About cloud-defense
A cloud-defense skill for blue teams that maps stages such as lateral movement, privilege escalation, and data exfiltration to log signals and preventive controls. It helps turn cloud penetration-test findings into concrete detection and remediation steps.
Key features
- 01Maps attacker stages to log signals
- 02Provides controls that interrupt attack stages
- 03Lists logging and threat-detection prerequisites
- 04Supports retesting the corresponding techniques
Use cases
- 01Write remediation sections for cloud pentest reports
- 02Design alerts for cloud control-plane events
- 03Review post-compromise defenses in AWS, Azure, or GCP accounts
Install
Copy the command and run it in a terminal.
npx skills add https:/After installing, type/cloud-defensein Claude Code to confirm it loaded.
Bundled files
References and scripts installed along with SKILL.md.
reference/detection-signals.mdhardening-controls.mdINDEX.mdDetails
From the project READMECloud Defense
The blue-team counterpart to cloud-containers. For each attacker move — lateral movement, privilege escalation, data exfiltration, defense evasion — this skill gives the log event to alert on and the single control that removes the technique. Use it to turn an offensive cloud finding into a concrete detection and remediation.
When to use
- Writing the remediation / hardening section of a cloud pentest report.
- Cloud detection engineering: deciding which control-plane events to alert on.
- Reviewing an AWS / Azure / GCP account's posture against the post-compromise chain.
Workflow
- Confirm the logging prerequisites are in place (org-wide trail, data events, threat detection on) — without them the signals below are invisible.
- Map each attacker stage to its detection signal — see reference/detection-signals.md.
- Apply the preventive control that breaks each stage — see reference/hardening-controls.md.
- Re-run the matching offensive technique from
cloud-containersto confirm the control holds or the alert fires.
References
- reference/INDEX.md — router
- reference/detection-signals.md — per-stage log signals + logging prerequisites
- reference/hardening-controls.md — the control that breaks each stage