CybersecurityPlaybooks
Skill9 starsChanged 6 months agoMITView on GitHub
24 ATT&CK-mapped offensive security playbooks for penetration testing, red teaming, and security assessments. USE WHEN user mentions kerberoasting, bloodhound, active directory attacks, nmap scanning, SQL injection, privilege escalation, lateral movement, C2 infrastructure, metasploit, credential access, SSRF, SMB exploitation, memory forensics, or any specific offensive security technique. Provides step-by-step operator-grade playbooks with actual tool commands, detection indicators, and MITRE ATT&CK mappings. Designed for use with Talon (Kali Linux MCP) and Ehud (penetration testing agent).
We split this skill into the rules it gives an agent
1 rule. About 0 are common, 1 is distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 94
All playbooks are for authorized security testing and educational purposes only.
≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
CybersecurityPlaybooks
24 curated offensive security playbooks adapted from the Anthropic-Cybersecurity-Skills community project (Apache-2.0). Each playbook is operator-grade with actual tool commands, MITRE ATT&CK mappings, and detection indicators.
Playbook Index
Red Team (11 playbooks)
| Playbook | File | ATT&CK | Tools |
| Kerberoasting with Impacket | reference/RedTeam/Kerberoasting.md | T1558.003 | impacket, hashcat |
| BloodHound CE Reconnaissance | reference/RedTeam/BloodhoundRecon.md | T1087.002 | bloodhound-python, SharpHound |
| Full-Scope Red Team Engagement | reference/RedTeam/FullScopeEngagement.md | Multiple | Full kill-chain |
| Sliver C2 Infrastructure | reference/RedTeam/SliverC2.md | T1071.001 | Sliver Framework |
| AD Certificate Services ESC1 | reference/RedTeam/ADCertServicesESC1.md | T1649 | Certipy |
| Zerologon (CVE-2020-1472) | reference/RedTeam/Zerologon.md | T1210 | impacket |
| NoPac (CVE-2021-42278/42287) | reference/RedTeam/NoPac.md | T1068 | noPac.py |
| DCSync Persistence | reference/RedTeam/DCSync.md | T1003.006 | mimikatz, impacket |
| WMIExec Lateral Movement | reference/RedTeam/WMIExec.md | T1047 | impacket |
| LaZagne Credential Access | reference/RedTeam/LaZagne.md | T1555 | LaZagne |
| Linux Privilege Escalation | reference/RedTeam/LinuxPrivEsc.md | T1548 | linpeas, GTFOBins |
Penetration Testing (5 playbooks)
| Playbook | File | ATT&CK | Tools |
| Metasploit Framework | reference/PenetrationTesting/MetasploitFramework.md | Multiple | msfconsole |
| Privilege Escalation Assessment | reference/PenetrationTesting/PrivEscAssessment.md | T1068 | winpeas, linpeas |
| API Security (OWASP Top 10) | reference/PenetrationTesting/APISecurity.md | Multiple | Burp, Postman |
| Kubernetes Pentesting | reference/PenetrationTesting/KubernetesPentest.md | Multiple | kubectl, kube-hunter |
Network Security (4 playbooks)
| Playbook | File | ATT&CK | Tools |
| Advanced Nmap Scanning | reference/NetworkSecurity/NmapAdvanced.md | T1046 | nmap, NSE |
| DNS Enumeration & Zone Transfer | reference/NetworkSecurity/DNSEnumeration.md | T1590.002 | dig, dnsenum |
| SMB Exploitation | reference/NetworkSecurity/SMBExploitation.md | T1210 | metasploit, crackmapexec |
| WiFi Cracking with Aircrack | reference/NetworkSecurity/WifiCracking.md | T1557 | aircrack-ng |
Web Application Security (3 playbooks)
| Playbook | File | ATT&CK | Tools |
| SQL Injection with sqlmap | reference/WebAppSecurity/SQLInjection.md | T1190 | sqlmap |
| Server-Side Request Forgery | reference/WebAppSecurity/SSRF.md | T1190 | Burp Suite |
| HTTP Request Smuggling | reference/WebAppSecurity/HTTPSmuggling.md | T1190 | Burp Suite |
Forensics & Malware Analysis (2 playbooks)
| Playbook | File | ATT&CK | Tools |
| Memory Credential Extraction | reference/Forensics/MemoryCredentials.md | T1003 | Volatility3 |
| Cobalt Strike Beacon Analysis | reference/Forensics/CobaltStrikeAnalysis.md | T1071.001 | CobaltStrikeParser |
Usage with Talon (Kali MCP)
These playbooks are designed to work with the Talon MCP server (SSH to Kali VM at 10.0.0.50). When a playbook references a tool command, execute it via the Kali MCP:
User: "Run a kerberoasting attack against the lab domain"
-> Load reference/RedTeam/Kerberoasting.md
-> Execute commands via Kali MCP (SSH to 10.0.0.50)
-> Follow the playbook phases: Enumerate -> Request TGS -> Crack -> ValidateUsage with Ehud (Pentest Agent)
Ehud can reference these playbooks during penetration testing engagements:
User: "Have Ehud test the Active Directory environment"
-> Ehud loads relevant playbooks (Kerberoasting, BloodHound, DCSync, etc.)
-> Executes structured assessment following ATT&CK kill chain
-> Generates findings mapped to MITRE techniquesLegal Notice
All playbooks are for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal.
Attribution
Playbooks adapted from mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0 License). Original author: Mahipal Jangra.
In this repository140 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- alex-hormozi-pitchSkill
- AlgorithmSkill
- AnnualReportsSkill
- ArtGeneratorSkill
- artSkill
- autoplanSkill
- autoresearchSkill
- benchmarkSkill
- brainstormingSkill
- brand-guidelinesSkill
- brightdataSkill
- browseSkill
- BugHunterSkill
- CallIntelligenceSkill
- canarySkill
- canvasSkill
- carefulSkill
- ceo-advisorSkill
- cfo-advisorSkill
- cmmcSkill
- codebase-indexerSkill
- codexSkill
- CodingAgentSkill
- company-valuesSkill
- connect-chromeSkill
- CORESkill
- system-createcliSkill
- CreateskillSkill
- csoSkill
- cto-advisorSkill
- defuddleSkill
- design-consultationSkill
- design-reviewSkill
- DevTeamSkill
- DiscordAdminSkill
- document-releaseSkill
- document-writerSkill
- doraSkill
- dpdpaSkill
- EmailManagerSkill
- executing-plansSkill
- fabricSkill
- fedrampSkill
- ffuf-web-fuzzingSkill
- find-communitySkill
- first-customersSkill
- FirstPrinciplesSkill
- form-croSkill
- freezeSkill
- gdpr-complianceSkill
- git-worktreesSkill
- GovernanceSkill
- grow-sustainablySkill
- gstack-upgradeSkill
- guardSkill
- hipaa-complianceSkill
- investigateSkill
- iso27001Skill
- iso27701Skill
- The first 60 shown.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.