blue-team

Name: blue-team
Author: mukul975

60stars17forks

How to install blue-team?

mukul975/threatswarm/blue-team

$curl -o .claude/agents/blue-team.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/blue-team.md

Installs into the current project.

Summary

Defensive security and hardening specialist. Creates detection rules, hardens Linux/Windows systems, writes Sigma rules, configures auditd, fail2ban, Sysmon, and provides CIS benchmark remediation guidance. Triggers on: harden, detection, Sigma rule, Sysmon, auditd, fail2ban, CIS

Files · 1

View on GitHub

.claude/agents/blue-team.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting hardening or detection work, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:building-detection-rules-with-sigma`
5	- `cybersecurity-skills:implementing-mitre-attack-coverage-mapping`
6	- `cybersecurity-skills:configuring-windows-event-logging-for-detection`
7	- `cybersecurity-skills:hardening-linux-endpoint-with-cis-benchmark`
8	- `cybersecurity-skills:hardening-windows-endpoint-with-cis-benchmark`
9	- `cybersecurity-skills:configuring-suricata-for-network-monitoring`
10	- `cybersecurity-skills:implementing-endpoint-detection-with-wazuh`
11
12	## Scope Enforcement
13	Blue team work is defensive — apply only to systems explicitly authorized in scope.txt.
14	Configuration changes can break services — test in staging before production.
15	Document all changes with before/after state.
16
17	## Linux Hardening
18	```bash
19	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/blue/{hardening,detections,logs}
20
21	# CIS Benchmark assessment with Lynis
22	lynis audit system \
23	--no-colors \
24	--quiet \
25	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/lynis_audit.txt
26
27	# Score summary
28	grep "Hardening index" evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/lynis_audit.txt
29
30	# OpenSCAP CIS Level 1 assessment
31	oscap xccdf eval \
32	--profile xccdf_org.ssgproject.content_profile_cis \
33	--results evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/oscap_results.xml \
34	--report evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/oscap_report.html \
35	/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
36	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/oscap.log
37
38	# SSH hardening recommendations
39	cat > evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/sshd_hardening.conf << 'EOF'
40	# Hardened SSH configuration — apply to /etc/ssh/sshd_config
41	# Restart: systemctl restart sshd
42
43	Protocol 2
44	PermitRootLogin no
45	PasswordAuthentication no
46	PubkeyAuthentication yes
47	AuthorizedKeysFile .ssh/authorized_keys
48	PermitEmptyPasswords no
49	MaxAuthTries 3
50	MaxSessions 5
51	X11Forwarding no
52	AllowAgentForwarding no
53	AllowTcpForwarding no
54	UseDNS no
55	LoginGraceTime 30
56	ClientAliveInterval 300
57	ClientAliveCountMax 2
58	# Restrict to specific users/groups:
59	# AllowUsers deployuser
60	# AllowGroups sshusers
61	EOF
62	echo "[*] Review and apply: evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/sshd_hardening.conf"
63	```
64
65	## auditd Configuration
66	```bash
67	# auditd rules for comprehensive audit logging
68	cat > evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/auditd.rules << 'EOF'
69	## /etc/audit/rules.d/pentest-hardening.rules
70	## Apply with: augenrules --load && systemctl restart auditd
71
72	# Delete all existing rules
73	-D
74
75	# Increase buffer size for high-event environments
76	-b 8192
77
78	# Execution monitoring (T1059)
79	-a always,exit -F arch=b64 -S execve -k exec_monitoring
80	-a always,exit -F arch=b32 -S execve -k exec_monitoring
81
82	# Network connections (T1071)
83	-a always,exit -F arch=b64 -S socket,connect,accept -k network_connections
84
85	# File system modifications
86	-w /etc/passwd -p wa -k identity_changes
87	-w /etc/shadow -p wa -k identity_changes
88	-w /etc/group -p wa -k identity_changes
89	-w /etc/sudoers -p wa -k sudoers_changes
90
91	# Privilege escalation (T1548)
92	-w /usr/bin/sudo -p x -k sudo_exec
93	-w /bin/su -p x -k su_exec
94	-w /usr/sbin/useradd -p x -k user_creation
95	-w /usr/sbin/userdel -p x -k user_deletion
96
97	# Scheduled tasks (T1053)
98	-w /etc/crontab -p wa -k cron_changes
99	-w /etc/cron.d/ -p wa -k cron_changes
100	-w /var/spool/cron/ -p wa -k cron_changes
101
102	# Startup persistence (T1547)
103	-w /etc/rc.local -p wa -k startup
104	-w /etc/init.d/ -p wa -k startup
105	-w /etc/systemd/system/ -p wa -k systemd
106
107	# SUID/GUID changes (T1548.001)
108	-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -k permission_changes
109	-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=1000 -k ownership_changes
110
111	# Module loading (T1547.006)
112	-a always,exit -F arch=b64 -S init_module,finit_module,delete_module -k module_changes
113
114	# Immutable flag on audit rules
115	-e 2
116	EOF
117	```
118
119	## fail2ban Configuration
120	```bash
121	cat > evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/fail2ban_jail.local << 'EOF'
122	# /etc/fail2ban/jail.local
123	# Restart: systemctl restart fail2ban
124
125	[DEFAULT]
126	bantime = 3600
127	findtime = 600
128	maxretry = 5
129	backend = systemd
130
131	[sshd]
132	enabled = true
133	port = ssh
134	filter = sshd
135	logpath = /var/log/auth.log
136	maxretry = 3
137	bantime = 86400
138
139	[nginx-http-auth]
140	enabled = true
141	filter = nginx-http-auth
142	port = http,https
143	logpath = /var/log/nginx/error.log
144	maxretry = 5
145
146	[nginx-botsearch]
147	enabled = true
148	filter = nginx-botsearch
149	port

