analyzing-cloud-storage-access-patterns
Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours…
Skill by mukul975
Install
Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.
npx agentmarket install skill/mukul975-analyzing-cloud-storage-access-patterns
Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.
Get the weekly diff
The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.
About
Use cases: backend, cloud, data, security
Reviews
Write a reviewNo reviews yet. Installed it? Reviews come from verified installers only. How reviews work
Permissions
What this skill can do and what it asks for, from its SKILL.md and code. Checked Oct 25, 2026.
- Tools
- No tools found
- Secrets
- None asked for
- Install scripts
- None found
- Runs as
- Python package
Network hosts it talks to 1
codeload.github.com· found in install command
Files it touches
~/.claude/skills/analyzing-cloud-storage-access-patterns
What's inside
- Skill name
analyzing-cloud-storage-access-patterns- Description
- Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.
- License
- Apache-2.0
- Instructions
- 43 lines in SKILL.md · view on GitHub
Before installing
- Ships executable scripts
Files (4)
- LICENSE
- SKILL.md
- api-reference.md · references/
- agent.py · scripts/
SKILL.md (first lines)
# Analyzing Cloud Storage Access Patterns
## When to Use
- When investigating security incidents that require analyzing cloud storage access patterns
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
## Prerequisites
- Familiarity with cloud security concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
## Instructions
1. Install dependencies: `pip install boto3 requests`
2. Query CloudTrail for S3 Data Events using AWS CLI or boto3.
3. Build access baselines: hourly request volume, per-user object counts, source IP history.
4. Detect anomalies:
- After-hours access (outside 8am-6pm local time)
- Bulk downloads: >100 GetObject calls from single principal in 1 hour
- New source IPs not seen in the prior 30 days
- ListBucket enumeration spikes (reconnaissance indicator)
5. Generate prioritized findings report.
```bash
python scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json
```
## Examples
### CloudTrail S3 Data Event
```json
{"eventName": "GetObject", "requestParameters": {"bucketName": "sensitive-data", "key": "financials/q4.xlsx"},
"sourceIPAddress": "203.0.113.50", "userIdentity": {"arn": "arn:aws:iam::123456789012:user/analyst"}}
```From mukul975/Anthropic-Cybersecurity-Skills, Apache-2.0.
More from mukul975/Anthropic-Cybersecurity-Skills
- 0.616score
conducting-spearphishing-simulation-campaign
mukul975
Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LNK…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
conducting-social-engineering-penetration-test
mukul975
Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
conducting-domain-persistence-with-dcsync
mukul975
Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
building-threat-intelligence-platform
mukul975
Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
building-threat-intelligence-enrichment-in-splunk
mukul975
Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them against…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
building-vulnerability-aging-and-sla-tracking
mukul975
Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g.
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
analyzing-cobaltstrike-malleable-c2-profiles
mukul975
Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
attacking-oauth-with-device-code-phishing
mukul975
Run OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID, using TokenTactics-style tooling to steal access and refresh…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
conducting-external-reconnaissance-with-osint
mukul975
Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
building-malware-incident-communication-template
mukul975
Build structured communication templates for malware incidents (ransomware, wiper, trojan, worm), covering internal stakeholder notifications, executive…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
conducting-gdpr-compliance-assessment
mukul975
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
configuring-active-directory-tiered-model
mukul975
Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory, covering Tier 0/1/2 separation, privileged…
SkillBFreshness: B★ 34.9KClaude Code +9
Signals
- Stars
- 34,941
- Forks
- 4,256
- Open issues
- 24
- Last commit (this folder)
- Aug 2, 2026 (2 months ago)
- Last release
- Jun 22, 2026 (4 months ago)
From GitHub (fetched Oct 24, 2026).
Details
- License
- Apache-2.0
- First seen
- Oct 24, 2026
- Last checked
- Oct 24, 2026
- Source
- GitHubgithub-graphql
Same skill elsewhere
Copies of this SKILL.md published by others; search shows only one of them.
More from mukul975
- 0.616score
building-threat-intelligence-platform
mukul975
Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
building-vulnerability-aging-and-sla-tracking
mukul975
Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g.
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
conducting-domain-persistence-with-dcsync
mukul975
Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
conducting-external-reconnaissance-with-osint
mukul975
Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
conducting-gdpr-compliance-assessment
mukul975
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of…
SkillBFreshness: B★ 34.9KClaude Code +9 - 0.616score
building-threat-intelligence-enrichment-in-splunk
mukul975
Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them against…
SkillBFreshness: B★ 34.9KClaude Code +9
Cite this page
analyzing-cloud-storage-access-patterns skill. Agent Mart. https://agentmart.dev/skills/mukul975-analyzing-cloud-storage-access-patterns (last updated 2026-10-24)