[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73EVTSX613DM7RYN02ZQ0VY":3,"skill-same:01M73EVTSX613DM7RYN02ZQ0VY":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":54,"ownerHtmlUrl":55,"ownerBlogUrl":56,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M73EVTSX613DM7RYN02ZQ0VY","performing-privileged-account-access-review",null,"Conduct systematic reviews of privileged accounts to validate access rights, identify excessive permissions, and enforce least privilege across PAM infrastructure.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-privileged-account-access-review\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-privileged-account-access-review\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: performing-privileged-account-access-review\ndescription: Conduct systematic reviews of privileged accounts to validate access\n  rights, identify excessive permissions, and enforce least privilege across PAM infrastructure.\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- pam\n- access-review\n- privileged-accounts\n- least-privilege\n- compliance\n- audit\n- identity-governance\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1078\n- T1110\n- T1556\n- T1098\nsource: https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\nsource_commit: 04450304b12645cb2b974ab96d28c0664758a88d\n---\n\n# Performing Privileged Account Access Review\n\n## Overview\n\nPrivileged Account Access Review is a critical identity governance process that validates whether users with elevated permissions still require their access. This review covers domain admins, service accounts, database administrators, cloud IAM roles, and application-level privileged accounts. Regular access reviews are mandated by SOC 2, PCI DSS, HIPAA, and SOX compliance frameworks, typically required quarterly for high-privilege accounts.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing privileged account access review\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- PAM solution deployed (CyberArk, BeyondTrust, Delinea, or equivalent)\n- Identity governance platform (SailPoint, Saviynt, or equivalent)\n- Complete inventory of privileged accounts across all platforms\n- Defined access review policy with SLAs and escalation procedures\n- Designated reviewers (account owners, managers, security team)\n\n## Core Concepts\n\n### Privileged Account Categories\n\n| Category | Examples | Risk Level | Review Frequency |\n|----------|----------|------------|-----------------|\n| Domain Admins | Enterprise Admin, Domain Admin, Schema Admin | Critical | Monthly |\n| Service Accounts | SQL service, backup agents, monitoring agents | High | Quarterly |\n| Cloud IAM | AWS root, Azure Global Admin, GCP Owner | Critical | Monthly |\n| Database Admin | DBA accounts, sa\u002Fsys accounts | High | Quarterly |\n| Application Admin | App admin roles, API keys with admin scope | Medium | Semi-annually |\n| Emergency\u002FBreak-glass | Firecall accounts, emergency access | Critical | After each use |\n\n### Four-Pillar Review Framework\n\n```\nDISCOVER                    VALIDATE                    REMEDIATE                 MONITOR\n    │                           │                           │                       │\n    ├─ Enumerate all            ├─ Verify business          ├─ Remove excess        ├─ Continuous\n    │  privileged accounts      │  justification            │  privileges           │  monitoring\n    │                           │                           │                       │\n    ├─ Identify orphaned        ├─ Confirm account          ├─ Disable orphaned     ├─ Anomaly\n    │  accounts                 │  ownership                │  accounts             │  detection\n    │                           │                           │                       │\n    ├─ Map permissions to       ├─ Check compliance         ├─ Enforce password     ├─ Session\n    │  business roles           │  with policies            │  rotation             │  recording\n    │                           │                           │                       │\n    └─ Classify by risk         └─ Review last usage        └─ Implement JIT        └─ Audit\n       level                       and activity                access                  logging\n```\n\n## Workflow\n\n### Step 1: Account Discovery and Inventory\n\nEnumerate all privileged accounts across the environment:\n\n**Active Directory:**\n- Domain Admins, Enterprise Admins, Schema Admins groups\n- Accounts with AdminCount=1 attribute\n- Service accounts with SPN (Service Principal Names)\n- Accounts with delegation rights (Unconstrained\u002FConstrained)\n\n**Cloud Platforms:**\n- AWS: IAM users\u002Froles with AdministratorAccess, PowerUserAccess, or `iam:*` permissions\n- Azure: Global Administrator, Privileged Role Administrator, Security Administrator roles\n- GCP: Owner, Editor roles at organization\u002Fproject level\n\n**Databases:**\n- SQL Server: sysadmin, db_owner, securityadmin fixed roles\n- Oracle: DBA, SYSDBA, SYSOPER privileges\n- PostgreSQL: superuser, createrole, createdb attributes\n\n### Step 2: Establish Review Criteria\n\nEach privileged account must be evaluated against:\n\n1. **Business Justification**: Does the user's current role require this privilege?