "improve…

لغة النص الأصلي: الإنجليزية

eslint-rule-engine

ESLint custom rule architecture. AST visitor rules with auto-fix, rule metadata, nested rule hierarchies, RuleTester harness, and monorepo-wide static analysis configuration. Sources: eslint/eslint (MIT).

لغة النص الأصلي: الإنجليزية

etcd-distributed-config

etcd distributed key-value store for centralized agent config and distributed locking. Watch API for live config reload, lease-based TTL keys, transactions, and distributed mutex patterns. Sources: etcd-io/etcd (Apache-2.0).

لغة النص الأصلي: الإنجليزية

eval-driven-agent-dev

Eval-driven agent development — 3-layer evaluation (static benchmarks, custom offline, online production). Evaluator-optimizer tight loop. Evals in CI, score-gated PRs. SWE-bench/GAIA/BFCL V4 for cross-model comparison. Trajectory-based and LLM-as-judge…

لغة النص الأصلي: الإنجليزية

evaluating-threat-intelligence-platforms

Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP…

لغة النص الأصلي: الإنجليزية

event-driven-architecture

Design event-driven systems — event sourcing, CQRS, saga pattern for distributed transactions, message queue patterns, and event schema design. Use when asked about "event sourcing", "CQRS", "saga", "distributed transaction", "message queue", "Kafka",…

لغة النص الأصلي: الإنجليزية

everyinc-compound-engineering

Compound Engineering plugin cho Claude Code + Cursor — 37 skills, 51 agents, triết lý 80% planning/review + 20% execution. Mỗi unit làm việc sau dễ hơn trước.

لغة النص الأصلي: الفيتنامية

executing-active-directory-attack-simulation

Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for…

لغة النص الأصلي: الإنجليزية

executing-phishing-simulation-campaign

Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing…

لغة النص الأصلي: الإنجليزية

executing-red-team-engagement-planning

Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins.

لغة النص الأصلي: الإنجليزية

executing-red-team-exercise

Executes comprehensive red team exercises that simulate real-world adversary operations against an organization's people, processes, and technology. The red team operates with stealth as a primary objective, employing the full attack lifecycle from initial…

لغة النص الأصلي: الإنجليزية

exploiting-active-directory-certificate-services-esc1

Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.

لغة النص الأصلي: الإنجليزية

exploiting-active-directory-with-bloodhound

BloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments. Red teams use BloodHound to identify attac

لغة النص الأصلي: الإنجليزية