Cyber security operations

Cyber Security Operations

Authorized Use

This skill covers dual-use offensive and defensive techniques. Offensive playbooks (red-team, penetration testing, credential access, C2, social-engineering simulation) are for engagements you own or have explicit written authorization to test. Before any offensive technique, confirm scope, a signed rules-of-engagement, and authority (tasks/engagement-intake.md), and document every action for the engagement record. Defensive, detection, forensic, and compliance playbooks assume you operate on systems you are responsible for.

Core Rule

Route, do not improvise. This skill does not contain techniques inline - it dispatches to one self-contained playbook under playbooks/. Every recommendation names the objective, the strategy basis, the technique's ATT&CK/D3FEND/NIST mapping, and the verification or detection path.

First Pass

1. Restate the objective: what outcome, on which systems, by when.
2. Classify the task into one category:
   • detection-hunting - detection engineering, threat hunting, SIEM analytics.
   • soc-incident-response - SOC operations, triage, incident response, containment.
   • dfir-forensics - disk/memory/network forensics, evidence acquisition, custody.
   • malware-analysis - static/dynamic analysis, reverse engineering, deobfuscation.
   • threat-intelligence - CTI, TTP mapping, actor tracking, IOC work.
   • cloud-container-security - cloud posture, Kubernetes/container, cloud IR.
   • network-wireless-security - network defense, traffic analysis, wireless.
   • application-api-security - web/app/API testing and hardening, OWASP.
   • identity-access-zerotrust - IAM, AD/Entra, zero-trust, credential protection.
   • ot-ics-security - OT/ICS/SCADA, historian, industrial protocols.
   • endpoint-mobile-security - endpoint hardening, EDR, mobile.
   • vuln-supplychain-devsecops - vulnerability management, supply chain, CI/CD security.
   • offensive-security - red-team, penetration testing, C2, social-engineering simulation.
   • crypto-ai-emerging - cryptography, AI security, blockchain, deception.
   • compliance-governance - CMMC/NIST/ISO, risk, privacy, audit.
3. For any offensive-security task, confirm first (tasks/engagement-intake.md). No scope, no action.
4. Route to one playbook: open references/INDEX.md, then references/index/<category>.md, and match a single playbook by name, tags, or ATT&CK technique ID. Do not read every playbook - locate one.
5. Read playbooks/<category>/<name>/PLAYBOOK.md and its local references/, scripts/, and assets/. Follow it exactly.
6. Execute with the loop: observe -> orient -> decide -> act -> verify. Each finding updates the plan. If the objective needs another technique, return to step 2.
7. Close with the right artifact (templates/): a forensic evidence report for DFIR, an engagement record for offensive work, a detection or remediation note otherwise.

Routing Index

references/INDEX.md lists the 15 categories and their per-category index files. Each references/index/<category>.md is a table of that category's playbooks (name, ATT&CK, tags, description). Both are generated by scripts/build_index.py - regenerate after adding or moving playbooks; never hand-edit them.

Tasks

• tasks/triage-and-route.md - the routing procedure, applied to every request.
• tasks/engagement-intake.md - authorization gate before any offensive playbook.
• tasks/evidence-handling.md - chain of custody, SHA-256 hashing, court-ready output.

Scripts and Templates

• scripts/build_index.py - regenerate the routing index from playbook frontmatter.
• scripts/credentials-pattern/ - credential/secret detection patterns (shared).
• templates/rules-of-engagement.md - authorization/RoE template.
• templates/forensic-evidence-report.md - court-ready evidence report.

Standards Alignment

Playbooks carry MITRE ATT&CK technique IDs, MITRE D3FEND countermeasures, and NIST CSF functions in their frontmatter. Use these to pair an offensive technique with its detection, and to map defensive work to a control framework.