\n2. **Least Privilege**: Can the task be performed with lower privileges?\n3. **Account Activity**: Has the account been active in the last 90 days?\n4. **Compliance Status**: Does the account meet password policy, MFA requirements?\n5. **Separation of Duties**: Does the access create SoD conflicts?\n6. **Ownership**: Is a responsible owner assigned and active?\n\n### Step 3: Conduct the Review\n\nFor each account, the designated reviewer must:\n\n1. Review the account details, permissions, and last activity date\n2. Approve (certify) the access if still required with documented justification\n3. Revoke access if no longer needed or the reviewer cannot justify the privilege\n4. Flag for investigation if anomalous activity or policy violations are detected\n5. Escalate if the reviewer cannot make a determination\n\nDecision matrix:\n\n| Condition | Action |\n|-----------|--------|\n| Active user, justified privilege | Certify - maintain access |\n| Active user, excessive privilege | Remediate - reduce to least privilege |\n| Inactive > 90 days | Disable account, notify owner |\n| No owner identified | Disable account, escalate to security |\n| SoD conflict detected | Remediate - reassign or add compensating controls |\n| Break-glass account | Verify last use was authorized, reset credentials |\n\n### Step 4: Remediation and Enforcement\n\nAfter reviews are completed:\n\n- Revoke access for accounts that were not certified within the SLA period\n- Implement automatic revocation for accounts not reviewed within 14 days\n- Rotate credentials for all certified privileged accounts\n- Convert standing privileges to just-in-time (JIT) access where possible\n- Update PAM vault with current account inventory\n\n### Step 5: Reporting and Documentation\n\nGenerate review reports including:\n\n- Total accounts reviewed vs. total in scope\n- Certification rate (approved vs. revoked)\n- Average review completion time\n- Overdue reviews and escalations\n- Remediation actions taken\n- Comparison with previous review cycle\n\n## Validation Checklist\n\n- [ ] Complete inventory of all privileged accounts documented\n- [ ] All accounts assigned to a responsible owner\u002Freviewer\n- [ ] Review criteria and decision matrix defined\n- [ ] Reviewers completed certification within SLA (14 days)\n- [ ] Revoked accounts disabled and credentials rotated\n- [ ] Orphaned accounts identified and disabled\n- [ ] Service accounts reviewed for least privilege\n- [ ] Break-glass accounts audited for authorized use only\n- [ ] Review report generated with metrics and trends\n- [ ] Remediation tickets created and tracked to completion\n- [ ] Evidence preserved for compliance audit\n\n## References\n\n- [NIST SP 800-53 AC-2: Account Management](https:\u002F\u002Fcsf.tools\u002Freference\u002Fnist-sp-800-53\u002Fr5\u002Fac\u002Fac-2\u002F)\n- [CIS Controls v8 - Control 5: Account Management](https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Faccount-management)\n- [Netwrix PAM Best Practices Guide](https:\u002F\u002Fnetwrix.com\u002Fen\u002Fresources\u002Fguides\u002Fprivileged-account-management-best-practices\u002F)\n- [StrongDM PAM Best Practices 2025](https:\u002F\u002Fwww.strongdm.com\u002Fblog\u002Fprivileged-access-management-best-practices)\n","# Performing Privileged Account Access Review\n\n## Overview\n\nPrivileged Account Access Review is a critical identity governance process that validates whether users with elevated permissions still require their access. This review covers domain admins, service accounts, database administrators, cloud IAM roles, and application-level privileged accounts. Regular access reviews are mandated by SOC 2, PCI DSS, HIPAA, and SOX compliance frameworks, typically required quarterly for high-privilege accounts.