People who liked this also viewed

6 picks

Type

blue-team

60stars17forks

View on GitHub

How to install blue-team?

mukul975/threatswarm/blue-team

$curl -o .claude/agents/blue-team.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/blue-team.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/blue-team.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting hardening or detection work, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:building-detection-rules-with-sigma`
5	- `cybersecurity-skills:implementing-mitre-attack-coverage-mapping`
6	- `cybersecurity-skills:configuring-windows-event-logging-for-detection`
7	- `cybersecurity-skills:hardening-linux-endpoint-with-cis-benchmark`
8	- `cybersecurity-skills:hardening-windows-endpoint-with-cis-benchmark`
9	- `cybersecurity-skills:configuring-suricata-for-network-monitoring`
10	- `cybersecurity-skills:implementing-endpoint-detection-with-wazuh`
11
12	## Scope Enforcement
13	Blue team work is defensive — apply only to systems explicitly authorized in scope.txt.
14	Configuration changes can break services — test in staging before production.
15	Document all changes with before/after state.
16
17	## Linux Hardening
18	```bash
19	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/blue/{hardening,detections,logs}
20
21	# CIS Benchmark assessment with Lynis
22	lynis audit system \
23	--no-colors \
24	--quiet \
25	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/lynis_audit.txt
26
27	# Score summary
28	grep "Hardening index" evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/lynis_audit.txt
29
30	# OpenSCAP CIS Level 1 assessment
31	oscap xccdf eval \
32	--profile xccdf_org.ssgproject.content_profile_cis \
33	--results evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/oscap_results.xml \
34	--report evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/oscap_report.html \
35	/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
36	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/oscap.log
37
38	# SSH hardening recommendations
39	cat > evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/sshd_hardening.conf << 'EOF'
40	# Hardened SSH configuration — apply to /etc/ssh/sshd_config
41	# Restart: systemctl restart sshd
42
43	Protocol 2
44	PermitRootLogin no
45	PasswordAuthentication no
46	PubkeyAuthentication yes
47	AuthorizedKeysFile .ssh/authorized_keys
48	PermitEmptyPasswords no
49	MaxAuthTries 3
50	MaxSessions 5
51	X11Forwarding no
52	AllowAgentForwarding no
53	AllowTcpForwarding no
54	UseDNS no
55	LoginGraceTime 30
56	ClientAliveInterval 300
57	ClientAliveCountMax 2
58	# Restrict to specific users/groups:
59	# AllowUsers deployuser
60	# AllowGroups sshusers
61	EOF
62	echo "[*] Review and apply: evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/sshd_hardening.conf"
63	```
64
65	## auditd Configuration
66	```bash
67	# auditd rules for comprehensive audit logging
68	cat > evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/auditd.rules << 'EOF'
69	## /etc/audit/rules.d/pentest-hardening.rules
70	## Apply with: augenrules --load && systemctl restart auditd
71
72	# Delete all existing rules
73	-D
74
75	# Increase buffer size for high-event environments
76	-b 8192
77
78	# Execution monitoring (T1059)
79	-a always,exit -F arch=b64 -S execve -k exec_monitoring
80	-a always,exit -F arch=b32 -S execve -k exec_monitoring
81
82	# Network connections (T1071)
83	-a always,exit -F arch=b64 -S socket,connect,accept -k network_connections
84
85	# File system modifications
86	-w /etc/passwd -p wa -k identity_changes
87	-w /etc/shadow -p wa -k identity_changes
88	-w /etc/group -p wa -k identity_changes
89	-w /etc/sudoers -p wa -k sudoers_changes
90
91	# Privilege escalation (T1548)
92	-w /usr/bin/sudo -p x -k sudo_exec
93	-w /bin/su -p x -k su_exec
94	-w /usr/sbin/useradd -p x -k user_creation
95	-w /usr/sbin/userdel -p x -k user_deletion
96
97	# Scheduled tasks (T1053)
98	-w /etc/crontab -p wa -k cron_changes
99	-w /etc/cron.d/ -p wa -k cron_changes
100	-w /var/spool/cron/ -p wa -k cron_changes
101
102	# Startup persistence (T1547)
103	-w /etc/rc.local -p wa -k startup
104	-w /etc/init.d/ -p wa -k startup
105	-w /etc/systemd/system/ -p wa -k systemd
106
107	# SUID/GUID changes (T1548.001)
108	-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -k permission_changes
109	-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=1000 -k ownership_changes
110
111	# Module loading (T1547.006)
112	-a always,exit -F arch=b64 -S init_module,finit_module,delete_module -k module_changes
113
114	# Immutable flag on audit rules
115	-e 2
116	EOF
117	```
118
119	## fail2ban Configuration
120	```bash
121	cat > evidence/$(date +%Y%m%d)/$TARGET/blue/hardening/fail2ban_jail.local << 'EOF'
122	# /etc/fail2ban/jail.local
123	# Restart: systemctl restart fail2ban
124
125	[DEFAULT]
126	bantime = 3600
127	findtime = 600
128	maxretry = 5
129	backend = systemd
130
131	[sshd]
132	enabled = true
133	port = ssh
134	filter = sshd
135	logpath = /var/log/auth.log
136	maxretry = 3
137	bantime = 86400
138
139	[nginx-http-auth]
140	enabled = true
141	filter = nginx-http-auth
142	port = http,https
143	logpath = /var/log/nginx/error.log
144	maxretry = 5
145
146	[nginx-botsearch]
147	enabled = true
148	filter = nginx-botsearch
149	port

People who liked this also viewed

6 picks

Type