Skip to content

Add two new cybersecurity skills: dependency confusion detection and Honeytokens for Detection (Deception Technology) - #110

Open
dakshverma23 wants to merge 1 commit into
mukul975:mainfrom
dakshverma23:add-supply-chain-deception-skills
Open

Add two new cybersecurity skills: dependency confusion detection and Honeytokens for Detection (Deception Technology)#110
dakshverma23 wants to merge 1 commit into
mukul975:mainfrom
dakshverma23:add-supply-chain-deception-skills

Conversation

@dakshverma23

Copy link
Copy Markdown

…AD honeytokens

Skills added:

  1. Detecting Dependency Confusion Attacks (Supply Chain Security)

    • Complete 7-phase workflow for npm, PyPI, Maven, RubyGems
    • Detection scripts (Python) for public registry monitoring
    • Install script analyzer with malware pattern detection
    • Secure configuration templates for all major package managers
    • 2026 attack campaign research (Mini Shai-Hulud, TanStack)
    • MITRE ATT&CK T1195.002, NIST CSF SR.1-01/02 mappings
  2. Deploying AD Honeytokens for Detection (Deception Technology)

    • Complete 8-phase deployment workflow
    • PowerShell deployment script with batch honeytoken creation
    • SIEM detection rules (Splunk, Sentinel, ELK, Graylog, QRadar)
    • Kerberoasting, DCSync, credential theft detection
    • MITRE ATT&CK T1003, T1558.003, D3FEND D3-DUC mappings
    • Event ID monitoring (4768, 4769, 4776, 4624, 4662)

…AD honeytokens

Skills added:
1. Detecting Dependency Confusion Attacks (Supply Chain Security)
   - Complete 7-phase workflow for npm, PyPI, Maven, RubyGems
   - Detection scripts (Python) for public registry monitoring
   - Install script analyzer with malware pattern detection
   - Secure configuration templates for all major package managers
   - 2026 attack campaign research (Mini Shai-Hulud, TanStack)
   - MITRE ATT&CK T1195.002, NIST CSF SR.1-01/02 mappings

2. Deploying AD Honeytokens for Detection (Deception Technology)
   - Complete 8-phase deployment workflow
   - PowerShell deployment script with batch honeytoken creation
   - SIEM detection rules (Splunk, Sentinel, ELK, Graylog, QRadar)
   - Kerberoasting, DCSync, credential theft detection
   - MITRE ATT&CK T1003, T1558.003, D3FEND D3-DUC mappings
   - Event ID monitoring (4768, 4769, 4776, 4624, 4662)

@rajpratham1 rajpratham1 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for contributing these two new cybersecurity skills. The content is comprehensive and the documentation is extensive.

Before this is ready to merge, I think a few areas should be addressed:

  • This PR introduces more than 5,000 lines of new content across multiple scripts and documentation files. It would be much easier to review if it were split into smaller PRs (for example, one PR per skill).
  • The Python and PowerShell scripts should include automated tests or at least documented validation steps so reviewers can verify their behavior.
  • Some scripts make external network requests and perform security-sensitive operations. It would be helpful to document their assumptions, supported environments, and any limitations.
  • Please ensure all references to attack campaigns, standards, and security guidance are backed by authoritative sources where appropriate.
  • Consider adding a high-level README or index describing what each new skill provides and how users should choose between them.

The overall direction looks valuable, but I'd like to see the implementation broken into smaller, easier-to-review changes with accompanying validation before approving.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants