Cyber Defense Pack: Incident Response, Ransomware & DFIR

Ten defensive security skills in one pack. Each is a standalone SKILL.md with an eight-phase playbook, output contract, JSON Schema, deterministic local validator, valid/invalid fixtures and report template. Every skill defaults to read-only analysis and keeps facts, hypotheses, actions and verification separate. Each skill is also listed on its own at $9 each ($90 bought separately). **What's inside** - **Ransomware Incident Commander:** evidence-preserving ransomware and data-extortion response from first signal through clean recovery. Never negotiates, pays or destroys evidence. - **Cloud Identity Incident Commander:** Microsoft 365 / Google Workspace account takeover investigation and containment, including scoped revocation of persistent OAuth grants. - **Phishing & BEC Incident Commander:** business email compromise triage from preserved message and identity evidence through financial, tenant and recipient containment. - **Software Supply-Chain Incident Tracer:** traces a suspected compromise from source and suppliers through builders, artifacts, registries, deployments and customers. - **DFIR Evidence Casebuilder:** turns host, network, cloud, identity and application evidence into a reproducible case with chain of custody, normalized timeline and explicit uncertainty. - **Detection Rule Quality Engineer:** behavior-based detection rules with telemetry contracts, positive and negative fixtures, false-positive budgets and staged rollout. Sigma-compatible output. - **Evidence-Driven Threat Hunt Engineer:** MITRE ATT&CK-grounded hunt hypotheses, telemetry feasibility checks, recorded negative results and promotion-ready detections. - **KEV Remediation Commander:** turns an asset inventory and CISA KEV data into prioritized, verification-ready patch waves. - **Kubernetes Defense Review:** supply chain, control plane, RBAC, workload, network policy, secrets, admission and runtime review of clusters and manifests. - **Agentic System Defense Review:** threat-models tool-using AI systems for prompt injection, data poisoning, authority confusion, secret exposure and unsafe actions. **How it works** 1. Intake gate records authorized scope, assets and permitted actions before analysis. 2. The router picks the one skill that fits the task. 3. The skill runs its eight-phase playbook. 4. The case file is checked against its JSON Schema by the local validator. **Frameworks referenced** MITRE ATT&CK, Sigma-compatible rule output, CISA KEV, CISA SCuBA baselines and SSVC-inspired decision trees. Sources are cited, not bundled; no endorsement is claimed. Inputs include Kubernetes manifests, cloud tenant audit logs and M365/Google Workspace identity telemetry. **Boundary** Defensive planning and authorized evidence analysis only: no exploit payloads, credential theft, persistence, indiscriminate scanning or silent external mutation. Local validation is not production certification. Works with: any agent that loads SKILL.md files and can run the bundled Python validators.