15-blue-team-defense

Name: 15-blue-team-defense
Author: Masriyan

190stars37forks

How to install 15-blue-team-defense?

masriyan/claude-code-cybersecurity-skill/15-blue-team-defense

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 15-blue-team-defense

Installs into the current project.

Summary

System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement

Files · 1

View on GitHub

SKILL.md

1	# Blue Team Defense & Hardening
2
3	## Purpose
4
5	Enable Claude to assist defenders with comprehensive security hardening, detection rule engineering, security baseline establishment, patch management, and security architecture review. Claude directly analyzes provided configurations, scripts, and system state — then produces specific hardening commands, detection rules, and improvement plans.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Hardening Linux (Ubuntu, RHEL, CentOS, Debian) servers
13	- Hardening Windows Server or Windows workstations (CIS Benchmarks)
14	- Creating detection rules (Sigma, Splunk, KQL, YARA, Snort/Suricata)
15	- Security baseline definition and monitoring
16	- Patch management strategy and prioritization
17	- Security architecture review (defense-in-depth, zero trust)
18	- Implementing Sysmon, auditd, or Windows audit policy
19	- Hardening SSH, nginx, Apache, or database configurations
20	- Network security controls and microsegmentation
21	- Endpoint protection (EDR, HIPS) configuration guidance
22	- Security posture improvement after a red team or pentest
23
24	---
25
26	## Prerequisites
27
28	```bash
29	pip install pyyaml jinja2 requests
30	```
31
32	Tools used in this skill:
33	- `Sysmon` — Windows endpoint telemetry (SwiftOnSecurity config recommended)
34	- `auditd` — Linux audit daemon
35	- `Lynis` — Linux security auditing tool
36	- `OpenSCAP / oscap` — CIS/STIG compliance scanning
37	- `fail2ban` — SSH and service brute-force protection
38	- `CIS-CAT` — CIS Benchmark compliance tool
39
40	---
41
42	## Core Capabilities
43
44	### 1. Linux System Hardening
45
46	When the user asks to harden a Linux server:
47
48	Claude produces specific commands ready to run.
49
50	#### SSH Hardening
51	```bash
52	# /etc/ssh/sshd_config — Secure SSH configuration
53	cat >> /etc/ssh/sshd_config << 'EOF'
54	# Security hardening
55	Protocol 2
56	PermitRootLogin no
57	PasswordAuthentication no
58	PermitEmptyPasswords no
59	MaxAuthTries 3
60	LoginGraceTime 30
61	ClientAliveInterval 300
62	ClientAliveCountMax 2
63	AllowUsers [specific_users] # Explicit user allowlist
64	PubkeyAuthentication yes
65	AuthorizedKeysFile .ssh/authorized_keys
66	X11Forwarding no
67	AllowAgentForwarding no
68	AllowTcpForwarding no
69	PrintMotd no
70	Banner /etc/ssh/banner
71	Subsystem sftp /usr/lib/openssh/sftp-server -l INFO
72	EOF
73
74	# Restart SSH (check config first)
75	sshd -t && systemctl restart sshd
76	```
77
78	#### Kernel Hardening (sysctl)
79	```bash
80	# /etc/sysctl.d/99-security.conf
81	cat > /etc/sysctl.d/99-security.conf << 'EOF'
82	# Disable IP forwarding (unless this is a router)
83	net.ipv4.ip_forward = 0
84	net.ipv6.conf.all.forwarding = 0
85
86	# Disable source routing (prevents IP spoofing attacks)
87	net.ipv4.conf.all.accept_source_route = 0
88	net.ipv6.conf.all.accept_source_route = 0
89
90	# Enable SYN cookies (SYN flood protection)
91	net.ipv4.tcp_syncookies = 1
92
93	# Ignore ICMP broadcasts
94	net.ipv4.icmp_echo_ignore_broadcasts = 1
95
96	# Disable ICMP redirects (prevents routing manipulation)
97	net.ipv4.conf.all.accept_redirects = 0
98	net.ipv6.conf.all.accept_redirects = 0
99	net.ipv4.conf.all.send_redirects = 0
100
101	# Log suspicious packets
102	net.ipv4.conf.all.log_martians = 1
103
104	# Disable IPv6 if not needed
105	net.ipv6.conf.all.disable_ipv6 = 1
106	net.ipv6.conf.default.disable_ipv6 = 1
107
108	# Address space layout randomization
109	kernel.randomize_va_space = 2
110
111	# Restrict core dumps (prevents memory leaks)
112	fs.suid_dumpable = 0
113
114	# Restrict kernel log access to root
115	kernel.dmesg_restrict = 1
116
117	# Disable magic SysRq key
118	kernel.sysrq = 0
119
120	# Hide kernel pointers
121	kernel.kptr_restrict = 2
122
123	# Restrict ptrace to own processes
124	kernel.yama.ptrace_scope = 1
125	EOF
126
127	sysctl --system
128	```
129
130	#### Firewall Configuration (iptables/nftables)
131	```bash
132	# UFW (Uncomplicated Firewall) — Ubuntu/Debian
133	ufw default deny incoming
134	ufw default allow outgoing
135	ufw allow ssh # or: ufw allow from [admin_ip] to any port 22
136	ufw allow from [monitoring_ip] to any port 9100 # Prometheus node exporter (internal only)
137	ufw enable
138	ufw status verbose
139
140	# iptables — manual approach for fine-grained control
141	iptables -F # Flush existing rules
142	iptables -P INPUT DROP # Default deny
143	iptables -P FORWARD DROP # Default deny forwarding
144	iptables -P OUTPUT ACCEPT # Allow all outbound (or restrict too)
145
146	# Allow established/related connections
147	iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
148
149	# Allow loopback
150	iptables -A INPUT -i lo -j ACCEPT
151
152	# Allow SSH from specific subnet only
153	iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -m conntrack --ctstate NEW -j ACCEPT
154
155	# Rate-limit SSH to prevent brute force
156	iptables -A INPUT -p tcp --dport 22 -m recent --set --name SSH
157	iptables -A INPUT -p tcp --dport 22 -m recent --update

People who liked this also viewed

6 picks

Type

15-blue-team-defense

190stars37forks

View on GitHub

How to install 15-blue-team-defense?

masriyan/claude-code-cybersecurity-skill/15-blue-team-defense

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 15-blue-team-defense

Installs into the current project.

Summary

System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement

Files · 1

View on GitHub

SKILL.md

1	# Blue Team Defense & Hardening
2
3	## Purpose
4
5	Enable Claude to assist defenders with comprehensive security hardening, detection rule engineering, security baseline establishment, patch management, and security architecture review. Claude directly analyzes provided configurations, scripts, and system state — then produces specific hardening commands, detection rules, and improvement plans.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Hardening Linux (Ubuntu, RHEL, CentOS, Debian) servers
13	- Hardening Windows Server or Windows workstations (CIS Benchmarks)
14	- Creating detection rules (Sigma, Splunk, KQL, YARA, Snort/Suricata)
15	- Security baseline definition and monitoring
16	- Patch management strategy and prioritization
17	- Security architecture review (defense-in-depth, zero trust)
18	- Implementing Sysmon, auditd, or Windows audit policy
19	- Hardening SSH, nginx, Apache, or database configurations
20	- Network security controls and microsegmentation
21	- Endpoint protection (EDR, HIPS) configuration guidance
22	- Security posture improvement after a red team or pentest
23
24	---
25
26	## Prerequisites
27
28	```bash
29	pip install pyyaml jinja2 requests
30	```
31
32	Tools used in this skill:
33	- `Sysmon` — Windows endpoint telemetry (SwiftOnSecurity config recommended)
34	- `auditd` — Linux audit daemon
35	- `Lynis` — Linux security auditing tool
36	- `OpenSCAP / oscap` — CIS/STIG compliance scanning
37	- `fail2ban` — SSH and service brute-force protection
38	- `CIS-CAT` — CIS Benchmark compliance tool
39
40	---
41
42	## Core Capabilities
43
44	### 1. Linux System Hardening
45
46	When the user asks to harden a Linux server:
47
48	Claude produces specific commands ready to run.
49
50	#### SSH Hardening
51	```bash
52	# /etc/ssh/sshd_config — Secure SSH configuration
53	cat >> /etc/ssh/sshd_config << 'EOF'
54	# Security hardening
55	Protocol 2
56	PermitRootLogin no
57	PasswordAuthentication no
58	PermitEmptyPasswords no
59	MaxAuthTries 3
60	LoginGraceTime 30
61	ClientAliveInterval 300
62	ClientAliveCountMax 2
63	AllowUsers [specific_users] # Explicit user allowlist
64	PubkeyAuthentication yes
65	AuthorizedKeysFile .ssh/authorized_keys
66	X11Forwarding no
67	AllowAgentForwarding no
68	AllowTcpForwarding no
69	PrintMotd no
70	Banner /etc/ssh/banner
71	Subsystem sftp /usr/lib/openssh/sftp-server -l INFO
72	EOF
73
74	# Restart SSH (check config first)
75	sshd -t && systemctl restart sshd
76	```
77
78	#### Kernel Hardening (sysctl)
79	```bash
80	# /etc/sysctl.d/99-security.conf
81	cat > /etc/sysctl.d/99-security.conf << 'EOF'
82	# Disable IP forwarding (unless this is a router)
83	net.ipv4.ip_forward = 0
84	net.ipv6.conf.all.forwarding = 0
85
86	# Disable source routing (prevents IP spoofing attacks)
87	net.ipv4.conf.all.accept_source_route = 0
88	net.ipv6.conf.all.accept_source_route = 0
89
90	# Enable SYN cookies (SYN flood protection)
91	net.ipv4.tcp_syncookies = 1
92
93	# Ignore ICMP broadcasts
94	net.ipv4.icmp_echo_ignore_broadcasts = 1
95
96	# Disable ICMP redirects (prevents routing manipulation)
97	net.ipv4.conf.all.accept_redirects = 0
98	net.ipv6.conf.all.accept_redirects = 0
99	net.ipv4.conf.all.send_redirects = 0
100
101	# Log suspicious packets
102	net.ipv4.conf.all.log_martians = 1
103
104	# Disable IPv6 if not needed
105	net.ipv6.conf.all.disable_ipv6 = 1
106	net.ipv6.conf.default.disable_ipv6 = 1
107
108	# Address space layout randomization
109	kernel.randomize_va_space = 2
110
111	# Restrict core dumps (prevents memory leaks)
112	fs.suid_dumpable = 0
113
114	# Restrict kernel log access to root
115	kernel.dmesg_restrict = 1
116
117	# Disable magic SysRq key
118	kernel.sysrq = 0
119
120	# Hide kernel pointers
121	kernel.kptr_restrict = 2
122
123	# Restrict ptrace to own processes
124	kernel.yama.ptrace_scope = 1
125	EOF
126
127	sysctl --system
128	```
129
130	#### Firewall Configuration (iptables/nftables)
131	```bash
132	# UFW (Uncomplicated Firewall) — Ubuntu/Debian
133	ufw default deny incoming
134	ufw default allow outgoing
135	ufw allow ssh # or: ufw allow from [admin_ip] to any port 22
136	ufw allow from [monitoring_ip] to any port 9100 # Prometheus node exporter (internal only)
137	ufw enable
138	ufw status verbose
139
140	# iptables — manual approach for fine-grained control
141	iptables -F # Flush existing rules
142	iptables -P INPUT DROP # Default deny
143	iptables -P FORWARD DROP # Default deny forwarding
144	iptables -P OUTPUT ACCEPT # Allow all outbound (or restrict too)
145
146	# Allow established/related connections
147	iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
148
149	# Allow loopback
150	iptables -A INPUT -i lo -j ACCEPT
151
152	# Allow SSH from specific subnet only
153	iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -m conntrack --ctstate NEW -j ACCEPT
154
155	# Rate-limit SSH to prevent brute force
156	iptables -A INPUT -p tcp --dport 22 -m recent --set --name SSH
157	iptables -A INPUT -p tcp --dport 22 -m recent --update

People who liked this also viewed

6 picks

Type