ir-playbook-bruteforce
De la autor
Incident-response playbook (PB-001) for brute-force, password-spraying and credential-stuffing attacks against SSH, PAM, Windows logon and web logins; use when Wazuh raises authentication-failure bursts (rule group authentication_failures, e.g. rules 5712, 5763, 60204) or a failure burst followed by a success (rule 40112).
Instalare
npx skills add gensecaihq/Wazuh-Autopilot --skill ir-playbook-bruteforce -a claude-code
Se instalează în .claude/skills/ir-playbook-bruteforce/ · Fiecare comandă descarcă skill-ul direct de pe GitHub cu utilitarul open source skills.
Identic octet cu octet cu commit-ul scanat, cu licența depozitului și un fișier SOURCE.txt.
Vrei ca agentul să-ți propună skill-uri în timp ce scrii? Vezi cum folosești skill-urile din IDE.
Verificări de siguranță pe SKILL.md
- Folosește sudoScăzut
De ce 78
aiqbench calculează scorul de încredere din semnale publice. Nu este un audit de securitate, așa că citește un skill înainte să-l instalezi.
Skill-uri similare
Cele mai apropiate de acesta prin ce fac și când sunt folosite.
- ir-playbook-suspicious-powershellgensecaihq/Wazuh-AutopilotIncident-response playbook for malicious PowerShell — encoded commands, download cradles, Office-spawned scripts, in-memory execution, credential dumping, Defender tampering and registry persistence; use when Wazuh raises PowerShell or Sysmon detections (e.g. rules 92057, 91809, 92047, 92008, 91844, 92024) on Windows hosts.Productivitate★ 60
- ir-playbook-ransomwaregensecaihq/Wazuh-AutopilotIncident-response playbook for ransomware — mass file modification/encryption, ransom notes, shadow-copy and backup deletion, service stopping and log clearing; use when Wazuh shows FIM bursts (rules 550, 553, 554), antimalware detections (rules 62113, 87105), audit-log clearing (rule 60117) or recovery-inhibition commands. Containment within minutes.Productivitate★ 60
- ir-playbook-privilege-escalationgensecaihq/Wazuh-AutopilotIncident-response playbook for privilege escalation on Linux and Windows — sudo/su abuse, SUID and capability misuse, kernel modules and exploits, sudoers/cron/systemd tampering, UAC bypass, admin-group changes and process injection; use when Wazuh raises escalation indicators (e.g. rules 5404, 5405, 5302, 80721, 92046, 92055, 60154) or a user gains unexpected root/SYSTEM.Altele★ 60
- ir-playbook-vulnerability-spikegensecaihq/Wazuh-AutopilotIncident-response playbook (PB-005) for vulnerability spikes — sudden jumps in new CVE findings, the same CVE across many hosts, KEV-listed CVEs on exposed assets, SCA regressions, or exploitation attempts against vulnerable assets; use when Wazuh vulnerability-detector alerts surge (rules 23505, 23506) or web/IDS exploitation alerts (rules 31106, 31152, 86601) hit a known-vulnerable host.Securitate★ 60
- ir-playbook-lateral-movementgensecaihq/Wazuh-AutopilotIncident-response playbook for lateral movement — SMB/admin shares, WinRM/PowerShell remoting, RDP, SSH, PsExec/WMI remote execution, pass-the-hash and remote services/tasks; use when Wazuh shows internal-to-internal authentication or remote-execution chains (e.g. rules 92652, 92653, 92650, 92068, 91823, or SSH success rule 5715 from an internal source).Productivitate★ 60
- ir-playbook-data-exfiltrationgensecaihq/Wazuh-AutopilotIncident-response playbook for suspected data exfiltration — archive staging, uploads to cloud storage, exfil over C2 or DNS, removable media and exposed cloud buckets; use when Wazuh flags staging or transfer indicators (e.g. rules 92212, 91846, 92038, 81101, 99548) or when volume/destination anomalies are reported. Most volume and DNS detections need custom rules — see section 1.Altele★ 60
Note și recenzii
—
nicio recenzie
Ai încercat acest skill? Notează-l ca să-i ajuți pe alții. Autentifică-te
Discuție
Intră în discuție. Autentifică-te