detecting-port-scanning-with-fail2ban

Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatically banning offending IP addresses and alerting security teams to suspicious network probing.

Jump to install

Repository: mukul975/Anthropic-Cybersecurity-Skills
Last source activity: June 1, 2026 at 10:13
Detected SKILL.md language: English
Stars: 27,732
Forks: 3,366

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill detecting-port-scanning-with-fail2ban

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

4 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

2026-08-02

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

2026-08-02

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

2026-08-02

View all from this repository

Detecting Port Scanning with Fail2ban

When to Use

Automatically blocking IP addresses that perform port scans against internet-facing servers

Defending SSH, HTTP, FTP, and other services against brute force attacks with automated IP banning

Creating custom detection filters for organization-specific attack patterns in log files

Reducing noise from automated scanning bots before traffic reaches IDS/IPS for deeper analysis

Implementing defense-in-depth by adding host-based automated response to network monitoring

Do not use as the sole network security control, for protecting against distributed attacks from many source IPs, or as a replacement for proper firewall rules and network segmentation.

Prerequisites

Fail2ban 0.11+ installed (fail2ban-client --version)

Root/sudo access for iptables/nftables manipulation

Services logging connection attempts to parseable log files (syslog, auth.log, access.log)

iptables or nftables installed and operational as the host firewall

Optional: SMTP server for email notifications on ban events

Workflow

Step 1: Install and Configure Fail2ban

# Install Fail2ban sudo apt install -y fail2ban # Create local configuration (never edit jail.conf directly) sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local # Configure global defaults sudo tee /etc/fail2ban/jail.local << 'EOF' [DEFAULT] # Ban duration (1 hour default, escalates for repeat offenders) bantime = 3600 # Detection window findtime = 600 # Max failures before ban maxretry = 5 # Ban action using iptables banaction = iptables-multiport banaction_allports = iptables-allports # Email notifications destemail = security@example.com sender = fail2ban@example.com mta = sendmail action = %(action_mwl)s # Ignore internal networks ignoreip = 127.0.0.1/8 ::1 10.10.0.0/16 # Use systemd journal backend where available backend = systemd [sshd] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 3 bantime = 7200 findtime = 300 [sshd-ddos] enabled = port = ssh filter = sshd-ddos logpath = /var/log/auth.log maxretry = 6 bantime = 3600 EOF

Detecting Port Scanning with Fail2ban

When to Use

Automatically blocking IP addresses that perform port scans against internet-facing servers

Defending SSH, HTTP, FTP, and other services against brute force attacks with automated IP banning

Creating custom detection filters for organization-specific attack patterns in log files

Reducing noise from automated scanning bots before traffic reaches IDS/IPS for deeper analysis

Implementing defense-in-depth by adding host-based automated response to network monitoring

Do not use as the sole network security control, for protecting against distributed attacks from many source IPs, or as a replacement for proper firewall rules and network segmentation.

Prerequisites

Fail2ban 0.11+ installed (fail2ban-client --version)

Root/sudo access for iptables/nftables manipulation

Services logging connection attempts to parseable log files (syslog, auth.log, access.log)

iptables or nftables installed and operational as the host firewall

Optional: SMTP server for email notifications on ban events

Workflow

Step 1: Install and Configure Fail2ban

name	detecting-port-scanning-with-fail2ban
description	Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatically banning offending IP addresses and alerting security teams to suspicious network probing.
domain	cybersecurity
subdomain	network-security
tags	["network-security","fail2ban","port-scanning","intrusion-prevention","automated-defense"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]
mitre_attack	["T1046","T1040","T1557","T1071","T1595"]

name	detecting-port-scanning-with-fail2ban
description	Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatically banning offending IP addresses and alerting security teams to suspicious network probing.
domain	cybersecurity
subdomain	network-security
tags	["network-security","fail2ban","port-scanning","intrusion-prevention","automated-defense"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]
mitre_attack	["T1046","T1040","T1557","T1071","T1595"]

Term	Definition
Jail	Fail2ban configuration unit that combines a filter (what to detect), an action (what to do), and parameters (thresholds, timing) for a specific service
Filter	Regular expression patterns that Fail2ban applies to log files to identify failed authentication attempts, scanning, or other malicious activity
Recidive Jail	Meta-jail that monitors Fail2ban's own log for repeat offenders, applying escalating ban durations to IPs banned multiple times
Find Time	Time window in seconds during which Fail2ban counts matching log entries; maxretry failures within findtime triggers a ban
Ban Action	Command or script executed when an IP is banned, typically adding firewall rules but extensible to webhooks, SIEM alerts, or blocklist updates
Ignore IP	Whitelist of IP addresses or CIDR ranges that are never banned, preventing lockout of trusted networks and monitoring systems

detecting-port-scanning-with-fail2ban

Install options

Review the source files