identity-compromise
From the author
Investigate suspected account compromise — brute force followed by success, impossible travel, privilege escalation and lateral movement across Linux and Windows; use when a user account appears in suspicious authentication activity.
Install
npx skills add gensecaihq/Wazuh-Autopilot --skill identity-compromise -a claude-code
Installs to .claude/skills/identity-compromise/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Uses sudoLow
Why 78
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- detecting-service-account-abuse26zl/cybersec-toolkitDetect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.Other★ 82
- detecting-email-account-compromise26zl/cybersec-toolkitDetect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.Productivity★ 82
- investigatetobihagemann/turboSystematically investigate bugs, test failures, build errors, performance issues, or unexpected behavior by cycling through characterize-isolate-hypothesize-test steps. Use when the user asks to "investigate this bug", "debug this", "figure out why this fails", "find the root cause", "why is this broken", "troubleshoot this", "diagnose the issue", "what's causing this error", "look into this failure", "why is this test failing", or "track down this bug".Finance★ 416
- broken-authenticationzebbern/claude-code-guideThis skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.Security★ 4.7K
- testing-for-broken-access-control26zl/cybersec-toolkitSystematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.Testing★ 82
- log-analysisjmagly/aiwgCorrelate auth.log, syslog, journald, application, and web logs to detect brute force, privilege escalation, and lateral movement.Other★ 225
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in