ir-playbook-lateral-movement
De la autor
Incident-response playbook for lateral movement — SMB/admin shares, WinRM/PowerShell remoting, RDP, SSH, PsExec/WMI remote execution, pass-the-hash and remote services/tasks; use when Wazuh shows internal-to-internal authentication or remote-execution chains (e.g. rules 92652, 92653, 92650, 92068, 91823, or SSH success rule 5715 from an internal source).
Instalare
npx skills add gensecaihq/Wazuh-Autopilot --skill ir-playbook-lateral-movement -a claude-code
Se instalează în .claude/skills/ir-playbook-lateral-movement/ · Fiecare comandă descarcă skill-ul direct de pe GitHub cu utilitarul open source skills.
Identic octet cu octet cu commit-ul scanat, cu licența depozitului și un fișier SOURCE.txt.
Vrei ca agentul să-ți propună skill-uri în timp ce scrii? Vezi cum folosești skill-urile din IDE.
Verificări de siguranță pe SKILL.md
Niciun avertisment.
De ce 80
aiqbench calculează scorul de încredere din semnale publice. Nu este un audit de securitate, așa că citește un skill înainte să-l instalezi.
Skill-uri similare
Cele mai apropiate de acesta prin ce fac și când sunt folosite.
- ir-playbook-suspicious-powershellgensecaihq/Wazuh-AutopilotIncident-response playbook for malicious PowerShell — encoded commands, download cradles, Office-spawned scripts, in-memory execution, credential dumping, Defender tampering and registry persistence; use when Wazuh raises PowerShell or Sysmon detections (e.g. rules 92057, 91809, 92047, 92008, 91844, 92024) on Windows hosts.Productivitate★ 60
- ir-playbook-bruteforcegensecaihq/Wazuh-AutopilotIncident-response playbook (PB-001) for brute-force, password-spraying and credential-stuffing attacks against SSH, PAM, Windows logon and web logins; use when Wazuh raises authentication-failure bursts (rule group authentication_failures, e.g. rules 5712, 5763, 60204) or a failure burst followed by a success (rule 40112).Altele★ 60
- ir-playbook-privilege-escalationgensecaihq/Wazuh-AutopilotIncident-response playbook for privilege escalation on Linux and Windows — sudo/su abuse, SUID and capability misuse, kernel modules and exploits, sudoers/cron/systemd tampering, UAC bypass, admin-group changes and process injection; use when Wazuh raises escalation indicators (e.g. rules 5404, 5405, 5302, 80721, 92046, 92055, 60154) or a user gains unexpected root/SYSTEM.Altele★ 60
- ir-playbook-ransomwaregensecaihq/Wazuh-AutopilotIncident-response playbook for ransomware — mass file modification/encryption, ransom notes, shadow-copy and backup deletion, service stopping and log clearing; use when Wazuh shows FIM bursts (rules 550, 553, 554), antimalware detections (rules 62113, 87105), audit-log clearing (rule 60117) or recovery-inhibition commands. Containment within minutes.Productivitate★ 60
- ir-playbook-data-exfiltrationgensecaihq/Wazuh-AutopilotIncident-response playbook for suspected data exfiltration — archive staging, uploads to cloud storage, exfil over C2 or DNS, removable media and exposed cloud buckets; use when Wazuh flags staging or transfer indicators (e.g. rules 92212, 91846, 92038, 81101, 99548) or when volume/destination anomalies are reported. Most volume and DNS detections need custom rules — see section 1.Altele★ 60
- offensive-lateral-movementSnailSploit/Claude-RedComprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay attacks (ntlmrelayx with PetitPotam, DFSCoerce, PrinterBug coercion), remote execution protocols (WMI, WinRM, DCOM, PsExec and alternatives), RDP session hijacking, and network pivoting through tunneling tools (chisel, ligolo-ng, SSH tunnels, SOCKS proxies). Provides operator-ready command sequences for mimikatz, crackmapexec/netexec, impacket suite, and evil-winrm with emphasis on OPSEC considerations, SMB signing bypass, and detection evasion. Maps to MITRE ATT&CK T1021 (Remote Services), T1550 (Use Alternate Authentication Material), and sub-techniques. Includes defender-perspective detection guidance for blue team awareness and a rapid engagement cheatsheet for common lateral movement scenarios encountered during internal penetration tests and assumed-breach exercises.Testare★ 9K
Note și recenzii
—
nicio recenzie
Ai încercat acest skill? Notează-l ca să-i ajuți pe alții. Autentifică-te
Discuție
Intră în discuție. Autentifică-te