github.com/AgentFlocks/flocks504
Flocks is an agentic SecOps platform.
npx skills add AgentFlocks/flocks -g -y
Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted...
Detect and analyze covert communication channels used by malware including DNS...
Captures and analyzes network packet data using Wireshark and tshark to identify...
Monitor and analyze ransomware group data leak sites (DLS) to track victim postings...
Identify ransomware network indicators including C2 beaconing patterns, TOR exit node...
Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify...
Leverages Splunk Enterprise Security and SPL (Search Processing Language) to...
Examine file system slack space, MFT entries, USN journal, and alternate data streams...
MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, techniques...
Map advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs)...
Analyzes structured and unstructured threat intelligence feeds to extract actionable...
Analyze the threat landscape using MISP (Malware Information Sharing Platform) by...
Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing...
Parse Apache and Nginx access logs to detect SQL injection attempts, local file...
Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of...
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect...
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct...
Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings...
Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles...
Build an automated system to track adversary infrastructure using passive DNS...
Builds a structured ransomware incident response playbook aligned with the CISA...
Apply bottom-up and top-down role mining techniques to discover optimal RBAC roles from...
Builds a structured SOC incident response playbook for ransomware attacks covering...
Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate, and...
Outlines methodologies for performing authorized penetration testing against AWS...
Perform DCSync attacks to replicate Active Directory credentials and establish domain...
Plan and execute a comprehensive red team engagement covering reconnaissance through...
Conduct internal Active Directory reconnaissance using BloodHound Community Edition to...
Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets...
Responds to phishing incidents by analyzing reported emails, extracting indicators...
Design and execute a social engineering penetration test including phishing, vishing...
Spearphishing simulation is a targeted social engineering attack vector used by red...
Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration...
Configure AWS Verified Access to provide VPN-less zero trust network access to internal...
A Certificate Authority (CA) is the trust anchor in a PKI hierarchy, responsible for...
Configuring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request identity...
Deploy Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP...
Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON...
Executes containment strategies to stop active adversary operations and prevent lateral...
Deploys canary files (honeytokens) across file systems to detect ransomware encryption...