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing privileged account access review\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- PAM solution deployed (CyberArk, BeyondTrust, Delinea, or equivalent)\n- Identity governance platform (SailPoint, Saviynt, or equivalent)\n- Complete inventory of privileged accounts across all platforms\n- Defined access review policy with SLAs and escalation procedures\n- Designated reviewers (account owners, managers, security team)\n\n## Core Concepts\n\n### Privileged Account Categories\n\n| Category | Examples | Risk Level | Review Frequency |\n|----------|----------|------------|-----------------|\n| Domain Admins | Enterprise Admin, Domain Admin, Schema Admin | Critical | Monthly |\n| Service Accounts | SQL service, backup agents, monitoring agents | High | Quarterly |\n| Cloud IAM | AWS root, Azure Global Admin, GCP Owner | Critical | Monthly |\n| Database Admin | DBA accounts, sa\u002Fsys accounts | High | Quarterly |\n| Application Admin | App admin roles, API keys with admin scope | Medium | Semi-annually |\n| Emergency\u002FBreak-glass | Firecall accounts, emergency access | Critical | After each use |\n\n### Four-Pillar Review Framework\n\n```\nDISCOVER                    VALIDATE                    REMEDIATE                 MONITOR\n    │                           │                           │                       │\n    ├─ Enumerate all            ├─ Verify business          ├─ Remove excess        ├─ Continuous\n    │  privileged accounts      │  justification            │  privileges           │  monitoring\n    │                           │                           │                       │\n    ├─ Identify orphaned        ├─ Confirm account          ├─ Disable orphaned     ├─ Anomaly\n    │  accounts                 │  ownership                │  accounts             │  detection\n    │                           │                           │                       │\n    ├─ Map permissions to       ├─ Check compliance         ├─ Enforce password     ├─ Session\n    │  business roles           │  with policies            │  rotation             │  recording\n    │                           │                           │                       │\n    └─ Classify by risk         └─ Review last usage        └─ Implement JIT        └─ Audit\n       level                       and activity                access                  logging\n```\n\n## Workflow\n\n### Step 1: Account Discovery and Inventory\n\nEnumerate all privileged accounts across the environment:\n\n**Active Directory:**\n- Domain Admins, Enterprise Admins, Schema Admins groups\n- Accounts with AdminCount=1 attribute\n- Service accounts with SPN (Service Principal Names)\n- Accounts with delegation rights (Unconstrained\u002FConstrained)\n\n**Cloud Platforms:**\n- AWS: IAM users\u002Froles with AdministratorAccess, PowerUserAccess, or `iam:*` permissions\n- Azure: Global Administrator, Privileged Role Administrator, Security Administrator roles\n- GCP: Owner, Editor roles at organization\u002Fproject level\n\n**Databases:**\n- SQL Server: sysadmin, db_owner, securityadmin fixed roles\n- Oracle: DBA, SYSDBA, SYSOPER privileges\n- PostgreSQL: superuser, createrole, createdb attributes\n\n### Step 2: Establish Review Criteria\n\nEach privileged account must be evaluated against:\n\n1. **Business Justification**: Does the user's current role require this privilege?\n2. **Least Privilege**: Can the task be performed with lower privileges?\n3. **Account Activity**: Has the account been active in the last 90 days?\n4. **Compliance Status**: Does the account meet password policy, MFA requirements?\n5. **Separation of Duties**: Does the access create SoD conflicts?\n6. **Ownership**: Is a responsible owner assigned and active?\n\n### Step 3: Conduct the Review\n\nFor each account, the designated reviewer must:\n\n1. Review the account details, permissions, and last activity date\n2. Approve (certify) the access if still required with documented justification\n3. Revoke access if no longer needed or the reviewer cannot justify the privilege\n4. Flag for investigation if anomalous activity or policy violations are detected\n5. Escalate if the reviewer cannot make a determination\n\nDecision matrix:\n\n| Condition | Action |\n|-----------|--------|\n| Active user, justified privilege | Certify - maintain access |\n| Active user, excessive privilege | Remediate - reduce to least privilege |\n| Inactive > 90 days | Disable account, notify owner |\n| No owner identified | Disable account, escalate to security |\n| SoD conflict detected | Remediate - reassign or add compensating controls |\n| Break-glass account | Verify last use was authorized, reset credentials |\n\n### Step 4: Remediation and Enforcement\n\nAfter reviews are completed:\n\n- Revoke access for accounts that were not certified within the SLA period\n- Implement automatic revocation for accounts not reviewed within 14 days\n- Rotate credentials for all certified privileged accounts\n- Convert standing privileges to just-in-time (JIT) access where possible\n- Update PAM vault with current account inventory\n\n### Step 5: Reporting and Documentation\n\nGenerate review reports including:\n\n- Total accounts reviewed vs. total in scope\n- Certification rate (approved vs. revoked)\n- Average review completion time\n- Overdue reviews and escalations\n- Remediation actions taken\n- Comparison with previous review cycle\n\n## Validation Checklist\n\n- [ ] Complete inventory of all privileged accounts documented\n- [ ] All accounts assigned to a responsible owner\u002Freviewer\n- [ ] Review criteria and decision matrix defined\n- [ ] Reviewers completed certification within SLA (14 days)\n- [ ] Revoked accounts disabled and credentials rotated\n- [ ] Orphaned accounts identified and disabled\n- [ ] Service accounts reviewed for least privilege\n- [ ] Break-glass accounts audited for authorized use only\n- [ ] Review report generated with metrics and trends\n- [ ] Remediation tickets created and tracked to completion\n- [ ] Evidence preserved for compliance audit\n\n## References\n\n- [NIST SP 800-53 AC-2: Account Management](https:\u002F\u002Fcsf.tools\u002Freference\u002Fnist-sp-800-53\u002Fr5\u002Fac\u002Fac-2\u002F)\n- [CIS Controls v8 - Control 5: Account Management](https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Faccount-management)\n- [Netwrix PAM Best Practices Guide](https:\u002F\u002Fnetwrix.com\u002Fen\u002Fresources\u002Fguides\u002Fprivileged-account-management-best-practices\u002F)\n- [StrongDM PAM Best Practices 2025](https:\u002F\u002Fwww.strongdm.com\u002Fblog\u002Fprivileged-access-management-best-practices)\n",{"name":5,"tags":25,"author":33,"domain":34,"source":35,"license":15,"version":36,"nist_csf":37,"subdomain":42,"description":7,"mitre_attack":43,"source_commit":48},[26,27,28,29,30,31,32],"pam","access-review","privileged-accounts","least-privilege","compliance","audit","identity-governance","mahipal","cybersecurity","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","1.0",[38,39,40,41],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management",[44,45,46,47],"T1078","T1110","T1556","T1098","04450304b12645cb2b974ab96d28c0664758a88d","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Fperforming-privileged-account-access-review",1,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-11 23:56:26",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill performing-privileged-account-access-review",{"tool":65,"command":66},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill performing-privileged-account-access-review",{"tool":68,"command":69},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill performing-privileged-account-access-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-privileged-account-access-review\u002FSKILL.md",true,[73,79,83,89,93,97,103],{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"assets\u002Ftemplate.md","ASSET","资产文件",1695,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-privileged-account-access-review\u002Fassets\u002Ftemplate.md",{"path":80,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fapi-reference.md","REFERENCE","参考文档",2403,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-privileged-account-access-review\u002Freferences\u002Fapi-reference.md",{"path":90,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fstandards.md",2249,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-privileged-account-access-review\u002Freferences\u002Fstandards.md",{"path":94,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fworkflows.md",3543,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-privileged-account-access-review\u002Freferences\u002Fworkflows.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",5842,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-privileged-account-access-review\u002Fscripts\u002Fagent.py",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fprocess.py",12693,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-privileged-account-access-review\u002Fscripts\u002Fprocess.py",[108,116,123,131,139,147],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":20},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":20},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":127,"sourceHtmlUrl":128,"categories":129,"keywords":130,"publishedAt":20},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":135,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":20},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":143,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":20},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":148,"name":149,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":152,"publishedAt":20},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]